@stacksjs/ts-cloud 0.16.29 → 0.16.30

package/dist/aws/index.js

@@ -1 +1 @@
-import{Ae,ir,us,ps,Tu,Ha,Ga,gs,ms,qa,rt,z,nt,se,b,ye,yn,Va,Oe,ja,In,Sn,Cn,wh,Rh,By,_y,xy,Oy,Rt,Ly,$y,My,Fy,Dt,Dh,Ph,Nh,Pt,kh,Bh,_h,En,Uy,Qy,Hy,sr,Gy,qy,Vy,za,Ka,wu,jy,zy,Ky,or,xh,Oh,ar,it,bn,Wa,Ru,Wy,Du,Jy,Nt,Xy,Yy,Zy,eI,ae,tI,rI,nI,iI,cr,sI,oI,aI,vn,Ja,Xa,Pu,Nu,Ya,dr}from"../chunk-t3yzfbe7.js";import{Ie,st,Tn,Lh}from"../chunk-b6ar7eqc.js";import{Za,Le,I}from"../chunk-3byba7sc.js";import{$e}from"../chunk-dm4vt53n.js";import{K}from"../chunk-92w1g5d9.js";import{ot,ce,Me,Se,kt,Rn,fs,As,lr,ur,Dn,pr,ys,Is,Ss,Cs,W,Es,bs,vs,Ts,de,ws,Rs,Ds,R,rc,Pn,nc,le,gr}from"../chunk-qjxdhb8x.js";import{S}from"../chunk-ffxcn7mw.js";import{wr,we}from"../chunk-9g8as6sa.js";import{f}from"../chunk-yc2rm4v9.js";import{o}from"../chunk-qrs912nk.js";import{Dr,li,n,l,nf}from"../chunk-m93g67j0.js";export{le as ACMClient,gr as ACMDnsValidator,n as AWSClient,Wa as ApplicationAutoScalingClient,ir as AwsBackupClient,Rh as BedrockAgentClient,wh as BedrockAgentRuntimeClient,Cn as BedrockClient,Sn as BedrockRuntimeClient,f as CloudFormationClient,I as CloudFrontClient,ye as CloudWatchLogsClient,Se as CloudflareProvider,Rt as ComprehendClient,yn as ConnectClient,ms as CostExplorerClient,Pn as DnsProviderFactory,Oe as DynamoDBClient,wr as EC2Client,$e as ECRClient,rt as ECSClient,dr as EFSClient,Va as ELBv2Client,it as ElastiCacheClient,Tn as EmailClient,ar as EventBridgeClient,Me as GoDaddyProvider,Ie as IAMClient,Ru as ImapServer,or as KendraClient,b as LambdaClient,ja as OpenSearchClient,ot as PROXIABLE_RECORD_TYPES,za as PersonalizeClient,wu as PersonalizeEventsClient,Ka as PersonalizeRuntimeClient,En as PollyClient,ce as PorkbunProvider,K as RDSClient,Dt as RekognitionClient,S as Route53Client,qa as Route53DomainsClient,W as Route53Provider,o as S3Client,st as SESClient,nt as SNSClient,se as SQSClient,we as SSMClient,Ae as STSClient,bn as SchedulerClient,z as SecretsManagerClient,Nt as SmsClient,Ya as SmsVoiceClient,Du as SmtpServer,vn as SupportClient,Ja as SupportTemplates,Pt as TextractClient,In as TranscribeClient,sr as TranslateClient,de as UnifiedDnsValidator,cr as VoiceClient,Ly as analyzeSentiment,Ss as applyDeclaredZoneSettings,vs as applyZoneMigration,l as buildQueryParams,li as coerceXmlValues,xy as completeWithClaude,Za as configOrigins,Fy as containsPii,Ph as countFacesInS3Image,eI as createDeliveryReceiptHandler,R as createDnsProvider,Rs as createGoDaddyValidator,gs as createObjectStorageClient,ws as createPorkbunValidator,oI as createRecordingHandler,Ds as createRoute53Validator,Hy as createSSML,Yy as createScheduledSmsHandler,Zy as createSmsClient,Xy as createSmsInboxHandler,Nu as createSmsInfrastructure,aI as createVoiceClient,sI as createVoicemailHandler,pr as delegateZone,ys as delegateZoneFromConfig,Is as describeDelegation,Cs as describeZoneSettings,nf as detectCredentialSource,rc as detectDnsProvider,Dh as detectLabelsFromS3,My as detectLanguage,nc as dnsProviders,Lh as email,Es as exportRoute53Zone,$y as extractEntities,Bh as extractFormsFromS3,_h as extractTablesFromS3,kh as extractTextFromS3,tI as formatPhoneNumber,Oy as generateEmbeddings,nI as getCountryCode,jy as getRecommendations,zy as getSimilarItems,Pu as getSmsInfrastructureStatus,Nh as isContentSafe,lr as isNameserverRegistrar,iI as isSamePhoneNumber,rI as isValidPhoneNumber,ur as isZoneHost,ps as keyMatchesFilters,_y as listClaudeModels,Vy as listLanguages,Qy as listVoices,Tu as migrateObjectStorage,ae as normalizePhoneNumber,bs as planZoneMigration,kt as policyTag,Ha as providerEndpoint,Rn as qualifyName,As as reconcileDeclaredRecords,us as remapKey,By as requestModelAccess,fs as resolveDeclaredRecords,Ga as resolveObjectStorage,Dr as resolveS3Endpoint,Oh as retrieveForRag,Le as s3OriginBucket,Dn as sameNameservers,xh as search,Xa as setupSmsInfrastructure,Wy as startImapServer,Jy as startSmtpServer,Uy as textToSpeech,Ky as trackEvent,Gy as translate,qy as translateToMultiple,Ts as verifyZoneParity};
+import{Ae,ir,us,ps,Tu,Ha,Ga,gs,ms,qa,rt,z,nt,se,b,ye,yn,Va,Oe,ja,In,Sn,Cn,wh,Rh,By,_y,xy,Oy,Rt,Ly,$y,My,Fy,Dt,Dh,Ph,Nh,Pt,kh,Bh,_h,En,Uy,Qy,Hy,sr,Gy,qy,Vy,za,Ka,wu,jy,zy,Ky,or,xh,Oh,ar,it,bn,Wa,Ru,Wy,Du,Jy,Nt,Xy,Yy,Zy,eI,ae,tI,rI,nI,iI,cr,sI,oI,aI,vn,Ja,Xa,Pu,Nu,Ya,dr}from"../chunk-t3yzfbe7.js";import{Ie,st,Tn,Lh}from"../chunk-b6ar7eqc.js";import{Za,Le,I}from"../chunk-1erk1r1m.js";import{$e}from"../chunk-dm4vt53n.js";import{K}from"../chunk-92w1g5d9.js";import{ot,ce,Me,Se,kt,Rn,fs,As,lr,ur,Dn,pr,ys,Is,Ss,Cs,W,Es,bs,vs,Ts,de,ws,Rs,Ds,R,rc,Pn,nc,le,gr}from"../chunk-qjxdhb8x.js";import{S}from"../chunk-ffxcn7mw.js";import{wr,we}from"../chunk-9g8as6sa.js";import{f}from"../chunk-yc2rm4v9.js";import{o}from"../chunk-qrs912nk.js";import{Dr,li,n,l,nf}from"../chunk-m93g67j0.js";export{le as ACMClient,gr as ACMDnsValidator,n as AWSClient,Wa as ApplicationAutoScalingClient,ir as AwsBackupClient,Rh as BedrockAgentClient,wh as BedrockAgentRuntimeClient,Cn as BedrockClient,Sn as BedrockRuntimeClient,f as CloudFormationClient,I as CloudFrontClient,ye as CloudWatchLogsClient,Se as CloudflareProvider,Rt as ComprehendClient,yn as ConnectClient,ms as CostExplorerClient,Pn as DnsProviderFactory,Oe as DynamoDBClient,wr as EC2Client,$e as ECRClient,rt as ECSClient,dr as EFSClient,Va as ELBv2Client,it as ElastiCacheClient,Tn as EmailClient,ar as EventBridgeClient,Me as GoDaddyProvider,Ie as IAMClient,Ru as ImapServer,or as KendraClient,b as LambdaClient,ja as OpenSearchClient,ot as PROXIABLE_RECORD_TYPES,za as PersonalizeClient,wu as PersonalizeEventsClient,Ka as PersonalizeRuntimeClient,En as PollyClient,ce as PorkbunProvider,K as RDSClient,Dt as RekognitionClient,S as Route53Client,qa as Route53DomainsClient,W as Route53Provider,o as S3Client,st as SESClient,nt as SNSClient,se as SQSClient,we as SSMClient,Ae as STSClient,bn as SchedulerClient,z as SecretsManagerClient,Nt as SmsClient,Ya as SmsVoiceClient,Du as SmtpServer,vn as SupportClient,Ja as SupportTemplates,Pt as TextractClient,In as TranscribeClient,sr as TranslateClient,de as UnifiedDnsValidator,cr as VoiceClient,Ly as analyzeSentiment,Ss as applyDeclaredZoneSettings,vs as applyZoneMigration,l as buildQueryParams,li as coerceXmlValues,xy as completeWithClaude,Za as configOrigins,Fy as containsPii,Ph as countFacesInS3Image,eI as createDeliveryReceiptHandler,R as createDnsProvider,Rs as createGoDaddyValidator,gs as createObjectStorageClient,ws as createPorkbunValidator,oI as createRecordingHandler,Ds as createRoute53Validator,Hy as createSSML,Yy as createScheduledSmsHandler,Zy as createSmsClient,Xy as createSmsInboxHandler,Nu as createSmsInfrastructure,aI as createVoiceClient,sI as createVoicemailHandler,pr as delegateZone,ys as delegateZoneFromConfig,Is as describeDelegation,Cs as describeZoneSettings,nf as detectCredentialSource,rc as detectDnsProvider,Dh as detectLabelsFromS3,My as detectLanguage,nc as dnsProviders,Lh as email,Es as exportRoute53Zone,$y as extractEntities,Bh as extractFormsFromS3,_h as extractTablesFromS3,kh as extractTextFromS3,tI as formatPhoneNumber,Oy as generateEmbeddings,nI as getCountryCode,jy as getRecommendations,zy as getSimilarItems,Pu as getSmsInfrastructureStatus,Nh as isContentSafe,lr as isNameserverRegistrar,iI as isSamePhoneNumber,rI as isValidPhoneNumber,ur as isZoneHost,ps as keyMatchesFilters,_y as listClaudeModels,Vy as listLanguages,Qy as listVoices,Tu as migrateObjectStorage,ae as normalizePhoneNumber,bs as planZoneMigration,kt as policyTag,Ha as providerEndpoint,Rn as qualifyName,As as reconcileDeclaredRecords,us as remapKey,By as requestModelAccess,fs as resolveDeclaredRecords,Ga as resolveObjectStorage,Dr as resolveS3Endpoint,Oh as retrieveForRag,Le as s3OriginBucket,Dn as sameNameservers,xh as search,Xa as setupSmsInfrastructure,Wy as startImapServer,Jy as startSmtpServer,Uy as textToSpeech,Ky as trackEvent,Gy as translate,qy as translateToMultiple,Ts as verifyZoneParity};

package/dist/bin/{chunk-4ab2bceq.js → chunk-675txngy.js}

@@ -1 +1 @@
-import{wd,Sr,w}from"./chunk-2q64f0df.js";import"./chunk-q9tvzcr7.js";export{w as CloudFrontClient,wd as configOrigins,Sr as s3OriginBucket};
+import{wd,Sr,w}from"./chunk-bvtpvstn.js";import"./chunk-q9tvzcr7.js";export{w as CloudFrontClient,wd as configOrigins,Sr as s3OriginBucket};

package/dist/bin/{chunk-a8b2a3ab.js → chunk-98e48n5j.js}

@@ -1 +1 @@
-import{ed,td,rd,nd,zu,Hu}from"./chunk-rs50jra0.js";import"./chunk-1wtkv65w.js";import"./chunk-2q64f0df.js";import"./chunk-j2yy3tth.js";import"./chunk-y9cdqk8c.js";import"./chunk-a9yp82q5.js";import"./chunk-q9tvzcr7.js";export{zu as deleteStaticSite,td as deployStaticSite,Hu as deployStaticSiteFull,ed as generateStaticSiteTemplate,nd as invalidateCache,rd as uploadStaticFiles};
+import{ed,td,rd,nd,zu,Hu}from"./chunk-nb5vjsdg.js";import"./chunk-1wtkv65w.js";import"./chunk-bvtpvstn.js";import"./chunk-j2yy3tth.js";import"./chunk-y9cdqk8c.js";import"./chunk-a9yp82q5.js";import"./chunk-q9tvzcr7.js";export{zu as deleteStaticSite,td as deployStaticSite,Hu as deployStaticSiteFull,ed as generateStaticSiteTemplate,nd as invalidateCache,rd as uploadStaticFiles};

package/dist/bin/{chunk-2q64f0df.js → chunk-bvtpvstn.js}

@@ -1,49 +1,37 @@
-import{u}from"./chunk-q9tvzcr7.js";import{k}from"./chunk-yqkdyf0w.js";function E(e){let i=Array.isArray(e?.Items)?e.Items:k(e?.Items?.CNAME);return{Quantity:i.length,Items:i.map(String)}}function wd(e){return k(e?.Origins?.Items?.Origin)}function Sr(e){for(let i of wd(e)){let t=String(i.DomainName??"").match(/^(.+?)\.s3[.-]/)?.[1];if(t)return t}return}class w{client;constructor(e,i){this.client=i??new u(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let n=t[i]??t.Item;if(n===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(n)?n:[n]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([n,s])=>!/^[A-Za-z0-9-]{1,64}$/.test(n)||!s||s.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=n.headers?.etag||n.headers?.ETag||n.ETag||"",r=n.body?.DistributionConfig||n.DistributionConfig||n.body;if(!r||r.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let o=this.collectionItems(r.Origins,"Origin"),a=this.collectionItems(r.CacheBehaviors,"CacheBehavior"),g=o.find((y)=>String(y.Id)===t.id),d=a.find((y)=>String(y.PathPattern)===t.pathPattern);if(g&&String(g.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${g.DomainName}; pass replaceExisting only after reviewing the live config`);if(d&&String(d.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${d.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let c={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([y,T])=>({HeaderName:y,HeaderValue:T}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},f=g?o.map((y)=>String(y.Id)===t.id?c:y):[...o,c],m=d?a.map((y)=>String(y.PathPattern)===t.pathPattern?l:y):[...a,l],C=JSON.stringify(o)!==JSON.stringify(f)||JSON.stringify(a)!==JSON.stringify(m);if(!C||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:C,applied:!1,etag:s};r.Origins={Quantity:f.length,Items:{Origin:f}},r.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let b=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(r),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:b.headers?.etag||b.headers?.ETag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=n.headers?.etag||n.headers?.ETag||n.ETag||"",r=n.body?.DistributionConfig||n.DistributionConfig||n.body;if(!r||r.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let o=this.collectionItems(r.Origins,"Origin"),a=this.collectionItems(r.CacheBehaviors,"CacheBehavior"),g=o.find((m)=>String(m.Id)===t.id),d=a.find((m)=>String(m.PathPattern)===t.pathPattern);if(g&&String(g.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(d&&String(d.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!d)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:s};let c=a.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(r.DefaultCacheBehavior?.TargetOriginId)===t.id||c.some((m)=>String(m.TargetOriginId)===t.id),l=h?o:o.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!g,etag:s};r.Origins={Quantity:l.length,Items:{Origin:l}},r.CacheBehaviors={Quantity:c.length,...c.length?{Items:{CacheBehavior:c}}:{}};let f=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(r),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!g,etag:f.headers?.etag||f.headers?.ETag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
