@stacksjs/ts-cloud 0.16.27 → 0.16.29

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-4a8qt6e8.js";import"./chunk-817q3s2p.js";import"./chunk-8k87zpnp.js";import{ir}from"./chunk-vsgq1d3s.js";import"./chunk-y5e7dmvc.js";import"./chunk-ypsgkj91.js";import"./chunk-kbwczaa8.js";import"./chunk-cgyqnbcm.js";import"./chunk-ffyhp5tk.js";import"./chunk-5810132y.js";import"./chunk-x6y663t7.js";import"./chunk-13htvxgc.js";import"./chunk-494fg5c6.js";import"./chunk-k545r9bk.js";import"./chunk-s5hq7v1h.js";import"./chunk-qfgvvwmb.js";import"./chunk-45v1azhc.js";import"./chunk-qx05kccj.js";import"./chunk-e3tjy3wg.js";import"./chunk-2857cbf1.js";import"./chunk-st7s9k78.js";import"./chunk-kfj4w903.js";import"./chunk-0hbrkdrc.js";import"./chunk-7412q5cz.js";import"./chunk-az5vvf5d.js";import"./chunk-kcprsn33.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await ir({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-kne9dmwr.js";import"./chunk-jeg6vw5v.js";import"./chunk-k8r5zfnf.js";import{ir}from"./chunk-k9d81ar0.js";import"./chunk-q9tvzcr7.js";import"./chunk-a9yp82q5.js";import"./chunk-7577ykbj.js";import"./chunk-remzfbhd.js";import"./chunk-9p7g25kx.js";import"./chunk-j2yy3tth.js";import"./chunk-jf8jp6f5.js";import"./chunk-bkzt5ntz.js";import"./chunk-2q64f0df.js";import"./chunk-1wtkv65w.js";import"./chunk-xtqx4v3f.js";import"./chunk-3ykx59eg.js";import"./chunk-yrq5bkxe.js";import"./chunk-1chq0c2k.js";import"./chunk-a1kpwbjg.js";import"./chunk-j8dkatkk.js";import"./chunk-e4p6hwct.js";import"./chunk-9nnfyqme.js";import"./chunk-6hrycgbh.js";import"./chunk-a3vraghd.js";import"./chunk-e6xn8g28.js";import"./chunk-y9cdqk8c.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await ir({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/{chunk-h85wqdvr.js → chunk-10asqy6j.js}

@@ -1,7 +1,7 @@
-var Ad={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{...Ad,...e.thresholds}}var _=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function Qr(e){if(!_.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Qr))]}function y(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function yd(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function Id(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(yd(e)))t.push(`${n} = ${s}`);return`${t.join(`
+var Id={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{...Id,...e.thresholds}}var _=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function Hr(e){if(!_.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Hr))]}function y(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function Sd(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function Cd(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(Sd(e)))t.push(`${n} = ${s}`);return`${t.join(`
 `)}
-`}function Sd(e={}){let t=h(e),n=y(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
-`)}function Ri(e={}){return`#!/usr/bin/env bash
+`}function Ed(e={}){let t=h(e),n=y(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
+`)}function Di(e={}){return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs L3/L4 flood mitigation.
 set -euo pipefail
 
@@ -13,11 +13,11 @@ fi
 
 install -d -m 0755 /etc/ts-cloud /etc/nftables.d
 cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
-${Id(e)}SYSCTL_EOF
+${Cd(e)}SYSCTL_EOF
 sysctl --system >/dev/null
 
 cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
-${Sd(e)}NFT_EOF
+${Ed(e)}NFT_EOF
 
