@stacksjs/ts-cloud 0.16.28 → 0.16.30

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-4a8qt6e8.js";import"./chunk-817q3s2p.js";import"./chunk-8k87zpnp.js";import{ir}from"./chunk-8npkajnt.js";import"./chunk-y5e7dmvc.js";import"./chunk-ypsgkj91.js";import"./chunk-kbwczaa8.js";import"./chunk-cgyqnbcm.js";import"./chunk-ffyhp5tk.js";import"./chunk-5810132y.js";import"./chunk-1g8gk1cb.js";import"./chunk-13htvxgc.js";import"./chunk-494fg5c6.js";import"./chunk-k545r9bk.js";import"./chunk-s5hq7v1h.js";import"./chunk-qfgvvwmb.js";import"./chunk-45v1azhc.js";import"./chunk-qx05kccj.js";import"./chunk-e3tjy3wg.js";import"./chunk-2857cbf1.js";import"./chunk-st7s9k78.js";import"./chunk-c0dh5ccy.js";import"./chunk-0hbrkdrc.js";import"./chunk-7412q5cz.js";import"./chunk-az5vvf5d.js";import"./chunk-kcprsn33.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await ir({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-kne9dmwr.js";import"./chunk-jeg6vw5v.js";import"./chunk-k8r5zfnf.js";import{ir}from"./chunk-g00a221j.js";import"./chunk-q9tvzcr7.js";import"./chunk-a9yp82q5.js";import"./chunk-7577ykbj.js";import"./chunk-remzfbhd.js";import"./chunk-9p7g25kx.js";import"./chunk-j2yy3tth.js";import"./chunk-jf8jp6f5.js";import"./chunk-bkzt5ntz.js";import"./chunk-bvtpvstn.js";import"./chunk-1wtkv65w.js";import"./chunk-xtqx4v3f.js";import"./chunk-3ykx59eg.js";import"./chunk-yrq5bkxe.js";import"./chunk-1chq0c2k.js";import"./chunk-a1kpwbjg.js";import"./chunk-j8dkatkk.js";import"./chunk-e4p6hwct.js";import"./chunk-9nnfyqme.js";import"./chunk-6hrycgbh.js";import"./chunk-a3vraghd.js";import"./chunk-e6xn8g28.js";import"./chunk-y9cdqk8c.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await ir({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/{chunk-h85wqdvr.js → chunk-10asqy6j.js}

@@ -1,7 +1,7 @@
-var Ad={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{...Ad,...e.thresholds}}var _=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function Qr(e){if(!_.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Qr))]}function y(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function yd(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function Id(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(yd(e)))t.push(`${n} = ${s}`);return`${t.join(`
+var Id={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{...Id,...e.thresholds}}var _=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function Hr(e){if(!_.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Hr))]}function y(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function Sd(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function Cd(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(Sd(e)))t.push(`${n} = ${s}`);return`${t.join(`
 `)}
-`}function Sd(e={}){let t=h(e),n=y(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
-`)}function Ri(e={}){return`#!/usr/bin/env bash
+`}function Ed(e={}){let t=h(e),n=y(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
+`)}function Di(e={}){return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs L3/L4 flood mitigation.
 set -euo pipefail
 
@@ -13,11 +13,11 @@ fi
 
 install -d -m 0755 /etc/ts-cloud /etc/nftables.d
 cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
-${Id(e)}SYSCTL_EOF
+${Cd(e)}SYSCTL_EOF
 sysctl --system >/dev/null
 
 cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
-${Sd(e)}NFT_EOF
+${Ed(e)}NFT_EOF
 
