@stacksjs/ts-cloud 0.16.19 → 0.16.20

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-mxvekmdx.js";import"./chunk-0trtkv9g.js";import"./chunk-e24bscb0.js";import{tr}from"./chunk-ehb9mpt8.js";import"./chunk-mx9ppkmn.js";import"./chunk-k7wh1wr5.js";import"./chunk-e55fdn0r.js";import"./chunk-z1dtdw3j.js";import"./chunk-4sa22raw.js";import"./chunk-vjkyj3xy.js";import"./chunk-48x0wc2g.js";import"./chunk-90102shh.js";import"./chunk-dyh0vndw.js";import"./chunk-148x1zq8.js";import"./chunk-5a7sxtwn.js";import"./chunk-6d8chxyr.js";import"./chunk-egn33pr9.js";import"./chunk-6kx50dyc.js";import"./chunk-t10e32an.js";import"./chunk-ys5n5c84.js";import"./chunk-2mv692y4.js";import"./chunk-ndddd2ft.js";import"./chunk-rbtt23vx.js";import"./chunk-h1rb8qvt.js";import"./chunk-1j8b1d58.js";import"./chunk-9vmtm7nq.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await tr({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-mxvekmdx.js";import"./chunk-0trtkv9g.js";import"./chunk-e24bscb0.js";import{tr}from"./chunk-7zfydgfz.js";import"./chunk-mx9ppkmn.js";import"./chunk-k7wh1wr5.js";import"./chunk-e55fdn0r.js";import"./chunk-z1dtdw3j.js";import"./chunk-gfr2215x.js";import"./chunk-vjkyj3xy.js";import"./chunk-48x0wc2g.js";import"./chunk-90102shh.js";import"./chunk-dyh0vndw.js";import"./chunk-148x1zq8.js";import"./chunk-5a7sxtwn.js";import"./chunk-840arz58.js";import"./chunk-egn33pr9.js";import"./chunk-6kx50dyc.js";import"./chunk-t10e32an.js";import"./chunk-ys5n5c84.js";import"./chunk-2mv692y4.js";import"./chunk-ndddd2ft.js";import"./chunk-rbtt23vx.js";import"./chunk-h1rb8qvt.js";import"./chunk-1j8b1d58.js";import"./chunk-9vmtm7nq.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await tr({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/{chunk-bcy9z4ks.js → chunk-0j2tpr8d.js}

@@ -1,4 +1,4 @@
-import{hd,O,d,Ad,x,p,le,g,Ut,Ed,so,oo,Rd,Nd,kd,Od,qr,ho,zt,xd,Ld,Gd,qd}from"./chunk-v2p7c7s4.js";import{B,u}from"./chunk-3m9ghthh.js";import{de,_t,w,Ot,s,di,xs,Rr,Mc,Fc,X,c,Ms,Qe,Dr,Uc,xt,Us,Qc,Pr,Qs,Nr,pi,Mt,fi,Ai,He,Ft,cd,dd,Ii,Si,ut,eo,i,Ci,ro,no}from"./chunk-kczzc599.js";import{n,l}from"./chunk-zx8ecz8b.js";import{Bt,o}from"./chunk-9asn5fpt.js";import{un}from"./chunk-hyeeqga9.js";import{pn,hu,ns,P,v,is,fu}from"./chunk-7xnwa0s8.js";import{me,er,cs,Ye,V,ne,C,he,nr,et,sr}from"./chunk-2m262b2n.js";import{j}from"./chunk-k53agv2m.js";import{E,ur,bs,Pt,pr,Du,Nt,Nu,ac,$e,st,Hn,k,kt,Cr}from"./chunk-5255nr93.js";import{fe}from"./chunk-r1wpwfff.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";function rn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=ch({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
+import{hd,O,d,Ad,x,p,le,g,Ut,Ed,so,oo,Rd,Nd,kd,Od,qr,ho,zt,xd,Ld,Gd,qd}from"./chunk-v2p7c7s4.js";import{B,u}from"./chunk-3m9ghthh.js";import{de,_t,w,Ot,s,di,xs,Rr,Mc,Fc,X,c,Ms,Qe,Dr,Uc,xt,Us,Qc,Pr,Qs,Nr,pi,Mt,fi,Ai,He,Ft,cd,dd,Ii,Si,ut,eo,i,Ci,ro,no}from"./chunk-kczzc599.js";import{n,l}from"./chunk-zx8ecz8b.js";import{Bt,o}from"./chunk-9asn5fpt.js";import{un}from"./chunk-hyeeqga9.js";import{pn,hu,ns,P,v,is,fu}from"./chunk-7xnwa0s8.js";import{me,er,cs,Ye,V,ne,C,he,nr,et,sr}from"./chunk-wgf1ndgq.js";import{j}from"./chunk-k53agv2m.js";import{E,ur,bs,Pt,pr,Du,Nt,Nu,ac,$e,st,Hn,k,kt,Cr}from"./chunk-aw1tp3p3.js";import{fe}from"./chunk-d46p0h6t.js";import{A}from"./chunk-31tvc877.js";import{_e}from"./chunk-5far81q7.js";import{be}from"./chunk-qcaqc5b8.js";import{h}from"./chunk-ptq9v346.js";function rn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=ch({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),y=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,
@@ -70,7 +70,7 @@ data: ${JSON.stringify(pt)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,m,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(f),JSON.stringify(y),e.defaultRole??I.defaultRole,e.enabled??I.enabled?1:0,e.enforceSso??I.enforceSso?1:0,R,I.id]),this.getOidcProvider(I.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let b=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[b,e.organizationId,t,r,a,m,this.encrypt(e.clientSecret),JSON.stringify(f),JSON.stringify(y),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,R,R]),this.getOidcProvider(b)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Vc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Vc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Vc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Vc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let m=this.idFn(),f=ui(32).toString("base64url"),y=ui(32).toString("base64url"),I=ui(64).toString("base64url"),R=this.now(),b=new Date(this.nowFn().getTime()+rl).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Vn(f),this.encrypt(y),this.encrypt(I),t,r,b,R]),{transaction:this.getOidcTransaction(m),state:f,nonce:y,verifier:I}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let y=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let I=this.getOidcSubject(e,r);if(I&&I.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(I)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[y,R,I.id]),this.getOidcSubject(e,r);let b=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[b,e,t,r,y,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function jr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-4j8ef0pe.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Fm(){return O("auth-encryption-key")}function Ke(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Vn(f),this.encrypt(y),this.encrypt(I),t,r,b,R]),{transaction:this.getOidcTransaction(m),state:f,nonce:y,verifier:I}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let y=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let I=this.getOidcSubject(e,r);if(I&&I.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(I)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[y,R,I.id]),this.getOidcSubject(e,r);let b=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[b,e,t,r,y,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function jr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-49vvjfrd.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Fm(){return O("auth-encryption-key")}function Ke(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
 `,{mode:384}),bI(r,384)}catch{}return a}import{constants as RI,createHash as Cp,createPublicKey as AI,createVerify as CI,timingSafeEqual as PI}from"node:crypto";var _h=new Set(["RS256","PS256","ES256"]),Ph=60;function Wc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function Pp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function _p(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let m=await e.text();if(m.length>1048576)throw Error(`${t} response is too large`);try{return Pp(JSON.parse(m),t)}catch(f){if(f instanceof Error&&f.message===`${t} is invalid`)throw f;throw Error(`${t} returned invalid JSON`)}}function _I(e,t){let r=Cp("sha256").update(e).digest(),a=Cp("sha256").update(t).digest();return PI(r,a)}function nl(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function No(e,t=fetch){let r=Wc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),m=await _p(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(m.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let y of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof m[y]!=="string")throw Error(`OIDC discovery is missing ${y}`);Wc(m[y],`OIDC ${y}`)}if(Array.isArray(m.response_types_supported)&&!m.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(m.code_challenge_methods_supported)&&!m.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let f=Array.isArray(m.id_token_signing_alg_values_supported)?m.id_token_signing_alg_values_supported.filter((y)=>typeof y==="string"):[];if(f.length>0&&!f.some((y)=>_h.has(y)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return m}async function ko(e,t,r,a,m=fetch){let f=e.getOidcProviderBySlug(t);if(!f?.enabled)throw Error("OIDC provider is unavailable");let y=Wc(r,"Application origin").origin,I=await No(f,m),R=`${y}/auth/oidc/${encodeURIComponent(f.slug)}/callback`,b=e.beginOidcTransaction(f.id,R,nl(a)),T=new URL(I.authorization_endpoint);return T.searchParams.set("response_type","code"),T.searchParams.set("client_id",f.clientId),T.searchParams.set("redirect_uri",R),T.searchParams.set("scope",f.scopes.join(" ")),T.searchParams.set("state",b.state),T.searchParams.set("nonce",b.nonce),T.searchParams.set("code_challenge",Cp("sha256").update(b.verifier).digest("base64url")),T.searchParams.set("code_challenge_method","S256"),{authorizationUrl:T.href,expiresAt:b.transaction.expiresAt}}function TI(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:Pp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:Pp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function xI(e,t,r){let a=TI(e),m=typeof a.header.alg==="string"?a.header.alg:"",f=typeof a.header.kid==="string"?a.header.kid:"";if(!_h.has(m)||!f)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(m))throw Error("OIDC ID-token algorithm was not advertised by the provider");let y=await _p(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(y.keys))throw Error("OIDC signing-key response is invalid");let I=y.keys.find((N)=>{if(!N||typeof N!=="object"||Array.isArray(N))return!1;let F=N;return F.kid===f&&(!F.alg||F.alg===m)&&(!F.use||F.use==="sig")});if(!I)throw Error("OIDC ID-token signing key was not found");let R=AI({key:I,format:"jwk"}),b=CI("SHA256").update(a.signingInput).end();if(!(m==="PS256"?b.verify({key:R,padding:RI.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):m==="ES256"?b.verify({key:R,dsaEncoding:"ieee-p1363"},a.signature):b.verify(R,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function DI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let m=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((R)=>typeof R==="string"):[];if(!m.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((m.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let f=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<f-Ph)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>f+Ph)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!_I(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let y=e.email.trim().toLowerCase();if(y.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(y))throw Error("OIDC provider returned an invalid email address");let I=y.split("@")[1];if(!I||!t.allowedDomains.includes(I))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:y,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function Bo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let m=Wc(t.origin,"Application origin").origin,f=e.consumeOidcTransaction(a.id,t.state),y=`${m}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(f.transaction.redirectUri!==y)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:I}=e.getOidcProviderCredentials(a.id),R=await No(a,r),b=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:f.transaction.redirectUri,code_verifier:f.verifier}),T={accept:"application/json","content-type":"application/x-www-form-urlencoded"},N=R.token_endpoint_auth_methods_supported??["client_secret_basic"];if(N.includes("client_secret_basic")){let H=(Z)=>new URLSearchParams({value:Z}).toString().slice(6),K=`${H(a.clientId)}:${H(I)}`;T.authorization=`Basic ${Buffer.from(K).toString("base64")}`}else if(N.includes("client_secret_post"))b.set("client_id",a.clientId),b.set("client_secret",I);else throw Error("OIDC provider does not support a configured client authentication method");let F=await _p(await r(R.token_endpoint,{method:"POST",headers:T,body:b,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof F.id_token!