 # Syntax-check before applying: a bad ruleset would leave the box unprotected.
 if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
@@ -40,5 +40,5 @@ include "/etc/nftables.d/ts-cloud-ddos.nft"
 fi
 systemctl enable nftables >/dev/null 2>&1 || true
 echo "ts-cloud: L3/L4 mitigation active"
-`}var b=["off","monitor","rate_limit","challenge","lockdown"];function ag(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function Hr(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
-export{Ad,Qr,yd,Id,Sd,Ri,ag,Hr};
+`}var b=["off","monitor","rate_limit","challenge","lockdown"];function dg(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function Gr(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
+export{Id,Hr,Sd,Cd,Ed,Di,dg,Gr};

package/dist/{chunk-twj83txn.js → chunk-26cq0zjv.js}

@@ -1,5 +1,5 @@
-import{Io,Kr,Gd,xi,To,wo}from"./chunk-w23wrsa4.js";import{Le}from"./chunk-ys5318bg.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as S,mkdtempSync as U,rmSync as L,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function I(t,e){return`${r[e]}${t}${r.reset}`}function fn(t){console.log(`${r.green}✓${r.reset} ${t}`)}function Cu(t){console.error(`${r.red}✗${r.reset} ${t}`)}function cs(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function k(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function w(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function ds(t){console.log(`
+import{So,Wr,Vd,Oi,wo,Ro}from"./chunk-2c8pcbq8.js";import{$e}from"./chunk-dm4vt53n.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as S,mkdtempSync as U,rmSync as L,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function I(t,e){return`${r[e]}${t}${r.reset}`}function An(t){console.log(`${r.green}✓${r.reset} ${t}`)}function bu(t){console.error(`${r.red}✗${r.reset} ${t}`)}function ds(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function k(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function w(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function ls(t){console.log(`
 ${r.bright}${r.cyan}${t}${r.reset}
-`)}var F=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function Eu(t,e="cyan"){let n=t.split(`
-`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(I(`┌${a}┐`,e)),n.forEach((l)=>{console.log(I(`│ ${l.padEnd(i)} │`,e))}),console.log(I(`└${a}┘`,e))}function R(t,e){for(let n of e){let i=s(t,n.name);S(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function Ua(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",P=l==="arm64"?"linux/arm64":"linux/amd64",E=e.kind==="php",c=t.onStep??(()=>{}),p=U(s(O(),"tscloud-img-"));try{let f=s(p,"app");S(f,{recursive:!0});let y,v;if(E){To({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=wo(n);R(f,o),R(s(p,"runtime"),xi().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let b=e.handlers?.http??"public/index.php";y={http:b,queue:e.handlers?.queue??b,cli:e.handlers?.cli??b},v=Io(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await Kr({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,v=o.sha256}let C=v.slice(0,16);d(s(p,"Dockerfile"),Gd({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let x=new Le(i),u;try{u=(await x.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await x.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${C}`;c("docker build"),A("docker",["build","--platform",P,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await x.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let T=h.proxyEndpoint.replace(/^https?:\/\//,""),B=s(p,".docker");return S(B,{recursive:!0}),d(s(B,"config.json"),JSON.stringify({auths:{[T]:{auth:h.authorizationToken}}})),A("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:B}}),k(`Image: ${m}`),{imageUri:m,tag:C,handlers:y}}finally{L(p,{recursive:!0,force:!0})}}
-export{fn,Cu,cs,k,w,ds,Eu,Ua};
+`)}var F=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function vu(t,e="cyan"){let n=t.split(`