+import{u}from"./chunk-q9tvzcr7.js";import{k}from"./chunk-yqkdyf0w.js";function E(e){let i=Array.isArray(e?.Items)?e.Items:k(e?.Items?.CNAME);return{Quantity:i.length,Items:i.map(String)}}function wd(e){return k(e?.Origins?.Items?.Origin)}function Sr(e){for(let i of wd(e)){let t=String(i.DomainName??"").match(/^(.+?)\.s3[.-]/)?.[1];if(t)return t}return}class w{client;constructor(e,i){this.client=i??new u(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let n=t[i]??t.Item;if(n===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(n)?n:[n]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([n,r])=>!/^[A-Za-z0-9-]{1,64}$/.test(n)||!r||r.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),r=n.headers?.etag||n.headers?.ETag||n.ETag||"",s=n.body?.DistributionConfig||n.DistributionConfig||n.body;if(!s||s.Enabled===void 0||!r)throw Error("Failed to read an ETag-protected CloudFront distribution config");let o=this.collectionItems(s.Origins,"Origin"),a=this.collectionItems(s.CacheBehaviors,"CacheBehavior"),c=o.find((f)=>String(f.Id)===t.id),d=a.find((f)=>String(f.PathPattern)===t.pathPattern);if(c&&String(c.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${c.DomainName}; pass replaceExisting only after reviewing the live config`);if(d&&String(d.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${d.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let g={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([f,T])=>({HeaderName:f,HeaderValue:T}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},y=c?o.map((f)=>String(f.Id)===t.id?g:f):[...o,g],m=d?a.map((f)=>String(f.PathPattern)===t.pathPattern?l:f):[...a,l],b=JSON.stringify(o)!==JSON.stringify(y)||JSON.stringify(a)!==JSON.stringify(m);if(!b||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:b,applied:!1,etag:r};s.Origins={Quantity:y.length,Items:{Origin:y}},s.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let p=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(s),headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:p.headers?.etag||p.headers?.ETag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),r=n.headers?.etag||n.headers?.ETag||n.ETag||"",s=n.body?.DistributionConfig||n.DistributionConfig||n.body;if(!s||s.Enabled===void 0||!r)throw Error("Failed to read an ETag-protected CloudFront distribution config");let o=this.collectionItems(s.Origins,"Origin"),a=this.collectionItems(s.CacheBehaviors,"CacheBehavior"),c=o.find((m)=>String(m.Id)===t.id),d=a.find((m)=>String(m.PathPattern)===t.pathPattern);if(c&&String(c.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(d&&String(d.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!d)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:r};let g=a.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(s.DefaultCacheBehavior?.TargetOriginId)===t.id||g.some((m)=>String(m.TargetOriginId)===t.id),l=h?o:o.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!c,etag:r};s.Origins={Quantity:l.length,Items:{Origin:l}},s.CacheBehaviors={Quantity:g.length,...g.length?{Items:{CacheBehavior:g}}:{}};let y=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(s),headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!c,etag:y.headers?.etag||y.headers?.ETag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch>
   <Paths>
     <Quantity>${e.paths.length}</Quantity>
     <Items>
-      ${e.paths.map((s)=>`<Path>${s}</Path>`).join(`
+      ${e.paths.map((r)=>`<Path>${r}</Path>`).join(`
       `)}
     </Items>
   </Paths>
   <CallerReference>${i}</CallerReference>
-</InvalidationBatch>`,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${e.distributionId}/invalidation`,body:t,headers:{"Content-Type":"application/xml"}});return{Id:n.Id||n.Invalidation?.Id,Status:n.Status||n.Invalidation?.Status||"InProgress",CreateTime:n.CreateTime||n.Invalidation?.CreateTime||new Date().toISOString()}}async getInvalidation(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation/${i}`});return{Id:t.Id||t.Invalidation?.Id,Status:t.Status||t.Invalidation?.Status,CreateTime:t.CreateTime||t.Invalidation?.CreateTime}}async listInvalidations(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation`}),t=[];if(i.InvalidationSummary){let n=Array.isArray(i.InvalidationSummary)?i.InvalidationSummary:[i.InvalidationSummary];t.push(...n.map((s)=>({Id:s.Id,Status:s.Status,CreateTime:s.CreateTime})))}return t}async waitForInvalidation(e,i){let n=0;while(n<60){if((await this.getInvalidation(e,i)).Status==="Completed")return;await new Promise((r)=>setTimeout(r,5000)),n++}throw Error(`Timeout waiting for invalidation ${i} to complete`)}async listDistributions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/distribution"}),i=[],n=(e.DistributionList||e).Items,s=[];if(Array.isArray(n))s=n;else if(n?.DistributionSummary)s=Array.isArray(n.DistributionSummary)?n.DistributionSummary:[n.DistributionSummary];return i.push(...s.map((r)=>({Id:r.Id,ARN:r.ARN,Status:r.Status,DomainName:r.DomainName,Aliases:r.Aliases?E(r.Aliases):void 0,Enabled:r.Enabled==="true"||r.Enabled===!0}))),i}async getDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`}),t=i.Distribution||i;return{Id:t.Id,ARN:t.ARN,Status:t.Status,DomainName:t.DomainName,Aliases:E(t.DistributionConfig?.Aliases??t.Aliases),Enabled:t.DistributionConfig?.Enabled==="true"||t.DistributionConfig?.Enabled===!0}}async getDistributionConfig(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t={...i.body?.DistributionConfig??i.body??{}};return delete t["@_xmlns"],{ETag:i.headers?.etag||i.headers?.ETag||"",DistributionConfig:t}}async invalidateAll(e){return this.createInvalidation({distributionId:e,paths:["/*"]})}async invalidatePaths(e,i){let t=i.map((n)=>n.startsWith("/")?n:`/${n}`);return this.createInvalidation({distributionId:e,paths:t})}async invalidatePattern(e,i){let t=i.startsWith("/")?i:`/${i}`;return this.createInvalidation({distributionId:e,paths:[t]})}async invalidateAfterDeployment(e){let{distributionId:i,changedPaths:t,invalidateAll:n=!1,wait:s=!1}=e,r;if(n||!t||t.length===0)r=await this.invalidateAll(i);else r=await this.invalidatePaths(i,t);if(s)await this.waitForInvalidation(i,r.Id);return{invalidationId:r.Id,status:r.Status}}async findDistributionByDomain(e){return(await this.listDistributions()).find((n)=>{if(n.DomainName===e)return!0;if(n.Aliases?.Items&&n.Aliases.Items.includes(e))return!0;return!1})||null}async batchInvalidate(e,i=["/*"]){return await Promise.all(e.map(async(n)=>{let s=await this.createInvalidation({distributionId:n,paths:i});return{distributionId:n,invalidationId:s.Id,status:s.Status}}))}async updateCustomErrorResponses(e){let{distributionId:i,customErrorResponses:t}=e,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),s=n.headers?.etag||n.headers?.ETag||"",r=n.body?.DistributionConfig||(n.body?.Enabled!==void 0?n.body:void 0)||n.DistributionConfig;if(!r||r.Enabled===void 0)throw Error("Failed to get current distribution config");if(t.length===0)r.CustomErrorResponses={Quantity:0};else r.CustomErrorResponses={Quantity:t.length,Items:{CustomErrorResponse:t.map((d)=>({ErrorCode:d.errorCode,...d.responsePagePath&&{ResponsePagePath:d.responsePagePath},...d.responseCode&&{ResponseCode:d.responseCode},...d.errorCachingMinTTL!==void 0&&{ErrorCachingMinTTL:d.errorCachingMinTTL}}))}};let o=this.buildDistributionConfigXml(r),a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:o,headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0}),g=a.body?.Distribution??a.body??{};return{Distribution:{Id:g.Id,ARN:g.ARN,Status:g.Status,DomainName:g.DomainName,Aliases:E(g.DistributionConfig?.Aliases),Enabled:g.DistributionConfig?.Enabled==="true"||g.DistributionConfig?.Enabled===!0},ETag:a.headers?.etag||a.headers?.ETag||""}}async removeCustomErrorResponses(e){return this.updateCustomErrorResponses({distributionId:e,customErrorResponses:[]})}async updateDistribution(e){let{distributionId:i,aliases:t,certificateArn:n,comment:s}=e,r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),o=r.headers?.etag||r.headers?.ETag||"",a=r.body?.DistributionConfig||(r.body?.Enabled!==void 0?r.body:void 0)||r.DistributionConfig;if(!a||a.Enabled===void 0)throw Error("Failed to get current distribution config");if(t&&t.length>0)a.Aliases={Quantity:t.length,Items:{CNAME:t}};if(n)a.ViewerCertificate={ACMCertificateArn:n,SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021",CertificateSource:"acm"};if(s)a.Comment=s;let g=this.buildDistributionConfigXml(a),d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:g,headers:{"Content-Type":"application/xml","If-Match":o},returnHeaders:!0}),c=d.body?.Distribution??d.body??{};return{Distribution:{Id:c.Id,ARN:c.ARN,Status:c.Status,DomainName:c.DomainName,Aliases:t?{Quantity:t.length,Items:t}:{Quantity:0,Items:[]},Enabled:c.DistributionConfig?.Enabled==="true"||c.DistributionConfig?.Enabled===!0},ETag:d.headers?.etag||d.headers?.ETag||""}}buildDistributionConfigXml(e){let i=(r)=>r.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;"),t={Items:"",Methods:"Method",Headers:"Name",Cookies:"Name",QueryStringCacheKeys:"Name",TrustedKeyGroups:"KeyGroup",TrustedSigners:"AwsAccountNumber",LambdaFunctionAssociations:"LambdaFunctionAssociation",FunctionAssociations:"FunctionAssociation",CacheBehaviors:"CacheBehavior",CustomErrorResponses:"CustomErrorResponse",GeoRestriction:"Location"},n={Origins:"Origin",Aliases:"CNAME",AllowedMethods:"Method",CachedMethods:"Method",CustomErrorResponses:"CustomErrorResponse",CacheBehaviors:"CacheBehavior"},s=(r,o,a="",g="")=>{if(o===null||o===void 0)return"";if(r.startsWith("@_")||r==="?xml")return"";if(typeof o==="boolean")return`${a}<${r}>${o}</${r}>
-`;if(typeof o==="number"||typeof o==="string")return`${a}<${r}>${i(String(o))}</${r}>
-`;if(Array.isArray(o)){if(r==="Items"){let c=n[g]||"Item";return`${a}<Items>
-${o.map((h)=>s(c,h,`${a}  `,r)).join("")}${a}</Items>
-`}let d=t[r]||r.replace(/s$/,"");return o.map((c)=>s(d,c,a,r)).join("")}if(typeof o==="object"){if(r==="Items"){let c=n[g]||"",h=Object.keys(o).filter((l)=>!l.startsWith("@_"));if(h.length===1&&!Array.isArray(o[h[0]])){let l=h[0],f=o[l];if(typeof f==="string")return`${a}<Items>
-${a}  <${l}>${i(f)}</${l}>
-${a}</Items>
-`;else if(typeof f==="object"&&!Array.isArray(f))return`${a}<Items>
-${s(l,f,a+"  ",r)}${a}</Items>
-`}if(h.length===1&&Array.isArray(o[h[0]])){let l=h[0],f=o[l],m="";for(let C of f)if(typeof C==="string")m+=`${a}  <${l}>${i(C)}</${l}>
-`;else m+=s(l,C,a+"  ",r);return`${a}<Items>
-${m}${a}</Items>
-`}if(Array.isArray(o)){let l="",f=c||"Item";for(let m of o)if(typeof m==="string")l+=`${a}  <${f}>${i(m)}</${f}>
-`;else l+=s(f,m,a+"  ",r);return`${a}<Items>
-${l}${a}</Items>
-`}}let d="";for(let[c,h]of Object.entries(o))if(!c.startsWith("@_"))d+=s(c,h,a+"  ",r);if(d==="")return`${a}<${r}/>