 # Syntax-check before applying: a bad ruleset would leave the box unprotected.
 if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
@@ -40,5 +40,5 @@ include "/etc/nftables.d/ts-cloud-ddos.nft"
 fi
 systemctl enable nftables >/dev/null 2>&1 || true
 echo "ts-cloud: L3/L4 mitigation active"
-`}var b=["off","monitor","rate_limit","challenge","lockdown"];function ag(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function Hr(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
-export{Ad,Qr,yd,Id,Sd,Ri,ag,Hr};
+`}var b=["off","monitor","rate_limit","challenge","lockdown"];function dg(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function Gr(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
+export{Id,Hr,Sd,Cd,Ed,Di,dg,Gr};

package/dist/chunk-1erk1r1m.js

@@ -0,0 +1,131 @@
+import{n}from"./chunk-m93g67j0.js";import{A}from"./chunk-mqm1hxaw.js";function T(e){let i=Array.isArray(e?.Items)?e.Items:A(e?.Items?.CNAME);return{Quantity:i.length,Items:i.map(String)}}function Za(e){return A(e?.Origins?.Items?.Origin)}function Le(e){for(let i of Za(e)){let t=String(i.DomainName??"").match(/^(.+?)\.s3[.-]/)?.[1];if(t)return t}return}class I{client;constructor(e,i){this.client=i??new n(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let r=t[i]??t.Item;if(r===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(r)?r:[r]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([r,s])=>!/^[A-Za-z0-9-]{1,64}$/.test(r)||!s||s.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||r.ETag||"",o=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!o||o.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(o.Origins,"Origin"),c=this.collectionItems(o.CacheBehaviors,"CacheBehavior"),u=a.find((f)=>String(f.Id)===t.id),d=c.find((f)=>String(f.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${u.DomainName}; pass replaceExisting only after reviewing the live config`);if(d&&String(d.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${d.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let g={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([f,P])=>({HeaderName:f,HeaderValue:P}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},y=u?a.map((f)=>String(f.Id)===t.id?g:f):[...a,g],m=d?c.map((f)=>String(f.PathPattern)===t.pathPattern?l:f):[...c,l],b=JSON.stringify(a)!==JSON.stringify(y)||JSON.stringify(c)!==JSON.stringify(m);if(!b||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:b,applied:!1,etag:s};o.Origins={Quantity:y.length,Items:{Origin:y}},o.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let p=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(o),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:p.headers?.etag||p.headers?.ETag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||r.ETag||"",o=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!o||o.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(o.Origins,"Origin"),c=this.collectionItems(o.CacheBehaviors,"CacheBehavior"),u=a.find((m)=>String(m.Id)===t.id),d=c.find((m)=>String(m.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(d&&String(d.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!d)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:s};let g=c.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(o.DefaultCacheBehavior?.TargetOriginId)===t.id||g.some((m)=>String(m.TargetOriginId)===t.id),l=h?a:a.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!u,etag:s};o.Origins={Quantity:l.length,Items:{Origin:l}},o.CacheBehaviors={Quantity:g.length,...g.length?{Items:{CacheBehavior:g}}:{}};let y=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(o),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!u,etag:y.headers?.etag||y.headers?.ETag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
+<InvalidationBatch>
+  <Paths>
+    <Quantity>${e.paths.length}</Quantity>
+    <Items>
+      ${e.paths.map((s)=>`<Path>${s}</Path>`).join(`
+      `)}
+    </Items>
+  </Paths>
+  <CallerReference>${i}</CallerReference>