+`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(I(`┌${a}┐`,e)),n.forEach((l)=>{console.log(I(`│ ${l.padEnd(i)} │`,e))}),console.log(I(`└${a}┘`,e))}function R(t,e){for(let n of e){let i=s(t,n.name);S(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function Qa(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",P=l==="arm64"?"linux/arm64":"linux/amd64",E=e.kind==="php",c=t.onStep??(()=>{}),p=U(s(O(),"tscloud-img-"));try{let f=s(p,"app");S(f,{recursive:!0});let y,v;if(E){wo({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=Ro(n);R(f,o),R(s(p,"runtime"),Oi().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let b=e.handlers?.http??"public/index.php";y={http:b,queue:e.handlers?.queue??b,cli:e.handlers?.cli??b},v=So(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await Wr({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,v=o.sha256}let C=v.slice(0,16);d(s(p,"Dockerfile"),Vd({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let x=new $e(i),u;try{u=(await x.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await x.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${C}`;c("docker build"),A("docker",["build","--platform",P,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await x.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let T=h.proxyEndpoint.replace(/^https?:\/\//,""),B=s(p,".docker");return S(B,{recursive:!0}),d(s(B,"config.json"),JSON.stringify({auths:{[T]:{auth:h.authorizationToken}}})),A("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:B}}),k(`Image: ${m}`),{imageUri:m,tag:C,handlers:y}}finally{L(p,{recursive:!0,force:!0})}}
+export{An,bu,ds,k,w,ls,vu,Qa};

package/dist/chunk-27hj07fb.js

@@ -0,0 +1,60 @@
+import{W,de,R,le,gr}from"./chunk-qjxdhb8x.js";import{o}from"./chunk-qrs912nk.js";import{Le,I}from"./chunk-3byba7sc.js";import{S}from"./chunk-ffxcn7mw.js";import{f}from"./chunk-yc2rm4v9.js";function Ma(t){let{bucketName:s,domain:c,aliases:e,certificateArn:g,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:m=!1,computeOriginDomain:w,computeOriginPort:O=3008,computeOriginId:F="app-compute",retainOnStackDelete:v=!1}=t,k=v?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},y=m&&!!w,B=y?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],E=y?["GET","HEAD"]:["GET","HEAD"],P={},x={};P.S3Bucket={Type:"AWS::S3::Bucket",...k,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},x.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},x.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},P.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...k,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let h;if(a&&y)h="InstallRootRedirectFunction",P[h]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+  var request = event.request;
+  if (request.uri === '/' || request.uri === '') {
+    return {
+      statusCode: 302,
+      statusDescription: 'Found',
+      headers: {
+        location: { value: 'https://' + request.headers.host.value + '/install.sh' }
+      }
+    };
+  }
+  return request;
+}`}};if(!a)P.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+  const request = event.request;
+  var uri = request.uri;
+
+  // If URI ends with /, serve index.html
+  if (uri.endsWith('/')) {
+    request.uri = uri + 'index.html';
+  }
+  // If URI doesn't have an extension, append .html
+  else if (!uri.includes('.')) {
+    request.uri = uri + '.html';
+  }
+
+  return request;
+}`}};let N={Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}},u=y?{Id:F,DomainName:w,CustomOriginConfig:{HTTPPort:O,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}:null,D=y?F:`S3-${s}`,p={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:u?[u,N]:[N],DefaultCacheBehavior:{TargetOriginId:D,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:B,CachedMethods:E,Compress:!0,...y?{CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",...a&&h?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[h,"FunctionARN"]}}]}:{}}:{CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...!a&&{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]}}},...y&&a?{CacheBehaviors:[{PathPattern:"/install.sh",TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"}]}:{},CustomErrorResponses:d?[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300}]:[{ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(c&&g)p.Aliases=e&&e.length>0?e:[c],p.ViewerCertificate={AcmCertificateArn:g,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else p.ViewerCertificate={CloudFrontDefaultCertificate:!0};return P.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",...k,DependsOn:["S3Bucket","CloudFrontOAC",...a&&y&&h?[h]:[],...!a?["UrlRewriteFunction"]:[]],Properties:{DistributionConfig:p}},x.