-`;return`${a}<${r}>
-${d}${a}</${r}>
+</InvalidationBatch>`,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/distribution/${e.distributionId}/invalidation`,body:t,headers:{"Content-Type":"application/xml"}});return{Id:n.Id||n.Invalidation?.Id,Status:n.Status||n.Invalidation?.Status||"InProgress",CreateTime:n.CreateTime||n.Invalidation?.CreateTime||new Date().toISOString()}}async getInvalidation(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation/${i}`});return{Id:t.Id||t.Invalidation?.Id,Status:t.Status||t.Invalidation?.Status,CreateTime:t.CreateTime||t.Invalidation?.CreateTime}}async listInvalidations(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/invalidation`}),t=[];if(i.InvalidationSummary){let n=Array.isArray(i.InvalidationSummary)?i.InvalidationSummary:[i.InvalidationSummary];t.push(...n.map((r)=>({Id:r.Id,Status:r.Status,CreateTime:r.CreateTime})))}return t}async waitForInvalidation(e,i){let n=0;while(n<60){if((await this.getInvalidation(e,i)).Status==="Completed")return;await new Promise((s)=>setTimeout(s,5000)),n++}throw Error(`Timeout waiting for invalidation ${i} to complete`)}async listDistributions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/distribution"}),i=[],n=(e.DistributionList||e).Items,r=[];if(Array.isArray(n))r=n;else if(n?.DistributionSummary)r=Array.isArray(n.DistributionSummary)?n.DistributionSummary:[n.DistributionSummary];return i.push(...r.map((s)=>({Id:s.Id,ARN:s.ARN,Status:s.Status,DomainName:s.DomainName,Aliases:s.Aliases?E(s.Aliases):void 0,Enabled:s.Enabled==="true"||s.Enabled===!0}))),i}async getDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`}),t=i.Distribution||i;return{Id:t.Id,ARN:t.ARN,Status:t.Status,DomainName:t.DomainName,Aliases:E(t.DistributionConfig?.Aliases??t.Aliases),Enabled:t.DistributionConfig?.Enabled==="true"||t.DistributionConfig?.Enabled===!0}}async getDistributionConfig(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t={...i.body?.DistributionConfig??i.body??{}};return delete t["@_xmlns"],{ETag:i.headers?.etag||i.headers?.ETag||"",DistributionConfig:t}}async invalidateAll(e){return this.createInvalidation({distributionId:e,paths:["/*"]})}async invalidatePaths(e,i){let t=i.map((n)=>n.startsWith("/")?n:`/${n}`);return this.createInvalidation({distributionId:e,paths:t})}async invalidatePattern(e,i){let t=i.startsWith("/")?i:`/${i}`;return this.createInvalidation({distributionId:e,paths:[t]})}async invalidateAfterDeployment(e){let{distributionId:i,changedPaths:t,invalidateAll:n=!1,wait:r=!1}=e,s;if(n||!t||t.length===0)s=await this.invalidateAll(i);else s=await this.invalidatePaths(i,t);if(r)await this.waitForInvalidation(i,s.Id);return{invalidationId:s.Id,status:s.Status}}async findDistributionByDomain(e){return(await this.listDistributions()).find((n)=>{if(n.DomainName===e)return!0;if(n.Aliases?.Items&&n.Aliases.Items.includes(e))return!0;return!1})||null}async batchInvalidate(e,i=["/*"]){return await Promise.all(e.map(async(n)=>{let r=await this.createInvalidation({distributionId:n,paths:i});return{distributionId:n,invalidationId:r.Id,status:r.Status}}))}async updateCustomErrorResponses(e){let{distributionId:i,customErrorResponses:t}=e,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),r=n.headers?.etag||n.headers?.ETag||"",s=n.body?.DistributionConfig||(n.body?.Enabled!==void 0?n.body:void 0)||n.DistributionConfig;if(!s||s.Enabled===void 0)throw Error("Failed to get current distribution config");if(t.length===0)s.CustomErrorResponses={Quantity:0};else s.CustomErrorResponses={Quantity:t.length,Items:{CustomErrorResponse:t.map((d)=>({ErrorCode:d.errorCode,...d.responsePagePath&&{ResponsePagePath:d.responsePagePath},...d.responseCode&&{ResponseCode:d.responseCode},...d.errorCachingMinTTL!==void 0&&{ErrorCachingMinTTL:d.errorCachingMinTTL}}))}};let o=this.buildDistributionConfigXml(s),a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:o,headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0}),c=a.body?.Distribution??a.body??{};return{Distribution:{Id:c.Id,ARN:c.ARN,Status:c.Status,DomainName:c.DomainName,Aliases:E(c.DistributionConfig?.Aliases),Enabled:c.DistributionConfig?.Enabled==="true"||c.DistributionConfig?.Enabled===!0},ETag:a.headers?.etag||a.headers?.ETag||""}}async removeCustomErrorResponses(e){return this.updateCustomErrorResponses({distributionId:e,customErrorResponses:[]})}async updateDistribution(e){let{distributionId:i,aliases:t,certificateArn:n,comment:r}=e,s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${i}/config`,returnHeaders:!0}),o=s.headers?.etag||s.headers?.ETag||"",a=s.body?.DistributionConfig||(s.body?.Enabled!==void 0?s.body:void 0)||s.DistributionConfig;if(!a||a.Enabled===void 0)throw Error("Failed to get current distribution config");if(t&&t.length>0)a.Aliases={Quantity:t.length,Items:{CNAME:t}};if(n)a.ViewerCertificate={ACMCertificateArn:n,SSLSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021",CertificateSource:"acm"};if(r)a.Comment=r;let c=this.buildDistributionConfigXml(a),d=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${i}/config`,body:c,headers:{"Content-Type":"application/xml","If-Match":o},returnHeaders:!0}),g=d.body?.Distribution??d.body??{};return{Distribution:{Id:g.Id,ARN:g.ARN,Status:g.Status,DomainName:g.DomainName,Aliases:t?{Quantity:t.length,Items:t}:{Quantity:0,Items:[]},Enabled:g.DistributionConfig?.Enabled==="true"||g.DistributionConfig?.Enabled===!0},ETag:d.headers?.etag||d.headers?.ETag||""}}buildDistributionConfigXml(e){let i=(o)=>o.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;"),t={Aliases:"CNAME",Origins:"Origin",OriginGroups:"OriginGroup",Members:"OriginGroupMember",StatusCodes:"StatusCode",CustomHeaders:"OriginCustomHeader",OriginSslProtocols:"SslProtocol",CacheBehaviors:"CacheBehavior",CustomErrorResponses:"CustomErrorResponse",AllowedMethods:"Method",CachedMethods:"Method",FunctionAssociations:"FunctionAssociation",LambdaFunctionAssociations:"LambdaFunctionAssociation",Headers:"Name",WhitelistedNames:"Name",QueryStringCacheKeys:"Name",TrustedSigners:"AwsAccountNumber",TrustedKeyGroups:"KeyGroup",GeoRestriction:"Location"},n=new Set(["TrustedSigners","TrustedKeyGroups","GeoRestriction"]),r=(o,a)=>Error(`Cannot build CloudFront XML for ${o}: ${a}`),s=(o,a,c="",d="")=>{if(a===null||a===void 0)return"";if(o.startsWith("@_")||o==="?xml")return"";if(typeof a==="boolean"||typeof a==="number"||typeof a==="string")return`${c}<${o}>${i(String(a))}</${o}>
+`;if(Array.isArray(a)){if(o==="Items"){let g=t[d];if(!g)throw r(`${d}.Items`,"no known entry name for this list");return s("Items",{[g]:a},c,d)}if(t[o]&&!n.has(o))return s(o,{Quantity:a.length,...a.length?{Items:a}:{}},c,d);throw r(`${d}.${o}`,t[o]?"pass the list as an object, it needs fields an array cannot carry":"an array is not a CloudFront list here")}if(typeof a==="object"){let g=Object.keys(a).filter((l)=>!l.startsWith("@_"));if(o==="Items"&&g.length===1){let[l]=g,y=(Array.isArray(a[l])?a[l]:[a[l]]).map((m)=>s(l,m,`${c}  `,o)).join("");return`${c}<Items>
+${y}${c}</Items>
+`}let h=g.map((l)=>s(l,a[l],`${c}  `,o)).join("");return h?`${c}<${o}>
+${h}${c}</${o}>
+`:`${c}<${o}/>
 `}return""};return`<?xml version="1.0" encoding="UTF-8"?>
 <DistributionConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
-${Object.entries(e).filter(([r])=>!r.startsWith("@_")).map(([r,o])=>s(r,o,"  ","DistributionConfig")).join("")}</DistributionConfig>`}async ensureDynamicHttpMethods(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",n=i.body?.DistributionConfig||i.DistributionConfig||i.body;if(!n)throw Error("Failed to get current distribution config");let s=!1,r=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],o=(d)=>{if(!d)return[];let c=d.Items;if(!c)return[];if(Array.isArray(c))return c.map(String);if(typeof c==="object"&&c.Method){let h=c.Method;return Array.isArray(h)?h.map(String):[String(h)]}if(c.Item)return Array.isArray(c.Item)?c.Item.map(String):[String(c.Item)];return[]},a=n.DefaultCacheBehavior;if(a){if(!o(a.AllowedMethods).includes("POST"))a.AllowedMethods={Quantity:r.length,Items:{Method:r},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},s=!0}if(!s)return!1;let g=this.buildDistributionConfigXml(n);return await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:g,headers:{"Content-Type":"application/xml","If-Match":t}}),!0}async addAliases(e,i,t){return this.updateDistribution({distributionId:e,aliases:i,certificateArn:t})}async createFunction(e){let{name:i,code:t,comment:n="",runtime:s="cloudfront-js-2.0"}=e,r=`<?xml version="1.0" encoding="UTF-8"?>
+${Object.entries(e).filter(([o])=>!o.startsWith("@_")).map(([o,a])=>s(o,a,"  ","DistributionConfig")).join("")}</DistributionConfig>`}async ensureDynamicHttpMethods(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",n=i.body?.DistributionConfig||i.DistributionConfig||i.body;if(!n)throw Error("Failed to get current distribution config");let r=!1,s=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],o=(d)=>{if(!d)return[];let g=d.Items;if(!g)return[];if(Array.isArray(g))return g.map(String);if(typeof g==="object"&&g.Method){let h=g.Method;return Array.isArray(h)?h.map(String):[String(h)]}if(g.Item)return Array.isArray(g.Item)?g.Item.map(String):[String(g.Item)];return[]},a=n.DefaultCacheBehavior;if(a){if(!o(a.AllowedMethods).includes("POST"))a.AllowedMethods={Quantity:s.length,Items:{Method:s},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},r=!0}if(!r)return!1;let c=this.buildDistributionConfigXml(n);return await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:c,headers:{"Content-Type":"application/xml","If-Match":t}}),!0}async addAliases(e,i,t){return this.updateDistribution({distributionId:e,aliases:i,certificateArn:t})}async createFunction(e){let{name:i,code:t,comment:n="",runtime:r="cloudfront-js-2.0"}=e,s=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateFunctionRequest xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <Name>${i}</Name>
   <FunctionConfig>
     <Comment>${n}</Comment>
-    <Runtime>${s}</Runtime>
+    <Runtime>${r}</Runtime>
   </FunctionConfig>
   <FunctionCode>${Buffer.from(t).toString("base64")}</FunctionCode>
-</CreateFunctionRequest>`,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/function",body:r,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),a=o.body?.FunctionSummary??o.body??{};return{FunctionARN:a.FunctionMetadata?.FunctionARN||a.FunctionARN,Name:a.Name||i,Stage:a.FunctionMetadata?.Stage||"DEVELOPMENT",ETag:o.headers?.etag||o.headers?.ETag||""}}async listFunctions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/function"}),i=[],t=(e.FunctionList??e)?.Items?.FunctionSummary;if(t){let n=Array.isArray(t)?t:[t];for(let s of n)i.push({Name:s.Name,FunctionARN:s.FunctionMetadata?.FunctionARN,Stage:s.FunctionMetadata?.Stage,CreatedTime:s.FunctionMetadata?.CreatedTime,LastModifiedTime:s.FunctionMetadata?.LastModifiedTime})}return i}async getFunction(e,i="LIVE"){try{let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${e}`,queryParams:{Stage:i},returnHeaders:!0}),n=t.body?.FunctionSummary||t.FunctionSummary||t.body||t;return{FunctionARN:n.FunctionMetadata?.FunctionARN,Name:n.Name||e,Stage:n.FunctionMetadata?.Stage||i,ETag:t.headers?.etag||t.ETag||"",FunctionCode:n.FunctionCode}}catch(t){if(t.message?.includes("404")||t.message?.includes("NoSuchFunctionExists"))return null;throw t}}async publishFunction(e,i){let t,n;if(typeof e==="object")t=e.Name,n=e.IfMatch;else t=e,n=i;if(!n){let o=await this.getFunction(t,"DEVELOPMENT");if(!o)throw Error(`Function ${t} not found`);n=o.ETag}let s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/function/${t}/publish`,headers:{"If-Match":n}}),r=s.FunctionSummary||s;return{FunctionARN:r.FunctionMetadata?.FunctionARN,Stage:r.FunctionMetadata?.Stage||"LIVE",FunctionSummary:r}}async describeFunction(e){let{Name:i,Stage:t="DEVELOPMENT"}=e,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${i}/describe`,queryParams:{Stage:t},returnHeaders:!0});return{ETag:n.headers?.etag||n.ETag||"",FunctionSummary:n.body?.FunctionSummary||n.FunctionSummary||n.body||n}}async updateFunction(e){let{Name:i,FunctionCode:t,FunctionConfig:n,IfMatch:s}=e,r=`<?xml version="1.0" encoding="UTF-8"?>
