@stacksjs/ts-cloud 0.16.35 → 0.16.36

package/dist/{chunk-abadztwc.js → chunk-78shfb0z.js}

@@ -1,4 +1,4 @@
-import{kd,L,d,xd,U,g,me,p,Kt,Md,Li,bo,Hd,qd,jd,pl,Yr,Hi,er,ml,fl,bl,Cl}from"./chunk-9aaj9a0s.js";import{_,u}from"./chunk-ctkzxq0d.js";import{pe,Qt,P,Ht,s,bi,Ws,_r,Zc,ed,ee,c,Ys,qe,Lr,td,Gt,eo,rd,$r,to,Mr,vi,jt,Di,Pi,je,zt,Ed,vd,ki,Bi,At,fo,i,xi,Ao,yo}from"./chunk-fszn9rnn.js";import{n}from"./chunk-7gvnrx46.js";import{o}from"./chunk-jch6ks7a.js";import{Cn}from"./chunk-906prq6g.js";import{be}from"./chunk-tsaffke7.js";import{En,Ju,As,B,w,ys,Xu}from"./chunk-n4z75mk8.js";import{Se,ar,Cs,nt,K,oe,E,Ie,lr,ae,st,gr}from"./chunk-c97wwdtk.js";import{W}from"./chunk-pdjap529.js";import{v,yr,$s,Mt,Sr,dg,Ft,ug,gg,bc,He,lt,Zn,O,Ut,Dr}from"./chunk-annmzhbb.js";import{S}from"./chunk-0kddm2mt.js";import{Me}from"./chunk-hvwqct5q.js";import{De}from"./chunk-ajn6xp8v.js";import{h}from"./chunk-mxw5gkd8.js";function mn(e){let t=Dc(e.name),r=Nl(e.configText);if(kw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=_f({...e,name:t}),l=e.configText.slice(0,r.end).trimEnd(),m=e.configText.slice(r.end),f=l.endsWith("{")?`
+import{kd,L,d,xd,U,g,me,p,Kt,Md,Li,bo,Hd,qd,jd,pl,Yr,Hi,er,ml,fl,bl,Cl}from"./chunk-9aaj9a0s.js";import{_,u}from"./chunk-ctkzxq0d.js";import{pe,Qt,P,Ht,s,bi,Ws,_r,Zc,ed,ee,c,Ys,qe,Lr,td,Gt,eo,rd,$r,to,Mr,vi,jt,Di,Pi,je,zt,Ed,vd,ki,Bi,At,fo,i,xi,Ao,yo}from"./chunk-fszn9rnn.js";import{n}from"./chunk-7gvnrx46.js";import{o}from"./chunk-ncsb3sdn.js";import{Cn}from"./chunk-q9rdxpmg.js";import{be}from"./chunk-mhv7dbr1.js";import{En,Ju,As,B,w,ys,Xu}from"./chunk-n4z75mk8.js";import{Se,ar,Cs,nt,K,oe,E,Ie,lr,ae,st,gr}from"./chunk-2x636sgn.js";import{W}from"./chunk-pdjap529.js";import{v,yr,$s,Mt,Sr,dg,Ft,ug,gg,bc,He,lt,Zn,O,Ut,Dr}from"./chunk-k3mazfb2.js";import{S}from"./chunk-0kddm2mt.js";import{Me}from"./chunk-hvwqct5q.js";import{De}from"./chunk-ajn6xp8v.js";import{h}from"./chunk-mxw5gkd8.js";function mn(e){let t=Dc(e.name),r=Nl(e.configText);if(kw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=_f({...e,name:t}),l=e.configText.slice(0,r.end).trimEnd(),m=e.configText.slice(r.end),f=l.endsWith("{")?`
 `:l.endsWith(",")?`
 
 `:`,
@@ -70,7 +70,7 @@ data: ${JSON.stringify(ut)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,l,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(m),JSON.stringify(f),e.defaultRole??b.defaultRole,e.enabled??b.enabled?1:0,e.enforceSso??b.enforceSso?1:0,k,b.id]),this.getOidcProvider(b.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let y=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[y,e.organizationId,t,r,a,l,this.encrypt(e.clientSecret),JSON.stringify(m),JSON.stringify(f),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,k,k]),this.getOidcProvider(y)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Lc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Lc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Lc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Lc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let l=this.idFn(),m=ci(32).toString("base64url"),f=ci(32).toString("base64url"),b=ci(64).toString("base64url"),k=this.now(),y=new Date(this.nowFn().getTime()+$l).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e,qn(m),this.encrypt(f),this.encrypt(b),t,r,y,k]),{transaction:this.getOidcTransaction(l),state:m,nonce:f,verifier:b}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,qn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?hI(r):void 0}linkOidcSubject(e,t,r,a){let l=this.getOidcProvider(e),m=this.getIdentity(t);if(!l||!m)throw Error("OIDC provider or identity was not found");let f=Sp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let b=this.getOidcSubject(e,r);if(b&&b.identityId!==t)throw Error("OIDC subject is already linked to another identity");let k=this.now();if(b)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[f,k,b.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,f,k,k]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function nn(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-f4m9k2q6.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as yI}from"node:crypto";import{chmodSync as vI,existsSync as bI,mkdirSync as SI,readFileSync as wI,writeFileSync as kI}from"node:fs";import{dirname as II}from"node:path";function gf(){return L("auth-encryption-key")}function Ze(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(bI(r)){let l=wI(r,"utf8").trim();if(l)return l}}catch{}let a=yI(32).toString("base64url");try{SI(II(r),{recursive:!0,mode:448}),kI(r,`${a}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e,qn(m),this.encrypt(f),this.encrypt(b),t,r,y,k]),{transaction:this.getOidcTransaction(l),state:m,nonce:f,verifier:b}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,qn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?hI(r):void 0}linkOidcSubject(e,t,r,a){let l=this.getOidcProvider(e),m=this.getIdentity(t);if(!l||!m)throw Error("OIDC provider or identity was not found");let f=Sp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let b=this.getOidcSubject(e,r);if(b&&b.identityId!==t)throw Error("OIDC subject is already linked to another identity");let k=this.now();if(b)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[f,k,b.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,f,k,k]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function nn(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-wxtr8sv8.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as yI}from"node:crypto";import{chmodSync as vI,existsSync as bI,mkdirSync as SI,readFileSync as wI,writeFileSync as kI}from"node:fs";import{dirname as II}from"node:path";function gf(){return L("auth-encryption-key")}function Ze(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(bI(r)){let l=wI(r,"utf8").trim();if(l)return l}}catch{}let a=yI(32).toString("base64url");try{SI(II(r),{recursive:!0,mode:448}),kI(r,`${a}
 `,{mode:384}),vI(r,384)}catch{}return a}import{constants as EI,createHash as Ip,createPublicKey as RI,createVerify as AI,timingSafeEqual as CI}from"node:crypto";var Ph=new Set(["RS256","PS256","ES256"]),Ch=60;function Fc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function Ep(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function Rp(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let l=await e.text();if(l.length>1048576)throw Error(`${t} response is too large`);try{return Ep(JSON.parse(l),t)}catch(m){if(m instanceof Error&&m.message===`${t} is invalid`)throw m;throw Error(`${t} returned invalid JSON`)}}function PI(e,t){let r=Ip("sha256").update(e).digest(),a=Ip("sha256").update(t).digest();return CI(r,a)}function Ml(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function Go(e,t=fetch){let r=Fc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),l=await Rp(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(l.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let f of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof l[f]!=="string")throw Error(`OIDC discovery is missing ${f}`);Fc(l[f],`OIDC ${f}`)}if(Array.isArray(l.response_types_supported)&&!l.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(l.code_challenge_methods_supported)&&!l.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let m=Array.isArray(l.id_token_signing_alg_values_supported)?l.id_token_signing_alg_values_supported.filter((f)=>typeof f==="string"):[];if(m.length>0&&!m.some((f)=>Ph.has(f)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return l}async function Vo(e,t,r,a,l=fetch){let m=e.getOidcProviderBySlug(t);if(!m?.enabled)throw Error("OIDC provider is unavailable");let f=Fc(r,"Application origin").origin,b=await Go(m,l),k=`${f}/auth/oidc/${encodeURIComponent(m.slug)}/callback`,y=e.beginOidcTransaction(m.id,k,Ml(a)),R=new URL(b.authorization_endpoint);return R.searchParams.set("response_type","code"),R.searchParams.set("client_id",m.clientId),R.searchParams.set("redirect_uri",k),R.searchParams.set("scope",m.scopes.join(" ")),R.searchParams.set("state",y.state),R.searchParams.set("nonce",y.nonce),R.searchParams.set("code_challenge",Ip("sha256").update(y.verifier).digest("base64url")),R.searchParams.set("code_challenge_method","S256"),{authorizationUrl:R.href,expiresAt:y.transaction.expiresAt}}function _I(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:Ep(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:Ep(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function TI(e,t,r){let a=_I(e),l=typeof a.header.alg==="string"?a.header.alg:"",m=typeof a.header.kid==="string"?a.header.kid:"";if(!Ph.has(l)||!m)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(l))throw Error("OIDC ID-token algorithm was not advertised by the provider");let f=await Rp(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(f.keys))throw Error("OIDC signing-key response is invalid");let b=f.keys.find((T)=>{if(!T||typeof T!=="object"||Array.isArray(T))return!1;let N=T;return N.kid===m&&(!N.alg||N.alg===l)&&(!N.use||N.use==="sig")});if(!b)throw Error("OIDC ID-token signing key was not found");let k=RI({key:b,format:"jwk"}),y=AI("SHA256").update(a.signingInput).end();if(!(l==="PS256"?y.verify({key:k,padding:EI.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):l==="ES256"?y.verify({key:k,dsaEncoding:"ieee-p1363"},a.signature):y.verify(k,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function xI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let l=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((k)=>typeof k==="string"):[];if(!l.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((l.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let m=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<m-Ch)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>m+Ch)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!PI(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let f=e.email.trim().toLowerCase();if(f.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(f))throw Error("OIDC provider returned an invalid email address");let b=f.split("@")[1];if(!b||!t.allowedDomains.includes(b))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:f,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function qo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let l=Fc(t.origin,"Application origin").origin,m=e.consumeOidcTransaction(a.id,t.state),f=`${l}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(m.transaction.redirectUri!==f)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:b}=e.getOidcProviderCredentials(a.id),k=await Go(a,r),y=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:m.transaction.redirectUri,code_verifier:m.verifier}),R={accept:"application/json","content-type":"application/x-www-form-urlencoded"},T=k.token_endpoint_auth_methods_supported??["client_secret_basic"];if(T.includes("client_secret_basic")){let q=(Y)=>new URLSearchParams({value:Y}).toString().slice(6),V=`${q(a.clientId)}:${q(b)}`;R.authorization=`Basic ${Buffer.from(V).toString("base64")}`}else if(T.includes("client_secret_post"))y.set("client_id",a.clientId),y.set("client_secret",b);else throw Error("OIDC provider does not support a configured client authentication method");let N=await Rp(await r(k.token_endpoint,{method:"POST",headers:R,body:y,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof N.id_token!=="string")throw Error("OIDC token response did not include an ID token");let j=await TI(N.id_token,k,r);return{identity:xI(j,a,m.nonce,t.now??new Date),returnPath:m.transaction.returnPath}}import{createHash as DI,randomBytes as OI}from"node:crypto";var Th=new Set(pe),Fl=7776000000,Ul=31536000000,Ql=86400000;function di(e){return typeof e==="string"?e:void 0}function _h(e){return DI("sha256").update(e).digest("hex")}function $I(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&Th.has(r)):[]}catch{return[]}}function NI(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Ap(e){let t=di(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:di(e.description),createdByActorId:di(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function Cp(e,t){let r=di(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:$I(e.capabilities),scope:NI(e),expiresAt:a,lastUsedAt:di(e.last_used_at),lastNetworkHint:di(e.last_network_hint),revokedAt:r,rotatedFromTokenId:di(e.rotated_from_token_id),createdByActorId:di(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function jI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:di(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class Wi{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),l=this.idFn(),m=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,m,m]);let f=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),b=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:l,roleTemplate:e.roleTemplate,scope:{type:b.type,id:b.id??null}}}),{serviceAccount:this.getServiceAccount(l),membership:f}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Ap(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Ap(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Ap).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let l=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(l?.status==="active")this.controlPlane.revokeMembership(l.