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},x.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},P.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",...k,DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},x.SiteUrl={Description:"Site URL",Value:c?`https://${c}`:{"Fn::Sub":"https://${CloudFrontDistribution.DomainName}"}},{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${c||s} (External DNS)`,Resources:P,Outputs:x}}async function hn(t){let s=t.region||"us-east-1",c="us-east-1",e=t.domain,g=t.bucket||e.replace(/\./g,"-"),i=t.stackName||`${t.siteName}-static-site`,r=new f("us-east-1"),a=new le("us-east-1"),d=null;if(!t.skipDnsVerification){d=R(t.dnsProvider),console.log(`Verifying DNS provider can manage ${e}...`);let n=await d.listRecords(e);if(!n.success){let l=n.message||"unknown error — check API credentials and domain ownership";return{success:!1,stackName:i,bucket:g,message:`DNS provider '${d.name}' cannot manage domain ${e}: ${l}`}}console.log(`DNS provider '${d.name}' verified for ${e}`)}else console.log(`Skipping DNS verification for ${e}`);let m=t.certificateArn,F=e.split(".").length===2?`www.${e}`:void 0;if(!m){console.log(`Checking for existing SSL certificate for ${e}...`);let n=await a.findCertificateByDomain(e),l=!1;if(n&&n.Status==="ISSUED"){if(F&&n.SubjectAlternativeNames)l=n.SubjectAlternativeNames.includes(F)||n.SubjectAlternativeNames.some((C)=>C===`*.${e}`);else l=!0;if(l)m=n.CertificateArn,console.log(`Found existing certificate with www coverage: ${m}`);else console.log(`Existing certificate doesn't cover ${F}, requesting new one...`)}if(!m){if(!d)return{success:!1,stackName:i,bucket:g,message:`No DNS provider available to validate SSL certificate for ${e}. Provide a certificateArn or enable DNS verification.`};console.log(`Requesting new SSL certificate for ${e}${F?` (including ${F})`:""}...`);let A=await new de(d,"us-east-1").findOrCreateCertificate({domainName:e,subjectAlternativeNames:F?[F]:void 0,waitForValidation:!0,maxWaitMinutes:10});if(A.status!=="issued")return{success:!1,stackName:i,bucket:g,message:`SSL certificate validation failed. Status: ${A.status}`};m=A.certificateArn,console.log(`Certificate issued: ${m}`)}}let v=!1,k;try{let n=await r.describeStacks({stackName:i});if(n.Stacks.length>0){let l=n.Stacks[0],C=l.StackStatus;if(C==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),v=!1;else if(C==="DELETE_COMPLETE")v=!1;else v=!0,k=(l.Outputs||[]).find((b)=>b.OutputKey==="BucketName")?.OutputValue}}catch(n){if(n.message?.includes("does not exist")||n.code==="ValidationError")v=!1;else throw n}let y=k||g;if(!v){let n=new o(s),l=new I,C=!1;if(e)try{console.log(`Checking for existing CloudFront distributions with alias ${e}...`);let A=await l.listDistributions();for(let b of A)if((b.Aliases?.Items??[]).includes(e)){C=!0,console.log(`Found existing CloudFront distribution ${b.Id} with alias ${e}`),console.log("Reusing existing infrastructure for updates...");let V=await l.getDistributionConfig(b.Id),U=Le(V.DistributionConfig);if(U)return console.log(`Using existing S3 bucket: ${U}`),{success:!0,stackName:`existing-${b.Id}`,bucket:U,distributionId:b.Id,distributionDomain:b.DomainName,domain:e,certificateArn:m,message:"Using existing CloudFront distribution",_existingInfrastructure:!0}}}catch{}if(!C)try{if((await n.headBucket(g)).exists){console.log(`Found orphaned S3 bucket ${g}, cleaning up...`);try{let b=n.emptyBucket(g).then(()=>n.deleteBucket(g)),T=new Promise((V,U)=>setTimeout(()=>U(Error("Bucket cleanup timeout")),30000));await Promise.race([b,T]),console.log(`Deleted orphaned S3 bucket ${g}`)}catch(b){console.log(`Note: Could not clean up S3 bucket: ${b.message}`);let T=Date.now().toString(36);y=`${g}-${T}`,console.log(`Using alternative bucket name: ${y}`)}}}catch{}}let E=Ma({bucketName:y,domain:e,aliases:F?