+</InvalidationBatch>`,r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${e.distributionId}/invalidation`,body:t,headers:{"Content-Type":"application/xml"}});return{Id:r.Id||r.Invalidation?.Id,Status:r.Status||r.Invalidation?.Status||"InProgress",CreateTime:r.CreateTime||r.Invalidation?.CreateTime||new Date().toISOString()}}async getInvalidation(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation/${i}`});return{Id:t.Id||t.Invalidation?.Id,Status:t.Status||t.Invalidation?.Status,CreateTime:t.CreateTime||t.Invalidation?.CreateTime}}async listInvalidations(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation`}),t=[];if(i.InvalidationSummary){let r=Array.isArray(i.InvalidationSummary)?i.InvalidationSummary:[i.InvalidationSummary];t.push(...r.map((s)=>({Id:s.Id,Status:s.Status,CreateTime:s.CreateTime})))}return t}async waitForInvalidation(e,i){let r=0;while(r<60){if((await this.getInvalidation(e,i)).Status==="Completed")return;await new Promise((o)=>setTimeout(o,5000)),r++}throw Error(`Timeout waiting for invalidation ${i} to complete`)}async listDistributions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/distribution"}),i=[],r=(e.DistributionList||e).Items,s=[];if(Array.isArray(r))s=r;else if(r?.DistributionSummary)s=Array.isArray(r.DistributionSummary)?r.DistributionSummary:[r.DistributionSummary];return i.push(...s.map((o)=>({Id:o.Id,ARN:o.ARN,Status:o.Status,DomainName:o.DomainName,Aliases:o.Aliases?T(o.Aliases):void 0,Enabled:o.Enabled==="true"||o.Enabled===!0}))),i}async getDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`}),t=i.Distribution||i;return{Id:t.Id,ARN:t.ARN,Status:t.Status,DomainName:t.DomainName,Aliases:T(t.DistributionConfig?.Aliases??t.Aliases),Enabled:t.DistributionConfig?.Enabled==="true"||t.DistributionConfig?.Enabled===!0}}async getDistributionConfig(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t={...i.body?.DistributionConfig??i.body??{}};return delete t["@_xmlns"],{ETag:i.headers?.etag||i.headers?.ETag||"",DistributionConfig:t}}async invalidateAll(e){return this.createInvalidation({distributionId:e,paths:["/*"]})}async invalidatePaths(e,i){let t=i.map((r)=>r.startsWith("/")?r:`/${r}`);return this.createInvalidation({distributionId:e,paths:t})}async invalidatePattern(e,i){let t=i.startsWith("/")?i:`/${i}`;return this.createInvalidation({distributionId:e,paths:[t]})}async invalidateAfterDeployment(e){let{distributionId:i,changedPaths:t,invalidateAll:r=!1,wait:s=!1}=e,o;if(r||!t||t.length===0)o=await this.invalidateAll(i);else o=await this.invalidatePaths(i,t);if(s)await this.waitForInvalidation(i,o.Id);return{invalidationId:o.Id,status:o.Status}}async findDistributionByDomain(e){return(await this.listDistributions()).find((r)=>{if(r.DomainName===e)return!0;if(r.Aliases?.Items&&r.Aliases.Items.includes(e))return!0;return!1})||null}async batchInvalidate(e,i=["/*"]){return await Promise.all(e.map(async(r)=>{let s=await this.createInvalidation({distributionId:r,paths:i});return{distributionId:r,invalidationId:s.Id,status:s.Status}}))}async updateCustomErrorResponses(e){let{distributionId:i,customErrorResponses:t}=e,r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||"",o=r.body?.DistributionConfig||(r.body?.Enabled!==void 0?r.body:void 0)||r.DistributionConfig;if(!o||o.Enabled===void 0)throw Error("Failed to get current distribution config");if(t.length===0)o.CustomErrorResponses={Quantity:0};else o.CustomErrorResponses={Quantity:t.length,Items:{CustomErrorResponse:t.map((d)=>({ErrorCode:d.errorCode,...d.responsePagePath&&{ResponsePagePath:d.responsePagePath},...d.responseCode&&{ResponseCode:d.responseCode},...d.errorCachingMinTTL!==void 0&&{ErrorCachingMinTTL:d.errorCachingMinTTL}}))}};let a=this.buildDistributionConfigXml(o),c=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:a,headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0}),u=c.body?.Distribution??c.body??{};return{Distribution:{Id:u.Id,ARN:u.ARN,Status:u.Status,DomainName:u.DomainName,Aliases:T(u.DistributionConfig?.Aliases),Enabled:u.DistributionConfig?.Enabled==="true"||u.DistributionConfig?.Enabled===!0},ETag:c.headers?.etag||c.headers?.ETag||""}}async removeCustomErrorResponses(e){return this.updateCustomErrorResponses({distributionId:e,customErrorResponses:[]})}async updateDistribution(e){let{distributionId:i,aliases:t,certificateArn:r,comment:s}=e,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),a=o.headers?.etag||o.headers?.ETag||"",c=o.body?.DistributionConfig||(o.body?.Enabled!