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((N)=>!Th.has(N)))throw Error("API token requires valid explicit capabilities");let l=e.scope??r.scope,m=this.controlPlane.resolveAuthorizationTarget(t.organizationId,l);if(!m)throw Error("API token scope was not found in this organization");for(let N of a)if(!P({membership:r,grants:this.controlPlane.listGrants(r.id),capability:N,target:m}).allowed)throw Error(`Service-account membership does not grant ${N} at the token scope`);let f=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+Fl);if(!Number.isFinite(f.getTime())||f.getTime()<=this.nowFn().getTime()+60000||f.getTime()>this.nowFn().getTime()+Ul)throw Error("API token expiry must be between one minute and one year from now");let b=this.idFn(),k=OI(32).toString("base64url"),y=`tsc_v1.${b}.${k}`,R=`tsc_v1.${b.slice(0,8)}`,T=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[b,t.id,e.name.trim().slice(0,100)||"API token",_h(y),R,JSON.stringify(a.sort()),l.type,l.type==="organization"?null:l.id??null,f.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,T,T]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:b,prefix:R,capabilities:a,scope:{type:l.type,id:l.id??null},expiresAt:f.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(b),secret:y}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?Cp(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>Cp(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],_h(e));if(!a)return;let l=Cp(a,this.now()),m=this.getServiceAccount(l.serviceAccountId);if(!m||m.state!=="active"||l.state!=="active")return;let f=this.controlPlane.getActor(m.actorId),b=this.controlPlane.getMembershipForActor(m.organizationId,m.actorId);if(!f||f.disabledAt||!b||b.status!=="active")return;let k=this.now(),y=!l.lastUsedAt||this.nowFn().getTime()-new Date(l.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[k,t?.slice(0,128)??null,k,l.id]),y)this.controlPlane.appendEvent({organizationId:m.organizationId,actorId:f.id,type:"api.token.used",payload:{serviceAccountId:m.id,tokenId:l.id,prefix:l.prefix}});return{serviceAccount:m,token:this.getToken(l.id),actor:f,membership:b}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),l=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:l?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let l=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:l?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?jI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),l=new Date(this.nowFn().getTime()+Ql).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -673,7 +673,7 @@ data: ${JSON.stringify({cursor:m,at:new Date().toISOString()})}
 ${b}
 ${k}`);return null}return a}catch(l){if(a)Lo(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${l.message}`);return null}}function us(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:ao(qa(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function In(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function gs(e,t){return In(t).find((r)=>r.id===e)}function tw(e){if(e.length<=YS)return e;return`${e.slice(0,YS)}
 
-[output truncated]`}async function rw(e,t,r){let a=e.getReader(),l=new TextDecoder,m="";while(!0){let{done:b,value:k}=await a.read();if(b)break;let y=l.decode(k,{stream:!0});if(m+=y,y)r?.(t,y)}let f=l.decode();if(f)m+=f,r?.(t,f);return m}async function wm(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[l,m,f]=await Promise.all([rw(r.stdout,"stdout",t.onOutput),rw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:f,ok:f===0,stdout:tw(l),stderr:tw(m)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ec(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function nw(e,t){if(t.role==="admin")return!0;let r=Ec(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let l=uT[a];return!!l&&!!t.capabilities?.includes(l)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),l=N_(r===""?"index.html":r);if(l.startsWith("..")||l.includes("/../"))return null;let m=Bt(e,l);if(Ii(m)&&!aw(m).isDirectory())return m;if(!Ec(m)&&Ii(`${m}.html`))return`${m}.html`;if(!Ec(m)&&Ii(Bt(m,"index.html")))return Bt(m,"index.html");return null}async function iw(e,t){let r=pT(e,t);if(!r){let m=Bt(e,"404.html");if(Ii(m))return new Response(await ii(m),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return kl("Not found",404)}if(aw(r).isDirectory())return kl("Not found",404);let a=await ii(r),l=V_[Ec(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":l}})}var Sl=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],ow=new WeakMap;async function sw(e){let t=ow.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),l={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return ow.set(e,l),l}async function Va(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,l=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let m=e.config??await Bl(),f=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,b=g(m);if(f&&b&&!b.password)b.password=f;let k=m.infrastructure?.compute?.managedServices?.vitess;if(f&&k&&typeof k==="object"&&!k.password)k.password=f;let y=xu(t,m);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let R=Object.keys(m.environments??{}),T=Q_(m,e.environment),N=X_(t),j=await Mo(m,T),q=new Map([[T,j]]),V=new Map([[T,Date.now()]]),Y=new Map([[T,Date.now()]]),te=new Map,le=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),Z=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=U(m)!=="serverless",we=(D)=>{let ze=q.get(D);if(ze&&!ZS(V.get(D),Date.now(),le))return Promise.resolve(ze);let Ve=te.get(D);if(Ve)return Ve;let Fe=!ce||ZS(Y.get(D),Date.now(),Z),Qe=Mo(m,D,{includeSiteHealth:Fe}).then((bt)=>{let z=q.get(D),Ur=Fe?bt:oT(z,bt);if(q.set(D,Ur),V.set(D,Date.now()),Fe)Y.set(D,Date.now());if(z?._serverReachable!==Ur._serverReachable||z?._metricsStatus!==Ur._metricsStatus||(z?.sitesDetail?.length??0)!==(Ur.sitesDetail?.length??0))it();return Ur}).finally(()=>te.delete(D));return te.set(D,Qe),Qe},ke=Ut(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!m.cloud?.attachTo)){let D=!1,ze=Date.now()+300000,Ve=async()=>{if(D)return;D=!0;try{let Qe=Date.now(),bt=Qe>=ze;if(bt)ze=Qe+300000;let z=y.environments.get(T);await bm({controlPlane:y.store,projectId:y.project.id,environmentId:z?.id,config:m,environment:T,force:!0,lightweight:!0,includeSiteHealth:bt})}catch(Qe){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Qe instanceof Error?Qe.message:String(Qe)}`)}finally{D=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ne=new Map,Le=new Map,Ge=new Set,gt=0;function Wt(D,ze){if(D.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`))return D;let Ve=y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`),Fe=Ve?y.store.getMembershipForActor(y.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...D,role:"member",sites:{},capabilities:[]};let Qe=y.store.listGrants(Fe.id),bt=y.store.resolveAuthorizationTarget(y.organization.id,Fe.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),z=Ht({membership:Fe,grants:Qe,target:bt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...D,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:z};let Ur=y.environments.get(ze),hr={};for(let at of y.store.listResources(y.project.id,Ur?.id).filter((pt)=>pt.kind==="application")){let pt=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:at.id});if(!pt||!P({membership:Fe,grants:Qe,capability:"project:read",target:pt}).allowed)continue;hr[at.slug]=P({membership:Fe,grants:Qe,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...D,role:"member",sites:hr,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:z}}function it(){gt+=1,ne.clear();for(let D of Ge)Lo(D,{recursive:!0,force:!0});Ge.clear()}let kt=(D,ze)=>`${ze}:${D.role==="admin"?"admin":`member:${Object.entries(D.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...D.capabilities??[]].sort().join(",")}`;async function Jt(D,ze){let Ve=Wt(D,ze),Fe=kt(Ve,ze),Qe=ne.get(Fe);if(Qe)return Qe;let bt=Le.get(Fe);if(bt)return bt;let z=gt,Ur=(async()=>{let hr=q.get(ze)??await Mo(m,ze);q.set(ze,hr);let at={...lm(hr,{user:Ve,slug:m.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},pt=await aT(t,at);if(pt&&z!==gt)return Lo(pt,{recursive:!0,force:!0}),ke?.uiRoot;if(pt)Ge.add(pt);let xr=pt??ke?.uiRoot;if(xr)ne.set(Fe,xr);return xr})();Le.set(Fe,Ur);try{return await Ur}finally{Le.delete(Fe)}}let dt=await Jt({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!dt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let G=new WeakMap,ue=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",he=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(he&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Pe=!he,mt=Nb(t),It=Pe?Lb(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,$e=new Ki(y.store,{encryptionKey:Ze(t)}),ht=new Wi(y.store),ut=new an(y.store),Je=new Ko(y.store,{encryptionKey:Ze(t)}),zr=new ap(y.store),Fo=new up(y.store,{cwd:t}),Qn=new dp(y.store,{encryptionKey:Ze(t)}),Lt=new c(y.store,{workerId:`dashboard:${process.pid}`}),Yt=new ca(y.store),oi=new Aa(y.store,Ze(t)),Ei=new Fa(y.store),Rc=new ns(Yt,Lt,oi),Ri=m.project?.region??"us-east-1",Im=Ze(t),vn=new Ga(Ei,{encryptionKey:Im,backends:[new Sn(y.store,Im),new Ua(new K(Ri),Ri),new Qa(new De(Ri),Ri),new Ha]});await Wu(vn,y,m);let Il=new W(Ri),dw={aws_rds:new da(new ma(Il)),aws_aurora:new la(new fa(Il)),aws_elasticache:new ua(new ha(new st(Ri))),server:new ga(new nr),container:new pa(new nr)},Em=(D)=>dw[D.provider],vr=new ka(y.store),co=new ls(vr,Lt),Rm=new Ba(oi),lw={managed_database:new xa(Yt,Il),logical_database:new _a(Yt,oi),volume:new La,files:new Oa(t),control_plane:new $a(y.store,t),infrastructure:new Ma(new ar(Ri))},uw=(D)=>lw[D.resourceKind],pw=(D)=>D.provider==="aws_backup"?void 0:Rm,El=new Gt(y.store),Rl=[new $r,new to(d(t,"volumes"))],si=new eo(El,Rl,Lt),Wa=new ya(y.store),Yn=new Sa(Wa,[new gn("aws"),new gn("hetzner"),new gn("ssh")],Lt),Ai=new Ia(y.store),Am=new ba(Ai,Wa),lo=new Ca(y.store),Cm=new Ea(lo,Lt),ai=new Ta(y.store),Al=new wa(ai,Lt),Pm=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((D)=>new Ra(D,y.store,y.project.id,y.organization.id)),Pr=new sa(y.store),_m=new aa(Pr,{queue:Lt}),fr=new Lr(y.store),Ci=new Mr(y.store),Dn=new Et(y.store),ot=new Di(y.store,{encryptionKey:Ze(t)}),gw=()=>sw(y.store);for(let D of y.environments.values())oa(Pr,m,{organization:y.organization,project:y.project,environment:D,resources:y.store.listResources(y.project.id,D.id)});let On=new Pi(ot,{emailImpl:async(D)=>{let{email:ze}=await import("./chunk-f4m9k2q6.js");return ze.send(D)}}),Tm=async(D)=>{let ze=fo(ot,y.project.id,D),Ve=[];for(let Fe of ze.filter((Qe)=>Qe.notify&&Qe.alert))Ve.push(...await On.deliverAll(On.enqueue(y.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await On.deliverAll(On.enqueueRemindersAndEscalations(y.organization.id,ot.listAlerts(y.project.id,{environmentId:D,states:["firing"]})))),Ve.push(...await On.retryDue()),{evaluations:ze,deliveries:Ve}},Pl=!1,mw=async()=>{if(Pl)return;Pl=!0;try{for(let D of y.environments.values())for(let ze of ot.listHealthChecks(y.project.id,D.id).filter((Ve)=>Ve.enabled)){let Ve=ot.listHealthResults(ze.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<ze.intervalSeconds*1000)continue;let Fe=await new je(ot).runAndEvaluate(ze);for(let Qe of Fe.evaluations.filter((bt)=>bt.notify&&bt.alert))await On.deliverAll(On.enqueue(y.organization.id,Qe.alert,Qe.transition))}}finally{Pl=!1}},xm=setInterval(()=>{for(let D of y.environments.values())Tm(D.id).catch((ze)=>console.error("ts-cloud alert evaluation failed:",ze))},60000);xm.unref?.();let Dm=setInterval(()=>{mw().catch((D)=>console.error("ts-cloud health check evaluation failed:",D))},30000);Dm.unref?.();let Om=setInterval(()=>{try{_m.tick()}catch(D){console.error("ts-cloud scheduled job evaluation failed:",D)}},30000);Om.unref?.();let $m=setInterval(()=>{try{co.enqueueDue(),co.enqueueRetention()}catch(D){console.error("ts-cloud backup policy evaluation failed:",D)}},30000);$m.unref?.(),fr.cleanup();let Nm=setInterval(()=>{try{fr.cleanup()}catch(D){console.error("ts-cloud preview cleanup failed:",D)}},3600000);Nm.unref?.();let fw=e.queueWorker??!0,hw=cT(),yw=async(D,ze)=>{let Fe=(D.environmentId?y.store.listEnvironments(D.projectId).find((Qe)=>Qe.id===D.environmentId):void 0)?.slug??String(T);if(ze.kind==="dashboard_operation"&&ze.operationId){let Qe=q.get(Fe)??j,bt=dm(ze.operationId,m,Qe);if(!bt||bt.danger||!["scheduler","backup","worker"].includes(bt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let z=await gl(m,Fe,bt);return{ok:z.ok,stdout:z.stdout,stderr:z.stderr??z.error,retryable:/temporar|unavailable|timeout|network/i.test(z.stderr??z.error??""),output:{command:z.command??null,operation:z.operation}}}if(ze.kind==="serverless_scheduler"){let Qe=await vm(m,Fe,"run");return{ok:Qe.ok,stdout:Qe.stdout,stderr:Qe.error,retryable:/temporar|unavailable|timeout|network/i.test(Qe.error??""),output:{command:Qe.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${ze.kind}.`}},Ac=fw?new Ys(Lt,{...td({store:y.store,execute:async(D,ze)=>{let Ve=ze.operation.input&&typeof ze.operation.input==="object"&&!Array.isArray(ze.operation.input)?ze.