+</CreateFunctionRequest>`,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/function",body:s,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),a=o.body?.FunctionSummary??o.body??{};return{FunctionARN:a.FunctionMetadata?.FunctionARN||a.FunctionARN,Name:a.Name||i,Stage:a.FunctionMetadata?.Stage||"DEVELOPMENT",ETag:o.headers?.etag||o.headers?.ETag||""}}async listFunctions(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/function"}),i=[],t=(e.FunctionList??e)?.Items?.FunctionSummary;if(t){let n=Array.isArray(t)?t:[t];for(let r of n)i.push({Name:r.Name,FunctionARN:r.FunctionMetadata?.FunctionARN,Stage:r.FunctionMetadata?.Stage,CreatedTime:r.FunctionMetadata?.CreatedTime,LastModifiedTime:r.FunctionMetadata?.LastModifiedTime})}return i}async getFunction(e,i="LIVE"){try{let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${e}`,queryParams:{Stage:i},returnHeaders:!0}),n=t.body?.FunctionSummary||t.FunctionSummary||t.body||t;return{FunctionARN:n.FunctionMetadata?.FunctionARN,Name:n.Name||e,Stage:n.FunctionMetadata?.Stage||i,ETag:t.headers?.etag||t.ETag||"",FunctionCode:n.FunctionCode}}catch(t){if(t.message?.includes("404")||t.message?.includes("NoSuchFunctionExists"))return null;throw t}}async publishFunction(e,i){let t,n;if(typeof e==="object")t=e.Name,n=e.IfMatch;else t=e,n=i;if(!n){let o=await this.getFunction(t,"DEVELOPMENT");if(!o)throw Error(`Function ${t} not found`);n=o.ETag}let r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:`/2020-05-31/function/${t}/publish`,headers:{"If-Match":n}}),s=r.FunctionSummary||r;return{FunctionARN:s.FunctionMetadata?.FunctionARN,Stage:s.FunctionMetadata?.Stage||"LIVE",FunctionSummary:s}}async describeFunction(e){let{Name:i,Stage:t="DEVELOPMENT"}=e,n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/function/${i}/describe`,queryParams:{Stage:t},returnHeaders:!0});return{ETag:n.headers?.etag||n.ETag||"",FunctionSummary:n.body?.FunctionSummary||n.FunctionSummary||n.body||n}}async updateFunction(e){let{Name:i,FunctionCode:t,FunctionConfig:n,IfMatch:r}=e,s=`<?xml version="1.0" encoding="UTF-8"?>
 <UpdateFunctionRequest xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <FunctionConfig>
     <Comment>${n.Comment}</Comment>
     <Runtime>${n.Runtime}</Runtime>
   </FunctionConfig>
   <FunctionCode>${Buffer.from(t).toString("base64")}</FunctionCode>
-</UpdateFunctionRequest>`,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/function/${i}`,body:r,headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{ETag:o.headers?.etag||o.ETag||"",FunctionSummary:o.body?.FunctionSummary||o.FunctionSummary||o.body||o}}async deleteFunction(e,i){let t=i;if(!t){let n=await this.getFunction(e,"DEVELOPMENT");if(!n)return;t=n.ETag}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/function/${e}`,headers:{"If-Match":t}})}async createIndexRewriteFunction(e){return this.createFunction({name:e,code:`function handler(event) {
+</UpdateFunctionRequest>`,o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/function/${i}`,body:s,headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{ETag:o.headers?.etag||o.ETag||"",FunctionSummary:o.body?.FunctionSummary||o.FunctionSummary||o.body||o}}async deleteFunction(e,i){let t=i;if(!t){let n=await this.getFunction(e,"DEVELOPMENT");if(!n)return;t=n.ETag}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/function/${e}`,headers:{"If-Match":t}})}async createIndexRewriteFunction(e){return this.createFunction({name:e,code:`function handler(event) {
     const request = event.request;
     var uri = request.uri;
 
@@ -58,27 +46,27 @@ ${Object.entries(e).filter(([r])=>!r.startsWith("@_")).map(([r,o])=>s(r,o,"  ","
     }
 
     return request;
-}`,comment:"Rewrite directory requests to index.html for S3 static sites",runtime:"cloudfront-js-2.0"})}async listOriginAccessControls(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/origin-access-control"}),i=[],t=(e.OriginAccessControlList??e)?.Items?.OriginAccessControlSummary;if(t){let n=Array.isArray(t)?t:[t];i.push(...n.map((s)=>({Id:s.Id,Name:s.Name,Description:s.Description,SigningProtocol:s.SigningProtocol,SigningBehavior:s.SigningBehavior,OriginAccessControlOriginType:s.OriginAccessControlOriginType})))}return i}async createOriginAccessControl(e){let{name:i,description:t=`OAC for ${i}`,signingProtocol:n="sigv4",signingBehavior:s="always",originType:r="s3"}=e,o=`<?xml version="1.0" encoding="UTF-8"?>
+}`,comment:"Rewrite directory requests to index.html for S3 static sites",runtime:"cloudfront-js-2.0"})}async listOriginAccessControls(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/origin-access-control"}),i=[],t=(e.OriginAccessControlList??e)?.Items?.OriginAccessControlSummary;if(t){let n=Array.isArray(t)?t:[t];i.push(...n.map((r)=>({Id:r.Id,Name:r.Name,Description:r.Description,SigningProtocol:r.SigningProtocol,SigningBehavior:r.SigningBehavior,OriginAccessControlOriginType:r.OriginAccessControlOriginType})))}return i}async createOriginAccessControl(e){let{name:i,description:t=`OAC for ${i}`,signingProtocol:n="sigv4",signingBehavior:r="always",originType:s="s3"}=e,o=`<?xml version="1.0" encoding="UTF-8"?>
 <OriginAccessControlConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">
   <Name>${i}</Name>
   <Description>${t}</Description>
   <SigningProtocol>${n}</SigningProtocol>
-  <SigningBehavior>${s}</SigningBehavior>
-  <OriginAccessControlOriginType>${r}</OriginAccessControlOriginType>
-</OriginAccessControlConfig>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/origin-access-control",body:o,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),g=a.body?.OriginAccessControl||a.OriginAccessControl||a.body||a;return{Id:g.Id,Name:g.OriginAccessControlConfig?.Name||i,Description:g.OriginAccessControlConfig?.Description||t,SigningProtocol:g.OriginAccessControlConfig?.SigningProtocol||n,SigningBehavior:g.OriginAccessControlConfig?.SigningBehavior||s,OriginAccessControlOriginType:g.OriginAccessControlConfig?.OriginAccessControlOriginType||r,ETag:a.headers?.etag||a.ETag||""}}async findOrCreateOriginAccessControl(e,i="s3"){let n=(await this.listOriginAccessControls()).find((r)=>r.Name===e&&r.OriginAccessControlOriginType===i);if(n)return{Id:n.Id,Name:n.Name,isNew:!1};let s=await this.createOriginAccessControl({name:e,originType:i});return{Id:s.Id,Name:s.Name,isNew:!0}}async createDistributionForS3(e){let{bucketName:i,bucketRegion:t,originAccessControlId:n,aliases:s=[],certificateArn:r,defaultRootObject:o="index.html",comment:a=`Distribution for ${i}`,priceClass:g="PriceClass_100",enabled:d=!0,trustedKeyGroupIds:c=[],mediaDelivery:h=!1}=e,l=`S3-${i}`,f=`${i}.s3.${t}.amazonaws.com`,m=`${Date.now()}-${Math.random().toString(36).slice(2)}`,C=c.length>0?`<TrustedKeyGroups>
+  <SigningBehavior>${r}</SigningBehavior>
+  <OriginAccessControlOriginType>${s}</OriginAccessControlOriginType>
+</OriginAccessControlConfig>`,a=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/origin-access-control",body:o,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),c=a.body?.OriginAccessControl||a.OriginAccessControl||a.body||a;return{Id:c.Id,Name:c.OriginAccessControlConfig?.Name||i,Description:c.OriginAccessControlConfig?.Description||t,SigningProtocol:c.OriginAccessControlConfig?.SigningProtocol||n,SigningBehavior:c.OriginAccessControlConfig?.SigningBehavior||r,OriginAccessControlOriginType:c.OriginAccessControlConfig?.OriginAccessControlOriginType||s,ETag:a.headers?.etag||a.ETag||""}}async findOrCreateOriginAccessControl(e,i="s3"){let n=(await this.listOriginAccessControls()).find((s)=>s.Name===e&&s.OriginAccessControlOriginType===i);if(n)return{Id:n.Id,Name:n.Name,isNew:!1};let r=await this.createOriginAccessControl({name:e,originType:i});return{Id:r.Id,Name:r.Name,isNew:!0}}async createDistributionForS3(e){let{bucketName:i,bucketRegion:t,originAccessControlId:n,aliases:r=[],certificateArn:s,defaultRootObject:o="index.html",comment:a=`Distribution for ${i}`,priceClass:c="PriceClass_100",enabled:d=!0,trustedKeyGroupIds:g=[],mediaDelivery:h=!1}=e,l=`S3-${i}`,y=`${i}.s3.${t}.amazonaws.com`,m=`${Date.now()}-${Math.random().toString(36).slice(2)}`,b=g.length>0?`<TrustedKeyGroups>
       <Enabled>true</Enabled>
-      <Quantity>${c.length}</Quantity>
-      <Items>${c.map((P)=>`<KeyGroup>${P}</KeyGroup>`).join("")}</Items>
-    </TrustedKeyGroups>`:"<TrustedKeyGroups><Enabled>false</Enabled><Quantity>0</Quantity></TrustedKeyGroups>",b="<Aliases><Quantity>0</Quantity></Aliases>";if(s.length>0)b=`<Aliases>
-    <Quantity>${s.length}</Quantity>
+      <Quantity>${g.length}</Quantity>
+      <Items>${g.map((P)=>`<KeyGroup>${P}</KeyGroup>`).join("")}</Items>
+    </TrustedKeyGroups>`:"<TrustedKeyGroups><Enabled>false</Enabled><Quantity>0</Quantity></TrustedKeyGroups>",p="<Aliases><Quantity>0</Quantity></Aliases>";if(r.length>0)p=`<Aliases>
+    <Quantity>${r.length}</Quantity>
     <Items>
-      ${s.map((P)=>`<CNAME>${P}</CNAME>`).join(`
+      ${r.map((P)=>`<CNAME>${P}</CNAME>`).join(`
       `)}
     </Items>
-  </Aliases>`;let y=`<ViewerCertificate>
+  </Aliases>`;let f=`<ViewerCertificate>
     <CloudFrontDefaultCertificate>true</CloudFrontDefaultCertificate>
-  </ViewerCertificate>`;if(r&&s.length>0)y=`<ViewerCertificate>
-    <ACMCertificateArn>${r}</ACMCertificateArn>
+  </ViewerCertificate>`;if(s&&r.length>0)f=`<ViewerCertificate>
+    <ACMCertificateArn>${s}</ACMCertificateArn>
     <SSLSupportMethod>sni-only</SSLSupportMethod>
     <MinimumProtocolVersion>TLSv1.2_2021</MinimumProtocolVersion>
     <CertificateSource>acm</CertificateSource>
@@ -92,7 +80,7 @@ ${Object.entries(e).filter(([r])=>!r.startsWith("@_")).map(([r,o])=>s(r,o,"  ","
     <Items>
       <Origin>
         <Id>${l}</Id>
-        <DomainName>${f}</DomainName>
+        <DomainName>${y}</DomainName>
         <OriginPath></OriginPath>
         <S3OriginConfig>
           <OriginAccessIdentity></OriginAccessIdentity>
@@ -120,11 +108,11 @@ ${Object.entries(e).filter(([r])=>!r.startsWith("@_")).map(([r,o])=>s(r,o,"  ","
     </AllowedMethods>
     <Compress>true</Compress>
     <CachePolicyId>658327ea-f89d-4fab-a63d-7e88639e58f6</CachePolicyId>
-    ${C}
+    ${b}
   </DefaultCacheBehavior>
-  ${b}
-  ${y}
-  <PriceClass>${g}</PriceClass>
+  ${p}
+  ${f}
+  <PriceClass>${c}</PriceClass>
   <Enabled>${d}</Enabled>
   <HttpVersion>http2and3</HttpVersion>
   <IsIPV6Enabled>true</IsIPV6Enabled>
@@ -139,5 +127,5 @@ ${Object.entries(e).filter(([r])=>!r.startsWith("@_")).map(([r,o])=>s(r,o,"  ","
       </CustomErrorResponse>
     </Items>
   </CustomErrorResponses>`}