==void 0?o.body:void 0)||o.DistributionConfig;if(!c||c.Enabled===void 0)throw Error("Failed to get current distribution config");if(t&&t.length>0)c.Aliases={Quantity:t.length,Items:{CNAME:t}};if(r)c.ViewerCertificate={ACMCertificateArn:r,SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021",CertificateSource:"acm"};if(s)c.Comment=s;let u=this.buildDistributionConfigXml(c),d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:u,headers:{"Content-Type":"application/xml","If-Match":a},returnHeaders:!0}),g=d.body?.Distribution??d.body??{};return{Distribution:{Id:g.Id,ARN:g.ARN,Status:g.Status,DomainName:g.DomainName,Aliases:t?{Quantity:t.length,Items:t}:{Quantity:0,Items:[]},Enabled:g.DistributionConfig?.Enabled==="true"||g.DistributionConfig?.Enabled===!0},ETag:d.headers?.etag||d.headers?.ETag||""}}buildDistributionConfigXml(e){let i=(a)=>a.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;"),t={Aliases:"CNAME",Origins:"Origin",OriginGroups:"OriginGroup",Members:"OriginGroupMember",StatusCodes:"StatusCode",CustomHeaders:"OriginCustomHeader",OriginSslProtocols:"SslProtocol",CacheBehaviors:"CacheBehavior",CustomErrorResponses:"CustomErrorResponse",AllowedMethods:"Method",CachedMethods:"Method",FunctionAssociations:"FunctionAssociation",LambdaFunctionAssociations:"LambdaFunctionAssociation",Headers:"Name",WhitelistedNames:"Name",QueryStringCacheKeys:"Name",TrustedSigners:"AwsAccountNumber",TrustedKeyGroups:"KeyGroup",GeoRestriction:"Location"},r=new Set(["TrustedSigners","TrustedKeyGroups","GeoRestriction"]),s=(a,c)=>Error(`Cannot build CloudFront XML for ${a}: ${c}`),o=(a,c,u="",d="")=>{if(c===null||c===void 0)return"";if(a.startsWith("@_")||a==="?xml")return"";if(typeof c==="boolean"||typeof c==="number"||typeof c==="string")return`${u}<${a}>${i(String(c))}</${a}>
+`;if(Array.isArray(c)){if(a==="Items"){let g=t[d];if(!g)throw s(`${d}.Items`,"no known entry name for this list");return o("Items",{[g]:c},u,d)}if(t[a]&&!r.has(a))return o(a,{Quantity:c.length,...c.length?{Items:c}:{}},u,d);throw s(`${d}.${a}`,t[a]?"pass the list as an object, it needs fields an array cannot carry":"an array is not a CloudFront list here")}if(typeof c==="object"){let g=Object.keys(c).filter((l)=>!l.startsWith("@_"));if(a==="Items"&&g.length===1){let[l]=g,y=(Array.isArray(c[l])?c[l]:[c[l]]).map((m)=>o(l,m,`${u}  `,a)).join("");return`${u}<Items>
+${y}${u}</Items>
+`}let h=g.map((l)=>o(l,c[l],`${u}  `,a)).join("");return h?`${u}<${a}>
+${h}${u}</${a}>
+`:`${u}<${a}/>
+`}return""};return`<?xml version="1.0" encoding="UTF-8"?>
+<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+${Object.entries(e).filter(([a])=>!a.startsWith("@_")).map(([a,c])=>o(a,c,"  ","DistributionConfig")).join("")}</DistributionConfig>`}async ensureDynamicHttpMethods(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",r=i.body?.DistributionConfig||i.DistributionConfig||i.body;if(!r)throw Error("Failed to get current distribution config");let s=!1,o=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],a=(d)=>{if(!d)return[];let g=d.Items;if(!g)return[];if(Array.isArray(g))return g.map(String);if(typeof g==="object"&&g.Method){let h=g.Method;return Array.isArray(h)?h.map(String):[String(h)]}if(g.Item)return Array.isArray(g.Item)?g.Item.map(String):[String(g.Item)];return[]},c=r.DefaultCacheBehavior;if(c){if(!a(c.AllowedMethods).includes("POST"))c.AllowedMethods={Quantity:o.length,Items:{Method:o},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},s=!0}if(!s)return!1;let u=this.buildDistributionConfigXml(r);return await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:u,headers:{"Content-Type":"application/xml","If-Match":t}}),!0}async addAliases(e,i,t){return this.updateDistribution({distributionId:e,aliases:i,certificateArn:t})}async createFunction(e){let{name:i,code:t,comment:r="",runtime:s="cloudfront-js-2.0"}=e,o=`<?xml version="1.0" encoding="UTF-8"?>
+<CreateFunctionRequest xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <Name>${i}</Name>
+  <FunctionConfig>
+    <Comment>${r}</Comment>
+    <Runtime>${s}</Runtime>
+  </FunctionConfig>
+  <FunctionCode>${Buffer.from(t).toString("base64")}</FunctionCode>