=="string")throw Error("OIDC token response did not include an ID token");let z=await xI(F.id_token,R,r);return{identity:DI(z,a,f.nonce,t.now??new Date),returnPath:f.transaction.returnPath}}import{createHash as OI,randomBytes as $I}from"node:crypto";var xh=new Set(de),il=7776000000,sl=31536000000,ol=86400000;function mi(e){return typeof e==="string"?e:void 0}function Th(e){return OI("sha256").update(e).digest("hex")}function NI(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&xh.has(r)):[]}catch{return[]}}function jI(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Tp(e){let t=mi(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:mi(e.description),createdByActorId:mi(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function xp(e,t){let r=mi(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:NI(e.capabilities),scope:jI(e),expiresAt:a,lastUsedAt:mi(e.last_used_at),lastNetworkHint:mi(e.last_network_hint),revokedAt:r,rotatedFromTokenId:mi(e.rotated_from_token_id),createdByActorId:mi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function MI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:mi(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class xi{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),m=this.idFn(),f=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,f,f]);let y=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),I=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:m,roleTemplate:e.roleTemplate,scope:{type:I.type,id:I.id??null}}}),{serviceAccount:this.getServiceAccount(m),membership:y}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Tp(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Tp(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Tp).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let m=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(m?.status==="active")this.controlPlane.revokeMembership(m.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((F)=>!xh.has(F)))throw Error("API token requires valid explicit capabilities");let m=e.scope??r.scope,f=this.controlPlane.resolveAuthorizationTarget(t.organizationId,m);if(!f)throw Error("API token scope was not found in this organization");for(let F of a)if(!w({membership:r,grants:this.controlPlane.listGrants(r.id),capability:F,target:f}).allowed)throw Error(`Service-account membership does not grant ${F} at the token scope`);let y=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+il);if(!Number.isFinite(y.getTime())||y.getTime()<=this.nowFn().getTime()+60000||y.getTime()>this.nowFn().getTime()+sl)throw Error("API token expiry must be between one minute and one year from now");let I=this.idFn(),R=$I(32).toString("base64url"),b=`tsc_v1.${I}.${R}`,T=`tsc_v1.${I.slice(0,8)}`,N=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[I,t.id,e.name.trim().slice(0,100)||"API token",Th(b),T,JSON.stringify(a.sort()),m.type,m.type==="organization"?null:m.id??null,y.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,N,N]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:I,prefix:T,capabilities:a,scope:{type:m.type,id:m.id??null},expiresAt:y.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(I),secret:b}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?xp(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>xp(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],Th(e));if(!a)return;let m=xp(a,this.now()),f=this.getServiceAccount(m.serviceAccountId);if(!f||f.state!=="active"||m.state!=="active")return;let y=this.controlPlane.getActor(f.actorId),I=this.controlPlane.getMembershipForActor(f.organizationId,f.actorId);if(!y||y.disabledAt||!I||I.status!=="active")return;let R=this.now(),b=!m.lastUsedAt||this.nowFn().getTime()-new Date(m.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[R,t?.slice(0,128)??null,R,m.id]),b)this.controlPlane.appendEvent({organizationId:f.organizationId,actorId:y.id,type:"api.token.used",payload:{serviceAccountId:f.id,tokenId:m.id,prefix:m.prefix}});return{serviceAccount:f,token:this.getToken(m.id),actor:y,membership:I}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),m=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let m=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?MI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),m=new Date(this.nowFn().getTime()+ol).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -673,7 +673,7 @@ data: ${JSON.stringify({cursor:f,at:new Date().toISOString()})}
 ${I}
 ${R}`);return null}return a}catch(m){if(a)Ps(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${m.message}`);return null}}function Xi(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:Co(Ga(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function dn(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function Yi(e,t){return dn(t).find((r)=>r.id===e)}function rw(e){if(e.length<=ZS)return e;return`${e.slice(0,ZS)}
 
-[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:I,value:R}=await a.read();if(I)break;let b=m.decode(R,{stream:!0});if(f+=b,b)r?.(t,b)}let y=m.decode();if(y)f+=y,r?.(t,y);return f}async function Fg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,y]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:y,ok:y===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Qt(e,m);if(Ti(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&Ti(`${f}.html`))return`${f}.html`;if(!Ac(f)&&Ti(Qt(f,"index.html")))return Qt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Qt(e,"404.html");if(Ti(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await Xd(),y=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,I=p(f);if(y&&I&&!I.password)I.password=y;let R=f.infrastructure?.compute?.managedServices?.vitess;if(y&&R&&typeof R==="object"&&!R.password)R.password=y;let b=Yl(t,f);if(b.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${b.reconciliation.failed} orphaned operation(s) as failed after restart.`);let T=Object.keys(f.environments??{}),N=Q_(f,e.environment),F=X_(t),z=await Cs(f,N),H=new Map([[N,z]]),K=new Map([[N,Date.now()]]),Z=new Map([[N,Date.now()]]),oe=new Map,ye=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=x(f)!=="serverless",Re=(L)=>{let Ue=H.get(L);if(Ue&&!XS(K.get(L),Date.now(),ye))return Promise.resolve(Ue);let Ve=oe.get(L);if(Ve)return Ve;let Fe=!ce||XS(Z.get(L),Date.now(),ee),nt=Cs(f,L,{includeSiteHealth:Fe}).then((Tt)=>{let W=H.get(L),Qr=Fe?Tt:oT(W,Tt);if(H.set(L,Qr),K.set(L,Date.now()),Fe)Z.set(L,Date.now());if(W?._serverReachable!==Qr._serverReachable||W?._metricsStatus!==Qr._metricsStatus||(W?.sitesDetail?.length??0)!==(Qr.sitesDetail?.length??0))ot();return Qr}).finally(()=>oe.delete(L));return oe.set(L,nt),nt},Ae=kt(t),ue=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ue!=="0"&&(ue==="1"||!f.cloud?.attachTo)){let L=!1,Ue=Date.now()+300000,Ve=async()=>{if(L)return;L=!0;try{let nt=Date.now(),Tt=nt>=Ue;if(Tt)Ue=nt+300000;let W=b.environments.get(N);await Bg({controlPlane:b.store,projectId:b.project.id,environmentId:W?.id,config:f,environment:N,force:!0,lightweight:!0,includeSiteHealth:Tt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{L=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,vt=0;function or(L,Ue){if(L.role==="admin"&&!b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`))return L;let Ve=b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`),Fe=Ve?b.store.getMembershipForActor(b.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...L,role:"member",sites:{},capabilities:[]};let nt=b.store.listGrants(Fe.id),Tt=b.store.resolveAuthorizationTarget(b.organization.id,Fe.scope)??b.store.resolveAuthorizationTarget(b.organization.id,{type:"project",id:b.project.id}),W=Ot({membership:Fe,grants:nt,target:Tt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...L,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Qr=b.environments.get(Ue),br={};for(let ct of b.store.listResources(b.project.id,Qr?.id).filter((gt)=>gt.kind==="application")){let gt=b.store.resolveAuthorizationTarget(b.organization.id,{type:"resource",id:ct.id});if(!gt||!w({membership:Fe,grants:nt,capability:"project:read",target:gt}).allowed)continue;br[ct.slug]=w({membership:Fe,grants:nt,capability:"config:write",target:gt}).allowed?"owner":"collaborator"}return{...L,role:"member",sites:br,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function ot(){vt+=1,ae.clear();for(let L of rt)Ps(L,{recursive:!0,force:!0});rt.clear()}let $t=(L,Ue)=>`${Ue}:${L.role==="admin"?"admin":`member:${Object.entries(L.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...L.capabilities??[]].sort().join(",")}`;async function ar(L,Ue){let Ve=or(L,Ue),Fe=$t(Ve,Ue),nt=ae.get(Fe);if(nt)return nt;let Tt=Le.get(Fe);if(Tt)return Tt;let W=vt,Qr=(async()=>{let br=H.get(Ue)??await Cs(f,Ue);H.set(Ue,br);let ct={..._g(br,{user:Ve,slug:f.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},gt=await aT(t,ct);if(gt&&W!==vt)return Ps(gt,{recursive:!0,force:!0}),Ae?.uiRoot;if(gt)rt.add(gt);let Mr=gt??Ae?.uiRoot;if(Mr)ae.set(Fe,Mr);return Mr})();Le.set(Fe,Qr);try{return await Qr}finally{Le.delete(Fe)}}let lt=await ar({username:"",passwordHash:"",role:"admin",sites:{}},N);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ve=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ie=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ie&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Oe=!Ie,bt=Zb(t),jt=Oe?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Me=new Oi(b.store,{encryptionKey:Ke(t)}),Et=new xi(b.store),pt=new Wr(b.store),tt=new xo(b.store,{encryptionKey:Ke(t)}),Gr=new up(b.store),_s=new fp(b.store,{cwd:t}),Zn=new mp(b.store,{encryptionKey:Ke(t)}),tr=new c(b.store,{workerId:`dashboard:${process.pid}`}),cr=new Wo(b.store),si=new ia(b.store,Ke(t)),Di=new wa(b.store),Cc=new Gi(cr,tr,si),Ni=f.project?.region??"us-east-1",Ug=Ke(t),En=new Na(Di,{encryptionKey:Ug,backends:[new cn(b.store,Ug),new Ra(new V(Ni),Ni),new Da(new be(Ni),Ni),new Pa]});await mu(En,b,f);let Ju=new j(Ni),lw={aws_rds:new Jo(new ta(Ju)),aws_aurora:new Xo(new ra(Ju)),aws_elasticache:new Yo(new na(new et(Ni))),server:new Zo(new Jt),container:new ea(new Jt)},qg=(L)=>lw[L.provider],Sr=new ya(b.store),To=new Ji(Sr,tr),Vg=new Ia(si),uw={managed_database:new Sa(cr,Ju),logical_database:new Ea(cr,si),volume:new ba,files:new Ca(t),control_plane:new va(b.store,t),infrastructure:new Ta(new er(Ni))},pw=(L)=>uw[L.resourceKind],mw=(L)=>L.provider==="aws_backup"?void 0:Vg,Gu=new xt(b.store),Qu=[new Pr,new Qs(d(t,"volumes"))],ai=new Us(Gu,Qu,tr),Qa=new sa(b.store),Xn=new oa(Qa,[new en("aws"),new en("hetzner"),new en("ssh")],tr),Bi=new aa(b.store),Wg=new ca(Bi,Qa),es=new da(b.store),Hg=new la(es,tr),ci=new pa(b.store),Yu=new ga(ci,tr),Kg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new ma(L,b.store,b.project.id,b.organization.id)),Or=new jo(b.store),Jg=new Ko(Or,{queue:tr}),vr=new Dr(b.store),Zi=new Nr(b.store),On=new mt(b.store),at=new fi(b.store,{encryptionKey:Ke(t)}),gw=()=>aw(b.store);for(let L of b.environments.values())zo(Or,f,{organization:b.organization,project:b.project,environment:L,resources:b.store.listResources(b.project.id,L.id)});let $n=new Ai(at,{emailImpl:async(L)=>{let{email:Ue}=await import("./chunk-4j8ef0pe.js");return Ue.send(L)}}),Gg=async(L)=>{let Ue=eo(at,b.project.id,L),Ve=[];for(let Fe of Ue.filter((nt)=>nt.notify&&nt.alert))Ve.push(...await $n.deliverAll($n.enqueue(b.