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,Qe=t,bt,z,Ur;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let at=Je.getBinding(String(Fe.bindingId)),pt=Je.getConnection(String(Fe.connectionId));if(!at||!pt||at.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let Rr=(at.repositoryId?Je.getRepository(at.repositoryId):Je.listRepositories(pt.id).find((fs)=>fs.fullName.toLowerCase()===at.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Rr&&pt.provider==="generic_ssh")Rr=`git@${new URL(pt.host).hostname}:${at.repositoryFullName}.git`;if(!Rr)Rr=new URL(`/${at.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ee=at.deployKeyId?Je.getDeployKey(at.deployKeyId):void 0,Zt=Ee&&at.deployKeyId?{...Ee,privateKey:Je.getDeployPrivateKey(at.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&D.target.previewId){let fs=et(pt,Je.getCredential(pt.id)),ge=fr.previews.getInstance(D.target.previewId);Ur=async($n,xc)=>{try{await fs.setCommitStatus(at.repositoryFullName,String(Fe.commitSha),{state:$n,url:ge?.url,description:xc})}catch(hs){ze.log(`Could not publish source status: ${hs instanceof Error?hs.message:String(hs)}`,{stream:"stderr"})}},await Ur("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}bt=km(Bt(wl(),"ts-cloud-queued-source-")),ze.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),Qe=(await Jo({remote:Rr,binding:at,destination:Bt(bt,"checkout"),ref:String(Fe.branch??at.defaultBranch),commitSha:String(Fe.commitSha)},{credential:Je.getCredential(pt.id),deployKey:Zt})).directory}if(ze.operation.kind!=="preview.destroy"){let at=D.target.previewId?fr.previews.getInstance(D.target.previewId):void 0,pt=at?fr.previews.getDefinition(at.definitionId):void 0,xr=ze.operation.resourceId?y.store.getResource(ze.operation.resourceId):void 0;if(z=await vn.resolve({projectId:y.project.id,environmentId:ze.operation.environmentId,resourceId:ze.operation.resourceId,functionId:xr?.kind==="function"?xr.id:void 0,previewId:at?.id,trustedPreview:!!at&&!at.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),z.warnings.some((Rr)=>Rr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${z.warnings.filter((Rr)=>Rr.code==="missing_required").map((Rr)=>Rr.key).join(", ")}`);if(ze.operation.resourceId)for(let Rr of Object.values(z.entries))Ei.setDependency({entryId:Rr.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:Rr.required,requiresRedeploy:!0});ze.log(`Resolved configuration ${z.configurationHash.slice(0,18)} for ${Object.keys(z.values).length} keys.`,{stream:"system"})}let hr=await wm(D,{cwd:Qe,cliEntry:l,signal:ze.signal,env:z?.values,onOutput:(at,pt)=>ze.log(pt,{stream:at,step:"execute",secrets:[...hw,...Object.entries(z?.entries??{}).filter(([,xr])=>xr.kind==="secret").map(([xr])=>z.values[xr]).filter(Boolean)]})});if(hr.ok&&ze.operation.resourceId&&z)for(let at of Object.values(z.entries))Ei.setDependency({entryId:at.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:at.required,requiresRedeploy:!1,lastDeployedVersion:at.version});return await Ur?.(hr.ok?"success":"failure",hr.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),hr}catch(hr){throw await Ur?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),hr}finally{if(bt)Lo(bt,{recursive:!0,force:!0})}}}),...pu({store:Pr,executor:yw}),...fu({store:Yt,secrets:oi,resolveAdapter:Em}),...yu(Wa,Yn.drivers),...Iu(lo,[new va("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Tu({store:ai,cleanup:Pm}),...rd(El,Rl),...Vu({store:vr,queue:Lt,resolveSource:uw,resolveDestination:pw,validateHealth:async(D,ze)=>{if(!D.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=ot.getHealthCheck(D.healthCheckId);if(!Ve||Ve.projectId!==D.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new je(ot).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:ze}}}),...ql({store:y.store,resolveDriver:e.releaseDriver??((D)=>({name:`${y.store.getResource(D.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:D.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(D,ze)=>{let Ve=ot.listHealthChecks(ze.projectId,ze.environmentId).find((Qe)=>Qe.enabled&&Qe.name===D&&(!Qe.resourceId||Qe.resourceId===ze.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${D} was not found for this release.`};let Fe=await new je(ot).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(D)=>console.error("ts-cloud deployment queue worker failed:",D)}):void 0;if(iu(y),es(ut,ie(y,String(T)),j),It)as(y,It.users),Ub($e,y,It.users);let cr=Fb({cwd:t,enabled:Pe,secret:mt,authentication:$e,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(T)}}),br=new ia,jm=setInterval(()=>br.sweep(),60000);jm.unref?.();let Cc=new Sc,Tl=new Sc(3,900000,900000),Pc=new Sc(8,900000,900000),Bm=setInterval(()=>Cc.prune(),300000),Mm=setInterval(()=>Tl.prune(),300000),Lm=setInterval(()=>Pc.prune(),300000);if(Bm.unref?.(),Mm.unref?.(),Lm.unref?.(),Pe){if(It?.generated)console.warn(`
+[output truncated]`}async function rw(e,t,r){let a=e.getReader(),l=new TextDecoder,m="";while(!0){let{done:b,value:k}=await a.read();if(b)break;let y=l.decode(k,{stream:!0});if(m+=y,y)r?.(t,y)}let f=l.decode();if(f)m+=f,r?.(t,f);return m}async function wm(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[l,m,f]=await Promise.all([rw(r.stdout,"stdout",t.onOutput),rw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:f,ok:f===0,stdout:tw(l),stderr:tw(m)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ec(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function nw(e,t){if(t.role==="admin")return!0;let r=Ec(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let l=uT[a];return!!l&&!!t.capabilities?.includes(l)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),l=N_(r===""?"index.html":r);if(l.startsWith("..")||l.includes("/../"))return null;let m=Bt(e,l);if(Ii(m)&&!aw(m).isDirectory())return m;if(!Ec(m)&&Ii(`${m}.html`))return`${m}.html`;if(!Ec(m)&&Ii(Bt(m,"index.html")))return Bt(m,"index.html");return null}async function iw(e,t){let r=pT(e,t);if(!r){let m=Bt(e,"404.html");if(Ii(m))return new Response(await ii(m),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return kl("Not found",404)}if(aw(r).isDirectory())return kl("Not found",404);let a=await ii(r),l=V_[Ec(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":l}})}var Sl=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],ow=new WeakMap;async function sw(e){let t=ow.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),l={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return ow.set(e,l),l}async function Va(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,l=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let m=e.config??await Bl(),f=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,b=g(m);if(f&&b&&!b.password)b.password=f;let k=m.infrastructure?.compute?.managedServices?.vitess;if(f&&k&&typeof k==="object"&&!k.password)k.password=f;let y=xu(t,m);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let R=Object.keys(m.environments??{}),T=Q_(m,e.environment),N=X_(t),j=await Mo(m,T),q=new Map([[T,j]]),V=new Map([[T,Date.now()]]),Y=new Map([[T,Date.now()]]),te=new Map,le=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),Z=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=U(m)!=="serverless",we=(D)=>{let ze=q.get(D);if(ze&&!ZS(V.get(D),Date.now(),le))return Promise.resolve(ze);let Ve=te.get(D);if(Ve)return Ve;let Fe=!ce||ZS(Y.get(D),Date.now(),Z),Qe=Mo(m,D,{includeSiteHealth:Fe}).then((bt)=>{let z=q.get(D),Ur=Fe?bt:oT(z,bt);if(q.set(D,Ur),V.set(D,Date.now()),Fe)Y.set(D,Date.now());if(z?._serverReachable!==Ur._serverReachable||z?._metricsStatus!==Ur._metricsStatus||(z?.sitesDetail?.length??0)!==(Ur.sitesDetail?.length??0))it();return Ur}).finally(()=>te.delete(D));return te.set(D,Qe),Qe},ke=Ut(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!m.cloud?.attachTo)){let D=!1,ze=Date.now()+300000,Ve=async()=>{if(D)return;D=!0;try{let Qe=Date.now(),bt=Qe>=ze;if(bt)ze=Qe+300000;let z=y.environments.get(T);await bm({controlPlane:y.store,projectId:y.project.id,environmentId:z?.id,config:m,environment:T,force:!0,lightweight:!0,includeSiteHealth:bt})}catch(Qe){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Qe instanceof Error?Qe.message:String(Qe)}`)}finally{D=!1}};Ve(),setInterval(()=>void Ve(),60000).unref?.()}let ne=new Map,Le=new Map,Ge=new Set,gt=0;function Wt(D,ze){if(D.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`))return D;let Ve=y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`),Fe=Ve?y.store.getMembershipForActor(y.organization.id,Ve.id):void 0;if(!Fe||Fe.status!=="active")return{...D,role:"member",sites:{},capabilities:[]};let Qe=y.store.listGrants(Fe.id),bt=y.store.resolveAuthorizationTarget(y.organization.id,Fe.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),z=Ht({membership:Fe,grants:Qe,target:bt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...D,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:z};let Ur=y.environments.get(ze),hr={};for(let at of y.store.listResources(y.project.id,Ur?.id).filter((pt)=>pt.kind==="application")){let pt=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:at.id});if(!pt||!P({membership:Fe,grants:Qe,capability:"project:read",target:pt}).allowed)continue;hr[at.slug]=P({membership:Fe,grants:Qe,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...D,role:"member",sites:hr,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:z}}function it(){gt+=1,ne.clear();for(let D of Ge)Lo(D,{recursive:!0,force:!0});Ge.clear()}let kt=(D,ze)=>`${ze}:${D.role==="admin"?"admin":`member:${Object.entries(D.sites).sort(([Ve],[Fe])=>Ve.localeCompare(Fe)).map(([Ve,Fe])=>`${Ve}=${Fe}`).join(",")}`}:${[...D.capabilities??[]].sort().join(",")}`;async function Jt(D,ze){let Ve=Wt(D,ze),Fe=kt(Ve,ze),Qe=ne.get(Fe);if(Qe)return Qe;let bt=Le.get(Fe);if(bt)return bt;let z=gt,Ur=(async()=>{let hr=q.get(ze)??await Mo(m,ze);q.set(ze,hr);let at={...lm(hr,{user:Ve,slug:m.project.slug}),viewer:{role:Ve.role,organizationRole:Ve.organizationRole,organizationSource:Ve.organizationSource,capabilities:Ve.capabilities??[]}},pt=await aT(t,at);if(pt&&z!==gt)return Lo(pt,{recursive:!0,force:!0}),ke?.uiRoot;if(pt)Ge.add(pt);let xr=pt??ke?.uiRoot;if(xr)ne.set(Fe,xr);return xr})();Le.set(Fe,Ur);try{return await Ur}finally{Le.delete(Fe)}}let dt=await Jt({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!dt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let G=new WeakMap,ue=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",he=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(he&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Pe=!he,mt=Nb(t),It=Pe?Lb(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,$e=new Ki(y.store,{encryptionKey:Ze(t)}),ht=new Wi(y.store),ut=new an(y.store),Je=new Ko(y.store,{encryptionKey:Ze(t)}),zr=new ap(y.store),Fo=new up(y.store,{cwd:t}),Qn=new dp(y.store,{encryptionKey:Ze(t)}),Lt=new c(y.store,{workerId:`dashboard:${process.pid}`}),Yt=new ca(y.store),oi=new Aa(y.store,Ze(t)),Ei=new Fa(y.store),Rc=new ns(Yt,Lt,oi),Ri=m.project?.region??"us-east-1",Im=Ze(t),vn=new Ga(Ei,{encryptionKey:Im,backends:[new Sn(y.store,Im),new Ua(new K(Ri),Ri),new Qa(new De(Ri),Ri),new Ha]});await Wu(vn,y,m);let Il=new W(Ri),dw={aws_rds:new da(new ma(Il)),aws_aurora:new la(new fa(Il)),aws_elasticache:new ua(new ha(new st(Ri))),server:new ga(new nr),container:new pa(new nr)},Em=(D)=>dw[D.provider],vr=new ka(y.store),co=new ls(vr,Lt),Rm=new Ba(oi),lw={managed_database:new xa(Yt,Il),logical_database:new _a(Yt,oi),volume:new La,files:new Oa(t),control_plane:new $a(y.store,t),infrastructure:new Ma(new ar(Ri))},uw=(D)=>lw[D.resourceKind],pw=(D)=>D.provider==="aws_backup"?void 0:Rm,El=new Gt(y.store),Rl=[new $r,new to(d(t,"volumes"))],si=new eo(El,Rl,Lt),Wa=new ya(y.store),Yn=new Sa(Wa,[new gn("aws"),new gn("hetzner"),new gn("ssh")],Lt),Ai=new Ia(y.store),Am=new ba(Ai,Wa),lo=new Ca(y.store),Cm=new Ea(lo,Lt),ai=new Ta(y.store),Al=new wa(ai,Lt),Pm=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((D)=>new Ra(D,y.store,y.project.id,y.organization.id)),Pr=new sa(y.store),_m=new aa(Pr,{queue:Lt}),fr=new Lr(y.store),Ci=new Mr(y.store),Dn=new Et(y.store),ot=new Di(y.store,{encryptionKey:Ze(t)}),gw=()=>sw(y.store);for(let D of y.environments.values())oa(Pr,m,{organization:y.organization,project:y.project,environment:D,resources:y.store.listResources(y.project.id,D.id)});let On=new Pi(ot,{emailImpl:async(D)=>{let{email:ze}=await import("./chunk-wxtr8sv8.js");return ze.send(D)}}),Tm=async(D)=>{let ze=fo(ot,y.project.id,D),Ve=[];for(let Fe of ze.filter((Qe)=>Qe.notify&&Qe.alert))Ve.push(...await On.deliverAll(On.enqueue(y.organization.id,Fe.alert,Fe.transition)));return Ve.push(...await On.deliverAll(On.enqueueRemindersAndEscalations(y.organization.id,ot.listAlerts(y.project.id,{environmentId:D,states:["firing"]})))),Ve.push(...await On.retryDue()),{evaluations:ze,deliveries:Ve}},Pl=!1,mw=async()=>{if(Pl)return;Pl=!0;try{for(let D of y.environments.values())for(let ze of ot.listHealthChecks(y.project.id,D.id).filter((Ve)=>Ve.enabled)){let Ve=ot.listHealthResults(ze.id,1)[0];if(Ve&&Date.now()-new Date(Ve.checkedAt).getTime()<ze.intervalSeconds*1000)continue;let Fe=await new je(ot).runAndEvaluate(ze);for(let Qe of Fe.evaluations.filter((bt)=>bt.notify&&bt.alert))await On.deliverAll(On.enqueue(y.organization.id,Qe.alert,Qe.transition))}}finally{Pl=!1}},xm=setInterval(()=>{for(let D of y.environments.values())Tm(D.id).catch((ze)=>console.error("ts-cloud alert evaluation failed:",ze))},60000);xm.unref?.