+</CreateFunctionRequest>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/function",body:o,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),c=a.body?.FunctionSummary??a.body??{};return{FunctionARN:c.FunctionMetadata?.FunctionARN||c.FunctionARN,Name:c.Name||i,Stage:c.FunctionMetadata?.Stage||"DEVELOPMENT",ETag:a.headers?.etag||a.headers?.ETag||""}}async listFunctions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/function"}),i=[],t=(e.FunctionList??e)?.Items?.FunctionSummary;if(t){let r=Array.isArray(t)?t:[t];for(let s of r)i.push({Name:s.Name,FunctionARN:s.FunctionMetadata?.FunctionARN,Stage:s.FunctionMetadata?.Stage,CreatedTime:s.FunctionMetadata?.CreatedTime,LastModifiedTime:s.FunctionMetadata?.LastModifiedTime})}return i}async getFunction(e,i="LIVE"){try{let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${e}`,queryParams:{Stage:i},returnHeaders:!0}),r=t.body?.FunctionSummary||t.FunctionSummary||t.body||t;return{FunctionARN:r.FunctionMetadata?.FunctionARN,Name:r.Name||e,Stage:r.FunctionMetadata?.Stage||i,ETag:t.headers?.etag||t.ETag||"",FunctionCode:r.FunctionCode}}catch(t){if(t.message?.includes("404")||t.message?.includes("NoSuchFunctionExists"))return null;throw t}}async publishFunction(e,i){let t,r;if(typeof e==="object")t=e.Name,r=e.IfMatch;else t=e,r=i;if(!r){let a=await this.getFunction(t,"DEVELOPMENT");if(!a)throw Error(`Function ${t} not found`);r=a.ETag}let s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/function/${t}/publish`,headers:{"If-Match":r}}),o=s.FunctionSummary||s;return{FunctionARN:o.FunctionMetadata?.FunctionARN,Stage:o.FunctionMetadata?.Stage||"LIVE",FunctionSummary:o}}async describeFunction(e){let{Name:i,Stage:t="DEVELOPMENT"}=e,r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${i}/describe`,queryParams:{Stage:t},returnHeaders:!0});return{ETag:r.headers?.etag||r.ETag||"",FunctionSummary:r.body?.FunctionSummary||r.FunctionSummary||r.body||r}}async updateFunction(e){let{Name:i,FunctionCode:t,FunctionConfig:r,IfMatch:s}=e,o=`<?xml version="1.0" encoding="UTF-8"?>
+<UpdateFunctionRequest xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <FunctionConfig>
+    <Comment>${r.Comment}</Comment>
+    <Runtime>${r.Runtime}</Runtime>
+  </FunctionConfig>
+  <FunctionCode>${Buffer.from(t).toString("base64")}</FunctionCode>
+</UpdateFunctionRequest>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/function/${i}`,body:o,headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{ETag:a.headers?.etag||a.ETag||"",FunctionSummary:a.body?.FunctionSummary||a.FunctionSummary||a.body||a}}async deleteFunction(e,i){let t=i;if(!t){let r=await this.getFunction(e,"DEVELOPMENT");if(!r)return;t=r.ETag}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/function/${e}`,headers:{"If-Match":t}})}async createIndexRewriteFunction(e){return this.createFunction({name:e,code:`function handler(event) {
+    const request = event.request;
+    var uri = request.uri;
+
+    // Check if the request is for a directory (ends with /)
+    if (uri.endsWith('/')) {
+        request.uri += 'index.html';
+    }
+    // Check if the request doesn't have a file extension
+    else if (!uri.includes('.')) {
+        // Add trailing slash to redirect to directory
+        request.uri += '/index.html';
+    }
+
+    return request;
+}`,comment:"Rewrite directory requests to index.html for S3 static sites",runtime:"cloudfront-js-2.0"})}async listOriginAccessControls(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/origin-access-control"}),i=[],t=(e.OriginAccessControlList??e)?.Items?.OriginAccessControlSummary;if(t){let r=Array.isArray(t)?t:[t];i.push(...r.map((s)=>({Id:s.Id,Name:s.Name,Description:s.Description,SigningProtocol:s.SigningProtocol,SigningBehavior:s.SigningBehavior,OriginAccessControlOriginType:s.OriginAccessControlOriginType})))}return i}async createOriginAccessControl(e){let{name:i,description:t=`OAC for ${i}`,signingProtocol:r="sigv4",signingBehavior:s="always",originType:o="s3"}=e,a=`<?xml version="1.0" encoding="UTF-8"?>
+<OriginAccessControlConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <Name>${i}</Name>
+  <Description>${t}</Description>
+  <SigningProtocol>${r}</SigningProtocol>
+  <SigningBehavior>${s}</SigningBehavior>
+  <OriginAccessControlOriginType>${o}</OriginAccessControlOriginType>