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(b.organization.id,at.listAlerts(b.project.id,{environmentId:L,states:["firing"]})))),Ve.push(...await $n.retryDue()),{evaluations:Ue,deliveries:Ve}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let L of b.environments.values())for(let Ue of at.listHealthChecks(b.project.id,L.id).filter((Ve)=>Ve.enabled)){let Ve=at.listHealthResults(Ue.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<Ue.intervalSeconds*1000)continue;let Fe=await new He(at).runAndEvaluate(Ue);for(let nt of Fe.evaluations.filter((Tt)=>Tt.notify&&Tt.alert))await $n.deliverAll($n.enqueue(b.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Qg=setInterval(()=>{for(let L of b.environments.values())Gg(L.id).catch((Ue)=>console.error("ts-cloud alert evaluation failed:",Ue))},60000);Qg.unref?.();let Yg=setInterval(()=>{fw().catch((L)=>console.error("ts-cloud health check evaluation failed:",L))},30000);Yg.unref?.();let Zg=setInterval(()=>{try{Jg.tick()}catch(L){console.error("ts-cloud scheduled job evaluation failed:",L)}},30000);Zg.unref?.();let Xg=setInterval(()=>{try{To.enqueueDue(),To.enqueueRetention()}catch(L){console.error("ts-cloud backup policy evaluation failed:",L)}},30000);Xg.unref?.(),vr.cleanup();let ef=setInterval(()=>{try{vr.cleanup()}catch(L){console.error("ts-cloud preview cleanup failed:",L)}},3600000);ef.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(L,Ue)=>{let Fe=(L.environmentId?b.store.listEnvironments(L.projectId).find((nt)=>nt.id===L.environmentId):void 0)?.slug??String(N);if(Ue.kind==="dashboard_operation"&&Ue.operationId){let nt=H.get(Fe)??z,Tt=Pg(Ue.operationId,f,nt);if(!Tt||Tt.danger||!["scheduler","backup","worker"].includes(Tt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Tt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(Ue.kind==="serverless_scheduler"){let nt=await Mg(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ue.kind}.`}},Pc=hw?new Ms(tr,{...Uc({store:b.store,execute:async(L,Ue)=>{let Ve=Ue.operation.input&&typeof Ue.operation.input==="object"&&!Array.isArray(Ue.operation.input)?Ue.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,nt=t,Tt,W,Qr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=tt.getBinding(String(Fe.bindingId)),gt=tt.getConnection(String(Fe.connectionId));if(!ct||!gt||ct.connectionId!==gt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?tt.getRepository(ct.repositoryId):tt.listRepositories(gt.id).find((Os)=>Os.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&gt.provider==="generic_ssh")_r=`git@${new URL(gt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,gt.host.endsWith("/")?gt.host:`${gt.host}/`).href;let Ce=ct.deployKeyId?tt.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:tt.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(gt.provider)&&L.target.previewId){let Os=We(gt,tt.getCredential(gt.id)),Se=vr.previews.getInstance(L.target.previewId);Qr=async(Nn,Oc)=>{try{await Os.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:Se?.url,description:Oc})}catch($s){Ue.log(`Could not publish source status: ${$s instanceof Error?$s.message:String($s)}`,{stream:"stderr"})}},await Qr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Tt=zg(Qt(Hu(),"ts-cloud-queued-source-")),Ue.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await $o({remote:_r,binding:ct,destination:Qt(Tt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:tt.getCredential(gt.id),deployKey:dr})).directory}if(Ue.operation.kind!=="preview.destroy"){let ct=L.target.previewId?vr.previews.getInstance(L.target.previewId):void 0,gt=ct?vr.previews.getDefinition(ct.definitionId):void 0,Mr=Ue.operation.resourceId?b.store.getResource(Ue.operation.resourceId):void 0;if(W=await En.resolve({projectId:b.project.id,environmentId:Ue.operation.environmentId,resourceId:Ue.operation.resourceId,functionId:Mr?.kind==="function"?Mr.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:gt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(Ue.operation.resourceId)for(let _r of Object.values(W.entries))Di.setDependency({entryId:_r.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});Ue.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let br=await Fg(L,{cwd:nt,cliEntry:m,signal:Ue.signal,env:W?.values,onOutput:(ct,gt)=>Ue.log(gt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,Mr])=>Mr.kind==="secret").map(([Mr])=>W.values[Mr]).filter(Boolean)]})});if(br.ok&&Ue.operation.resourceId&&W)for(let ct of Object.values(W.entries))Di.setDependency({entryId:ct.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Qr?.(br.ok?"success":"failure",br.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),br}catch(br){throw await Qr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),br}finally{if(Tt)Ps(Tt,{recursive:!0,force:!0})}}}),...Bl({store:Or,executor:vw}),...Ol({store:cr,secrets:si,resolveAdapter:qg}),...$l(Qa,Xn.drivers),...Fl(es,[new ua("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...ql({store:ci,cleanup:Kg}),...Qc(Gu,Qu),...du({store:Sr,queue:tr,resolveSource:pw,resolveDestination:mw,validateHealth:async(L,Ue)=>{if(!L.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=at.getHealthCheck(L.healthCheckId);if(!Ve||Ve.projectId!==L.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:Ue}}}),...ll({store:b.store,resolveDriver:e.releaseDriver??((L)=>({name:`${b.store.getResource(L.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:L.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(L,Ue)=>{let Ve=at.listHealthChecks(Ue.projectId,Ue.environmentId).find((nt)=>nt.enabled&&nt.name===L&&(!nt.resourceId||nt.resourceId===Ue.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${L} was not found for this release.`};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(L)=>console.error("ts-cloud deployment queue worker failed:",L)}):void 0;if(bl(b),Ui(pt,te(b,String(N)),z),jt)zi(b,jt.users),oS(Me,b,jt.users);let mr=nS({cwd:t,enabled:Oe,secret:bt,authentication:Me,authorization:{store:b.store,organizationId:b.organization.id,projectId:b.project.id,defaultEnvironment:String(N)}}),wr=new Vo,tf=setInterval(()=>wr.sweep(),60000);tf.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),rf=setInterval(()=>_c.prune(),300000),nf=setInterval(()=>Xu.prune(),300000),of=setInterval(()=>Tc.prune(),300000);if(rf.unref?.(),nf.unref?.(),of.unref?.(),Oe){if(jt?.generated)console.warn(`
+[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:I,value:R}=await a.read();if(I)break;let b=m.decode(R,{stream:!0});if(f+=b,b)r?.(t,b)}let y=m.decode();if(y)f+=y,r?.(t,y);return f}async function Fg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,y]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:y,ok:y===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Qt(e,m);if(Ti(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&Ti(`${f}.html`))return`${f}.html`;if(!Ac(f)&&Ti(Qt(f,"index.html")))return Qt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Qt(e,"404.html");if(Ti(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await Xd(),y=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,I=p(f);if(y&&I&&!I.password)I.password=y;let R=f.infrastructure?.compute?.managedServices?.vitess;if(y&&R&&typeof R==="object"&&!R.password)R.password=y;let b=Yl(t,f);if(b.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${b.reconciliation.failed} orphaned operation(s) as failed after restart.`);let T=Object.keys(f.environments??{}),N=Q_(f,e.environment),F=X_(t),z=await Cs(f,N),H=new Map([[N,z]]),K=new Map([[N,Date.now()]]),Z=new Map([[N,Date.now()]]),oe=new Map,ye=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=x(f)!=="serverless",Re=(L)=>{let Ue=H.get(L);if(Ue&&!XS(K.get(L),Date.now(),ye))return Promise.resolve(Ue);let Ve=oe.get(L);if(Ve)return Ve;let Fe=!ce||XS(Z.get(L),Date.now(),ee),nt=Cs(f,L,{includeSiteHealth:Fe}).then((Tt)=>{let W=H.get(L),Qr=Fe?Tt:oT(W,Tt);if(H.set(L,Qr),K.set(L,Date.now()),Fe)Z.set(L,Date.now());if(W?._serverReachable!==Qr._serverReachable||W?._metricsStatus!==Qr._metricsStatus||(W?.sitesDetail?.length??0)!==(Qr.sitesDetail?.length??0))ot();return Qr}).finally(()=>oe.delete(L));return oe.set(L,nt),nt},Ae=kt(t),ue=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&ue!=="0"&&(ue==="1"||!f.cloud?.attachTo)){let L=!1,Ue=Date.now()+300000,Ve=async()=>{if(L)return;L=!0;try{let nt=Date.now(),Tt=nt>=Ue;if(Tt)Ue=nt+300000;let W=b.environments.get(N);await Bg({controlPlane:b.store,projectId:b.project.id,environmentId:W?.id,config:f,environment:N,force:!0,lightweight:!0,includeSiteHealth:Tt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{L=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,vt=0;function or(L,Ue){if(L.role==="admin"&&!b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`))return L;let Ve=b.store.getActorByExternalId("user",`dashboard:${L.username.toLowerCase()}`),Fe=Ve?b.store.getMembershipForActor(b.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...L,role:"member",sites:{},capabilities:[]};let nt=b.store.listGrants(Fe.id),Tt=b.store.resolveAuthorizationTarget(b.organization.id,Fe.scope)??b.store.resolveAuthorizationTarget(b.organization.id,{type:"project",id:b.project.id}),W=Ot({membership:Fe,grants:nt,target:Tt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...L,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Qr=b.environments.get(Ue),br={};for(let ct of b.store.listResources(b.project.id,Qr?.id).filter((gt)=>gt.kind==="application")){let gt=b.store.resolveAuthorizationTarget(b.organization.id,{type:"resource",id:ct.id});if(!gt||!w({membership:Fe,grants:nt,capability:"project:read",target:gt}).allowed)continue;br[ct.slug]=w({membership:Fe,grants:nt,capability:"config:write",target:gt}).allowed?"owner":"collaborator"}return{...L,role:"member",sites:br,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function ot(){vt+=1,ae.clear();for(let L of rt)Ps(L,{recursive:!0,force:!0});rt.clear()}let $t=(L,Ue)=>`${Ue}:${L.role==="admin"?"admin":`member:${Object.entries(L.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...L.capabilities??[]].sort().join(",")}`;async function ar(L,Ue){let Ve=or(L,Ue),Fe=$t(Ve,Ue),nt=ae.get(Fe);if(nt)return nt;let Tt=Le.get(Fe);if(Tt)return Tt;let W=vt,Qr=(async()=>{let br=H.get(Ue)??await Cs(f,Ue);H.set(Ue,br);let ct={..._g(br,{user:Ve,slug:f.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},gt=await aT(t,ct);if(gt&&W!==vt)return Ps(gt,{recursive:!0,force:!0}),Ae?.uiRoot;if(gt)rt.add(gt);let Mr=gt??Ae?.uiRoot;if(Mr)ae.set(Fe,Mr);return Mr})();Le.set(Fe,Qr);try{return await Qr}finally{Le.delete(Fe)}}let lt=await ar({username:"",passwordHash:"",role:"admin",sites:{}},N);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ve=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ie=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ie&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Oe=!Ie,bt=Zb(t),jt=Oe?