-</DistributionConfig>`,p=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:T,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),I=p.body?.Distribution||p.Distribution||p.body||p;return{Id:I.Id,ARN:I.ARN,DomainName:I.DomainName,Status:I.Status,ETag:p.headers?.etag||p.ETag||""}}async createMediaDistributionForS3(e){return this.createDistributionForS3({...e,defaultRootObject:"",mediaDelivery:!0,comment:e.comment??`Media distribution for ${e.bucketName}`})}async listPublicKeys(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(e.PublicKeyList??e,"PublicKeySummary").map((t)=>({Id:String(t.Id),Name:String(t.Name),Comment:t.Comment?String(t.Comment):void 0}))}async createPublicKey(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront public key name is invalid");if(!e.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let i=(s)=>s.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${i(e.callerReference??`${Date.now()}-${e.name}`)}</CallerReference><Name>${i(e.name)}</Name><EncodedKey>${i(e.encodedKey)}</EncodedKey><Comment>${i(e.comment??"")}</Comment></PublicKeyConfig>`}),n=t.PublicKey??t;return{Id:String(n.Id),Name:String(n.PublicKeyConfig?.Name??e.name),EncodedKey:String(n.PublicKeyConfig?.EncodedKey??e.encodedKey),Comment:String(n.PublicKeyConfig?.Comment??e.comment??"")}}async listKeyGroups(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(e.KeyGroupList??e,"KeyGroupSummary").map((t)=>({Id:String(t.KeyGroup?.Id??t.Id),Name:String(t.KeyGroup?.KeyGroupConfig?.Name??t.KeyGroupConfig?.Name??t.Name),Items:this.collectionItems(t.KeyGroup?.KeyGroupConfig?.Items??t.KeyGroupConfig?.Items??t.Items,"Item").map(String),Comment:t.KeyGroup?.KeyGroupConfig?.Comment??t.KeyGroupConfig?.Comment??t.Comment}))}async createKeyGroup(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront key group name is invalid");let i=[...new Set(e.publicKeyIds)];if(i.length===0)throw TypeError("CloudFront key group requires at least one public key");let t=(o)=>o.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),n=i.map((o)=>`<Item>${t(o)}</Item>`).join(""),s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${t(e.name)}</Name><Items>${n}</Items><Comment>${t(e.comment??"")}</Comment></KeyGroupConfig>`}),r=s.KeyGroup??s;return{Id:String(r.Id),Name:String(r.KeyGroupConfig?.Name??e.name),Items:i,Comment:String(r.KeyGroupConfig?.Comment??e.comment??"")}}static getS3BucketPolicyForCloudFront(e,i){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e}/*`,Condition:{StringEquals:{"AWS:SourceArn":i}}}]}}async waitForDistributionDeployed(e,i=60){for(let t=0;t<i;t++){if((await this.getDistribution(e)).Status==="Deployed")return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async disableDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",n=i.body?.DistributionConfig||(i.body?.Enabled!==void 0?i.body:void 0)||i.DistributionConfig;if(!n||n.Enabled===void 0)throw Error("Failed to get current distribution config");n.Enabled=!1;let s=this.buildDistributionConfigXml(n),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:s,headers:{"Content-Type":"application/xml","If-Match":t},returnHeaders:!0});return{ETag:r.headers?.etag||r.headers?.ETag||r.ETag||""}}async deleteDistribution(e,i){let t=i||"";if(!t){let n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`,returnHeaders:!0});t=n.headers?.etag||n.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${e}`,headers:{"If-Match":t}})}async waitForDistributionDisabled(e,i=60){for(let t=0;t<i;t++){let n=await this.getDistribution(e);if(n.Status==="Deployed"&&!n.Enabled)return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async removeAlias(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),n=t.headers?.etag||t.headers?.ETag||"",s=t.body?.DistributionConfig||(t.body?.Enabled!==void 0?t.body:void 0)||t.DistributionConfig;if(!s||s.Enabled===void 0)throw Error("Failed to get current distribution config");let r=E(s.Aliases).Items;if(r.length===0)throw Error("Distribution has no aliases to remove");let o=r.filter((d)=>d!==i);if(o.length===r.length)throw Error(`Alias ${i} not found in distribution`);if(s.Aliases.Quantity=o.length,s.Aliases.Items=o.length>0?{CNAME:o}:void 0,o.length===0)s.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let a=this.buildDistributionConfigXml(s),g=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:a,headers:{"Content-Type":"application/xml","If-Match":n},returnHeaders:!0});return{ETag:g.headers?.etag||g.headers?.ETag||g.ETag||""}}}
+</DistributionConfig>`,C=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:T,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),I=C.body?.Distribution||C.Distribution||C.body||C;return{Id:I.Id,ARN:I.ARN,DomainName:I.DomainName,Status:I.Status,ETag:C.headers?.etag||C.ETag||""}}async createMediaDistributionForS3(e){return this.createDistributionForS3({...e,defaultRootObject:"",mediaDelivery:!0,comment:e.comment??`Media distribution for ${e.bucketName}`})}async listPublicKeys(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(e.PublicKeyList??e,"PublicKeySummary").map((t)=>({Id:String(t.Id),Name:String(t.Name),Comment:t.Comment?String(t.Comment):void 0}))}async createPublicKey(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront public key name is invalid");if(!e.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let i=(r)=>r.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${i(e.callerReference??`${Date.now()}-${e.name}`)}</CallerReference><Name>${i(e.name)}</Name><EncodedKey>${i(e.encodedKey)}</EncodedKey><Comment>${i(e.comment??"")}</Comment></PublicKeyConfig>`}),n=t.PublicKey??t;return{Id:String(n.Id),Name:String(n.PublicKeyConfig?.Name??e.name),EncodedKey:String(n.PublicKeyConfig?.EncodedKey??e.encodedKey),Comment:String(n.PublicKeyConfig?.Comment??e.comment??"")}}async listKeyGroups(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(e.KeyGroupList??e,"KeyGroupSummary").map((t)=>({Id:String(t.KeyGroup?.Id??t.Id),Name:String(t.KeyGroup?.KeyGroupConfig?.Name??t.KeyGroupConfig?.Name??t.Name),Items:this.collectionItems(t.KeyGroup?.KeyGroupConfig?.Items??t.KeyGroupConfig?.Items??t.Items,"Item").map(String),Comment:t.KeyGroup?.KeyGroupConfig?.Comment??t.KeyGroupConfig?.Comment??t.Comment}))}async createKeyGroup(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront key group name is invalid");let i=[...new Set(e.publicKeyIds)];if(i.length===0)throw TypeError("CloudFront key group requires at least one public key");let t=(o)=>o.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),n=i.map((o)=>`<Item>${t(o)}</Item>`).join(""),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${t(e.name)}</Name><Items>${n}</Items><Comment>${t(e.comment??"")}</Comment></KeyGroupConfig>`}),s=r.KeyGroup??r;return{Id:String(s.Id),Name:String(s.KeyGroupConfig?.Name??e.name),Items:i,Comment:String(s.KeyGroupConfig?.Comment??e.comment??"")}}static getS3BucketPolicyForCloudFront(e,i){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e}/*`,Condition:{StringEquals:{"AWS:SourceArn":i}}}]}}async waitForDistributionDeployed(e,i=60){for(let t=0;t<i;t++){if((await this.getDistribution(e)).Status==="Deployed")return!0;await new Promise((r)=>setTimeout(r,30000))}return!1}async disableDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",n=i.body?.DistributionConfig||(i.body?.Enabled!==void 0?i.body:void 0)||i.DistributionConfig;if(!n||n.Enabled===void 0)throw Error("Failed to get current distribution config");n.Enabled=!1;let r=this.buildDistributionConfigXml(n),s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:r,headers:{"Content-Type":"application/xml","If-Match":t},returnHeaders:!0});return{ETag:s.headers?.etag||s.headers?.ETag||s.ETag||""}}async deleteDistribution(e,i){let t=i||"";if(!t){let n=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`,returnHeaders:!0});t=n.headers?.etag||n.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${e}`,headers:{"If-Match":t}})}async waitForDistributionDisabled(e,i=60){for(let t=0;t<i;t++){let n=await this.getDistribution(e);if(n.Status==="Deployed"&&!n.Enabled)return!0;await new Promise((r)=>setTimeout(r,30000))}return!1}async removeAlias(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),n=t.headers?.etag||t.headers?.ETag||"",r=t.body?.DistributionConfig||(t.body?.Enabled!==void 0?t.body:void 0)||t.DistributionConfig;if(!r||r.Enabled===void 0)throw Error("Failed to get current distribution config");let s=E(r.Aliases).Items;if(s.length===0)throw Error("Distribution has no aliases to remove");let o=s.filter((d)=>d!==i);if(o.length===s.length)throw Error(`Alias ${i} not found in distribution`);if(r.Aliases.Quantity=o.length,r.Aliases.Items=o.length>0?{CNAME:o}:void 0,o.length===0)r.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let a=this.buildDistributionConfigXml(r),c=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:a,headers:{"Content-Type":"application/xml","If-Match":n},returnHeaders:!0});return{ETag:c.headers?.etag||c.headers?.ETag||c.ETag||""}}}
 export{wd,Sr,w};

package/dist/bin/{chunk-k9d81ar0.js → chunk-g00a221j.js}

@@ -1,4 +1,4 @@
-import{Gs,et,A,H,C,F,De,Wt}from"./chunk-kne9dmwr.js";import{se,sn,te,an,h,Rr,qs}from"./chunk-jeg6vw5v.js";import{Oe,b,rs,pr,Yn,Zn,pt,Kr,Ba,_t,Jr,We,Le,Ge,Fa,gt,mr,Me,Ke,ei,ti,zi,Hi,Je,Xr,hr,ft,m,Yi,hs,ys}from"./chunk-k8r5zfnf.js";import{Ft,u}from"./chunk-q9tvzcr7.js";import{g}from"./chunk-a9yp82q5.js";import{me}from"./chunk-7577ykbj.js";import{Er,Tt,wr,Cr,Ar,Ir,on}from"./chunk-remzfbhd.js";import{ze,ar,Mi,O,Wr,xa,$a,Dt,Jn,Xn}from"./chunk-9p7g25kx.js";import{v}from"./chunk-j2yy3tth.js";import{ie,W,Wn}from"./chunk-jf8jp6f5.js";import{w}from"./chunk-2q64f0df.js";import{V}from"./chunk-yrq5bkxe.js";import{R}from"./chunk-1chq0c2k.js";import{J,P,U,vr,yo,Tr,tn}from"./chunk-a1kpwbjg.js";import{co}from"./chunk-j8dkatkk.js";import{K,Cs,As,mo,Mt,z,Is}from"./chunk-9nnfyqme.js";import{ks,_s}from"./chunk-6hrycgbh.js";import{ts}from"./chunk-a3vraghd.js";import{Gr}from"./chunk-0sht4yfg.js";import{x,k,zs}from"./chunk-yqkdyf0w.js";import{createHash as FT}from"node:crypto";import{existsSync as po,mkdtempSync as cp,readdirSync as cb,rmSync as fs,statSync as Sb}from"node:fs";import{readFile as Ui,writeFile as gs}from"node:fs/promises";import{tmpdir as kd}from"node:os";import{dirname as UT,extname as Ga,join as Et,normalize as zT,relative as VT,resolve as qT,sep as JT}from"node:path";import{fileURLToPath as GT}from"node:url";class Md extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class ki{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new Md(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as TS}from"node:crypto";import{lstatSync as Nb,readdirSync as $b,readFileSync as Mb}from"node:fs";import{relative as Lb,resolve as xp,sep as Bb}from"node:path";function jb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function zo(e,t,r){return{path:e,reason:t,weight:r}}function Dp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Ts(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function Rt(e){let t=jb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Ts("dockerfile","dockerfile",0.99,[zo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=Dp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(Ts("laravel","server",0.98,[zo("artisan","Laravel Artisan entrypoint is present.",0.45),zo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Ts("php","server",0.82,[zo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=Dp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",l=[zo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)l.push(zo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(Ts(c,f.kind,Math.min(0.94,l.reduce((E,D)=>E+D.weight,0)),l,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Ts("static","static",0.78,[zo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Ts("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function $n(e,t={}){let r=xp(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),l=(a)=>{for(let f of $b(a).sort()){if(c.has(f))continue;let E=xp(a,f),D=Lb(r,E).split(Bb).join("/");if(!D||D.startsWith("../"))throw Error("Detection path escaped the application root");let N=Nb(E);if(N.