[e,F]:[e],certificateArn:m,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,passthroughUrls:t.passthroughUrls,singlePageApp:t.singlePageApp,dynamicApp:t.dynamicApp,computeOriginDomain:t.computeOriginDomain,computeOriginPort:t.computeOriginPort,computeOriginId:t.computeOriginId}),P=Object.entries(t.tags||{}).map(([n,l])=>({Key:n,Value:l}));if(P.push({Key:"ManagedBy",Value:"ts-cloud"}),P.push({Key:"Application",Value:t.siteName}),d)P.push({Key:"DnsProvider",Value:d.name});let x,h=!1;if(v){h=!0,console.log(`Updating CloudFormation stack: ${i}`);try{x=(await r.updateStack({stackName:i,templateBody:JSON.stringify(E),capabilities:["CAPABILITY_IAM"],tags:P})).StackId,console.log(`Update initiated, stack ID: ${x}`)}catch(n){if(n.message?.includes("No updates are to be performed")){let l=await r.describeStacks({stackName:i});x=l.Stacks[0].StackId;let C=l.Stacks[0]?.Outputs||[],A=(T)=>C.find((V)=>V.OutputKey===T)?.OutputValue,b=A("DistributionDomain");if(b)await M(d,e,b);return{success:!0,stackId:x,stackName:i,bucket:A("BucketName")||y,distributionId:A("DistributionId"),distributionDomain:b,domain:e,certificateArn:m,message:"Static site infrastructure is already up to date"}}else throw n}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${y}`),console.log(`Domain: ${e}`),console.log(`Certificate ARN: ${m}`),x=(await r.createStack({stackName:i,templateBody:JSON.stringify(E),capabilities:["CAPABILITY_IAM"],tags:P,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${x}`);console.log(`Waiting for stack to reach ${h?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,h?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(n){if(n.message?.includes("must be verified")||n.message?.includes("Access denied for operation")){console.log("CloudFront account verification required - checking for existing infrastructure...");try{let C=new I,A=await C.listDistributions();for(let b of A)if((b.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${b.Id} with alias ${e}`),console.log("Using existing infrastructure despite account verification requirement...");let V=await C.getDistributionConfig(b.Id),U=Le(V.DistributionConfig);if(U){console.log(`Using existing S3 bucket: ${U}`);let j=b.DomainName;if(j)await M(d,e,j);return{success:!0,stackName:`existing-${b.Id}`,bucket:U,distributionId:b.Id,distributionDomain:b.DomainName,domain:e,certificateArn:m,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}catch{}return console.log(`
+┌─────────────────────────────────────────────────────────────────────────────┐
+│  AWS ACCOUNT VERIFICATION REQUIRED                                          │
+├─────────────────────────────────────────────────────────────────────────────┤
+│  Your AWS account must be verified before you can create CloudFront         │
+│  distributions. This is a one-time requirement for new AWS accounts.        │
+│                                                                             │
+│  To verify your account:                                                    │
+│                                                                             │
+│  1. Go to: https://console.aws.amazon.com/support/home#/                   │
+│  2. Click "Create case"                                                     │
+│  3. Select "Service limit increase"                                         │
+│  4. For Service: Select "CloudFront"                                        │
+│  5. For Request: "Please verify my account for CloudFront access"           │
+│  6. Submit the case                                                         │
+│                                                                             │
+│  Verification typically takes 1-2 business days.                            │
+│  After verification, re-run: bunx bunpress deploy                           │
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:x,stackName:i,bucket:y,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:x,stackName:i,bucket:y,message:`Stack deployment failed: ${n.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],D=(n)=>u.find((l)=>l.OutputKey===n)?.OutputValue,p=D("DistributionDomain");if(p&&d)console.log(`Creating DNS records via ${d.name}...`),await M(d,e,p);else if(p&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:x,stackName:i,bucket:D("BucketName")||y,distributionId:D("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function M(t,s,c){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof W){console.log(`Creating Route53 alias record for apex domain ${s} -> ${c}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:c});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created Route53 alias record: ${s} -> ${c}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${c}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:c});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${c}`);else console.log(`Created Route53 alias record: ${r} -> ${c}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let m of d.records){let w=m.