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Me=new Oi(b.store,{encryptionKey:Ke(t)}),Et=new xi(b.store),pt=new Wr(b.store),tt=new xo(b.store,{encryptionKey:Ke(t)}),Gr=new up(b.store),_s=new fp(b.store,{cwd:t}),Zn=new mp(b.store,{encryptionKey:Ke(t)}),tr=new c(b.store,{workerId:`dashboard:${process.pid}`}),cr=new Wo(b.store),si=new ia(b.store,Ke(t)),Di=new wa(b.store),Cc=new Gi(cr,tr,si),Ni=f.project?.region??"us-east-1",Ug=Ke(t),En=new Na(Di,{encryptionKey:Ug,backends:[new cn(b.store,Ug),new Ra(new V(Ni),Ni),new Da(new be(Ni),Ni),new Pa]});await mu(En,b,f);let Ju=new j(Ni),lw={aws_rds:new Jo(new ta(Ju)),aws_aurora:new Xo(new ra(Ju)),aws_elasticache:new Yo(new na(new et(Ni))),server:new Zo(new Jt),container:new ea(new Jt)},qg=(L)=>lw[L.provider],Sr=new ya(b.store),To=new Ji(Sr,tr),Vg=new Ia(si),uw={managed_database:new Sa(cr,Ju),logical_database:new Ea(cr,si),volume:new ba,files:new Ca(t),control_plane:new va(b.store,t),infrastructure:new Ta(new er(Ni))},pw=(L)=>uw[L.resourceKind],mw=(L)=>L.provider==="aws_backup"?void 0:Vg,Gu=new xt(b.store),Qu=[new Pr,new Qs(d(t,"volumes"))],ai=new Us(Gu,Qu,tr),Qa=new sa(b.store),Xn=new oa(Qa,[new en("aws"),new en("hetzner"),new en("ssh")],tr),Bi=new aa(b.store),Wg=new ca(Bi,Qa),es=new da(b.store),Hg=new la(es,tr),ci=new pa(b.store),Yu=new ga(ci,tr),Kg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((L)=>new ma(L,b.store,b.project.id,b.organization.id)),Or=new jo(b.store),Jg=new Ko(Or,{queue:tr}),vr=new Dr(b.store),Zi=new Nr(b.store),On=new mt(b.store),at=new fi(b.store,{encryptionKey:Ke(t)}),gw=()=>aw(b.store);for(let L of b.environments.values())zo(Or,f,{organization:b.organization,project:b.project,environment:L,resources:b.store.listResources(b.project.id,L.id)});let $n=new Ai(at,{emailImpl:async(L)=>{let{email:Ue}=await import("./chunk-49vvjfrd.js");return Ue.send(L)}}),Gg=async(L)=>{let Ue=eo(at,b.project.id,L),Ve=[];for(let Fe of Ue.filter((nt)=>nt.notify&&nt.alert))Ve.push(...await $n.deliverAll($n.enqueue(b.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(b.organization.id,at.listAlerts(b.project.id,{environmentId:L,states:["firing"]})))),Ve.push(...await $n.retryDue()),{evaluations:Ue,deliveries:Ve}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let L of b.environments.values())for(let Ue of at.listHealthChecks(b.project.id,L.id).filter((Ve)=>Ve.enabled)){let Ve=at.listHealthResults(Ue.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<Ue.intervalSeconds*1000)continue;let Fe=await new He(at).runAndEvaluate(Ue);for(let nt of Fe.evaluations.filter((Tt)=>Tt.notify&&Tt.alert))await $n.deliverAll($n.enqueue(b.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Qg=setInterval(()=>{for(let L of b.environments.values())Gg(L.id).catch((Ue)=>console.error("ts-cloud alert evaluation failed:",Ue))},60000);Qg.unref?.();let Yg=setInterval(()=>{fw().catch((L)=>console.error("ts-cloud health check evaluation failed:",L))},30000);Yg.unref?.();let Zg=setInterval(()=>{try{Jg.tick()}catch(L){console.error("ts-cloud scheduled job evaluation failed:",L)}},30000);Zg.unref?.();let Xg=setInterval(()=>{try{To.enqueueDue(),To.enqueueRetention()}catch(L){console.error("ts-cloud backup policy evaluation failed:",L)}},30000);Xg.unref?.(),vr.cleanup();let ef=setInterval(()=>{try{vr.cleanup()}catch(L){console.error("ts-cloud preview cleanup failed:",L)}},3600000);ef.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(L,Ue)=>{let Fe=(L.environmentId?b.store.listEnvironments(L.projectId).find((nt)=>nt.id===L.environmentId):void 0)?.slug??String(N);if(Ue.kind==="dashboard_operation"&&Ue.operationId){let nt=H.get(Fe)??z,Tt=Pg(Ue.operationId,f,nt);if(!Tt||Tt.danger||!["scheduler","backup","worker"].includes(Tt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Tt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(Ue.kind==="serverless_scheduler"){let nt=await Mg(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ue.kind}.`}},Pc=hw?new Ms(tr,{...Uc({store:b.store,execute:async(L,Ue)=>{let Ve=Ue.operation.input&&typeof Ue.operation.input==="object"&&!Array.isArray(Ue.operation.input)?Ue.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,nt=t,Tt,W,Qr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=tt.getBinding(String(Fe.bindingId)),gt=tt.getConnection(String(Fe.connectionId));if(!ct||!gt||ct.connectionId!==gt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?tt.getRepository(ct.repositoryId):tt.listRepositories(gt.id).find((Os)=>Os.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&gt.provider==="generic_ssh")_r=`git@${new URL(gt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,gt.host.endsWith("/")?gt.host:`${gt.host}/`).href;let Ce=ct.deployKeyId?tt.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:tt.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(gt.provider)&&L.target.previewId){let Os=We(gt,tt.getCredential(gt.id)),Se=vr.previews.getInstance(L.target.previewId);Qr=async(Nn,Oc)=>{try{await Os.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:Se?.url,description:Oc})}catch($s){Ue.log(`Could not publish source status: ${$s instanceof Error?$s.message:String($s)}`,{stream:"stderr"})}},await Qr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Tt=zg(Qt(Hu(),"ts-cloud-queued-source-")),Ue.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await $o({remote:_r,binding:ct,destination:Qt(Tt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:tt.getCredential(gt.id),deployKey:dr})).directory}if(Ue.operation.kind!=="preview.destroy"){let ct=L.target.previewId?vr.previews.getInstance(L.target.previewId):void 0,gt=ct?vr.previews.getDefinition(ct.definitionId):void 0,Mr=Ue.operation.resourceId?b.store.getResource(Ue.operation.resourceId):void 0;if(W=await En.resolve({projectId:b.project.id,environmentId:Ue.operation.environmentId,resourceId:Ue.operation.resourceId,functionId:Mr?.kind==="function"?Mr.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:gt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(Ue.operation.resourceId)for(let _r of Object.values(W.entries))Di.setDependency({entryId:_r.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});Ue.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let br=await Fg(L,{cwd:nt,cliEntry:m,signal:Ue.signal,env:W?.values,onOutput:(ct,gt)=>Ue.log(gt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,Mr])=>Mr.kind==="secret").map(([Mr])=>W.values[Mr]).filter(Boolean)]})});if(br.ok&&Ue.operation.resourceId&&W)for(let ct of Object.values(W.entries))Di.setDependency({entryId:ct.id,resourceId:Ue.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Qr?.(br.ok?"success":"failure",br.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),br}catch(br){throw await Qr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),br}finally{if(Tt)Ps(Tt,{recursive:!0,force:!0})}}}),...Bl({store:Or,executor:vw}),...Ol({store:cr,secrets:si,resolveAdapter:qg}),...$l(Qa,Xn.drivers),...Fl(es,[new ua("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...ql({store:ci,cleanup:Kg}),...Qc(Gu,Qu),...du({store:Sr,queue:tr,resolveSource:pw,resolveDestination:mw,validateHealth:async(L,Ue)=>{if(!L.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=at.getHealthCheck(L.healthCheckId);if(!Ve||Ve.projectId!==L.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:Ue}}}),...ll({store:b.store,resolveDriver:e.releaseDriver??((L)=>({name:`${b.store.getResource(L.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:L.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(L,Ue)=>{let Ve=at.listHealthChecks(Ue.projectId,Ue.environmentId).find((nt)=>nt.enabled&&nt.name===L&&(!nt.resourceId||nt.resourceId===Ue.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${L} was not found for this release.`};let Fe=await new He(at).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(L)=>console.error("ts-cloud deployment queue worker failed:",L)}):void 0;if(bl(b),Ui(pt,te(b,String(N)),z),jt)zi(b,jt.users),oS(Me,b,jt.users);let mr=nS({cwd:t,enabled:Oe,secret:bt,authentication:Me,authorization:{store:b.store,organizationId:b.organization.id,projectId:b.project.id,defaultEnvironment:String(N)}}),wr=new Vo,tf=setInterval(()=>wr.sweep(),60000);tf.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),rf=setInterval(()=>_c.prune(),300000),nf=setInterval(()=>Xu.prune(),300000),of=setInterval(()=>Tc.prune(),300000);if(rf.unref?.(),nf.unref?.(),of.unref?.(),Oe){if(jt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${jt.generated.username}
     password: ${jt.generated.password}

package/dist/{chunk-4j8ef0pe.js → chunk-49vvjfrd.js}

@@ -1 +1 @@
-import{Sn,Dh}from"./chunk-r1wpwfff.js";import"./chunk-9wmer0zx.js";import"./chunk-9asn5fpt.js";import"./chunk-zx8ecz8b.js";export{Sn as EmailClient,Dh as email};
+import{Sn,Dh}from"./chunk-d46p0h6t.js";import"./chunk-9wmer0zx.js";import"./chunk-9asn5fpt.js";import"./chunk-zx8ecz8b.js";export{Sn as EmailClient,Dh as email};

package/dist/{chunk-5255nr93.js → chunk-aw1tp3p3.js}

@@ -22,7 +22,7 @@ EOF`,`DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,"UPTIME_SEC=
 `)}
 `}return`${["server {","    listen 80;","    listen [::]:80;",`    server_name ${r};`,...n,"}"].join(`
 `)}
-`}function Xr(e){let t=`/etc/nginx/sites-available/${e.siteName}`,r=`/etc/nginx/sites-enabled/${e.siteName}`,n=ha(e),s=[...Jr()];if(e.auth){let i=xs(e.siteName),a=(m)=>m.split("'").join("'\\''"),c=a(e.auth.password),l=a(e.auth.username);s.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${c}')`,`printf '%s:%s\\n' '${l}' "$TS_CLOUD_HTPASS" > ${i}`,`chmod 640 ${i}`,`chown root:www-data ${i} 2>/dev/null || true`)}return s.push(`cat > ${t} <<'TS_CLOUD_NGINX_EOF'`,n.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${t} ${r}`,"rm -f /etc/nginx/sites-enabled/default",`${He} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),s}var He="/usr/local/bin/ts-cloud-nginx";function Jr(e="/opt/pantry"){return[...ur(),...ge(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${He} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${e} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${He}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${He} -t`,`ExecStart=${He} -g 'daemon off;'`,`ExecReload=${He} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function bt(e,t){return!e.events||e.events.includes(t)}async function Qr(e,t,r,n={}){if(!e)return[];let s=n.fetchImpl??globalThis.fetch,i=[],a=[],c=(l,m)=>s(l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(m)}).catch(()=>{return});if(e.slack?.webhookUrl&&bt(e,t))i.push("slack"),a.push(c(e.slack.webhookUrl,{text:r}));if(e.discord?.webhookUrl&&bt(e,t))i.push("discord"),a.push(c(e.discord.webhookUrl,{content:r}));if(e.telegram?.botToken&&e.telegram.chatId&&bt(e,t)){i.push("telegram");let l=`https://api.telegram.org/bot${e.telegram.botToken}/sendMessage`;a.push(c(l,{chat_id:e.telegram.chatId,text:r}))}if(e.webhook?.url&&bt(e,t))if(i.push("webhook"),(e.webhook.method||"POST")==="GET"){let l=e.webhook.url.includes("?")?"&":"?",m=`${e.webhook.url}${l}event=${encodeURIComponent(t)}&message=${encodeURIComponent(r)}`;a.push(s(m,{method:"GET"}).catch(()=>{return}))}else a.push(c(e.webhook.url,{event:t,message:r}));if(e.email?.to&&bt(e,t))i.push("email"),a.push(Sa(e.email,t,r));return await Promise.all(a),i}async function Sa(e,t,r){try{let n=await import("./chunk-4j8ef0pe.js");await n.email.send({to:e.to,from:e.from,subject:`[ts-cloud] ${t}`,text:r})}catch{}}function Os(e,t){return t??e}function Ze(e){if(!e)return[];let t=[];if(e.slack?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${e.slack.webhookUrl} || true`);if(e.discord?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${e.discord.webhookUrl} || true`);if(e.telegram?.botToken&&e.telegram.chatId)t.push(`curl -fsS -X POST "https://api.telegram.org/bot${e.