();let Dm=setInterval(()=>{mw().catch((D)=>console.error("ts-cloud health check evaluation failed:",D))},30000);Dm.unref?.();let Om=setInterval(()=>{try{_m.tick()}catch(D){console.error("ts-cloud scheduled job evaluation failed:",D)}},30000);Om.unref?.();let $m=setInterval(()=>{try{co.enqueueDue(),co.enqueueRetention()}catch(D){console.error("ts-cloud backup policy evaluation failed:",D)}},30000);$m.unref?.(),fr.cleanup();let Nm=setInterval(()=>{try{fr.cleanup()}catch(D){console.error("ts-cloud preview cleanup failed:",D)}},3600000);Nm.unref?.();let fw=e.queueWorker??!0,hw=cT(),yw=async(D,ze)=>{let Fe=(D.environmentId?y.store.listEnvironments(D.projectId).find((Qe)=>Qe.id===D.environmentId):void 0)?.slug??String(T);if(ze.kind==="dashboard_operation"&&ze.operationId){let Qe=q.get(Fe)??j,bt=dm(ze.operationId,m,Qe);if(!bt||bt.danger||!["scheduler","backup","worker"].includes(bt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let z=await gl(m,Fe,bt);return{ok:z.ok,stdout:z.stdout,stderr:z.stderr??z.error,retryable:/temporar|unavailable|timeout|network/i.test(z.stderr??z.error??""),output:{command:z.command??null,operation:z.operation}}}if(ze.kind==="serverless_scheduler"){let Qe=await vm(m,Fe,"run");return{ok:Qe.ok,stdout:Qe.stdout,stderr:Qe.error,retryable:/temporar|unavailable|timeout|network/i.test(Qe.error??""),output:{command:Qe.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${ze.kind}.`}},Ac=fw?new Ys(Lt,{...td({store:y.store,execute:async(D,ze)=>{let Ve=ze.operation.input&&typeof ze.operation.input==="object"&&!Array.isArray(ze.operation.input)?ze.operation.input:{},Fe=Ve.source&&typeof Ve.source==="object"?Ve.source:void 0,Qe=t,bt,z,Ur;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let at=Je.getBinding(String(Fe.bindingId)),pt=Je.getConnection(String(Fe.connectionId));if(!at||!pt||at.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let Rr=(at.repositoryId?Je.getRepository(at.repositoryId):Je.listRepositories(pt.id).find((fs)=>fs.fullName.toLowerCase()===at.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Rr&&pt.provider==="generic_ssh")Rr=`git@${new URL(pt.host).hostname}:${at.repositoryFullName}.git`;if(!Rr)Rr=new URL(`/${at.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ee=at.deployKeyId?Je.getDeployKey(at.deployKeyId):void 0,Zt=Ee&&at.deployKeyId?{...Ee,privateKey:Je.getDeployPrivateKey(at.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&D.target.previewId){let fs=et(pt,Je.getCredential(pt.id)),ge=fr.previews.getInstance(D.target.previewId);Ur=async($n,xc)=>{try{await fs.setCommitStatus(at.repositoryFullName,String(Fe.commitSha),{state:$n,url:ge?.url,description:xc})}catch(hs){ze.log(`Could not publish source status: ${hs instanceof Error?hs.message:String(hs)}`,{stream:"stderr"})}},await Ur("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}bt=km(Bt(wl(),"ts-cloud-queued-source-")),ze.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),Qe=(await Jo({remote:Rr,binding:at,destination:Bt(bt,"checkout"),ref:String(Fe.branch??at.defaultBranch),commitSha:String(Fe.commitSha)},{credential:Je.getCredential(pt.id),deployKey:Zt})).directory}if(ze.operation.kind!=="preview.destroy"){let at=D.target.previewId?fr.previews.getInstance(D.target.previewId):void 0,pt=at?fr.previews.getDefinition(at.definitionId):void 0,xr=ze.operation.resourceId?y.store.getResource(ze.operation.resourceId):void 0;if(z=await vn.resolve({projectId:y.project.id,environmentId:ze.operation.environmentId,resourceId:ze.operation.resourceId,functionId:xr?.kind==="function"?xr.id:void 0,previewId:at?.id,trustedPreview:!!at&&!at.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),z.warnings.some((Rr)=>Rr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${z.warnings.filter((Rr)=>Rr.code==="missing_required").map((Rr)=>Rr.key).join(", ")}`);if(ze.operation.resourceId)for(let Rr of Object.values(z.entries))Ei.setDependency({entryId:Rr.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:Rr.required,requiresRedeploy:!0});ze.log(`Resolved configuration ${z.configurationHash.slice(0,18)} for ${Object.keys(z.values).length} keys.`,{stream:"system"})}let hr=await wm(D,{cwd:Qe,cliEntry:l,signal:ze.signal,env:z?.values,onOutput:(at,pt)=>ze.log(pt,{stream:at,step:"execute",secrets:[...hw,...Object.entries(z?.entries??{}).filter(([,xr])=>xr.kind==="secret").map(([xr])=>z.values[xr]).filter(Boolean)]})});if(hr.ok&&ze.operation.resourceId&&z)for(let at of Object.values(z.entries))Ei.setDependency({entryId:at.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:at.required,requiresRedeploy:!1,lastDeployedVersion:at.version});return await Ur?.(hr.ok?"success":"failure",hr.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),hr}catch(hr){throw await Ur?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),hr}finally{if(bt)Lo(bt,{recursive:!0,force:!0})}}}),...pu({store:Pr,executor:yw}),...fu({store:Yt,secrets:oi,resolveAdapter:Em}),...yu(Wa,Yn.drivers),...Iu(lo,[new va("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Tu({store:ai,cleanup:Pm}),...rd(El,Rl),...Vu({store:vr,queue:Lt,resolveSource:uw,resolveDestination:pw,validateHealth:async(D,ze)=>{if(!D.healthCheckId)return{healthy:!0,mode:"adapter"};let Ve=ot.getHealthCheck(D.healthCheckId);if(!Ve||Ve.projectId!==D.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new je(ot).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",healthCheckId:Ve.id,healthResultId:Fe.result.id,target:ze}}}),...ql({store:y.store,resolveDriver:e.releaseDriver??((D)=>({name:`${y.store.getResource(D.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:D.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(D,ze)=>{let Ve=ot.listHealthChecks(ze.projectId,ze.environmentId).find((Qe)=>Qe.enabled&&Qe.name===D&&(!Qe.resourceId||Qe.resourceId===ze.resourceId));if(!Ve)return{healthy:!1,message:`Named health gate ${D} was not found for this release.`};let Fe=await new je(ot).runAndEvaluate(Ve);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:Ve.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(D)=>console.error("ts-cloud deployment queue worker failed:",D)}):void 0;if(iu(y),es(ut,ie(y,String(T)),j),It)as(y,It.users),Ub($e,y,It.users);let cr=Fb({cwd:t,enabled:Pe,secret:mt,authentication:$e,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(T)}}),br=new ia,jm=setInterval(()=>br.sweep(),60000);jm.unref?.();let Cc=new Sc,Tl=new Sc(3,900000,900000),Pc=new Sc(8,900000,900000),Bm=setInterval(()=>Cc.prune(),300000),Mm=setInterval(()=>Tl.prune(),300000),Lm=setInterval(()=>Pc.prune(),300000);if(Bm.unref?.(),Mm.unref?.(),Lm.unref?.(),Pe){if(It?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${It.generated.username}
     password: ${It.generated.password}

package/dist/{chunk-f2xqeers.js → chunk-gyp7jcgw.js}

@@ -1 +1 @@
-import{ps,ms,fs,hs,ja,za}from"./chunk-906prq6g.js";import"./chunk-0kddm2mt.js";import"./chunk-my6yn5sd.js";import"./chunk-yzns0k2b.js";import"./chunk-mxw5gkd8.js";import"./chunk-jch6ks7a.js";import"./chunk-7gvnrx46.js";export{ja as deleteStaticSite,ms as deployStaticSite,za as deployStaticSiteFull,ps as generateStaticSiteTemplate,hs as invalidateCache,fs as uploadStaticFiles};
+import{ps,ms,fs,hs,ja,za}from"./chunk-q9rdxpmg.js";import"./chunk-0kddm2mt.js";import"./chunk-my6yn5sd.js";import"./chunk-yzns0k2b.js";import"./chunk-mxw5gkd8.js";import"./chunk-ncsb3sdn.js";import"./chunk-7gvnrx46.js";export{ja as deleteStaticSite,ms as deployStaticSite,za as deployStaticSiteFull,ps as generateStaticSiteTemplate,hs as invalidateCache,fs as uploadStaticFiles};

package/dist/{chunk-annmzhbb.js → chunk-k3mazfb2.js}

@@ -1,4 +1,4 @@
-import{Bd,L,d,g,_i,_d,Ld,me,p,te,Kr,yt,St,Xt,Jr,Mi}from"./chunk-9aaj9a0s.js";import{o}from"./chunk-jch6ks7a.js";import{_,Br,xr,u}from"./chunk-ctkzxq0d.js";import{fi}from"./chunk-50m6sq01.js";import{Pr,De}from"./chunk-ajn6xp8v.js";import{h}from"./chunk-mxw5gkd8.js";import{Oi}from"./chunk-pfav9qnt.js";import{readFileSync as Ks}from"node:fs";import{join as ja}from"node:path";function sg(e={}){let t=new Set;for(let r of Object.values(e)){if(!r.domain)continue;if(r.redirect||r.deploy==="server"||r.start)t.add(r.domain)}return t}function Ur(e){return e.replace(/\.$/,"").toLowerCase()}function Ri(e,t,r){let n=Ur(e.name),s=Ur(t),i=Ur(r),a=i===s?"@":i.endsWith(`.${s}`)?i.slice(0,-(s.length+1)):i;return n===i||n===a||a==="@"&&(n===""||n===s)}async function uc(e,t,r,n,s="A"){let i=await e.listRecords(t);if(!i.success)return[`could not list ${s} records: ${i.message||"unknown provider error"}`];let a=i.records.filter((m)=>m.type===s&&Ri(m,t,r)),c=a.findIndex((m)=>m.content===n);if(a.length<=1||c===-1)return[];let l=[];for(let[m,S]of a.entries()){if(m===c)continue;let b=await e.deleteRecord(t,S);if(!b.success)l.push(`could not remove stale ${S.name} ${s} ${S.content}: ${b.message||"unknown provider error"}`)}return l}function Ee(e){if(!e)return;let t=e.trim();if(!t)return;if(!t.includes("/"))return t;let[r]=t.split("/");if(!r.endsWith("::"))return r||void 0;return`${r}1`}var gc=new Set(["mail","smtp","imap","mx"]);function Ln(e){return!gc.has(e.split(".")[0]??"")}async function og(e){let{provider:t,zone:r,fqdn:n,ipv4:s,ipv6:i,ttl:a=600}=e,c={published:[],warnings:[]},l=[{type:"A",content:s}];if(i&&Ln(n))l.push({type:"AAAA",content:i});for(let{type:m,content:S}of l){let b=await t.upsertRecord(r,{name:n,type:m,content:S,ttl:a});if(b?.success===!1){c.warnings.push(`${n} → ${S} failed: ${b.error||b.message||"unknown error"}`);continue}if(c.warnings.push(...(await uc(t,r,n,S,m)).map((y)=>`${n} cleanup: ${y}`)),await pc(t,r,n,S,m))c.published.push({fqdn:n,type:m,content:S});else c.warnings.push(`${n} → ${S} reported success at ${t.name} but no matching ${m} record exists — create it manually: ${m} ${n} → ${S}`)}return c}async function pc(e,t,r,n,s){try{if(typeof e?.listRecords!=="function")return!0;let i=await e.listRecords(t);if(!i?.success||!Array.isArray(i.records))return!0;return i.records.some((a)=>{let c=typeof a?.name==="string"?a.name.replace(/\.$/,""):"";return a?.type===s&&c===r&&a?.content===n})}catch{return!0}}function Hr(e){return(Buffer.isBuffer(e)?e.toString("utf8"):typeof e==="string"?e:"").replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm,"$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g,"encrypted:[redacted]").trim().slice(-8000)}function $n(e,t){let r=Hr(e?.stderr),n=/line (\d+): syntax error/.exec(r);if(!n)return"";let s=Number(n[1]),i=t.split(`
+import{Bd,L,d,g,_i,_d,Ld,me,p,te,Kr,yt,St,Xt,Jr,Mi}from"./chunk-9aaj9a0s.js";import{o}from"./chunk-ncsb3sdn.js";import{_,Br,xr,u}from"./chunk-ctkzxq0d.js";import{fi}from"./chunk-50m6sq01.js";import{Pr,De}from"./chunk-ajn6xp8v.js";import{h}from"./chunk-mxw5gkd8.js";import{Oi}from"./chunk-pfav9qnt.js";import{readFileSync as Ks}from"node:fs";import{join as ja}from"node:path";function sg(e={}){let t=new Set;for(let r of Object.values(e)){if(!r.domain)continue;if(r.redirect||r.deploy==="server"||r.start)t.add(r.domain)}return t}function Ur(e){return e.replace(/\.$/,"").toLowerCase()}function Ri(e,t,r){let n=Ur(e.name),s=Ur(t),i=Ur(r),a=i===s?"@":i.endsWith(`.${s}`)?i.slice(0,-(s.length+1)):i;return n===i||n===a||a==="@"&&(n===""||n===s)}async function uc(e,t,r,n,s="A"){let i=await e.listRecords(t);if(!i.success)return[`could not list ${s} records: ${i.message||"unknown provider error"}`];let a=i.records.filter((m)=>m.type===s&&Ri(m,t,r)),c=a.findIndex((m)=>m.content===n);if(a.length<=1||c===-1)return[];let l=[];for(let[m,S]of a.entries()){if(m===c)continue;let b=await e.deleteRecord(t,S);if(!b.success)l.push(`could not remove stale ${S.name} ${s} ${S.content}: ${b.message||"unknown provider error"}`)}return l}function Ee(e){if(!e)return;let t=e.trim();if(!t)return;if(!t.includes("/"))return t;let[r]=t.split("/");if(!r.endsWith("::"))return r||void 0;return`${r}1`}var gc=new Set(["mail","smtp","imap","mx"]);function Ln(e){return!gc.has(e.split(".")[0]??"")}async function og(e){let{provider:t,zone:r,fqdn:n,ipv4:s,ipv6:i,ttl:a=600}=e,c={published:[],warnings:[]},l=[{type:"A",content:s}];if(i&&Ln(n))l.push({type:"AAAA",content:i});for(let{type:m,content:S}of l){let b=await t.upsertRecord(r,{name:n,type:m,content:S,ttl:a});if(b?.success===!1){c.warnings.push(`${n} → ${S} failed: ${b.error||b.message||"unknown error"}`);continue}if(c.warnings.push(...(await uc(t,r,n,S,m)).map((y)=>`${n} cleanup: ${y}`)),await pc(t,r,n,S,m))c.published.push({fqdn:n,type:m,content:S});else c.warnings.push(`${n} → ${S} reported success at ${t.name} but no matching ${m} record exists — create it manually: ${m} ${n} → ${S}`)}return c}async function pc(e,t,r,n,s){try{if(typeof e?.listRecords!=="function")return!0;let i=await e.listRecords(t);if(!i?.success||!Array.isArray(i.records))return!0;return i.records.some((a)=>{let c=typeof a?.name==="string"?a.name.replace(/\.$/,""):"";return a?.type===s&&c===r&&a?.content===n})}catch{return!0}}function Hr(e){return(Buffer.isBuffer(e)?e.toString("utf8"):typeof e==="string"?e:"").replace(/(^|\n)(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=).*$/gm,"$1$2[redacted]").replace(/encrypted:[A-Za-z0-9+/=]+/g,"encrypted:[redacted]").trim().slice(-8000)}function $n(e,t){let r=Hr(e?.stderr),n=/line (\d+): syntax error/.exec(r);if(!n)return"";let s=Number(n[1]),i=t.split(`