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:m.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${c}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:c,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created ALIAS record: ${s} -> ${c}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${c}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:c,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${c}`);else console.log(`Created CNAME record: ${r} -> ${c}`)}else{console.log(`Creating CNAME record for ${s} -> ${c}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:c,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created CNAME record: ${s} -> ${c}`)}}async function fn(t){let{sourceDir:s,cleanBucket:c=!1,onProgress:e,...g}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await hn(g);if(!i.success)return i;if(c){e?.("clean","Cleaning old files from S3...");try{await new o(g.region||"us-east-1").emptyBucket(i.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-y37887r3.js"),a=await r({sourceDir:s,bucket:i.bucket,region:g.region||"us-east-1",cacheControl:g.cacheControl,onProgress:(m,w,O)=>{e?.("upload",`${m}/${w}: ${O}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-y37887r3.js");await m(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function ss(t){let{bucketName:s,domain:c,certificateArn:e,hostedZoneId:g,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+  const request = event.request;
+  var uri = request.uri;
+
+  // If URI ends with /, serve index.html
+  if (uri.endsWith('/')) {
+    request.uri = uri + 'index.html';
+  }
+  // If URI doesn't have an extension, append .html
+  else if (!uri.includes('.')) {
+    request.uri = uri + '.html';
+  }
+
+  return request;
+}`}};let m={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(c&&e)m.Aliases=[c],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(a.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},d.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},d.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},a.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},c&&g)a.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:g,Name:c,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},a.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:g,Name:c,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},d.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${c||s}`,Resources:a,Outputs:d}}async function os(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let u=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!u)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return hn({siteName:t.siteName,region:t.region,domain:u,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let s=t.region||"us-east-1",c="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let g=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),i=t.stackName||`${t.siteName}-static-site`,r=new f(c),a=new S,d=new le("us-east-1"),m=new gr("us-east-1"),{hostedZoneId:w,certificateArn:O}=t;if(e&&!w){let u=await a.findHostedZoneForDomain(e);if(u)w=u.Id.replace("/hostedzone/","");else return{success:!1,stackName:i,bucket:g,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!O&&w){let u=await d.findCertificateByDomain(e);if(u&&u.Status==="ISSUED")O=u.CertificateArn;else O=(await m.requestAndValidate({domainName:e,hostedZoneId:w,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let F=!1,v;try{let u=await r.describeStacks({stackName:i});if(u.Stacks.length>0){let D=u.Stacks[0],p=D.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),F=!1;else if(p==="DELETE_COMPLETE")F=!1;else F=!0,v=(D.Outputs||[]).find((l)=>l.OutputKey==="BucketName")?.OutputValue}}catch(u){if(u.message?.includes("does not exist")||u.code==="ValidationError")F=!1;else throw u}let k=v||g;if(!F){let u=new o(s),D=new I,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let n=await D.listDistributions();for(let l of n)if((l.