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${D}`);if(N.isDirectory())l(E);else if(N.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let G={path:D,size:N.size};if(s.has(D)&&N.size<=i)G.content=Mb(E,"utf8");o.push(G)}}};return l(r),o}function Bd(e){if(Array.isArray(e))return`[${e.map(Bd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Bd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function pa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function Gn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Ld(e){return JSON.parse(JSON.stringify(e))}function Fb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ld({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ld({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ld({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function ce(e,t=[]){let r=[],n=(G)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(G),i=Object.fromEntries(Object.entries(e.environment??{}).map(([G,Y])=>{if(typeof Y==="string"&&n(G))return r.push(Gn(`environment.${G}`,"write_only_secret_required",`${G} must be supplied through the write-only secrets boundary.`)),[G,{secretRef:G}];return[G,Y]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let G=Object.fromEntries(Object.entries(e.build.buildArgs).map(([Y,ee])=>{if(n(Y))return r.push(Gn(`build.buildArgs.${Y}`,"write_only_build_secret_required",`${Y} must be declared in secretNames instead of buildArgs.`)),[Y,"[REDACTED]"];return[Y,ee]}));o={...e.build,buildArgs:G}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(Gn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!pa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(Gn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((G)=>!pa(G)))r.push(Gn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!pa(e.build.context)||!pa(e.build.dockerfile)))r.push(Gn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!pa(e.build.publishDirectory))r.push(Gn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(Gn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(Gn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(Gn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(Gn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(Gn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(Gn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(Gn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((G)=>typeof G==="object"?[G.secretRef]:[]),l=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=l.filter((G)=>!a.has(G)),E={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},D=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),N=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:E,configPatch:Fb({...e,build:o,environment:i}),capabilityRequirements:D,costDrivers:N,serializedManifest:`${Bd(E)}
+import{Gs,et,A,H,C,F,De,Wt}from"./chunk-kne9dmwr.js";import{se,sn,te,an,h,Rr,qs}from"./chunk-jeg6vw5v.js";import{Oe,b,rs,pr,Yn,Zn,pt,Kr,Ba,_t,Jr,We,Le,Ge,Fa,gt,mr,Me,Ke,ei,ti,zi,Hi,Je,Xr,hr,ft,m,Yi,hs,ys}from"./chunk-k8r5zfnf.js";import{Ft,u}from"./chunk-q9tvzcr7.js";import{g}from"./chunk-a9yp82q5.js";import{me}from"./chunk-7577ykbj.js";import{Er,Tt,wr,Cr,Ar,Ir,on}from"./chunk-remzfbhd.js";import{ze,ar,Mi,O,Wr,xa,$a,Dt,Jn,Xn}from"./chunk-9p7g25kx.js";import{v}from"./chunk-j2yy3tth.js";import{ie,W,Wn}from"./chunk-jf8jp6f5.js";import{w}from"./chunk-bvtpvstn.js";import{V}from"./chunk-yrq5bkxe.js";import{R}from"./chunk-1chq0c2k.js";import{J,P,U,vr,yo,Tr,tn}from"./chunk-a1kpwbjg.js";import{co}from"./chunk-j8dkatkk.js";import{K,Cs,As,mo,Mt,z,Is}from"./chunk-9nnfyqme.js";import{ks,_s}from"./chunk-6hrycgbh.js";import{ts}from"./chunk-a3vraghd.js";import{Gr}from"./chunk-0sht4yfg.js";import{x,k,zs}from"./chunk-yqkdyf0w.js";import{createHash as FT}from"node:crypto";import{existsSync as po,mkdtempSync as cp,readdirSync as cb,rmSync as fs,statSync as Sb}from"node:fs";import{readFile as Ui,writeFile as gs}from"node:fs/promises";import{tmpdir as kd}from"node:os";import{dirname as UT,extname as Ga,join as Et,normalize as zT,relative as VT,resolve as qT,sep as JT}from"node:path";import{fileURLToPath as GT}from"node:url";class Md extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class ki{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new Md(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as TS}from"node:crypto";import{lstatSync as Nb,readdirSync as $b,readFileSync as Mb}from"node:fs";import{relative as Lb,resolve as xp,sep as Bb}from"node:path";function jb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function zo(e,t,r){return{path:e,reason:t,weight:r}}function Dp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Ts(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function Rt(e){let t=jb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Ts("dockerfile","dockerfile",0.99,[zo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=Dp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(Ts("laravel","server",0.98,[zo("artisan","Laravel Artisan entrypoint is present.",0.45),zo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Ts("php","server",0.82,[zo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=Dp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",l=[zo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)l.push(zo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(Ts(c,f.kind,Math.min(0.94,l.reduce((E,D)=>E+D.weight,0)),l,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Ts("static","static",0.78,[zo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Ts("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function $n(e,t={}){let r=xp(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),l=(a)=>{for(let f of $b(a).sort()){if(c.has(f))continue;let E=xp(a,f),D=Lb(r,E).split(Bb).join("/");if(!D||D.startsWith("../"))throw Error("Detection path escaped the application root");let N=Nb(E);if(N.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${D}`);if(N.isDirectory())l(E);else if(N.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let G={path:D,size:N.size};if(s.has(D)&&N.size<=i)G.content=Mb(E,"utf8");o.push(G)}}};return l(r),o}function Bd(e){if(Array.isArray(e))return`[${e.map(Bd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Bd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function pa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function Gn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Ld(e){return JSON.parse(JSON.stringify(e))}function Fb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ld({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ld({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ld({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function ce(e,t=[]){let r=[],n=(G)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(G),i=Object.fromEntries(Object.entries(e.environment??{}).map(([G,Y])=>{if(typeof Y==="string"&&n(G))return r.push(Gn(`environment.${G}`,"write_only_secret_required",`${G} must be supplied through the write-only secrets boundary.`)),[G,{secretRef:G}];return[G,Y]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let G=Object.fromEntries(Object.entries(e.build.buildArgs).map(([Y,ee])=>{if(n(Y))return r.push(Gn(`build.buildArgs.${Y}`,"write_only_build_secret_required",`${Y} must be declared in secretNames instead of buildArgs.`)),[Y,"[REDACTED]"];return[Y,ee]}));o={...e.build,buildArgs:G}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(Gn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!pa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(Gn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((G)=>!pa(G)))r.push(Gn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!pa(e.build.context)||!pa(e.build.dockerfile)))r.push(Gn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!pa(e.build.publishDirectory))r.push(Gn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(Gn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(Gn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(Gn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(Gn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(Gn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(Gn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(Gn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((G)=>typeof G==="object"?[G.secretRef]:[]),l=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=l.filter((G)=>!a.has(G)),E={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},D=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),N=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:E,configPatch:Fb({...e,build:o,environment:i}),capabilityRequirements:D,costDrivers:N,serializedManifest:`${Bd(E)}
 `}}function Op(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function _p(e,t,r={}){let n=r.maxBytes??104857600,i=r.maxEntries??1e4,o=r.maxExpandedBytes??524288000;if(e.byteLength>n)throw Error("Archive exceeds the compressed size limit");let s=new DataView(e.buffer,e.byteOffset,e.byteLength),c=[],l=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let f=0;while(f+30<=e.length){let E=s.getUint32(f,!0);if(E===33639248||E===101010256)break;if(E!==67324752)throw Error("Malformed ZIP local header");let D=s.getUint16(f+6,!0),N=s.getUint32(f+18,!0),G=s.getUint32(f+22,!0),Y=s.getUint16(f+26,!0),ee=s.getUint16(f+28,!0);if(D&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let oe=new TextDecoder().decode(e.subarray(f+30,f+30+Y));if(!Op(oe))throw Error(`Unsafe archive path: ${oe}`);if(c.push(oe),l+=G,c.length>i||l>o)throw Error("Archive expansion limit exceeded");f+=30+Y+ee+N}return{format:"zip",entries:c.length,expandedBytes:l,paths:c}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let a=0;while(a+512<=e.length){let f=e.subarray(a,a+512);if(f.every((Y)=>Y===0))break;let E=(Y,ee)=>new TextDecoder().decode(f.subarray(Y,Y+ee)).replace(/\0.*$/,""),D=`${E(345,155)}${E(345,155)?"/":""}${E(0,100)}`,N=Number.parseInt(E(124,12).trim()||"0",8),G=String.fromCharCode(f[156]??0);if(!Op(D))throw Error(`Unsafe archive path: ${D}`);if(G==="1"||G==="2")throw Error(`Archive links are not accepted: ${D}`);if(!Number.isFinite(N)||N<0)throw Error("Malformed TAR entry size");if(c.push(D),l+=N,c.length>i||l>o)throw Error("Archive expansion limit exceeded");a+=512+Math.ceil(N/512)*512}return{format:"tar",entries:c.length,expandedBytes:l,paths:c}}var Np=new Set(["source","build","runtime","environment","domain","review"]);function $p(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Mp(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function Lp(e){for(let[r,n]of Object.entries(e.environment??{}))if(typeof n==="string"&&Mp(r)&&n)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,n]of Object.entries(e.build.buildArgs??{}))if(Mp(r)&&n)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function Bp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:$p(e.input,{}),suppliedSecretNames:$p(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class On{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(Lp(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),n=this.now(),i=e.step??"source";if(!Np.has(i))throw Error("Invalid draft step");let o=[...new Set(e.suppliedSecretNames??[])].sort(),s=ce(e.draft,o).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),i,JSON.stringify(e.draft),JSON.stringify(o),s,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:i,status:s,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?Bp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Bp)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!Np.