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${e.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if(e.webhook?.url)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${e.webhook.url} || true`);if(t.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...t,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}import{isIP as As}from"node:net";var Dn="/etc/rpx/certs",Ls="/etc/rpx/local-ca",_a="rpx-root-ca.crt";function Wt(e=Ls){return`${e.replace(/\/+$/,"")}/${_a}`}function Pn(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function Nn(e,t={}){let r=new Set;for(let n of Object.values(e)){if(!n?.domain)continue;if(u(n)==="bucket")continue;r.add(n.domain)}if(t.autoWww!==!1)for(let n of[...r]){if(!Pn(n))continue;r.add(`www.${n}`)}return[...r]}var va=["1.1.1.1","8.8.8.8"],ya="/var/www/acme-challenge";function $a(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function ba(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function en(e){if(!e)return;return e.tls??"local-ca"}function Us(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Hs(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function Ta(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(As(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function wa(e,t,r){let n=[],s=new Set,i=(m,S)=>{let v=m.trim().toLowerCase();if(!v||s.has(v))return;s.add(v),n.push({host:v,source:S})},a=t.hostname?.trim(),c=(a||`${r}.local`).toLowerCase();if(i(c,a?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([m,S])=>!!S&&Ur(m)))i(`dashboard.${c}`,"the management dashboard site");for(let[m,S]of Object.entries(e)){if(!S?.domain)continue;if(u(S)==="bucket")continue;if(!Ta(S.domain))continue;i(S.domain,`site "${m}"`)}return n}function Ca(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function Pa(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let s=Ca(r,t.allowedSuffixes);if(!s)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${s}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function Pu(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function ec(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Ea(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function Ms(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),s=t.slug??"app",i=t.proxy.certsDir??Dn,a=t.proxy.loadBalancer,c=[],l=new Set;for(let[_,f]of Object.entries(e)){if(!f||!f.domain)continue;let y=u(f);if(y==="bucket")continue;let x=Pu(f.path),P=ec(f.domain,x),C=ba(f);if(y==="redirect"){c.push({to:f.domain,path:x,redirect:$a(f.redirect),id:P,...C?{auth:C}:{}}),l.add(f.domain);continue}if(y==="proxy"){let T=Tr(f);if(T.length===0)continue;let b=T.length===1?T[0]:T;c.push({to:f.domain,path:x,from:b,id:P,...C?{auth:C}:{},...Array.isArray(b)&&a?{loadBalancer:a}:{}}),l.add(f.domain);continue}if(y==="server-app"){if(typeof f.port!=="number")continue;let T=Ea(f.port,r);c.push({to:f.domain,path:x,from:T,id:P,...C?{auth:C}:{},...Array.isArray(T)&&a?{loadBalancer:a}:{}})}else c.push({to:f.domain,path:x,static:{dir:`${n}/${s}-${_}/current`,spa:f.spa??!1,pathRewriteStyle:f.pathRewriteStyle??"directory"},cleanUrls:f.pathRewriteStyle!=="flat",...C?{auth:C}:{},id:P});l.add(f.domain)}if(t.proxy.autoWww!==!1)for(let _ of[...l]){if(!Pn(_))continue;let f=`www.${_}`;if(l.has(f))continue;c.push({to:f,redirect:{to:`https://${_}`},id:ec(f)}),l.add(f)}c.sort((_,f)=>{if(_.to!==f.to)return _.to.localeCompare(f.to);return(f.path?.length??0)-(_.path?.length??0)});let m={proxies:c,productionCerts:{certsDir:i,certsDirServerNames:[...l]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(t.proxy.onDemandTls&&l.size>0)m.onDemandTls={enabled:!0,allowedSuffixes:[...l],email:t.proxy.onDemandTlsEmail,certsDir:i,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)m.acmeChallengeWebroot=t.proxy.acmeWebroot??ya;let S=t.proxy.cdn,v=S?.frontedHosts?.length?S.frontedHosts:[...l];if(S?.secret&&v.length>0)m.originGuard={header:S.secretHeader??"X-Origin-Verify",value:S.secret,hosts:v};if(t.lan)if(en(t.lan)==="off")m.https=!1;else{let _=wa(e,t.lan,s);Pa(_,m.onDemandTls);let f=t.lan.ip&&As(t.lan.ip)!==0?[t.lan.ip]:[];m.localCa={dir:Ls,hosts:_.map((y)=>y.host),...f.length>0?{ips:f}:{},installTrust:!0}}return m}function K(e,t){return Ms(e,t)}function gr(e,t,r){return Ms(e,r,t)}function Nh(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
+`}function Xr(e){let t=`/etc/nginx/sites-available/${e.siteName}`,r=`/etc/nginx/sites-enabled/${e.siteName}`,n=ha(e),s=[...Jr()];if(e.auth){let i=xs(e.siteName),a=(m)=>m.split("'").join("'\\''"),c=a(e.auth.password),l=a(e.auth.username);s.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${c}')`,`printf '%s:%s\\n' '${l}' "$TS_CLOUD_HTPASS" > ${i}`,`chmod 640 ${i}`,`chown root:www-data ${i} 2>/dev/null || true`)}return s.push(`cat > ${t} <<'TS_CLOUD_NGINX_EOF'`,n.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${t} ${r}`,"rm -f /etc/nginx/sites-enabled/default",`${He} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),s}var He="/usr/local/bin/ts-cloud-nginx";function Jr(e="/opt/pantry"){return[...ur(),...ge(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${He} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${e} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${He}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${He} -t`,`ExecStart=${He} -g 'daemon off;'`,`ExecReload=${He} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function bt(e,t){return!e.events||e.events.includes(t)}async function Qr(e,t,r,n={}){if(!e)return[];let s=n.fetchImpl??globalThis.fetch,i=[],a=[],c=(l,m)=>s(l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(m)}).catch(()=>{return});if(e.slack?.webhookUrl&&bt(e,t))i.push("slack"),a.push(c(e.slack.webhookUrl,{text:r}));if(e.discord?.webhookUrl&&bt(e,t))i.push("discord"),a.push(c(e.discord.webhookUrl,{content:r}));if(e.telegram?.botToken&&e.telegram.chatId&&bt(e,t)){i.push("telegram");let l=`https://api.telegram.org/bot${e.telegram.botToken}/sendMessage`;a.push(c(l,{chat_id:e.telegram.chatId,text:r}))}if(e.webhook?.url&&bt(e,t))if(i.push("webhook"),(e.webhook.method||"POST")==="GET"){let l=e.webhook.url.includes("?")?"&":"?",m=`${e.webhook.url}${l}event=${encodeURIComponent(t)}&message=${encodeURIComponent(r)}`;a.push(s(m,{method:"GET"}).catch(()=>{return}))}else a.push(c(e.webhook.url,{event:t,message:r}));if(e.email?.to&&bt(e,t))i.push("email"),a.push(Sa(e.email,t,r));return await Promise.all(a),i}async function Sa(e,t,r){try{let n=await import("./chunk-49vvjfrd.js");await n.email.send({to:e.to,from:e.from,subject:`[ts-cloud] ${t}`,text:r})}catch{}}function Os(e,t){return t??e}function Ze(e){if(!e)return[];let t=[];if(e.slack?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${e.slack.webhookUrl} || true`);if(e.discord?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${e.discord.webhookUrl} || true`);if(e.telegram?.botToken&&e.telegram.chatId)t.push(`curl -fsS -X POST "https://api.telegram.org/bot${e.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${e.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if(e.webhook?.url)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${e.webhook.url} || true`);if(t.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...t,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}import{isIP as As}from"node:net";var Dn="/etc/rpx/certs",Ls="/etc/rpx/local-ca",_a="rpx-root-ca.crt";function Wt(e=Ls){return`${e.replace(/\/+$/,"")}/${_a}`}function Pn(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function Nn(e,t={}){let r=new Set;for(let n of Object.values(e)){if(!n?.domain)continue;if(u(n)==="bucket")continue;r.add(n.domain)}if(t.autoWww!==!1)for(let n of[...r]){if(!Pn(n))continue;r.add(`www.${n}`)}return[...r]}var va=["1.1.1.1","8.8.8.8"],ya="/var/www/acme-challenge";function $a(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function ba(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function en(e){if(!e)return;return e.tls??"local-ca"}function Us(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Hs(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function Ta(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(As(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function wa(e,t,r){let n=[],s=new Set,i=(m,S)=>{let v=m.trim().toLowerCase();if(!v||s.has(v))return;s.add(v),n.push({host:v,source:S})},a=t.hostname?.trim(),c=(a||`${r}.local`).toLowerCase();if(i(c,a?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([m,S])=>!!S&&Ur(m)))i(`dashboard.${c}`,"the management dashboard site");for(let[m,S]of Object.entries(e)){if(!S?.domain)continue;if(u(S)==="bucket")continue;if(!Ta(S.domain))continue;i(S.domain,`site "${m}"`)}return n}function Ca(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function Pa(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let s=Ca(r,t.allowedSuffixes);if(!s)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${s}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function Pu(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function ec(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Ea(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function Ms(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),s=t.slug??"app",i=t.proxy.certsDir??Dn,a=t.proxy.loadBalancer,c=[],l=new Set;for(let[_,f]of Object.entries(e)){if(!f||!f.domain)continue;let y=u(f);if(y==="bucket")continue;let x=Pu(f.path),P=ec(f.domain,x),C=ba(f);if(y==="redirect"){c.push({to:f.domain,path:x,redirect:$a(f.redirect),id:P,...C?{auth:C}:{}}),l.add(f.domain);continue}if(y==="proxy"){let T=Tr(f);if(T.length===0)continue;let b=T.length===1?T[0]:T;c.push({to:f.domain,path:x,from:b,id:P,...C?{auth:C}:{},...Array.isArray(b)&&a?{loadBalancer:a}:{}}),l.add(f.domain);continue}if(y==="server-app"){if(typeof f.port!=="number")continue;let T=Ea(f.port,r);c.push({to:f.domain,path:x,from:T,id:P,...C?{auth:C}:{},...Array.isArray(T)&&a?{loadBalancer:a}:{}})}else c.push({to:f.domain,path:x,static:{dir:`${n}/${s}-${_}/current`,spa:f.spa??!1,pathRewriteStyle:f.pathRewriteStyle??"directory"},cleanUrls:f.pathRewriteStyle!=="flat",...C?{auth:C}:{},id:P});l.add(f.domain)}if(t.proxy.autoWww!==!1)for(let _ of[...l]){if(!Pn(_))continue;let f=`www.${_}`;if(l.has(f))continue;c.push({to:f,redirect:{to:`https://${_}`},id:ec(f)}),l.add(f)}c.sort((_,f)=>{if(_.to!==f.to)return _.to.localeCompare(f.to);return(f.path?.length??0)-(_.path?.length??0)});let m={proxies:c,productionCerts:{certsDir:i,certsDirServerNames:[...l]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(t.proxy.onDemandTls&&l.size>0)m.onDemandTls={enabled:!0,allowedSuffixes:[...l],email:t.proxy.onDemandTlsEmail,certsDir:i,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)m.acmeChallengeWebroot=t.proxy.acmeWebroot??ya;let S=t.proxy.cdn,v=S?.frontedHosts?.length?S.frontedHosts:[...l];if(S?.secret&&v.length>0)m.originGuard={header:S.secretHeader??"X-Origin-Verify",value:S.secret,hosts:v};if(t.lan)if(en(t.lan)==="off")m.https=!1;else{let _=wa(e,t.lan,s);Pa(_,m.onDemandTls);let f=t.lan.ip&&As(t.lan.ip)!==0?[t.lan.ip]:[];m.localCa={dir:Ls,hosts:_.map((y)=>y.host),...f.length>0?{ips:f}:{},installTrust:!0}}return m}function K(e,t){return Ms(e,t)}function gr(e,t,r){return Ms(e,r,t)}function Nh(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
 // Routes are derived from the \`sites\` model on every \`buddy deploy\`.