 `),a=Math.max(1,s-12),c=Math.min(i.length,s+2),l=i.slice(a-1,c).map((m,S)=>{let b=a+S,y=/^[A-Z_][A-Z0-9_]*=/.test(m)?m.replace(/=.*/,"=<redacted>"):m;return`  ${String(b).padStart(4)}${b===s?" >":"  "} ${y}`});return["",`The deploy script bash rejected is ${i.length} lines; it stopped at ${s}.`,...l].join(`
 `)}function Lt(e){let t=e,r=typeof t?.status==="number"?` (exit ${t.status})`:"",n=t?.signal?` (signal ${t.signal})`:"",s=[Hr(t?.stderr),Hr(t?.stdout)].filter(Boolean).join(`
 `);return`Remote SSH command failed${r}${n}${s?`
@@ -22,7 +22,7 @@ EOF`,`DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,"UPTIME_SEC=
 `)}
 `}return`${["server {","    listen 80;","    listen [::]:80;",`    server_name ${r};`,...n,"}"].join(`
 `)}
-`}function Xr(e){let t=`/etc/nginx/sites-available/${e.siteName}`,r=`/etc/nginx/sites-enabled/${e.siteName}`,n=ya(e),s=[...Qr()];if(e.auth){let i=hs(e.siteName),a=(m)=>m.split("'").join("'\\''"),c=a(e.auth.password),l=a(e.auth.username);s.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${c}')`,`printf '%s:%s\\n' '${l}' "$TS_CLOUD_HTPASS" > ${i}`,`chmod 640 ${i}`,`chown root:www-data ${i} 2>/dev/null || true`)}return s.push(`cat > ${t} <<'TS_CLOUD_NGINX_EOF'`,n.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${t} ${r}`,"rm -f /etc/nginx/sites-enabled/default",`${Ae} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),s}var Ae="/usr/local/bin/ts-cloud-nginx";function Qr(e="/opt/pantry"){return[...yr(),...fe(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${Ae} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${e} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${Ae}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${Ae} -t`,`ExecStart=${Ae} -g 'daemon off;'`,`ExecReload=${Ae} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function Ct(e,t){return!e.events||e.events.includes(t)}async function Zr(e,t,r,n={}){if(!e)return[];let s=n.fetchImpl??globalThis.fetch,i=[],a=[],c=(l,m)=>s(l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(m)}).catch(()=>{return});if(e.slack?.webhookUrl&&Ct(e,t))i.push("slack"),a.push(c(e.slack.webhookUrl,{text:r}));if(e.discord?.webhookUrl&&Ct(e,t))i.push("discord"),a.push(c(e.discord.webhookUrl,{content:r}));if(e.telegram?.botToken&&e.telegram.chatId&&Ct(e,t)){i.push("telegram");let l=`https://api.telegram.org/bot${e.telegram.botToken}/sendMessage`;a.push(c(l,{chat_id:e.telegram.chatId,text:r}))}if(e.webhook?.url&&Ct(e,t))if(i.push("webhook"),(e.webhook.method||"POST")==="GET"){let l=e.webhook.url.includes("?")?"&":"?",m=`${e.webhook.url}${l}event=${encodeURIComponent(t)}&message=${encodeURIComponent(r)}`;a.push(s(m,{method:"GET"}).catch(()=>{return}))}else a.push(c(e.webhook.url,{event:t,message:r}));if(e.email?.to&&Ct(e,t))i.push("email"),a.push($a(e.email,t,r));return await Promise.all(a),i}async function $a(e,t,r){try{let n=await import("./chunk-f4m9k2q6.js");await n.email.send({to:e.to,from:e.from,subject:`[ts-cloud] ${t}`,text:r})}catch{}}function Ss(e,t){return t??e}function Ze(e){if(!e)return[];let t=[];if(e.slack?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${e.slack.webhookUrl} || true`);if(e.discord?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${e.discord.webhookUrl} || true`);if(e.telegram?.botToken&&e.telegram.chatId)t.push(`curl -fsS -X POST "https://api.telegram.org/bot${e.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${e.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if(e.webhook?.url)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${e.webhook.url} || true`);if(t.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...t,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}import{isIP as vs}from"node:net";var Un="/etc/rpx/certs",ys="/etc/rpx/local-ca",ba="rpx-root-ca.crt";function Wt(e=ys){return`${e.replace(/\/+$/,"")}/${ba}`}function Qn(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function Hn(e,t={}){let r=new Set;for(let n of Object.values(e)){if(!n?.domain)continue;if(u(n)==="bucket")continue;r.add(n.domain)}if(t.autoWww!==!1)for(let n of[...r]){if(!Qn(n))continue;r.add(`www.${n}`)}return[...r]}var Ta=["1.1.1.1","8.8.8.8"],wa="/var/www/acme-challenge";function Ca(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function Pa(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function tn(e){if(!e)return;return e.tls??"local-ca"}function bs(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Ts(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function Ea(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(vs(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function Ra(e,t,r){let n=[],s=new Set,i=(m,S)=>{let b=m.trim().toLowerCase();if(!b||s.has(b))return;s.add(b),n.push({host:b,source:S})},a=t.hostname?.trim(),c=(a||`${r}.local`).toLowerCase();if(i(c,a?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([m,S])=>!!S&&Jr(m)))i(`dashboard.${c}`,"the management dashboard site");for(let[m,S]of Object.entries(e)){if(!S?.domain)continue;if(u(S)==="bucket")continue;if(!Ea(S.domain))continue;i(S.domain,`site "${m}"`)}return n}function xa(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function Oa(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let s=xa(r,t.allowedSuffixes);if(!s)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${s}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function lg(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function mc(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Da(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function ws(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),s=t.slug??"app",i=t.proxy.certsDir??Un,a=t.proxy.loadBalancer,c=[],l=new Set;for(let[y,f]of Object.entries(e)){if(!f||!f.domain)continue;let T=u(f);if(T==="bucket")continue;let D=lg(f.path),R=mc(f.domain,D),C=Pa(f);if(T==="redirect"){c.push({to:f.domain,path:D,redirect:Ca(f.redirect),id:R,...C?{auth:C}:{}}),l.add(f.domain);continue}if(T==="proxy"){let P=xr(f);if(P.length===0)continue;let w=P.length===1?P[0]:P;c.push({to:f.domain,path:D,from:w,id:R,...C?{auth:C}:{},...Array.isArray(w)&&a?{loadBalancer:a}:{}}),l.add(f.domain);continue}if(T==="server-app"){if(typeof f.port!=="number")continue;let P=Da(f.port,r);c.push({to:f.domain,path:D,from:P,id:R,...C?{auth:C}:{},...Array.isArray(P)&&a?{loadBalancer:a}:{}})}else c.push({to:f.domain,path:D,static:{dir:`${n}/${s}-${y}/current`,spa:f.spa??!1,pathRewriteStyle:f.pathRewriteStyle??"directory"},cleanUrls:f.pathRewriteStyle!=="flat",...C?{auth:C}:{},id:R});l.add(f.domain)}if(t.proxy.autoWww!==!1)for(let y of[...l]){if(!Qn(y))continue;let f=`www.${y}`;if(l.has(f))continue;c.push({to:f,redirect:{to:`https://${y}`},id:mc(f)}),l.add(f)}c.sort((y,f)=>{if(y.to!==f.to)return y.to.localeCompare(f.to);return(f.path?.length??0)-(y.path?.length??0)});let m={proxies:c,productionCerts:{certsDir:i,certsDirServerNames:[...l]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(t.proxy.onDemandTls&&l.size>0)m.onDemandTls={enabled:!0,allowedSuffixes:[...l],email:t.proxy.onDemandTlsEmail,certsDir:i,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)m.acmeChallengeWebroot=t.proxy.acmeWebroot??wa;let S=t.proxy.cdn,b=S?.frontedHosts?.length?S.frontedHosts:[...l];if(S?.secret&&b.length>0)m.originGuard={header:S.secretHeader??"X-Origin-Verify",value:S.secret,hosts:b};if(t.lan)if(tn(t.lan)==="off")m.https=!1;else{let y=Ra(e,t.lan,s);Oa(y,m.onDemandTls);let f=t.lan.ip&&vs(t.lan.ip)!==0?[t.lan.ip]:[];m.localCa={dir:ys,hosts:y.map((T)=>T.host),...f.length>0?{ips:f}:{},installTrust:!0}}return m}function X(e,t){return ws(e,t)}function Ir(e,t,r){return ws(e,r,t)}function nh(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
+`}function Xr(e){let t=`/etc/nginx/sites-available/${e.siteName}`,r=`/etc/nginx/sites-enabled/${e.siteName}`,n=ya(e),s=[...Qr()];if(e.auth){let i=hs(e.siteName),a=(m)=>m.split("'").join("'\\''"),c=a(e.auth.password),l=a(e.auth.username);s.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${c}')`,`printf '%s:%s\\n' '${l}' "$TS_CLOUD_HTPASS" > ${i}`,`chmod 640 ${i}`,`chown root:www-data ${i} 2>/dev/null || true`)}return s.push(`cat > ${t} <<'TS_CLOUD_NGINX_EOF'`,n.replace(/\n$/,""),"TS_CLOUD_NGINX_EOF",`ln -sf ${t} ${r}`,"rm -f /etc/nginx/sites-enabled/default",`${Ae} -t`,"systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true"),s}var Ae="/usr/local/bin/ts-cloud-nginx";function Qr(e="/opt/pantry"){return[...yr(),...fe(["nginx.org"]),"mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi","getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data","chown -R www-data:www-data /var/lib/nginx /var/log/nginx",`cat > ${Ae} <<'TS_CLOUD_NGINXBIN_EOF'`,"#!/bin/sh",`eval "$(cd ${e} && pantry env 2>/dev/null)"`,"NGINX_BIN=/opt/pantry/pantry/.bin/nginx",'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi','if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi','exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',"TS_CLOUD_NGINXBIN_EOF",`chmod +x ${Ae}`,"cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'","fastcgi_param  QUERY_STRING       $query_string;","fastcgi_param  REQUEST_METHOD     $request_method;","fastcgi_param  CONTENT_TYPE       $content_type;","fastcgi_param  CONTENT_LENGTH     $content_length;","fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;","fastcgi_param  REQUEST_URI        $request_uri;","fastcgi_param  DOCUMENT_URI       $document_uri;","fastcgi_param  DOCUMENT_ROOT      $document_root;","fastcgi_param  SERVER_PROTOCOL    $server_protocol;","fastcgi_param  REQUEST_SCHEME     $scheme;","fastcgi_param  HTTPS              $https if_not_empty;","fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;","fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;","fastcgi_param  REMOTE_ADDR        $remote_addr;","fastcgi_param  REMOTE_PORT        $remote_port;","fastcgi_param  SERVER_ADDR        $server_addr;","fastcgi_param  SERVER_PORT        $server_port;","fastcgi_param  SERVER_NAME        $server_name;","fastcgi_param  REDIRECT_STATUS    200;","TS_CLOUD_FCGI_EOF","cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'","user www-data;","worker_processes auto;","pid /run/nginx.pid;","error_log /var/log/nginx/error.log;","events { worker_connections 1024; }","http {","    default_type application/octet-stream;","    types {","        text/html html htm;","        text/css css;","        application/javascript js;","        application/json json;","        image/svg+xml svg;","        image/png png;","        image/jpeg jpg jpeg;","        image/gif gif;","        image/x-icon ico;","        image/webp webp;","        font/woff2 woff2;","        font/woff woff;","        text/plain txt;","    }","    access_log /var/log/nginx/access.log;","    sendfile on;","    tcp_nopush on;","    keepalive_timeout 65;","    server_tokens off;","    client_max_body_size 100m;","    client_body_temp_path /var/lib/nginx/body;","    proxy_temp_path /var/lib/nginx/proxy;","    fastcgi_temp_path /var/lib/nginx/fastcgi;","    uwsgi_temp_path /var/lib/nginx/uwsgi;","    scgi_temp_path /var/lib/nginx/scgi;","    server {","        listen 80 default_server;","        listen [::]:80 default_server;","        server_name _;","        return 444;","    }","    include /etc/nginx/sites-enabled/*;","}","TS_CLOUD_NGINXCONF_EOF","cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'","[Unit]","Description=ts-cloud nginx (pantry)","After=network.target","","[Service]","Type=simple",`ExecStartPre=${Ae} -t`,`ExecStart=${Ae} -g 'daemon off;'`,`ExecReload=${Ae} -s reload`,"Restart=always","RestartSec=3","","[Install]","WantedBy=multi-user.target","TS_CLOUD_NGINXUNIT_EOF","systemctl daemon-reload","systemctl enable ts-cloud-nginx","ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"]}function Ct(e,t){return!e.events||e.events.includes(t)}async function Zr(e,t,r,n={}){if(!e)return[];let s=n.fetchImpl??globalThis.fetch,i=[],a=[],c=(l,m)=>s(l,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(m)}).catch(()=>{return});if(e.slack?.webhookUrl&&Ct(e,t))i.push("slack"),a.push(c(e.slack.webhookUrl,{text:r}));if(e.discord?.webhookUrl&&Ct(e,t))i.push("discord"),a.push(c(e.discord.webhookUrl,{content:r}));if(e.telegram?.botToken&&e.telegram.chatId&&Ct(e,t)){i.push("telegram");let l=`https://api.telegram.org/bot${e.telegram.botToken}/sendMessage`;a.push(c(l,{chat_id:e.telegram.chatId,text:r}))}if(e.webhook?.url&&Ct(e,t))if(i.push("webhook"),(e.webhook.method||"POST")==="GET"){let l=e.webhook.url.includes("?")?"&":"?",m=`${e.webhook.url}${l}event=${encodeURIComponent(t)}&message=${encodeURIComponent(r)}`;a.push(s(m,{method:"GET"}).catch(()=>{return}))}else a.push(c(e.webhook.url,{event:t,message:r}));if(e.email?.to&&Ct(e,t))i.push("email"),a.push($a(e.email,t,r));return await Promise.all(a),i}async function $a(e,t,r){try{let n=await import("./chunk-wxtr8sv8.js");await n.email.send({to:e.to,from:e.from,subject:`[ts-cloud] ${t}`,text:r})}catch{}}function Ss(e,t){return t??e}function Ze(e){if(!e)return[];let t=[];if(e.slack?