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${l.Id} for ${e}`);let A=await D.getDistributionConfig(l.Id),b=Le(A.DistributionConfig);if(b){let T=e.replace(/\./g,"-");if(!b.startsWith(T)&&!b.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${b}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${b}`),w&&l.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:S.CloudFrontHostedZoneId,TargetDNSName:l.DomainName,EvaluateTargetHealth:!1}),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:S.CloudFrontHostedZoneId,TargetDNSName:l.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(V){console.log(`Note: Could not update Route53 records: ${V.message}`)}return{success:!0,stackName:`existing-${l.Id}`,bucket:b,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:O,message:"Using existing CloudFront distribution"}}}}catch{}if(w)try{let l=(await a.listResourceRecordSets({HostedZoneId:w})).ResourceRecordSets||[];for(let C of l)if(C.Name===`${e}.`&&(C.Type==="A"||C.Type==="AAAA")){if(C.AliasTarget){console.log(`Found orphaned Route53 ${C.Type} record for ${e}, cleaning up...`);try{await a.deleteRecord({HostedZoneId:w,RecordSet:C}),console.log(`Deleted orphaned Route53 ${C.Type} record for ${e}`)}catch(A){console.log(`Note: Could not delete Route53 record: ${A.message}`)}}}}catch{}}if(!p)try{if((await u.headBucket(g)).exists){console.log(`Found orphaned S3 bucket ${g}, cleaning up...`);try{let l=u.emptyBucket(g).then(()=>u.deleteBucket(g)),C=new Promise((A,b)=>setTimeout(()=>b(Error("Bucket cleanup timeout")),30000));await Promise.race([l,C]),console.log(`Deleted orphaned S3 bucket ${g}`)}catch(l){console.log(`Note: Could not clean up S3 bucket: ${l.message}`);let C=Date.now().toString(36);k=`${g}-${C}`,console.log(`Using alternative bucket name: ${k}`)}}}catch{}}let y=ss({bucketName:k,domain:e,certificateArn:O,hostedZoneId:w,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),B=Object.entries(t.tags||{}).map(([u,D])=>({Key:u,Value:D}));B.push({Key:"ManagedBy",Value:"ts-cloud"}),B.push({Key:"Application",Value:t.siteName});let E,P=!1;if(F){P=!0,console.log(`Updating CloudFormation stack: ${i}`),console.log(`Using existing bucket: ${k}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${O||"not specified"}`);try{E=(await r.updateStack({stackName:i,templateBody:JSON.stringify(y),capabilities:["CAPABILITY_IAM"],tags:B})).StackId,console.log(`Update initiated, stack ID: ${E}`)}catch(u){if(u.message?.includes("No updates are to be performed")){let D=await r.describeStacks({stackName:i});E=D.Stacks[0].StackId;let p=D.Stacks[0]?.Outputs||[],n=(l)=>p.find((C)=>C.OutputKey===l)?.OutputValue;return{success:!0,stackId:E,stackName:i,bucket:n("BucketName")||k,distributionId:n("DistributionId"),distributionDomain:n("DistributionDomain"),domain:e,certificateArn:O,message:"Static site infrastructure is already up to date"}}else throw u}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${k}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${O||"not specified"}`),console.log("Stack does not exist, creating..."),E=(await r.createStack({stackName:i,templateBody:JSON.stringify(y),capabilities:["CAPABILITY_IAM"],tags:B,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${E}`);console.log(`Waiting for stack to reach ${P?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,P?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(u){if(u.message?.includes("must be verified")||u.message?.includes("Access denied for operation")||u.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let D=new I;if(e)try{let p=await D.listDistributions();for(let n of p)if((n.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${n.Id} with alias ${e}`);let C=await D.getDistributionConfig(n.Id),A=Le(C.DistributionConfig);if(A)return console.log(`Using existing S3 bucket: ${A}`),{success:!0,stackName:`existing-${n.Id}`,bucket:A,distributionId:n.Id,distributionDomain:n.DomainName,domain:e,certificateArn:O,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new o(s);if((await p.headBucket(k)).exists)console.log(`Using existing S3 bucket: ${k}`);else console.log(`Creating S3 bucket: ${k}...`),await p.createBucket(k);await p.putBucketWebsite(k,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(k,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${k} configured`);let l=`OAC-${k}`;console.log(`Creating Origin Access Control: ${l}...