 import { startProxies } from '@stacksjs/rpx'
 

package/dist/chunk-d46p0h6t.js

@@ -0,0 +1,34 @@
+import{n}from"./chunk-zx8ecz8b.js";import{o}from"./chunk-9asn5fpt.js";import{y}from"./chunk-9wmer0zx.js";import{Fe}from"./chunk-bxrzsth8.js";function f(e,t){let s=[`Action=${e}`,"Version=2010-05-08"];for(let[a,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((c,u)=>{if(typeof c==="object"&&c!==null)for(let[d,m]of Object.entries(c))s.push(`${a}.member.${u+1}.${d}=${encodeURIComponent(String(m))}`);else s.push(`${a}.member.${u+1}=${encodeURIComponent(String(c))}`)});else if(typeof i==="object"){for(let[c,u]of Object.entries(i))if(u!==void 0&&u!==null)s.push(`${a}.${c}=${encodeURIComponent(String(u))}`)}else s.push(`${a}=${encodeURIComponent(String(i))}`)}return s.join("&")}function r(e,t){let s=new RegExp(`<${t}>([^<]*)</${t}>`),a=e.match(s);return a?a[1]:void 0}function l(e,t,s){let a=new RegExp(`<${t}>([\\s\\S]*?)</${t}>`),i=e.match(a);if(!i)return[];let c=[],u=new RegExp(`<${s}>([\\s\\S]*?)</${s}>`,"g"),d;while((d=u.exec(i[1]))!==null)c.push(d[1]);return c}class fe{client;region;constructor(e="us-east-1",t){this.client=new n(void 0,{profile:t}),this.region=e}async request(e,t={}){let s=f(e,t);return await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s})}async createUser(e){let t=await this.request("CreateUser",e);return this.parseUser(t)}async getUser(e={}){let t=await this.request("GetUser",e);return this.parseUser(t)}async listUsers(e={}){let t=await this.request("ListUsers",e),s=this.parseUsers(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Users:s,IsTruncated:a,Marker:i}}async updateUser(e){await this.request("UpdateUser",e)}async deleteUser(e){await this.request("DeleteUser",e)}parseUser(e){return{UserName:r(e,"UserName")||"",UserId:r(e,"UserId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate"),PasswordLastUsed:r(e,"PasswordLastUsed")}}parseUsers(e){return l(e,"Users","member").map((s)=>({UserName:r(s,"UserName")||"",UserId:r(s,"UserId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate"),PasswordLastUsed:r(s,"PasswordLastUsed")}))}async createGroup(e){let t=await this.request("CreateGroup",e);return this.parseGroup(t)}async getGroup(e){let t=await this.request("GetGroup",e),s=this.parseGroup(t),a=this.parseUsers(t),i=r(t,"IsTruncated")==="true",c=r(t,"Marker");return{Group:s,Users:a,IsTruncated:i,Marker:c}}async listGroups(e={}){let t=await this.request("ListGroups",e),s=this.parseGroups(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Groups:s,IsTruncated:a,Marker:i}}async updateGroup(e){await this.request("UpdateGroup",e)}async deleteGroup(e){await this.request("DeleteGroup",e)}async addUserToGroup(e){await this.request("AddUserToGroup",e)}async removeUserFromGroup(e){await this.request("RemoveUserFromGroup",e)}async listGroupsForUser(e){let t=await this.request("ListGroupsForUser",e),s=this.parseGroups(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Groups:s,IsTruncated:a,Marker:i}}parseGroup(e){return{GroupName:r(e,"GroupName")||"",GroupId:r(e,"GroupId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate")}}parseGroups(e){return l(e,"Groups","member").map((s)=>({GroupName:r(s,"GroupName")||"",GroupId:r(s,"GroupId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate")}))}async createRole(e){let t=await this.request("CreateRole",e);return this.parseRole(t)}async getRole(e){let t=await this.request("GetRole",e);return this.parseRole(t)}async listRoles(e={}){let t=await this.request("ListRoles",e),s=this.parseRoles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Roles:s,IsTruncated:a,Marker:i}}async updateRole(e){await this.request("UpdateRole",e)}async updateRoleDescription(e){let t=await this.request("UpdateRoleDescription",e);return this.parseRole(t)}async updateAssumeRolePolicy(e){await this.request("UpdateAssumeRolePolicy",e)}async deleteRole(e){await this.request("DeleteRole",e)}async tagRole(e){await this.request("TagRole",e)}async untagRole(e){await this.request("UntagRole",e)}async listRoleTags(e){let t=await this.request("ListRoleTags",e),s=this.parseTags(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Tags:s,IsTruncated:a,Marker:i}}parseRole(e){return{RoleName:r(e,"RoleName")||"",RoleId:r(e,"RoleId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate"),AssumeRolePolicyDocument:r(e,"AssumeRolePolicyDocument"),Description:r(e,"Description"),MaxSessionDuration:r(e,"MaxSessionDuration")?Number.parseInt(r(e,"MaxSessionDuration"),10):void 0}}parseRoles(e){return l(e,"Roles","member").map((s)=>({RoleName:r(s,"RoleName")||"",RoleId:r(s,"RoleId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate"),AssumeRolePolicyDocument:r(s,"AssumeRolePolicyDocument"),Description:r(s,"Description"),MaxSessionDuration:r(s,"MaxSessionDuration")?Number.parseInt(r(s,"MaxSessionDuration"),10):void 0}))}parseTags(e){return l(e,"Tags","member").map((s)=>({Key:r(s,"Key")||"",Value:r(s,"Value")||""}))}async createPolicy(e){let t=await this.request("CreatePolicy",e);return this.parsePolicy(t)}async getPolicy(e){let t=await this.request("GetPolicy",e);return this.parsePolicy(t)}async getPolicyVersion(e){let t=await this.request("GetPolicyVersion",e);return{VersionId:r(t,"VersionId")||"",IsDefaultVersion:r(t,"IsDefaultVersion")==="true",CreateDate:r(t,"CreateDate"),Document:r(t,"Document")}}async listPolicies(e={}){let t=await this.request("ListPolicies",e),s=this.parsePolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Policies:s,IsTruncated:a,Marker:i}}async listPolicyVersions(e){let t=await this.request("ListPolicyVersions",e),s=this.parsePolicyVersions(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{Versions:s,IsTruncated:a,Marker:i}}async createPolicyVersion(e){let t=await this.request("CreatePolicyVersion",e);return{VersionId:r(t,"VersionId")||"",IsDefaultVersion:r(t,"IsDefaultVersion")==="true",CreateDate:r(t,"CreateDate")}}async deletePolicyVersion(e){await this.request("DeletePolicyVersion",e)}async setDefaultPolicyVersion(e){await this.request("SetDefaultPolicyVersion",e)}async deletePolicy(e){await this.request("DeletePolicy",e)}async attachUserPolicy(e){await this.request("AttachUserPolicy",e)}async detachUserPolicy(e){await this.request("DetachUserPolicy",e)}async attachGroupPolicy(e){await this.request("AttachGroupPolicy",e)}async detachGroupPolicy(e){await this.request("DetachGroupPolicy",e)}async attachRolePolicy(e){await this.request("AttachRolePolicy",e)}async detachRolePolicy(e){await this.request("DetachRolePolicy",e)}async listAttachedUserPolicies(e){let t=await this.request("ListAttachedUserPolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}async listAttachedGroupPolicies(e){let t=await this.request("ListAttachedGroupPolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}async listAttachedRolePolicies(e){let t=await this.request("ListAttachedRolePolicies",e),s=this.parseAttachedPolicies(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AttachedPolicies:s,IsTruncated:a,Marker:i}}parsePolicy(e){return{PolicyName:r(e,"PolicyName")||"",PolicyId:r(e,"PolicyId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),DefaultVersionId:r(e,"DefaultVersionId"),AttachmentCount:r(e,"AttachmentCount")?Number.parseInt(r(e,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:r(e,"PermissionsBoundaryUsageCount")?Number.parseInt(r(e,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:r(e,"IsAttachable")==="true",Description:r(e,"Description"),CreateDate:r(e,"CreateDate"),UpdateDate:r(e,"UpdateDate")}}parsePolicies(e){return l(e,"Policies","member").map((s)=>({PolicyName:r(s,"PolicyName")||"",PolicyId:r(s,"PolicyId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),DefaultVersionId:r(s,"DefaultVersionId"),AttachmentCount:r(s,"AttachmentCount")?Number.parseInt(r(s,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:r(s,"PermissionsBoundaryUsageCount")?Number.parseInt(r(s,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:r(s,"IsAttachable")==="true",Description:r(s,"Description"),CreateDate:r(s,"CreateDate"),UpdateDate:r(s,"UpdateDate")}))}parsePolicyVersions(e){return l(e,"Versions","member").map((s)=>({VersionId:r(s,"VersionId")||"",IsDefaultVersion:r(s,"IsDefaultVersion")==="true",CreateDate:r(s,"CreateDate")}))}parseAttachedPolicies(e){return l(e,"AttachedPolicies","member").map((s)=>({PolicyName:r(s,"PolicyName")||"",PolicyArn:r(s,"PolicyArn")||""}))}async putUserPolicy(e){await this.request("PutUserPolicy",e)}async getUserPolicy(e){let t=await this.request("GetUserPolicy",e);return{UserName:r(t,"UserName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteUserPolicy(e){await this.request("DeleteUserPolicy",e)}async listUserPolicies(e){let t=await this.request("ListUserPolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async putGroupPolicy(e){await this.request("PutGroupPolicy",e)}async getGroupPolicy(e){let t=await this.request("GetGroupPolicy",e);return{GroupName:r(t,"GroupName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteGroupPolicy(e){await this.request("DeleteGroupPolicy",e)}async listGroupPolicies(e){let t=await this.request("ListGroupPolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async putRolePolicy(e){await this.request("PutRolePolicy",e)}async getRolePolicy(e){let t=await this.request("GetRolePolicy",e);return{RoleName:r(t,"RoleName")||"",PolicyName:r(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(r(t,"PolicyDocument")||"")}}async deleteRolePolicy(e){await this.request("DeleteRolePolicy",e)}async listRolePolicies(e){let t=await this.request("ListRolePolicies",e),s=l(t,"PolicyNames","member"),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{PolicyNames:s,IsTruncated:a,Marker:i}}async createAccessKey(e={}){let t=await this.request("CreateAccessKey",e);if(typeof t==="object"){let s=t?.CreateAccessKeyResult?.AccessKey||t?.AccessKey;if(s)return{AccessKey:{UserName:s.UserName||"",AccessKeyId:s.AccessKeyId||"",Status:s.Status||"Active",SecretAccessKey:s.SecretAccessKey||"",CreateDate:s.CreateDate}}}return{AccessKey:{UserName:r(t,"UserName")||"",AccessKeyId:r(t,"AccessKeyId")||"",Status:r(t,"Status")||"Active",SecretAccessKey:r(t,"SecretAccessKey")||"",CreateDate:r(t,"CreateDate")}}}async