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${e.slack.webhookUrl} || true`);if(e.discord?.webhookUrl)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${e.discord.webhookUrl} || true`);if(e.telegram?.botToken&&e.telegram.chatId)t.push(`curl -fsS -X POST "https://api.telegram.org/bot${e.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${e.telegram.chatId}" --data-urlencode "text=$MSG" || true`);if(e.webhook?.url)t.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${e.webhook.url} || true`);if(t.length===0)return[];return["cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'","#!/bin/bash",'MSG="$1"',...t,"TS_CLOUD_NOTIFY_EOF","chmod +x /usr/local/bin/ts-cloud-notify"]}import{isIP as vs}from"node:net";var Un="/etc/rpx/certs",ys="/etc/rpx/local-ca",ba="rpx-root-ca.crt";function Wt(e=ys){return`${e.replace(/\/+$/,"")}/${ba}`}function Qn(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function Hn(e,t={}){let r=new Set;for(let n of Object.values(e)){if(!n?.domain)continue;if(u(n)==="bucket")continue;r.add(n.domain)}if(t.autoWww!==!1)for(let n of[...r]){if(!Qn(n))continue;r.add(`www.${n}`)}return[...r]}var Ta=["1.1.1.1","8.8.8.8"],wa="/var/www/acme-challenge";function Ca(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function Pa(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function tn(e){if(!e)return;return e.tls??"local-ca"}function bs(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function Ts(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function Ea(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(vs(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function Ra(e,t,r){let n=[],s=new Set,i=(m,S)=>{let b=m.trim().toLowerCase();if(!b||s.has(b))return;s.add(b),n.push({host:b,source:S})},a=t.hostname?.trim(),c=(a||`${r}.local`).toLowerCase();if(i(c,a?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([m,S])=>!!S&&Jr(m)))i(`dashboard.${c}`,"the management dashboard site");for(let[m,S]of Object.entries(e)){if(!S?.domain)continue;if(u(S)==="bucket")continue;if(!Ea(S.domain))continue;i(S.domain,`site "${m}"`)}return n}function xa(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function Oa(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let s=xa(r,t.allowedSuffixes);if(!s)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${s}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function lg(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function mc(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Da(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function ws(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),s=t.slug??"app",i=t.proxy.certsDir??Un,a=t.proxy.loadBalancer,c=[],l=new Set;for(let[y,f]of Object.entries(e)){if(!f||!f.domain)continue;let T=u(f);if(T==="bucket")continue;let D=lg(f.path),R=mc(f.domain,D),C=Pa(f);if(T==="redirect"){c.push({to:f.domain,path:D,redirect:Ca(f.redirect),id:R,...C?{auth:C}:{}}),l.add(f.domain);continue}if(T==="proxy"){let P=xr(f);if(P.length===0)continue;let w=P.length===1?P[0]:P;c.push({to:f.domain,path:D,from:w,id:R,...C?{auth:C}:{},...Array.isArray(w)&&a?{loadBalancer:a}:{}}),l.add(f.domain);continue}if(T==="server-app"){if(typeof f.port!=="number")continue;let P=Da(f.port,r);c.push({to:f.domain,path:D,from:P,id:R,...C?{auth:C}:{},...Array.isArray(P)&&a?{loadBalancer:a}:{}})}else c.push({to:f.domain,path:D,static:{dir:`${n}/${s}-${y}/current`,spa:f.spa??!1,pathRewriteStyle:f.pathRewriteStyle??"directory"},cleanUrls:f.pathRewriteStyle!=="flat",...C?{auth:C}:{},id:R});l.add(f.domain)}if(t.proxy.autoWww!==!1)for(let y of[...l]){if(!Qn(y))continue;let f=`www.${y}`;if(l.has(f))continue;c.push({to:f,redirect:{to:`https://${y}`},id:mc(f)}),l.add(f)}c.sort((y,f)=>{if(y.to!==f.to)return y.to.localeCompare(f.to);return(f.path?.length??0)-(y.path?.length??0)});let m={proxies:c,productionCerts:{certsDir:i,certsDirServerNames:[...l]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1}};if(t.proxy.onDemandTls&&l.size>0)m.onDemandTls={enabled:!0,allowedSuffixes:[...l],email:t.proxy.onDemandTlsEmail,certsDir:i,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)m.acmeChallengeWebroot=t.proxy.acmeWebroot??wa;let S=t.proxy.cdn,b=S?.frontedHosts?.length?S.frontedHosts:[...l];if(S?.secret&&b.length>0)m.originGuard={header:S.secretHeader??"X-Origin-Verify",value:S.secret,hosts:b};if(t.lan)if(tn(t.lan)==="off")m.https=!1;else{let y=Ra(e,t.lan,s);Oa(y,m.onDemandTls);let f=t.lan.ip&&vs(t.lan.ip)!==0?[t.lan.ip]:[];m.localCa={dir:ys,hosts:y.map((T)=>T.host),...f.length>0?{ips:f}:{},installTrust:!0}}return m}function X(e,t){return ws(e,t)}function Ir(e,t,r){return ws(e,r,t)}function nh(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
 // Routes are derived from the \`sites\` model on every \`buddy deploy\`.
 import { startProxies } from '@stacksjs/rpx'
 

package/dist/{chunk-tsaffke7.js → chunk-mhv7dbr1.js}

@@ -1,4 +1,4 @@
-import{gt,n}from"./chunk-7gvnrx46.js";import{o}from"./chunk-jch6ks7a.js";import{I}from"./chunk-yzns0k2b.js";import{f}from"./chunk-kzjvasjs.js";import{he}from"./chunk-kcj92xx7.js";function R(e,t){let r=[`Action=${e}`,"Version=2010-05-08"];for(let[a,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((c,l)=>{if(typeof c==="object"&&c!==null)for(let[d,m]of Object.entries(c))r.push(`${a}.member.${l+1}.${d}=${encodeURIComponent(String(m))}`);else r.push(`${a}.member.${l+1}=${encodeURIComponent(String(c))}`)});else if(typeof i==="object"){for(let[c,l]of Object.entries(i))if(l!==void 0&&l!==null)r.push(`${a}.${c}=${encodeURIComponent(String(l))}`)}else r.push(`${a}=${encodeURIComponent(String(i))}`)}return r.join("&")}var S=new gt({ignoreAttributes:!0,parseTagValue:!1,trimValues:!0});function b(e){if(typeof e!=="string"||!e.trim())return{};return S.parse(e)}function s(e,t){let r=[e];while(r.length>0){let a=[];for(let i of r){if(!i||typeof i!=="object")continue;if(Array.isArray(i)){a.push(...i);continue}if(t in i){let c=i[t];return typeof c==="string"?c:void 0}a.push(...Object.values(i))}r=a}return}function u(e,t,r){let a=[e];while(a.length>0){let i=[];for(let c of a){if(!c||typeof c!=="object")continue;if(Array.isArray(c)){i.push(...c);continue}if(t in c){let l=c[t]?.[r];return l===void 0||l===null?[]:Array.isArray(l)?l:[l]}i.push(...Object.values(c))}a=i}return[]}class be{client;region;constructor(e="us-east-1",t){this.client=new n(void 0,{profile:t}),this.region=e}async request(e,t={}){let r=R(e,t),a=await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r,rawResponse:!0});return b(a)}async createUser(e){let t=await this.request("CreateUser",e);return this.parseUser(t)}async getUser(e={}){let t=await this.request("GetUser",e);return this.parseUser(t)}async listUsers(e={}){let t=await this.request("ListUsers",e),r=this.parseUsers(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Users:r,IsTruncated:a,Marker:i}}async updateUser(e){await this.request("UpdateUser",e)}async deleteUser(e){await this.request("DeleteUser",e)}parseUser(e){return{UserName:s(e,"UserName")||"",UserId:s(e,"UserId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate"),PasswordLastUsed:s(e,"PasswordLastUsed")}}parseUsers(e){return u(e,"Users","member").map((r)=>({UserName:s(r,"UserName")||"",UserId:s(r,"UserId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate"),PasswordLastUsed:s(r,"PasswordLastUsed")}))}async createGroup(e){let t=await this.request("CreateGroup",e);return this.parseGroup(t)}async getGroup(e){let t=await this.request("GetGroup",e),r=this.parseGroup(t),a=this.parseUsers(t),i=s(t,"IsTruncated")==="true",c=s(t,"Marker");return{Group:r,Users:a,IsTruncated:i,Marker:c}}async listGroups(e={}){let t=await this.request("ListGroups",e),r=this.parseGroups(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Groups:r,IsTruncated:a,Marker:i}}async updateGroup(e){await this.request("UpdateGroup",e)}async deleteGroup(e){await this.request("DeleteGroup",e)}async addUserToGroup(e){await this.request("AddUserToGroup",e)}async removeUserFromGroup(e){await this.request("RemoveUserFromGroup",e)}async listGroupsForUser(e){let t=await this.request("ListGroupsForUser",e),r=this.parseGroups(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Groups:r,IsTruncated:a,Marker:i}}parseGroup(e){return{GroupName:s(e,"GroupName")||"",GroupId:s(e,"GroupId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate")}}parseGroups(e){return u(e,"Groups","member").map((r)=>({GroupName:s(r,"GroupName")||"",GroupId:s(r,"GroupId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate")}))}async createRole(e){let t=await this.request("CreateRole",e);return this.parseRole(t)}async getRole(e){let t=await this.request("GetRole",e);return this.parseRole(t)}async listRoles(e={}){let t=await this.request("ListRoles",e),r=this.parseRoles(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Roles:r,IsTruncated:a,Marker:i}}async updateRole(e){await this.request("UpdateRole",e)}async updateRoleDescription(e){let t=await this.request("UpdateRoleDescription",e);return this.parseRole(t)}async updateAssumeRolePolicy(e){await this.request("UpdateAssumeRolePolicy",e)}async deleteRole(e){await this.request("DeleteRole",e)}async tagRole(e){await this.request("TagRole",e)}async untagRole(e){await this.request("UntagRole",e)}async listRoleTags(e){let t=await this.request("ListRoleTags",e),r=this.parseTags(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Tags:r,IsTruncated:a,Marker:i}}parseRole(e){return{RoleName:s(e,"RoleName")||"",RoleId:s(e,"RoleId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate"),AssumeRolePolicyDocument:s(e,"AssumeRolePolicyDocument"),Description:s(e,"Description"),MaxSessionDuration:s(e,"MaxSessionDuration")?Number.parseInt(s(e,"MaxSessionDuration"),10):void 0}}parseRoles(e){return u(e,"Roles","member").map((r)=>({RoleName:s(r,"RoleName")||"",RoleId:s(r,"RoleId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate"),AssumeRolePolicyDocument:s(r,"AssumeRolePolicyDocument"),Description:s(r,"Description"),MaxSessionDuration:s(r,"MaxSessionDuration")?Number.parseInt(s(r,"MaxSessionDuration"),10):void 0}))}parseTags(e){return u(e,"Tags","member").map((r)=>({Key:s(r,"Key")||"",Value:s(r,"Value")||""}))}async createPolicy(e){let t=await this.request("CreatePolicy",e);return this.parsePolicy(t)}async getPolicy(e){let t=await this.request("GetPolicy",e);return this.parsePolicy(t)}async getPolicyVersion(e){let t=await this.request("GetPolicyVersion",e);return{VersionId:s(t,"VersionId")||"",IsDefaultVersion:s(t,"IsDefaultVersion")==="true",CreateDate:s(t,"CreateDate"),Document:s(t,"Document")}}async listPolicies(e={}){let t=await this.request("ListPolicies",e),r=this.parsePolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Policies:r,IsTruncated:a,Marker:i}}async listPolicyVersions(e){let t=await this.request("ListPolicyVersions",e),r=this.parsePolicyVersions(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Versions:r,IsTruncated:a,Marker:i}}async createPolicyVersion(e){let t=await this.request("CreatePolicyVersion",e);return{VersionId:s(t,"VersionId")||"",IsDefaultVersion:s(t,"IsDefaultVersion")==="true",CreateDate:s(t,"CreateDate")}}async deletePolicyVersion(e){await this.request("DeletePolicyVersion",e)}async setDefaultPolicyVersion(e){await this.request("SetDefaultPolicyVersion",e)}async deletePolicy(e){await this.request("DeletePolicy",e)}async attachUserPolicy(e){await this.request("AttachUserPolicy",e)}async detachUserPolicy(e){await this.request("DetachUserPolicy",e)}async attachGroupPolicy(e){await this.request("AttachGroupPolicy",e)}async detachGroupPolicy(e){await this.request("DetachGroupPolicy",e)}async attachRolePolicy(e){await this.request("AttachRolePolicy",e)}async detachRolePolicy(e){await this.request("DetachRolePolicy",e)}async listAttachedUserPolicies(e){let t=await this.request("ListAttachedUserPolicies",e),r=this.parseAttachedPolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AttachedPolicies:r,IsTruncated:a,Marker:i}}async listAttachedGroupPolicies(e){let t=await this.request("ListAttachedGroupPolicies",e),r=this.parseAttachedPolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AttachedPolicies:r,IsTruncated:a,Marker:i}}async listAttachedRolePolicies(e){let t=await this.request("ListAttachedRolePolicies",e),r=this.parseAttachedPolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AttachedPolicies:r,IsTruncated:a,Marker:i}}parsePolicy(e){return{PolicyName:s(e,"PolicyName")||"",PolicyId:s(e,"PolicyId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),DefaultVersionId:s(e,"DefaultVersionId"),AttachmentCount:s(e,"AttachmentCount")?Number.parseInt(s(e,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:s(e,"PermissionsBoundaryUsageCount")?Number.parseInt(s(e,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:s(e,"IsAttachable")==="true",Description:s(e,"Description"),CreateDate:s(e,"CreateDate"),UpdateDate:s(e,"UpdateDate")}}parsePolicies(e){return