+</OriginAccessControlConfig>`,c=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/origin-access-control",body:a,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),u=c.body?.OriginAccessControl||c.OriginAccessControl||c.body||c;return{Id:u.Id,Name:u.OriginAccessControlConfig?.Name||i,Description:u.OriginAccessControlConfig?.Description||t,SigningProtocol:u.OriginAccessControlConfig?.SigningProtocol||r,SigningBehavior:u.OriginAccessControlConfig?.SigningBehavior||s,OriginAccessControlOriginType:u.OriginAccessControlConfig?.OriginAccessControlOriginType||o,ETag:c.headers?.etag||c.ETag||""}}async findOrCreateOriginAccessControl(e,i="s3"){let r=(await this.listOriginAccessControls()).find((o)=>o.Name===e&&o.OriginAccessControlOriginType===i);if(r)return{Id:r.Id,Name:r.Name,isNew:!1};let s=await this.createOriginAccessControl({name:e,originType:i});return{Id:s.Id,Name:s.Name,isNew:!0}}async createDistributionForS3(e){let{bucketName:i,bucketRegion:t,originAccessControlId:r,aliases:s=[],certificateArn:o,defaultRootObject:a="index.html",comment:c=`Distribution for ${i}`,priceClass:u="PriceClass_100",enabled:d=!0,trustedKeyGroupIds:g=[],mediaDelivery:h=!1}=e,l=`S3-${i}`,y=`${i}.s3.${t}.amazonaws.com`,m=`${Date.now()}-${Math.random().toString(36).slice(2)}`,b=g.length>0?`<TrustedKeyGroups>
+      <Enabled>true</Enabled>
+      <Quantity>${g.length}</Quantity>
+      <Items>${g.map((S)=>`<KeyGroup>${S}</KeyGroup>`).join("")}</Items>
+    </TrustedKeyGroups>`:"<TrustedKeyGroups><Enabled>false</Enabled><Quantity>0</Quantity></TrustedKeyGroups>",p="<Aliases><Quantity>0</Quantity></Aliases>";if(s.length>0)p=`<Aliases>
+    <Quantity>${s.length}</Quantity>
+    <Items>
+      ${s.map((S)=>`<CNAME>${S}</CNAME>`).join(`
+      `)}
+    </Items>
+  </Aliases>`;let f=`<ViewerCertificate>
+    <CloudFrontDefaultCertificate>true</CloudFrontDefaultCertificate>
+  </ViewerCertificate>`;if(o&&s.length>0)f=`<ViewerCertificate>
+    <ACMCertificateArn>${o}</ACMCertificateArn>
+    <SSLSupportMethod>sni-only</SSLSupportMethod>
+    <MinimumProtocolVersion>TLSv1.2_2021</MinimumProtocolVersion>
+    <CertificateSource>acm</CertificateSource>
+  </ViewerCertificate>`;let P=`<?xml version="1.0" encoding="UTF-8"?>
+<DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
+  <CallerReference>${m}</CallerReference>
+  <Comment>${c}</Comment>
+  <DefaultRootObject>${a}</DefaultRootObject>
+  <Origins>
+    <Quantity>1</Quantity>
+    <Items>
+      <Origin>
+        <Id>${l}</Id>
+        <DomainName>${y}</DomainName>
+        <OriginPath></OriginPath>
+        <S3OriginConfig>
+          <OriginAccessIdentity></OriginAccessIdentity>
+        </S3OriginConfig>
+        <OriginAccessControlId>${r}</OriginAccessControlId>
+      </Origin>
+    </Items>
+  </Origins>
+  <DefaultCacheBehavior>
+    <TargetOriginId>${l}</TargetOriginId>
+    <ViewerProtocolPolicy>redirect-to-https</ViewerProtocolPolicy>
+    <AllowedMethods>
+      <Quantity>2</Quantity>
+      <Items>
+        <Method>GET</Method>
+        <Method>HEAD</Method>
+      </Items>
+      <CachedMethods>
+        <Quantity>2</Quantity>
+        <Items>
+          <Method>GET</Method>
+          <Method>HEAD</Method>
+        </Items>
+      </CachedMethods>
+    </AllowedMethods>
+    <Compress>true</Compress>
+    <CachePolicyId>658327ea-f89d-4fab-a63d-7e88639e58f6</CachePolicyId>
+    ${b}
+  </DefaultCacheBehavior>
+  ${p}
+  ${f}
+  <PriceClass>${u}</PriceClass>
+  <Enabled>${d}</Enabled>
+  <HttpVersion>http2and3</HttpVersion>
+  <IsIPV6Enabled>true</IsIPV6Enabled>
+  ${h?"<CustomErrorResponses><Quantity>0</Quantity></CustomErrorResponses>":`<CustomErrorResponses>
+    <Quantity>1</Quantity>
+    <Items>
+      <CustomErrorResponse>
+        <ErrorCode>403</ErrorCode>
+        <ResponsePagePath>/index.html</ResponsePagePath>
+        <ResponseCode>200</ResponseCode>
+        <ErrorCachingMinTTL>300</ErrorCachingMinTTL>
+      </CustomErrorResponse>
+    </Items>
+  </CustomErrorResponses>`}