listAccessKeys(e={}){let t=await this.request("ListAccessKeys",e),s=this.parseAccessKeys(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{AccessKeyMetadata:s,IsTruncated:a,Marker:i}}async updateAccessKey(e){await this.request("UpdateAccessKey",e)}async deleteAccessKey(e){await this.request("DeleteAccessKey",e)}async getAccessKeyLastUsed(e){let t=await this.request("GetAccessKeyLastUsed",e);return{UserName:r(t,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:r(t,"LastUsedDate"),ServiceName:r(t,"ServiceName"),Region:r(t,"Region")}}}parseAccessKeys(e){return l(e,"AccessKeyMetadata","member").map((s)=>({UserName:r(s,"UserName"),AccessKeyId:r(s,"AccessKeyId")||"",Status:r(s,"Status")||"Active",CreateDate:r(s,"CreateDate")}))}async createInstanceProfile(e){let t=await this.request("CreateInstanceProfile",e);return this.parseInstanceProfile(t)}async getInstanceProfile(e){let t=await this.request("GetInstanceProfile",e);return this.parseInstanceProfile(t)}async listInstanceProfiles(e={}){let t=await this.request("ListInstanceProfiles",e),s=this.parseInstanceProfiles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{InstanceProfiles:s,IsTruncated:a,Marker:i}}async listInstanceProfilesForRole(e){let t=await this.request("ListInstanceProfilesForRole",e),s=this.parseInstanceProfiles(t),a=r(t,"IsTruncated")==="true",i=r(t,"Marker");return{InstanceProfiles:s,IsTruncated:a,Marker:i}}async addRoleToInstanceProfile(e){await this.request("AddRoleToInstanceProfile",e)}async removeRoleFromInstanceProfile(e){await this.request("RemoveRoleFromInstanceProfile",e)}async deleteInstanceProfile(e){await this.request("DeleteInstanceProfile",e)}parseInstanceProfile(e){return{InstanceProfileName:r(e,"InstanceProfileName")||"",InstanceProfileId:r(e,"InstanceProfileId")||"",Arn:r(e,"Arn")||"",Path:r(e,"Path"),CreateDate:r(e,"CreateDate")}}parseInstanceProfiles(e){return l(e,"InstanceProfiles","member").map((s)=>({InstanceProfileName:r(s,"InstanceProfileName")||"",InstanceProfileId:r(s,"InstanceProfileId")||"",Arn:r(s,"Arn")||"",Path:r(s,"Path"),CreateDate:r(s,"CreateDate")}))}async getAccountPasswordPolicy(){let e=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:r(e,"MinimumPasswordLength")?Number.parseInt(r(e,"MinimumPasswordLength"),10):void 0,RequireSymbols:r(e,"RequireSymbols")==="true",RequireNumbers:r(e,"RequireNumbers")==="true",RequireUppercaseCharacters:r(e,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:r(e,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:r(e,"AllowUsersToChangePassword")==="true",ExpirePasswords:r(e,"ExpirePasswords")==="true",MaxPasswordAge:r(e,"MaxPasswordAge")?Number.parseInt(r(e,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:r(e,"PasswordReusePrevention")?Number.parseInt(r(e,"PasswordReusePrevention"),10):void 0,HardExpiry:r(e,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(e){await this.request("UpdateAccountPasswordPolicy",e)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let e=await this.request("GetAccountSummary"),t={},s=l(e,"SummaryMap","entry");for(let a of s){let i=r(a,"key"),c=r(a,"value");if(i&&c)t[i]=Number.parseInt(c,10)}return t}async listAccountAliases(){let e=await this.request("ListAccountAliases"),t=l(e,"AccountAliases","member"),s=r(e,"IsTruncated")==="true",a=r(e,"Marker");return{AccountAliases:t,IsTruncated:s,Marker:a}}async createAccountAlias(e){await this.request("CreateAccountAlias",e)}async deleteAccountAlias(e){await this.request("DeleteAccountAlias",e)}async simulatePrincipalPolicy(e){let t=await this.request("SimulatePrincipalPolicy",e);return this.parseSimulationResults(t)}parseSimulationResults(e){let s=l(e,"EvaluationResults","member").map((c)=>{let d=l(c,"MatchedStatements","member").map((m)=>({SourcePolicyId:r(m,"SourcePolicyId"),SourcePolicyType:r(m,"SourcePolicyType")}));return{EvalActionName:r(c,"EvalActionName")||"",EvalResourceName:r(c,"EvalResourceName"),EvalDecision:r(c,"EvalDecision")||"",MatchedStatements:d.length>0?d:void 0}}),a=r(e,"IsTruncated")==="true",i=r(e,"Marker");return{EvaluationResults:s,IsTruncated:a,Marker:i}}}function p(e,t){return(e?.[`${t}Response`]??e)?.[`${t}Result`]}class tt{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(t)}async createEmailIdentity(e){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailIdentity(e){let t=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:t.IdentityType,IdentityName:e,SendingEnabled:t.VerifiedForSendingStatus,VerificationStatus:t.VerificationStatus,DkimAttributes:t.DkimAttributes,MailFromAttributes:t.MailFromAttributes}}async putEmailIdentityMailFromAttributes(e,t){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async listEmailIdentities(e){let t="/v2/email/identities",s=[];if(e?.PageSize)s.push(`PageSize=${e.PageSize}`);if(e?.NextToken)s.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(s.length>0)t+=`?${s.join("&")}`;let a=await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}});return{EmailIdentities:a.EmailIdentities,NextToken:a.NextToken}}async deleteEmailIdentity(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(e){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:e.SigningEnabled})})}async sendEmail(e){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).MessageId}}async sendBulkEmail(e){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).BulkEmailEntryResults}}async createEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailTemplate(e){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(e){let t="/v2/email/templates",s=[];if(e?.PageSize)s.push(`PageSize=${e.PageSize}`);if(e?.NextToken)s.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(s.length>0)t+=`?${s.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"}),t=p(e,"GetSendStatistics")?.SendDataPoints?.member;return{SendDataPoints:t==null?[]:Array.isArray(t)?t:[t]}}async getSendQuota(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"}),t=p(e,"GetSendQuota"),s=(a)=>a==null||a===""?void 0:Number(a);return{Max24HourSend:s(t?.Max24HourSend),MaxSendRate:s(t?.MaxSendRate),SentLast24Hours:s(t?.SentLast24Hours)}}async verifyDomain(e){let t=await this.createEmailIdentity({EmailIdentity:e});return{dkimTokens:t.DkimAttributes?.Tokens,verificationStatus:t.DkimAttributes?.Status}}async sendSimpleEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],s=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0,a={};if(e.text)a.Text={Data:e.text};if(e.html)a.Html={Data:e.html};return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Simple:{Subject:{Data:e.subject},Body:a}},ReplyToAddresses:s})}async sendTemplatedEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],s=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0;return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.templateData)}},ReplyToAddresses:s})}async getDkimRecords(e){let t=await this.getEmailIdentity(e);if(!t.DkimAttributes?.Tokens)return[];return t.DkimAttributes.Tokens.map((s)=>({name:`${s}._domainkey.${e}`,type:"CNAME",value:`${s}.dkim.amazonses.com`}))}async isDomainVerified(e){try{let t=await this.getEmailIdentity(e);return t.VerificationStatus==="SUCCESS"&&t.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(e,t=60,s=30000){for(let a=0;a<t;a++){if(await this.isDomainVerified(e))return!0;await new Promise((c)=>setTimeout(c,s))}return!1}buildFormBody(e){return Object.entries(e).filter(([,s])=>s!==void 0).map(([s,a])=>`${encodeURIComponent(s)}=${encodeURIComponent(a)}`).join("&")}async createReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async deleteReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async setActiveReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async listReceiptRuleSets(e){let t={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(e)t.NextToken=e;let s=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),a=s?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||s?.ListReceiptRuleSetsResult,i=a?.RuleSets?.member;return{RuleSets:Array.isArray(i)?i:i?[i]:[],NextToken:a?.NextToken}}async describeReceiptRuleSet(e){let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})}),s=t?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||t?.DescribeReceiptRuleSetResult,a=s?.Rules?.member;return{Metadata:s?.Metadata,Rules:Array.isArray(a)?a:a?[a]:[]}}async createReceiptRule(e){let t={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name,"Rule.Enabled":e.Rule.Enabled!==!1?"true":"false"};if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.After)t.After=e.After;if(e.Rule.Recipients)e.Rule.Recipients.forEach((s,a)=>{t[`Rule.Recipients.member.${a+1}`]=s});e.Rule.Actions.forEach((s,a)=>{let i=a+1;if(s.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=s.S3Action.BucketName,s.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=s.S3Action.ObjectKeyPrefix;if(s.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=s.S3Action.KmsKeyArn}if(s.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=s.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=s.LambdaAction.InvocationType||"Event";if(s.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=s.SNSAction.TopicArn,s.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=s.SNSAction.Encoding}if(s.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=s.StopAction.Scope,s.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=s.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async deleteReceiptRule(e,t){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:e,RuleName:t})})}async receiptRuleSetExists(e){try{return await this.describeReceiptRuleSet(e),!0}catch(t){if(t.code==="RuleSetDoesNotExist"||t.statusCode===400)return!1;throw t}}async getActiveReceiptRuleSet(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),t=e?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||e?.DescribeActiveReceiptRuleSetResult;if(!t?.Metadata)return null;let s=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(s)?s:s?[s]:[]}}async updateReceiptRule(e){let t={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name};if(e.Rule.Enabled!