u(e,"Policies","member").map((r)=>({PolicyName:s(r,"PolicyName")||"",PolicyId:s(r,"PolicyId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),DefaultVersionId:s(r,"DefaultVersionId"),AttachmentCount:s(r,"AttachmentCount")?Number.parseInt(s(r,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:s(r,"PermissionsBoundaryUsageCount")?Number.parseInt(s(r,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:s(r,"IsAttachable")==="true",Description:s(r,"Description"),CreateDate:s(r,"CreateDate"),UpdateDate:s(r,"UpdateDate")}))}parsePolicyVersions(e){return u(e,"Versions","member").map((r)=>({VersionId:s(r,"VersionId")||"",IsDefaultVersion:s(r,"IsDefaultVersion")==="true",CreateDate:s(r,"CreateDate")}))}parseAttachedPolicies(e){return u(e,"AttachedPolicies","member").map((r)=>({PolicyName:s(r,"PolicyName")||"",PolicyArn:s(r,"PolicyArn")||""}))}async putUserPolicy(e){await this.request("PutUserPolicy",e)}async getUserPolicy(e){let t=await this.request("GetUserPolicy",e);return{UserName:s(t,"UserName")||"",PolicyName:s(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(s(t,"PolicyDocument")||"")}}async deleteUserPolicy(e){await this.request("DeleteUserPolicy",e)}async listUserPolicies(e){let t=await this.request("ListUserPolicies",e),r=u(t,"PolicyNames","member"),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{PolicyNames:r,IsTruncated:a,Marker:i}}async putGroupPolicy(e){await this.request("PutGroupPolicy",e)}async getGroupPolicy(e){let t=await this.request("GetGroupPolicy",e);return{GroupName:s(t,"GroupName")||"",PolicyName:s(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(s(t,"PolicyDocument")||"")}}async deleteGroupPolicy(e){await this.request("DeleteGroupPolicy",e)}async listGroupPolicies(e){let t=await this.request("ListGroupPolicies",e),r=u(t,"PolicyNames","member"),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{PolicyNames:r,IsTruncated:a,Marker:i}}async putRolePolicy(e){await this.request("PutRolePolicy",e)}async getRolePolicy(e){let t=await this.request("GetRolePolicy",e);return{RoleName:s(t,"RoleName")||"",PolicyName:s(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(s(t,"PolicyDocument")||"")}}async deleteRolePolicy(e){await this.request("DeleteRolePolicy",e)}async listRolePolicies(e){let t=await this.request("ListRolePolicies",e),r=u(t,"PolicyNames","member"),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{PolicyNames:r,IsTruncated:a,Marker:i}}async createAccessKey(e={}){let t=await this.request("CreateAccessKey",e);if(typeof t==="object"){let r=t?.CreateAccessKeyResult?.AccessKey||t?.AccessKey;if(r)return{AccessKey:{UserName:r.UserName||"",AccessKeyId:r.AccessKeyId||"",Status:r.Status||"Active",SecretAccessKey:r.SecretAccessKey||"",CreateDate:r.CreateDate}}}return{AccessKey:{UserName:s(t,"UserName")||"",AccessKeyId:s(t,"AccessKeyId")||"",Status:s(t,"Status")||"Active",SecretAccessKey:s(t,"SecretAccessKey")||"",CreateDate:s(t,"CreateDate")}}}async listAccessKeys(e={}){let t=await this.request("ListAccessKeys",e),r=this.parseAccessKeys(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AccessKeyMetadata:r,IsTruncated:a,Marker:i}}async updateAccessKey(e){await this.request("UpdateAccessKey",e)}async deleteAccessKey(e){await this.request("DeleteAccessKey",e)}async getAccessKeyLastUsed(e){let t=await this.request("GetAccessKeyLastUsed",e);return{UserName:s(t,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:s(t,"LastUsedDate"),ServiceName:s(t,"ServiceName"),Region:s(t,"Region")}}}parseAccessKeys(e){return u(e,"AccessKeyMetadata","member").map((r)=>({UserName:s(r,"UserName"),AccessKeyId:s(r,"AccessKeyId")||"",Status:s(r,"Status")||"Active",CreateDate:s(r,"CreateDate")}))}async createInstanceProfile(e){let t=await this.request("CreateInstanceProfile",e);return this.parseInstanceProfile(t)}async getInstanceProfile(e){let t=await this.request("GetInstanceProfile",e);return this.parseInstanceProfile(t)}async listInstanceProfiles(e={}){let t=await this.request("ListInstanceProfiles",e),r=this.parseInstanceProfiles(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{InstanceProfiles:r,IsTruncated:a,Marker:i}}async listInstanceProfilesForRole(e){let t=await this.request("ListInstanceProfilesForRole",e),r=this.parseInstanceProfiles(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{InstanceProfiles:r,IsTruncated:a,Marker:i}}async addRoleToInstanceProfile(e){await this.request("AddRoleToInstanceProfile",e)}async removeRoleFromInstanceProfile(e){await this.request("RemoveRoleFromInstanceProfile",e)}async deleteInstanceProfile(e){await this.request("DeleteInstanceProfile",e)}parseInstanceProfile(e){return{InstanceProfileName:s(e,"InstanceProfileName")||"",InstanceProfileId:s(e,"InstanceProfileId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate")}}parseInstanceProfiles(e){return u(e,"InstanceProfiles","member").map((r)=>({InstanceProfileName:s(r,"InstanceProfileName")||"",InstanceProfileId:s(r,"InstanceProfileId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate")}))}async getAccountPasswordPolicy(){let e=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:s(e,"MinimumPasswordLength")?Number.parseInt(s(e,"MinimumPasswordLength"),10):void 0,RequireSymbols:s(e,"RequireSymbols")==="true",RequireNumbers:s(e,"RequireNumbers")==="true",RequireUppercaseCharacters:s(e,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:s(e,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:s(e,"AllowUsersToChangePassword")==="true",ExpirePasswords:s(e,"ExpirePasswords")==="true",MaxPasswordAge:s(e,"MaxPasswordAge")?Number.parseInt(s(e,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:s(e,"PasswordReusePrevention")?Number.parseInt(s(e,"PasswordReusePrevention"),10):void 0,HardExpiry:s(e,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(e){await this.request("UpdateAccountPasswordPolicy",e)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let e=await this.request("GetAccountSummary"),t={},r=u(e,"SummaryMap","entry");for(let a of r){let i=s(a,"key"),c=s(a,"value");if(i&&c)t[i]=Number.parseInt(c,10)}return t}async listAccountAliases(){let e=await this.request("ListAccountAliases"),t=u(e,"AccountAliases","member"),r=s(e,"IsTruncated")==="true",a=s(e,"Marker");return{AccountAliases:t,IsTruncated:r,Marker:a}}async createAccountAlias(e){await this.request("CreateAccountAlias",e)}async deleteAccountAlias(e){await this.request("DeleteAccountAlias",e)}async simulatePrincipalPolicy(e){let t=await this.request("SimulatePrincipalPolicy",e);return this.parseSimulationResults(t)}parseSimulationResults(e){let r=u(e,"EvaluationResults","member").map((c)=>{let d=u(c,"MatchedStatements","member").map((m)=>({SourcePolicyId:s(m,"SourcePolicyId"),SourcePolicyType:s(m,"SourcePolicyType")}));return{EvalActionName:s(c,"EvalActionName")||"",EvalResourceName:s(c,"EvalResourceName"),EvalDecision:s(c,"EvalDecision")||"",MatchedStatements:d.length>0?d:void 0}}),a=s(e,"IsTruncated")==="true",i=s(e,"Marker");return{EvaluationResults:r,IsTruncated:a,Marker:i}}}class ot{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(t)}async createEmailIdentity(e){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailIdentity(e){let t=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:t.IdentityType,IdentityName:e,SendingEnabled:t.VerifiedForSendingStatus,VerificationStatus:t.VerificationStatus,DkimAttributes:t.DkimAttributes,MailFromAttributes:t.MailFromAttributes}}async putEmailIdentityMailFromAttributes(e,t){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async listEmailIdentities(e){let t="/v2/email/identities",r=[];if(e?.PageSize)r.push(`PageSize=${e.PageSize}`);if(e?.NextToken)r.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(r.length>0)t+=`?${r.join("&")}`;let a=await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}});return{EmailIdentities:a.EmailIdentities,NextToken:a.NextToken}}async deleteEmailIdentity(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(e){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:e.SigningEnabled})})}async sendEmail(e){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).MessageId}}async sendBulkEmail(e){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).BulkEmailEntryResults}}async createEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailTemplate(e){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(e){let t="/v2/email/templates",r=[];if(e?.PageSize)r.push(`PageSize=${e.PageSize}`);if(e?.NextToken)r.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(r.length>0)t+=`?${r.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"}),t=f(e,"GetSendStatistics")?.SendDataPoints?.member;return{SendDataPoints:t==null?[]:Array.isArray(t)?t:[t]}}async getSendQuota(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"}),t=f(e,"GetSendQuota"),r=(a)=>a==null||a===""?void 0:Number(a);return{Max24HourSend:r(t?.Max24HourSend),MaxSendRate:r(t?.MaxSendRate),SentLast24Hours:r(t?.SentLast24Hours)}}async verifyDomain(e){let t=await this.createEmailIdentity({EmailIdentity:e});return{dkimTokens:t.DkimAttributes?.Tokens,verificationStatus:t.DkimAttributes?.Status}}async sendSimpleEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],r=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0,a={};if(e.text)a.Text={Data:e.text};if(e.html)a.Html={Data:e.html};return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Simple:{Subject:{Data:e.subject},Body:a}},ReplyToAddresses:r})}async sendTemplatedEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],r=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0;return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.templateData)}},ReplyToAddresses:r})}async getDkimRecords(e){let t=await this.getEmailIdentity(e);if(!t.DkimAttributes?.Tokens)return[];return t.DkimAttributes.Tokens.map((r)=>({name:`${r}._domainkey.${e}`,type:"CNAME",value:`${r}.dkim.amazonses.com`}))}async isDomainVerified(e){try{let t=await this.getEmailIdentity(e);return t.VerificationStatus==="SUCCESS"&&t.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(e,t=60,r=30000){for(let a=0;a<t;a++){if(await this.isDomainVerified(e))return!0;await new Promise((c)=>setTimeout(c,r))}return!1}buildFormBody(e){return Object.entries(e).filter(([,r])=>r!==void 0).map(([r,a])=>`${encodeURIComponent(r)}=${encodeURIComponent(a)}`).join("&")}async createReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async deleteReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async setActiveReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async listReceiptRuleSets(e){let t={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(e)t.NextToken=e;let r=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),a=r?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||r?.ListReceiptRuleSetsResult,i=a?.RuleSets?.member;return{RuleSets:Array.isArray(i)?i:i?[i]:[],NextToken:a?.NextToken}}async describeReceiptRuleSet(e){let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})}),r=t?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||t?.DescribeReceiptRuleSetResult,a=r?.Rules?.member;return{Metadata:r?.Metadata,Rules:Array.isArray(a)?a:a?[a]:[]}}async createReceiptRule(e){let t={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name,"Rule.Enabled":e.Rule.Enabled!==!1?"true":"false"};if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.After)t.After=e.After;if(e.Rule.Recipients)e.Rule.Recipients.forEach((r,a)=>{t[`Rule.Recipients.member.${a+1}`]=r});e.Rule.Actions.forEach((r,a)=>{let i=a+1;if(r.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=r.S3Action.BucketName,r.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=r.S3Action.ObjectKeyPrefix;if(r.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=r.S3Action.KmsKeyArn}if(r.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=r.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=r.LambdaAction.InvocationType||"Event";if(r.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=r.SNSAction.TopicArn,r.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=r.SNSAction.Encoding}if(r.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=r.StopAction.Scope,r.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=r.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async deleteReceiptRule(e,t){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:e,RuleName:t})})}async receiptRuleSetExists(e){try{return await this.describeReceiptRuleSet(e),!0}catch(t){if(t.code==="RuleSetDoesNotExist"||t.statusCode===400)return!1;throw t}}async getActiveReceiptRuleSet(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),t=e?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||e?.DescribeActiveReceiptRuleSetResult;if(!t?.Metadata)return null;let r=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(r)?r:r?[r]:[]}}async updateReceiptRule(e){let t={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name};if(e.Rule.Enabled!==void 0)t["Rule.Enabled"]=e.Rule.Enabled?"true":"false";if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.Rule.Recipients)e.Rule.Recipients.forEach((r,a)=>{t[`Rule.Recipients.member.${a+1}`]=r});e.Rule.Actions.forEach((r,a)=>{let i=a+1;if(r.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=r.S3Action.BucketName,r.