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==n.projectId)throw Error("Draft project cannot be changed");Lp(r.draft);let i=[...new Set(r.suppliedSecretNames??n.suppliedSecretNames)].sort(),o=ce(r.draft,i).valid?"ready":"draft",s=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(i),o,s,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:o}}),this.get(e)}markApplied(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let i=ce(n.input,n.suppliedSecretNames);if(!i.valid)throw Error(`Draft is not deployable: ${[...i.issues.map((s)=>s.message),...i.missingSecrets.map((s)=>`Missing secret ${s}`)].join("; ")}`);let o=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[o,e,t]),this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r,type:"application.draft.applied",payload:h({draftId:e,manifest:i.manifest})}),this.get(e)}}import{createCipheriv as Ub,createDecipheriv as zb,createHash as Up,randomBytes as Vb}from"node:crypto";function ga(e){return typeof e==="string"&&e?e:void 0}function jd(e){return Up("sha256").update(e).digest("hex").slice(0,16)}function jp(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function qb(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:ga(e.credential_fingerprint),credentialExpiresAt:ga(e.credential_expires_at),status:String(e.status),healthMessage:ga(e.health_message),lastTestedAt:ga(e.last_tested_at),version:Number(e.version),createdByActorId:ga(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Ln{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=Up("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Vb(12),r=Ub("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Registry credential envelope is invalid");let o=zb("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}current(e){let t=qb(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),n=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),jp(e.host),t?this.encrypt(t):null,t?jd(t):null,e.credentialExpiresAt??null,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:jp(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let n=this.get(e);if(!n||n.status==="disconnected")throw Error("Registry connection was not found");let i=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(i),jd(i),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:jd(i),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let n=this.credential(e),i=t.fetch??fetch,o=new AbortController,s=setTimeout(()=>o.abort(),t.timeoutMs??15000),c=n?.token?`Bearer ${n.token}`:n?.username||n?.password?`Basic ${Buffer.from(`${n.username??""}:${n.password??""}`).toString("base64")}`:void 0;try{let l=await i(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:o.signal,headers:c?{Authorization:c}:void 0}),a=l.headers.get("www-authenticate")??"";if(l.status===401&&a.startsWith("Bearer ")&&n){let D=Object.fromEntries([...a.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((oe)=>[oe[1],oe[2]])),N=new URL(D.realm??"");if(N.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(D.service)N.searchParams.set("service",D.service);if(t.image)N.searchParams.set("scope",`repository:${zp(t.image).repository}:pull`);let G=await i(N,{signal:o.signal,redirect:"error",headers:c?{Authorization:c}:void 0});if(!G.ok)throw Error(`Registry authentication failed (${G.status})`);let Y=await G.json(),ee=Y.token??Y.access_token;if(!ee)throw Error("Registry did not return an access token");l=t.image?await Fp(i,r.host,t.image,ee,o.signal):await i(`${r.host}/v2/`,{signal:o.signal,redirect:"error",headers:{Authorization:`Bearer ${ee}`}})}else if(l.ok&&t.image)l=await Fp(i,r.host,t.image,n?.token,o.signal,c);let f=l.ok?"healthy":"degraded",E=l.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${l.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[f,E,this.now(),this.now(),e]),this.get(e)}catch(l){let a=o.signal.aborted?"Registry request timed out.":l instanceof Error?l.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[a.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(s)}}}function zp(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let n=t.slice(r+1),i=n.lastIndexOf("@"),o=n.lastIndexOf(":"),s=i>=0?i:o>n.lastIndexOf("/")?o:-1,c=s>=0?n.slice(0,s):n,l=s>=0?n.slice(s+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(c)||!/^[A-Za-z0-9_.:+-]+$/.test(l))throw Error("Image reference is invalid");return{repository:c,reference:l}}async function Fp(e,t,r,n,i,o){let s=zp(r);return e(`${t}/v2/${s.repository}/manifests/${encodeURIComponent(s.reference)}`,{method:"HEAD",redirect:"error",signal:i,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...n?{Authorization:`Bearer ${n}`}:o?{Authorization:o}:{}}})}import{createHash as Jb}from"node:crypto";import{chmodSync as Vp,existsSync as qp,mkdirSync as Gb,renameSync as Wb,unlinkSync as Jp,writeFileSync as Hb}from"node:fs";import{basename as Kb,join as Qb}from"node:path";function Fd(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class Mn{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=A(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=Kb(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let n=_p(e.bytes,r),i=Jb("sha256").update(e.bytes).digest("hex"),o=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,i);if(o)return Fd(o);let s=this.idFn();Gb(this.root,{recursive:!0,mode:448}),Vp(this.root,448);let c=Qb(this.root,`${s}.archive`),l=`${c}.partial`;try{Hb(l,e.bytes,{mode:384,flag:"wx"}),Wb(l,c),Vp(c,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.organizationId,e.projectId,r,c,i,e.bytes.byteLength,n.format,n.entries,n.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(a){if(qp(l))Jp(l);if(qp(c))Jp(c);throw a}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:s,filename:r,sha256:i,size:e.bytes.byteLength,entries:n.entries}}),this.get(s)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?Fd(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(Fd)}}function $r(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),n=r?e.controlPlane.listEnvironments(r.id).find((a)=>a.id===t.input.environmentId):void 0;if(!r||!n||n.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==n.slug)throw Error(`Type ${n.slug} to confirm this deployment target`);let i=ce(t.input,t.suppliedSecretNames);if(!i.valid)throw Error(`Application plan is invalid: ${[...i.issues.map((a)=>a.message),...i.missingSecrets.map((a)=>`Missing secret ${a}`)].join("; ")}`);let o=e.controlPlane.listResources(r.id,n.id).find((a)=>a.kind==="application"&&a.slug===t.input.slug),s=JSON.parse(JSON.stringify({manifest:i.manifest,configPatch:i.configPatch})),c=o?e.controlPlane.updateResource(o.id,o.version,{name:t.input.name,desiredState:s}):e.controlPlane.createResource({projectId:r.id,environmentId:n.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:s,metadata:{source:"application-onboarding",draftId:t.id}}),l=new b(e.controlPlane).enqueue({projectId:r.id,environmentId:n.id,resourceId:c.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:s,lockKey:`resource:${c.id}`,providerKey:c.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:c.id,operationId:l.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:n.slug,strategy:t.input.build.kind,costDrivers:i.costDrivers}}),{plan:i,resource:c,operation:l}}function rr(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,n=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",i=(o,s)=>s&&(o==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:i("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:i("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:i("blue_green",n),explanation:n?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:i("canary",n),explanation:n?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function ec(e,t){let r=rr(e).find((n)=>n.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as Yb}from"node:crypto";var Xb=/^sha256:[a-f0-9]{64}$/,Zb=/^[a-f0-9]{40,64}$/i;function _i(e){return typeof e==="string"&&e?e:void 0}function Vo(e,t){try{return JSON.parse(String(e))}catch{return t}}function Gp(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:Vo(e.provenance,{}),attestation:Vo(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Wp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:_i(e.source_sha),configHash:String(e.config_hash),manifest:Vo(e.manifest,{}),provenance:Vo(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:Vo(e.health_gate,void 0),hooks:Vo(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:_i(e.previous_release_id),promotedFromReleaseId:_i(e.promoted_from_release_id),actorId:_i(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:_i(e.pin_reason),activatedAt:_i(e.activated_at),failedAt:_i(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function eS(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:_i(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:Vo(e.health,{}),message:String(e.message),operationId:_i(e.operation_id),createdAt:String(e.created_at)}}function tS(e,t){let r=[],n=(i,o,s)=>{if(JSON.stringify(o)===JSON.stringify(s))return;if(o&&s&&typeof o==="object"&&typeof s==="object"&&!Array.isArray(o)&&!Array.isArray(s)){for(let c of[...new Set([...Object.keys(o),...Object.keys(s)])].sort())n(i?`${i}.${c}`:c,o[c],s[c]);return}r.push({path:i,...o!==void 0?{before:o}:{},...s!==void 0?{after:s}:{}})};return n("",e,t),r}class Ud{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Xb.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return Gp(t);let r=this.id(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(h(e.provenance??{})),JSON.stringify(h(e.attestation??{})),n,n]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?Gp(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),n=this.controlPlane.listEnvironments(e.projectId).find((E)=>E.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!n)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Zb.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");ec({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let i=h(e.config),o=Yb("sha256").update(JSON.stringify(i)).digest("hex"),s=this.active(e.resourceId),c=this.id(),l=this.now().toISOString(),a=e.approvalRequired?"awaiting_approval":"built",f=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,o,JSON.stringify(h(e.manifest)),JSON.stringify(h(e.provenance??{})),e.strategy,a,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(f),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,s?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",l,l]),this.recordTransition(c,void 0,a,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(c)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Wp(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Wp).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(eS)}recordTransition(e,t,r,n){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,n.trafficPercent??null,JSON.stringify(h(n.health??{})),n.message.slice(0,1000),n.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let n=this.get(e);if(!n)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[n.status].includes(t))throw Error(`Invalid release transition ${n.status} → ${t}`);let o=this.now().toISOString();if(t==="active"){let s=this.active(n.resourceId);if(s&&s.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[o,s.id]),this.recordTransition(s.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,o,t,o,o,e]),this.recordTransition(e,n.