+</DistributionConfig>`,C=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:P,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),E=C.body?.Distribution||C.Distribution||C.body||C;return{Id:E.Id,ARN:E.ARN,DomainName:E.DomainName,Status:E.Status,ETag:C.headers?.etag||C.ETag||""}}async createMediaDistributionForS3(e){return this.createDistributionForS3({...e,defaultRootObject:"",mediaDelivery:!0,comment:e.comment??`Media distribution for ${e.bucketName}`})}async listPublicKeys(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(e.PublicKeyList??e,"PublicKeySummary").map((t)=>({Id:String(t.Id),Name:String(t.Name),Comment:t.Comment?String(t.Comment):void 0}))}async createPublicKey(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront public key name is invalid");if(!e.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let i=(s)=>s.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${i(e.callerReference??`${Date.now()}-${e.name}`)}</CallerReference><Name>${i(e.name)}</Name><EncodedKey>${i(e.encodedKey)}</EncodedKey><Comment>${i(e.comment??"")}</Comment></PublicKeyConfig>`}),r=t.PublicKey??t;return{Id:String(r.Id),Name:String(r.PublicKeyConfig?.Name??e.name),EncodedKey:String(r.PublicKeyConfig?.EncodedKey??e.encodedKey),Comment:String(r.PublicKeyConfig?.Comment??e.comment??"")}}async listKeyGroups(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(e.KeyGroupList??e,"KeyGroupSummary").map((t)=>({Id:String(t.KeyGroup?.Id??t.Id),Name:String(t.KeyGroup?.KeyGroupConfig?.Name??t.KeyGroupConfig?.Name??t.Name),Items:this.collectionItems(t.KeyGroup?.KeyGroupConfig?.Items??t.KeyGroupConfig?.Items??t.Items,"Item").map(String),Comment:t.KeyGroup?.KeyGroupConfig?.Comment??t.KeyGroupConfig?.Comment??t.Comment}))}async createKeyGroup(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront key group name is invalid");let i=[...new Set(e.publicKeyIds)];if(i.length===0)throw TypeError("CloudFront key group requires at least one public key");let t=(a)=>a.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),r=i.map((a)=>`<Item>${t(a)}</Item>`).join(""),s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${t(e.name)}</Name><Items>${r}</Items><Comment>${t(e.comment??"")}</Comment></KeyGroupConfig>`}),o=s.KeyGroup??s;return{Id:String(o.Id),Name:String(o.KeyGroupConfig?.Name??e.name),Items:i,Comment:String(o.KeyGroupConfig?.Comment??e.comment??"")}}static getS3BucketPolicyForCloudFront(e,i){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e}/*`,Condition:{StringEquals:{"AWS:SourceArn":i}}}]}}async waitForDistributionDeployed(e,i=60){for(let t=0;t<i;t++){if((await this.getDistribution(e)).Status==="Deployed")return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async disableDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",r=i.body?.DistributionConfig||(i.body?.Enabled!==void 0?i.body:void 0)||i.DistributionConfig;if(!r||r.Enabled===void 0)throw Error("Failed to get current distribution config");r.Enabled=!1;let s=this.buildDistributionConfigXml(r),o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:s,headers:{"Content-Type":"application/xml","If-Match":t},returnHeaders:!0});return{ETag:o.headers?.etag||o.headers?.ETag||o.ETag||""}}async deleteDistribution(e,i){let t=i||"";if(!t){let r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`,returnHeaders:!0});t=r.headers?.etag||r.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${e}`,headers:{"If-Match":t}})}async waitForDistributionDisabled(e,i=60){for(let t=0;t<i;t++){let r=await this.getDistribution(e);if(r.Status==="Deployed"&&!r.Enabled)return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async removeAlias(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),r=t.headers?.etag||t.headers?.ETag||"",s=t.body?.DistributionConfig||(t.body?.Enabled!==void 0?t.body:void 0)||t.DistributionConfig;if(!s||s.Enabled===void 0)throw Error("Failed to get current distribution config");let o=T(s.Aliases).Items;if(o.length===0)throw Error("Distribution has no aliases to remove");let a=o.filter((d)=>d!==i);if(a.length===o.length)throw Error(`Alias ${i} not found in distribution`);if(s.Aliases.Quantity=a.length,s.Aliases.Items=a.length>0?{CNAME:a}:void 0,a.length===0)s.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let c=this.buildDistributionConfigXml(s),u=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:c,headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{ETag:u.headers?.etag||u.headers?.ETag||u.ETag||""}}}
+export{Za,Le,I};

package/dist/{chunk-twj83txn.js → chunk-26cq0zjv.js}

@@ -1,5 +1,5 @@
-import{Io,Kr,Gd,xi,To,wo}from"./chunk-w23wrsa4.js";import{Le}from"./chunk-ys5318bg.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as S,mkdtempSync as U,rmSync as L,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function I(t,e){return`${r[e]}${t}${r.reset}`}function fn(t){console.log(`${r.green}✓${r.reset} ${t}`)}function Cu(t){console.error(`${r.red}✗${r.reset} ${t}`)}function cs(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function k(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function w(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function ds(t){console.log(`