`);let C=await D.findOrCreateOriginAccessControl(l);console.log(`Origin Access Control ${C.Id} ready`),console.log("Creating CloudFront distribution...");let A=await D.createDistributionForS3({bucketName:k,bucketRegion:s,originAccessControlId:C.Id,aliases:e?[e]:[],certificateArn:O,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||k}`});console.log(`CloudFront distribution ${A.Id} created`),console.log("Updating S3 bucket policy...");let b=I.getS3BucketPolicyForCloudFront(k,A.ARN);if(await p.putBucketPolicy(k,b),console.log("S3 bucket policy updated"),e&&w){console.log(`Creating Route53 records for ${e}...`);try{await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:S.CloudFrontHostedZoneId,TargetDNSName:A.DomainName,EvaluateTargetHealth:!1}),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:S.CloudFrontHostedZoneId,TargetDNSName:A.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(T){console.log(`Note: Could not create Route53 records: ${T.message}`)}}return{success:!0,stackName:`direct-${A.Id}`,bucket:k,distributionId:A.Id,distributionDomain:A.DomainName,domain:e,certificateArn:O,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:E,stackName:i,bucket:k,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:E,stackName:i,bucket:k,message:`Stack deployment failed: ${u.message}`}}let h=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],N=(u)=>h.find((D)=>D.OutputKey===u)?.OutputValue;return{success:!0,stackId:E,stackName:i,bucket:N("BucketName")||k,distributionId:N("DistributionId"),distributionDomain:N("DistributionDomain"),domain:e,certificateArn:O,message:"Static site infrastructure deployed successfully"}}async function as(t){let{sourceDir:s,bucket:c,region:e,cacheControl:g="max-age=31536000, public",onProgress:i}=t,r=new o(e),{readdir:a}=await import("node:fs/promises"),{join:d,relative:m}=await import("node:path"),{createHash:w}=await import("node:crypto");async function O(h){let N=[],u=await a(h,{withFileTypes:!0});for(let D of u){let p=d(h,D.name);if(D.isDirectory())N.push(...await O(p));else N.push(p)}return N}function F(h){let N=h.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[N||""]||"application/octet-stream"}function v(h){return w("md5").update(h).digest("hex")}async function k(){let h=new Map,N;do{let u=await r.listObjects({bucket:c,maxKeys:1000,continuationToken:N});for(let D of u.objects){let p=D.ETag?.replace(/"/g,"")||"";h.set(D.Key,p)}N=u.nextContinuationToken}while(N);return h}let y=await O(s),B=[],E=0,P=0,x=await k();for(let h of y){let N=m(s,h),u=F(h),D=h.endsWith(".html")?"max-age=3600, public":g;try{let p=Buffer.from(await Bun.file(h).arrayBuffer()),n=v(p),l=x.get(N);if(l&&l===n){P++,i?.(E+P,y.length,N);continue}await r.putObject({bucket:c,key:N,body:p,contentType:u,cacheControl:D}),E++,i?.(E+P,y.length,N)}catch(p){B.push(`Failed to upload ${N}: ${p.message}`)}}return{uploaded:E,skipped:P,errors:B}}async function cs(t){return{invalidationId:(await new I().invalidateAll(t)).Id}}async function Fa(t,s="us-east-1"){let c=new f(s);try{let r=((await c.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((a)=>a.OutputKey==="BucketName")?.OutputValue;if(r)await new o(s).emptyBucket(r)}catch{}await c.deleteStack(t);let e=await c.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function Ua(t){let{sourceDir:s,cleanBucket:c=!1,onProgress:e,...g}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await os(g);if(!i.success)return i;if(c){e?.("clean","Cleaning old files from S3...");try{await new o(g.region||"us-east-1").emptyBucket(i.bucket)}catch(d){console.log(`Note: Could not clean bucket: ${d.message}`)}}e?.("upload","Uploading files to S3...");let r=await as({sourceDir:s,bucket:i.bucket,region:g.region||"us-east-1",cacheControl:g.cacheControl,onProgress:(d,m,w)=>{e?.("upload",`${d}/${m}: ${w}`)}});if(r.errors.length>0)return{...i,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(i.distributionId&&r.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await cs(i.distributionId);e?.("complete","Deployment complete!");let a=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged)`:`Deployed ${r.uploaded} files successfully`;return{...i,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:a}}
+export{Ma,hn,fn,ss,os,as,cs,Fa,Ua};