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let n=this.id(),i=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,i]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:_i(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),n=this.get(t);if(!r||!n)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==n.artifactId,sourceChanged:r.sourceSha!==n.sourceSha,configChanged:r.configHash!==n.configHash,manifestChanges:tS(r.manifest,n.manifest),dataCaveat:n.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${n.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let n of this.list()){let i=r.get(n.resourceId)??[];i.push(n),r.set(n.resourceId,i)}return[...r.values()].flatMap((n)=>n.slice(t)).filter((n)=>new Date(n.createdAt)<e.before&&!n.pinned&&!["active","activating","awaiting_approval"].includes(n.status)&&!this.list().some((i)=>i.previousReleaseId===n.id&&["active","activating"].includes(i.status)))}}class ot{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Ud(e),this.queue=new b(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let n=t.action??"activate",i=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${n}`,idempotencyKey:`release:${r.id}:${n}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${n} queued.`,operationId:i.id,trafficPercent:0}),i}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let n=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),i=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!i)return{release:n};let o=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:i.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:n,rollbackOperation:o}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let n=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!n||n.resourceId!==r.resourceId||!["superseded","active"].includes(n.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${n.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:n.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function rS(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function Hp(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");ec({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:rS(t.release)})}async function Kp(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var nS=["release.activate","release.rollback"];function iS(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Qp(e){let t=new ot(e.store),r=async(n)=>{let i=iS(n.operation.input),o=typeof i.releaseId==="string"?i.releaseId:"",s=t.releases.get(o);if(!s)throw Error(`Queued release ${o||"(missing)"} was not found`);if(s.projectId!==n.operation.projectId||s.environmentId!==n.operation.environmentId||s.resourceId!==n.operation.resourceId)throw Error("Queued release does not match the operation scope");let c=t.releases.getArtifact(s.artifactId);if(!c||c.digest!==t.releases.getArtifact(s.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let l=typeof i.targetReleaseId==="string"&&i.targetReleaseId?i.targetReleaseId:s.previousReleaseId,a=l?t.releases.get(l):void 0;if(a&&(a.resourceId!==s.resourceId||a.artifactId===s.artifactId&&a.id===s.id))throw Error("Rollback target does not match the release resource");let f=await e.resolveDriver(s);n.checkpoint("verify",`Verifying ${c.digest} and ${s.configHash} for ${f.name}.`),n.log(`Artifact ${c.digest}; source ${s.sourceSha??"not recorded"}; config ${s.configHash}.`,{stream:"system"}),n.throwIfCancellationRequested();let E;try{E=n.operation.kind==="release.rollback"?await Kp(f,{release:s,artifact:c,previous:a}):await Hp(f,{release:s,artifact:c,previous:a})}catch(D){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:D instanceof Error?D.message:String(D)});throw D}for(let D of E.transitions)t.releases.progress(s.id,{message:`${n.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${D.trafficPercent}%.`,trafficPercent:D.trafficPercent,health:D.observed,operationId:n.operation.id}),n.log(`Traffic ${D.trafficPercent}%: ${D.healthy?"healthy":"unhealthy"}.`,{stream:D.healthy?"step":"stderr",step:"health"});if(n.checkpoint("health","Evaluating the provider health result."),!E.activated||!E.healthy){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:{resourceVersions:E.resourceVersions},message:E.error??"Provider health gate failed."});throw Error(E.error??`${f.name} reported an unhealthy release`)}if(n.operation.kind==="release.activate"&&s.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:`Named health gate ${s.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${s.healthGate.name} is unavailable`);n.checkpoint("named-health-gate",`Waiting on ${s.healthGate.name}.`);let D=await e.resolveHealthGate(s.healthGate.name,s);if(n.log(`${s.healthGate.name}: ${D.healthy?"healthy":"unhealthy"}${D.message?` — ${D.message}`:""}.`,{stream:D.healthy?"step":"stderr",step:"health"}),!D.healthy)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:D.evidence,message:D.message??`Named health gate ${s.healthGate.name} failed.`}),Error(D.message??`Named health gate ${s.healthGate.name} failed`)}if(n.operation.kind==="release.rollback"){let D=t.releases.get(s.id);if(D.status!=="rolled_back")t.releases.transition(D.id,"rolled_back",{message:`Traffic restored through ${f.name}.`,operationId:n.operation.id,trafficPercent:0,health:{resourceVersions:E.resourceVersions}});if(a&&a.status!=="active"){let N=a.status==="activating"?a:t.releases.transition(a.id,"activating",{message:"Rollback target restoring traffic.",operationId:n.operation.id,trafficPercent:0});t.releases.transition(N.id,"active",{message:"Previous immutable release restored.",operationId:n.operation.id,trafficPercent:100,health:{resourceVersions:E.resourceVersions}})}}else t.completeHealthGate(s.id,{healthy:!0,operationId:n.operation.id,health:{providerVersion:E.providerVersion??null,resourceVersions:E.resourceVersions},message:"Provider activation and health gates completed."});return n.checkpoint("finalize","Persisted the terminal release state."),{releaseId:s.id,artifactDigest:c.digest,provider:f.name,providerVersion:E.providerVersion??null,resourceVersions:E.resourceVersions,status:t.releases.get(s.id).status}};return Object.fromEntries(nS.map((n)=>[n,r]))}import{createCipheriv as oS,createDecipheriv as sS,createHash as tg,randomBytes as zd}from"node:crypto";var rg={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function xt(e){return typeof e==="string"&&e?e:void 0}function Go(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function $i(e){return JSON.stringify(h(e))}function Jo(e){return tg("sha256").update(e).digest("hex")}function Yp(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Xp(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function Vd(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function Zp(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function tc(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function aS(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function cS(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:xt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:xt(e.credential_fingerprint),grantedScopes:Go(e.granted_scopes,[]),capabilities:Go(e.capabilities,rg[String(e.provider)]),status:String(e.status),healthMessage:xt(e.health_message),lastTestedAt:xt(e.last_tested_at),lastSyncedAt:xt(e.last_synced_at),credentialExpiresAt:xt(e.credential_expires_at),version:Number(e.version),createdByActorId:xt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qd(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:Go(e.metadata,{}),syncedAt:String(e.synced_at)}}function eg(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:xt(e.environment_id),resourceId:xt(e.resource_id),connectionId:String(e.connection_id),repositoryId:xt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:xt(e.branch_rule),tagRule:xt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:Go(e.include_paths,[]),excludePaths:Go(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:xt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:xt(e.disabled_reason),version:Number(e.version),createdByActorId:xt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Jd(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:xt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Gd(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:xt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:xt(e.provider_webhook_id),events:Go(e.events,[]),status:String(e.status),healthMessage:xt(e.health_message),lastDeliveryAt:xt(e.last_delivery_at),lastReconciledAt:xt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Wd(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:xt(e.action),commitSha:xt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:Go(e.payload_summary,{}),operationId:xt(e.operation_id),error:xt(e.error),receivedAt:String(e.received_at),processedAt:xt(e.processed_at)}}class Yt{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?tg("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=zd(12),r=oS("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted source credential is unavailable");let o=sS("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),n=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Xp(e.name),Yp(e.host),e.owner?.trim()||null,e.authKind??(n?"access_token":"none"),n?this.encrypt(n):null,n?Jo(n).slice(0,16):null,$i([...new Set(e.grantedScopes??[])].sort()),$i(rg[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:Yp(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=cS(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let n=this.getConnection(e);if(!n||n.status==="disconnected")throw Error("Active source connection was not found");let i=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(i),Jo(i).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:Jo(i).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let n=this.now(),i=t.grantedScopes?[...new Set(t.grantedScopes.map((o)=>o.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,i?$i(i):null,t.tested?n:null,t.synced?n:null,n,e]),i&&JSON.stringify(i)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:i}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),n=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),i=n?String(n.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[i,e.connectionId,e.providerRepositoryId,Vd(e.fullName),aS(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,$i(e.metadata),r]),qd(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(i))}listRepositories(e,t,r=100){let n=t?.trim().toLowerCase();return(n?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${n}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(qd)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?qd(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),n=this.now(),i=`sha256:${Jo(e.publicKey.trim())}`,o=`sha256:${Jo(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Xp(e.name),e.publicKey.trim(),i,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),o,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:i,hostFingerprint:o}}),Jd(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?Jd(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(Jd)}revokeDeployKey(e,t){let r=this.getDeployKey(e),n=r?this.getConnection(r.connectionId):void 0;if(!r||!n)throw Error("Deploy key was not found");let i=this.listBindings({connectionId:n.id}).filter((s)=>s.deployKeyId===e),o=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[o,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:n.id,deployKeyId:e,affectedBindingIds:i.map((s)=>s.id)}}),{affectedBindings:i}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),n=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)