==void 0)t["Rule.Enabled"]=e.Rule.Enabled?"true":"false";if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.Rule.Recipients)e.Rule.Recipients.forEach((s,a)=>{t[`Rule.Recipients.member.${a+1}`]=s});e.Rule.Actions.forEach((s,a)=>{let i=a+1;if(s.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=s.S3Action.BucketName,s.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=s.S3Action.ObjectKeyPrefix;if(s.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=s.S3Action.KmsKeyArn}if(s.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=s.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=s.LambdaAction.InvocationType||"Event";if(s.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=s.SNSAction.TopicArn,s.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=s.SNSAction.Encoding}if(s.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=s.StopAction.Scope,s.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=s.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async sendRawEmail(e){let t=Buffer.from(e.rawMessage).toString("base64"),s={Action:"SendRawEmail",Version:"2010-12-01",Source:e.source,"RawMessage.Data":t};e.destinations.forEach((c,u)=>{s[`Destinations.member.${u+1}`]=c});let a=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(s)});return{MessageId:(a?.SendRawEmailResponse?.SendRawEmailResult||a?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(e){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`}))?.SuppressedDestination||null}catch(t){if(t.message?.includes("404")||t.message?.includes("NotFoundException"))return null;throw t}}async deleteSuppressedDestination(e){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`})}}class Sn{ses;s3;iam;route53;region;domain;defaultFrom;constructor(e={}){this.region=e.region||"us-east-1",this.domain=e.domain,this.defaultFrom=e.defaultFrom,this.ses=new tt(this.region),this.s3=new o(this.region),this.iam=new fe(this.region),this.route53=new y(this.region)}async send(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let s=e.fromName?`${e.fromName} <${t}>`:t,a=Array.isArray(e.to)?e.to:[e.to];if(!e.attachments||e.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:s,to:a,subject:e.subject,text:e.text,html:e.html,replyTo:e.replyTo})).MessageId||""};let i=this.buildRawEmail(e,s,a);return{messageId:(await this.ses.sendEmail({FromEmailAddress:s,Destination:{ToAddresses:a,CcAddresses:e.cc?Array.isArray(e.cc)?e.cc:[e.cc]:void 0,BccAddresses:e.bcc?Array.isArray(e.bcc)?e.bcc:[e.bcc]:void 0},Content:{Raw:{Data:Buffer.from(i).toString("base64")}}})).MessageId||""}}async sendTemplate(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let s=e.fromName?`${e.fromName} <${t}>`:t;return{messageId:(await this.ses.sendTemplatedEmail({from:s,to:e.to,templateName:e.templateName,templateData:e.templateData,replyTo:e.replyTo})).MessageId||""}}async sendBulk(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let s=e.recipients.map((i)=>({Destination:{ToAddresses:Array.isArray(i.to)?i.to:[i.to]},ReplacementEmailContent:i.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(i.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:t,BulkEmailEntries:s,DefaultContent:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.defaultTemplateData)}}})).BulkEmailEntryResults?.map((i)=>({status:i.Status||"UNKNOWN",messageId:i.MessageId,error:i.Error}))||[]}}async setupDomain(e){let t;try{t=await this.ses.getEmailIdentity(e)}catch{let a=await this.ses.createEmailIdentity({EmailIdentity:e});t={VerificationStatus:a.DkimAttributes?.Status,DkimAttributes:a.DkimAttributes,SendingEnabled:a.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:e,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(e,{MailFromDomain:`mail.${e}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let s=await this.ses.getDkimRecords(e);return{domainVerified:t.SendingEnabled===!0,dkimStatus:t.DkimAttributes?.Status||"UNKNOWN",dkimTokens:t.DkimAttributes?.Tokens,mailFromStatus:t.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(e){let t=[],s=await this.ses.getDkimRecords(e);for(let a of s)t.push({type:a.type,name:a.name,value:a.value,ttl:1800});return t.push({type:"MX",name:e,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),t.push({type:"MX",name:`mail.${e}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),t.push({type:"TXT",name:`mail.${e}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),t.push({type:"TXT",name:`_dmarc.${e}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${e}`,ttl:3600}),t}async isDomainReady(e){try{let t=await this.ses.getEmailIdentity(e);return t.SendingEnabled===!0&&t.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(e){let t={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${e.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":e.accountId}}}]};await this.s3.putBucketPolicy(e.bucketName,t);try{await this.ses.createReceiptRuleSet(e.ruleSetName)}catch(a){if(!a.message?.includes("already exists")&&a.code!=="AlreadyExists")throw a}let s=[{S3Action:{BucketName:e.bucketName,ObjectKeyPrefix:e.prefix||"inbox/"}}];if(e.lambdaArn)s.push({LambdaAction:{FunctionArn:e.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:s}})}catch(a){if(a.message?.includes("already exists"))await this.ses.deleteReceiptRule(e.ruleSetName,e.ruleName),await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:s}});else throw a}await this.ses.setActiveReceiptRuleSet(e.ruleSetName)}async getIncomingEmails(e){return(await this.s3.list({bucket:e.bucket,prefix:e.prefix||"incoming/",maxKeys:e.maxResults||100})).map((s)=>({key:s.Key||"",lastModified:s.LastModified||"",size:s.Size||0}))}async readEmail(e){return await this.s3.getObject(e.bucket,e.key)}async createSmtpCredentials(e){let t=`ses-smtp-${e.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:s}=await import("./chunk-6kcmbymp.js"),a=new s,i=(g,A)=>{let h={Action:g,Version:"2010-05-08",...A};return Object.entries(h).map(([R,S])=>`${encodeURIComponent(R)}=${encodeURIComponent(S)}`).join("&")};try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateUser",{UserName:t})})}catch(g){if(!g.message?.includes("EntityAlreadyExists"))throw g}let c={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${e.domain}`}}}]},u=`ses-smtp-policy-${e.domain.replace(/\./g,"-")}`;try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("PutUserPolicy",{UserName:t,PolicyName:u,PolicyDocument:JSON.stringify(c)})})}catch{}let m=(await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateAccessKey",{UserName:t})}))?.CreateAccessKeyResult?.AccessKey;if(!m?.AccessKeyId||!m?.SecretAccessKey)throw Error("Failed to create access key");let P=this.deriveSmtpPassword(m.SecretAccessKey);return{username:m.AccessKeyId,password:P,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(e){let t=Fe("node:crypto"),s="SendRawEmail",a=Buffer.from([4]),i=t.createHmac("sha256",`AWS4${e}`).update("11111111").digest();return i=t.createHmac("sha256",i).update(this.region).digest(),i=t.createHmac("sha256",i).update("ses").digest(),i=t.createHmac("sha256",i).update("aws4_request").digest(),i=t.createHmac("sha256",i).update("SendRawEmail").digest(),Buffer.concat([a,i]).toString("base64")}async createTemplate(e){await this.ses.createEmailTemplate({TemplateName:e.name,TemplateContent:{Subject:e.subject,Text:e.text,Html:e.html}})}async getTemplate(e){try{let t=await this.ses.getEmailTemplate(e);return{name:t.TemplateName||e,subject:t.TemplateContent?.Subject,text:t.TemplateContent?.Text,html:t.TemplateContent?.Html}}catch{return null}}async deleteTemplate(e){await this.ses.deleteEmailTemplate(e)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((t)=>({name:t.TemplateName||"",createdAt:t.CreatedTimestamp}))||[]}async deploy(e){let t=`${e.appName}-${e.environment}-email-rules`,s=`${e.appName}-inbound-email`,a=e.storage?.bucketName||`${e.appName}-${e.environment}-email`,i=await this.setupDomain(e.domain);if(!(await this.s3.listBuckets()).Buckets?.some((m)=>m.Name===a))await this.s3.createBucket(a);await this.setupReceiving({domain:e.domain,ruleSetName:t,ruleName:s,bucketName:a,prefix:e.storage?.prefix||"inbox/",accountId:e.accountId,recipients:e.catchAll?[e.domain]:e.mailboxes,scanEnabled:!0});let d=await this.getDnsRecords(e.domain);return{success:!0,domainVerified:i.domainVerified,dkimStatus:i.dkimStatus,receiptRuleSet:t,storageBucket:a,dnsRecords:d}}async undeploy(e){let t=`${e.appName}-${e.environment}-email-rules`,s=`${e.appName}-inbound-email`,a=`${e.appName}-${e.environment}-email`;try{await this.ses.deleteReceiptRule(t,s)}catch{}try{await this.ses.deleteReceiptRuleSet(t)}catch{}if(e.deleteBucket)try{await this.s3.emptyAndDeleteBucket(a)}catch{}}async getSendingStats(){let e=await this.ses.getSendQuota();return{sentLast24Hours:e.SentLast24Hours||0,maxSendRate:e.MaxSendRate||0,max24HourSend:e.Max24HourSend||0}}buildRawEmail(e,t,s){let a=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,i="";if(i+=`From: ${t}\r
+`,i+=`To: ${s.join(", ")}\r
+`,e.cc){let c=Array.isArray(e.cc)?e.cc:[e.cc];i+=`Cc: ${c.join(", ")}\r
+`}if(i+=`Subject: ${e.subject}\r
+`,i+=`MIME-Version: 1.0\r
+`,i+=`Content-Type: multipart/mixed; boundary="${a}"\r
+`,i+=`\r
+`,e.text||e.html)if(i+=`--${a}\r
+`,e.html&&e.text){let c=`----=_Alt_${Date.now()}`;i+=`Content-Type: multipart/alternative; boundary="${c}"\r
+`,i+=`\r
+`,i+=`--${c}\r
+`,i+=`Content-Type: text/plain; charset="UTF-8"\r
+`,i+=`\r
+`,i+=`${e.text}\r
+`,i+=`--${c}\r
+`,i+=`Content-Type: text/html; charset="UTF-8"\r
+`,i+=`\r
+`,i+=`${e.html}\r
+`,i+=`--${c}--\r
+`}else if(e.html)i+=`Content-Type: text/html; charset="UTF-8"\r
+`,i+=`\r
+`,i+=`${e.html}\r
+`;else i+=`Content-Type: text/plain; charset="UTF-8"\r
+`,i+=`\r
+`,i+=`${e.text}\r
+`;if(e.attachments)for(let c of e.attachments)i+=`--${a}\r
+`,i+=`Content-Type: ${c.contentType||"application/octet-stream"}; name="${c.filename}"\r
+`,i+=`Content-Transfer-Encoding: base64\r
+`,i+=`Content-Disposition: attachment; filename="${c.filename}"\r
+`,i+=`\r
+`,i+=`${c.content}\r
+`;return i+=`--${a}--\r
+`,i}}var Dh=new Sn;
+export{fe,tt,Sn,Dh};