+import{So,Wr,Vd,Oi,wo,Ro}from"./chunk-2c8pcbq8.js";import{$e}from"./chunk-dm4vt53n.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as S,mkdtempSync as U,rmSync as L,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function I(t,e){return`${r[e]}${t}${r.reset}`}function An(t){console.log(`${r.green}✓${r.reset} ${t}`)}function bu(t){console.error(`${r.red}✗${r.reset} ${t}`)}function ds(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function k(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function w(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function ls(t){console.log(`
 ${r.bright}${r.cyan}${t}${r.reset}
-`)}var F=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function Eu(t,e="cyan"){let n=t.split(`
-`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(I(`┌${a}┐`,e)),n.forEach((l)=>{console.log(I(`│ ${l.padEnd(i)} │`,e))}),console.log(I(`└${a}┘`,e))}function R(t,e){for(let n of e){let i=s(t,n.name);S(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function Ua(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",P=l==="arm64"?"linux/arm64":"linux/amd64",E=e.kind==="php",c=t.onStep??(()=>{}),p=U(s(O(),"tscloud-img-"));try{let f=s(p,"app");S(f,{recursive:!0});let y,v;if(E){To({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=wo(n);R(f,o),R(s(p,"runtime"),xi().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let b=e.handlers?.http??"public/index.php";y={http:b,queue:e.handlers?.queue??b,cli:e.handlers?.cli??b},v=Io(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await Kr({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,v=o.sha256}let C=v.slice(0,16);d(s(p,"Dockerfile"),Gd({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let x=new Le(i),u;try{u=(await x.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await x.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${C}`;c("docker build"),A("docker",["build","--platform",P,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await x.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let T=h.proxyEndpoint.replace(/^https?:\/\//,""),B=s(p,".docker");return S(B,{recursive:!0}),d(s(B,"config.json"),JSON.stringify({auths:{[T]:{auth:h.authorizationToken}}})),A("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:B}}),k(`Image: ${m}`),{imageUri:m,tag:C,handlers:y}}finally{L(p,{recursive:!0,force:!0})}}
-export{fn,Cu,cs,k,w,ds,Eu,Ua};
+`)}var F=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function vu(t,e="cyan"){let n=t.split(`
+`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(I(`┌${a}┐`,e)),n.forEach((l)=>{console.log(I(`│ ${l.padEnd(i)} │`,e))}),console.log(I(`└${a}┘`,e))}function R(t,e){for(let n of e){let i=s(t,n.name);S(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function Qa(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",P=l==="arm64"?"linux/arm64":"linux/amd64",E=e.kind==="php",c=t.onStep??(()=>{}),p=U(s(O(),"tscloud-img-"));try{let f=s(p,"app");S(f,{recursive:!0});let y,v;if(E){wo({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=Ro(n);R(f,o),R(s(p,"runtime"),Oi().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let b=e.handlers?.http??"public/index.php";y={http:b,queue:e.handlers?.queue??b,cli:e.handlers?.cli??b},v=So(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await Wr({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,v=o.sha256}let C=v.slice(0,16);d(s(p,"Dockerfile"),Vd({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let x=new $e(i),u;try{u=(await x.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await x.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${C}`;c("docker build"),A("docker",["build","--platform",P,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await x.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let T=h.proxyEndpoint.replace(/^https?:\/\//,""),B=s(p,".docker");return S(B,{recursive:!0}),d(s(B,"config.json"),JSON.stringify({auths:{[T]:{auth:h.authorizationToken}}})),A("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:B}}),k(`Image: ${m}`),{imageUri:m,tag:C,handlers:y}}finally{L(p,{recursive:!0,force:!0})}}
+export{An,bu,ds,k,w,ls,vu,Qa};