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=r.S3Action.ObjectKeyPrefix;if(r.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=r.S3Action.KmsKeyArn}if(r.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=r.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=r.LambdaAction.InvocationType||"Event";if(r.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=r.SNSAction.TopicArn,r.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=r.SNSAction.Encoding}if(r.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=r.StopAction.Scope,r.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=r.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async sendRawEmail(e){let t=Buffer.from(e.rawMessage).toString("base64"),r={Action:"SendRawEmail",Version:"2010-12-01",Source:e.source,"RawMessage.Data":t};e.destinations.forEach((c,l)=>{r[`Destinations.member.${l+1}`]=c});let a=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)});return{MessageId:(a?.SendRawEmailResponse?.SendRawEmailResult||a?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(e){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`}))?.SuppressedDestination||null}catch(t){if(t.message?.includes("404")||t.message?.includes("NotFoundException"))return null;throw t}}async deleteSuppressedDestination(e){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`})}}class kn{ses;s3;iam;route53;region;domain;defaultFrom;constructor(e={}){this.region=e.region||"us-east-1",this.domain=e.domain,this.defaultFrom=e.defaultFrom,this.ses=new ot(this.region),this.s3=new o(this.region),this.iam=new be(this.region),this.route53=new I(this.region)}async send(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let r=e.fromName?`${e.fromName} <${t}>`:t,a=Array.isArray(e.to)?e.to:[e.to];if(!e.attachments||e.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:r,to:a,subject:e.subject,text:e.text,html:e.html,replyTo:e.replyTo})).MessageId||""};let i=this.buildRawEmail(e,r,a);return{messageId:(await this.ses.sendEmail({FromEmailAddress:r,Destination:{ToAddresses:a,CcAddresses:e.cc?Array.isArray(e.cc)?e.cc:[e.cc]:void 0,BccAddresses:e.bcc?Array.isArray(e.bcc)?e.bcc:[e.bcc]:void 0},Content:{Raw:{Data:Buffer.from(i).toString("base64")}}})).MessageId||""}}async sendTemplate(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let r=e.fromName?`${e.fromName} <${t}>`:t;return{messageId:(await this.ses.sendTemplatedEmail({from:r,to:e.to,templateName:e.templateName,templateData:e.templateData,replyTo:e.replyTo})).MessageId||""}}async sendBulk(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let r=e.recipients.map((i)=>({Destination:{ToAddresses:Array.isArray(i.to)?i.to:[i.to]},ReplacementEmailContent:i.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(i.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:t,BulkEmailEntries:r,DefaultContent:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.defaultTemplateData)}}})).BulkEmailEntryResults?.map((i)=>({status:i.Status||"UNKNOWN",messageId:i.MessageId,error:i.Error}))||[]}}async setupDomain(e){let t;try{t=await this.ses.getEmailIdentity(e)}catch{let a=await this.ses.createEmailIdentity({EmailIdentity:e});t={VerificationStatus:a.DkimAttributes?.Status,DkimAttributes:a.DkimAttributes,SendingEnabled:a.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:e,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(e,{MailFromDomain:`mail.${e}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let r=await this.ses.getDkimRecords(e);return{domainVerified:t.SendingEnabled===!0,dkimStatus:t.DkimAttributes?.Status||"UNKNOWN",dkimTokens:t.DkimAttributes?.Tokens,mailFromStatus:t.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(e){let t=[],r=await this.ses.getDkimRecords(e);for(let a of r)t.push({type:a.type,name:a.name,value:a.value,ttl:1800});return t.push({type:"MX",name:e,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),t.push({type:"MX",name:`mail.${e}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),t.push({type:"TXT",name:`mail.${e}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),t.push({type:"TXT",name:`_dmarc.${e}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${e}`,ttl:3600}),t}async isDomainReady(e){try{let t=await this.ses.getEmailIdentity(e);return t.SendingEnabled===!0&&t.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(e){let t={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${e.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":e.accountId}}}]};await this.s3.putBucketPolicy(e.bucketName,t);try{await this.ses.createReceiptRuleSet(e.ruleSetName)}catch(a){if(!a.message?.includes("already exists")&&a.code!=="AlreadyExists")throw a}let r=[{S3Action:{BucketName:e.bucketName,ObjectKeyPrefix:e.prefix||"inbox/"}}];if(e.lambdaArn)r.push({LambdaAction:{FunctionArn:e.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:r}})}catch(a){if(a.message?.includes("already exists"))await this.ses.deleteReceiptRule(e.ruleSetName,e.ruleName),await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:r}});else throw a}await this.ses.setActiveReceiptRuleSet(e.ruleSetName)}async getIncomingEmails(e){return(await this.s3.list({bucket:e.bucket,prefix:e.prefix||"incoming/",maxKeys:e.maxResults||100})).map((r)=>({key:r.Key||"",lastModified:r.LastModified||"",size:r.Size||0}))}async readEmail(e){return await this.s3.getObject(e.bucket,e.key)}async createSmtpCredentials(e){let t=`ses-smtp-${e.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:r}=await import("./chunk-yhjagaff.js"),a=new r,i=(p,y)=>{let P={Action:p,Version:"2010-05-08",...y};return Object.entries(P).map(([A,h])=>`${encodeURIComponent(A)}=${encodeURIComponent(h)}`).join("&")};try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateUser",{UserName:t})})}catch(p){if(!p.message?.includes("EntityAlreadyExists"))throw p}let c={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${e.domain}`}}}]},l=`ses-smtp-policy-${e.domain.replace(/\./g,"-")}`;try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("PutUserPolicy",{UserName:t,PolicyName:l,PolicyDocument:JSON.stringify(c)})})}catch{}let m=(await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateAccessKey",{UserName:t})}))?.CreateAccessKeyResult?.AccessKey;if(!m?.AccessKeyId||!m?.SecretAccessKey)throw Error("Failed to create access key");let g=this.deriveSmtpPassword(m.SecretAccessKey);return{username:m.AccessKeyId,password:g,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(e){let t=he("node:crypto"),r="SendRawEmail",a=Buffer.from([4]),i=t.createHmac("sha256",`AWS4${e}`).update("11111111").digest();return i=t.createHmac("sha256",i).update(this.region).digest(),i=t.createHmac("sha256",i).update("ses").digest(),i=t.createHmac("sha256",i).update("aws4_request").digest(),i=t.createHmac("sha256",i).update("SendRawEmail").digest(),Buffer.concat([a,i]).toString("base64")}async createTemplate(e){await this.ses.createEmailTemplate({TemplateName:e.name,TemplateContent:{Subject:e.subject,Text:e.text,Html:e.html}})}async getTemplate(e){try{let t=await this.ses.getEmailTemplate(e);return{name:t.TemplateName||e,subject:t.TemplateContent?.Subject,text:t.TemplateContent?.Text,html:t.TemplateContent?.Html}}catch{return null}}async deleteTemplate(e){await this.ses.deleteEmailTemplate(e)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((t)=>({name:t.TemplateName||"",createdAt:t.CreatedTimestamp}))||[]}async deploy(e){let t=`${e.appName}-${e.environment}-email-rules`,r=`${e.appName}-inbound-email`,a=e.storage?.bucketName||`${e.appName}-${e.environment}-email`,i=await this.setupDomain(e.domain);if(!(await this.s3.listBuckets()).Buckets?.some((m)=>m.Name===a))await this.s3.createBucket(a);await this.setupReceiving({domain:e.domain,ruleSetName:t,ruleName:r,bucketName:a,prefix:e.storage?.prefix||"inbox/",accountId:e.accountId,recipients:e.catchAll?[e.domain]:e.mailboxes,scanEnabled:!0});let d=await this.getDnsRecords(e.domain);return{success:!0,domainVerified:i.domainVerified,dkimStatus:i.dkimStatus,receiptRuleSet:t,storageBucket:a,dnsRecords:d}}async undeploy(e){let t=`${e.appName}-${e.environment}-email-rules`,r=`${e.appName}-inbound-email`,a=`${e.appName}-${e.environment}-email`;try{await this.ses.deleteReceiptRule(t,r)}catch{}try{await this.ses.deleteReceiptRuleSet(t)}catch{}if(e.deleteBucket)try{await this.s3.emptyAndDeleteBucket(a)}catch{}}async getSendingStats(){let e=await this.ses.getSendQuota();return{sentLast24Hours:e.SentLast24Hours||0,maxSendRate:e.MaxSendRate||0,max24HourSend:e.Max24HourSend||0}}buildRawEmail(e,t,r){let a=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,i="";if(i+=`From: ${t}\r
+import{gt,n}from"./chunk-7gvnrx46.js";import{o}from"./chunk-ncsb3sdn.js";import{I}from"./chunk-yzns0k2b.js";import{f}from"./chunk-kzjvasjs.js";import{he}from"./chunk-kcj92xx7.js";function R(e,t){let r=[`Action=${e}`,"Version=2010-05-08"];for(let[a,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((c,l)=>{if(typeof c==="object"&&c!==null)for(let[d,m]of Object.entries(c))r.push(`${a}.member.${l+1}.${d}=${encodeURIComponent(String(m))}`);else r.push(`${a}.member.${l+1}=${encodeURIComponent(String(c))}`)});else if(typeof i==="object"){for(let[c,l]of Object.entries(i))if(l!==void 0&&l!==null)r.push(`${a}.${c}=${encodeURIComponent(String(l))}`)}else r.push(`${a}=${encodeURIComponent(String(i))}`)}return r.join("&")}var S=new gt({ignoreAttributes:!0,parseTagValue:!1,trimValues:!0});function b(e){if(typeof e!=="string"||!e.trim())return{};return S.parse(e)}function s(e,t){let r=[e];while(r.length>0){let a=[];for(let i of r){if(!i||typeof i!=="object")continue;if(Array.isArray(i)){a.push(...i);continue}if(t in i){let c=i[t];return typeof c==="string"?c:void 0}a.push(...Object.values(i))}r=a}return}function u(e,t,r){let a=[e];while(a.length>0){let i=[];for(let c of a){if(!c||typeof c!=="object")continue;if(Array.isArray(c)){i.push(...c);continue}if(t in c){let l=c[t]?.[r];return l===void 0||l===null?[]:Array.isArray(l)?l:[l]}i.push(...Object.values(c))}a=i}return[]}class be{client;region;constructor(e="us-east-1",t){this.client=new n(void 0,{profile:t}),this.region=e}async request(e,t={}){let r=R(e,t),a=await this.client.request({service:"iam",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r,rawResponse:!0});return b(a)}async createUser(e){let t=await this.request("CreateUser",e);return this.parseUser(t)}async getUser(e={}){let t=await this.request("GetUser",e);return this.parseUser(t)}async listUsers(e={}){let t=await this.request("ListUsers",e),r=this.parseUsers(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Users:r,IsTruncated:a,Marker:i}}async updateUser(e){await this.request("UpdateUser",e)}async deleteUser(e){await this.request("DeleteUser",e)}parseUser(e){return{UserName:s(e,"UserName")||"",UserId:s(e,"UserId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate"),PasswordLastUsed:s(e,"PasswordLastUsed")}}parseUsers(e){return u(e,"Users","member").map((r)=>({UserName:s(r,"UserName")||"",UserId:s(r,"UserId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate"),PasswordLastUsed:s(r,"PasswordLastUsed")}))}async createGroup(e){let t=await this.request("CreateGroup",e);return this.parseGroup(t)}async getGroup(e){let t=await this.request("GetGroup",e),r=this.parseGroup(t),a=this.parseUsers(t),i=s(t,"IsTruncated")==="true",c=s(t,"Marker");return{Group:r,Users:a,IsTruncated:i,Marker:c}}async listGroups(e={}){let t=await this.request("ListGroups",e),r=this.parseGroups(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Groups:r,IsTruncated:a,Marker:i}}async updateGroup(e){await this.request("UpdateGroup",e)}async deleteGroup(e){await this.request("DeleteGroup",e)}async addUserToGroup(e){await this.request("AddUserToGroup",e)}async removeUserFromGroup(e){await this.request("RemoveUserFromGroup",e)}async listGroupsForUser(e){let t=await this.request("ListGroupsForUser",e),r=this.parseGroups(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Groups:r,IsTruncated:a,Marker:i}}parseGroup(e){return{GroupName:s(e,"GroupName")||"",GroupId:s(e,"GroupId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate")}}parseGroups(e){return u(e,"Groups","member").map((r)=>({GroupName:s(r,"GroupName")||"",GroupId:s(r,"GroupId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate")}))}async createRole(e){let t=await this.request("CreateRole",e);return this.parseRole(t)}async getRole(e){let t=await this.request("GetRole",e);return this.parseRole(t)}async listRoles(e={}){let t=await this.request("ListRoles",e),r=this.parseRoles(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Roles:r,IsTruncated:a,Marker:i}}async updateRole(e){await this.request("UpdateRole",e)}async updateRoleDescription(e){let t=await this.request("UpdateRoleDescription",e);return this.parseRole(t)}async updateAssumeRolePolicy(e){await this.request("UpdateAssumeRolePolicy",e)}async deleteRole(e){await this.request("DeleteRole",e)}async tagRole(e){await this.request("TagRole",e)}async untagRole(e){await this.request("UntagRole",e)}async listRoleTags(e){let t=await this.request("ListRoleTags",e),r=this.parseTags(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Tags:r,IsTruncated:a,Marker:i}}parseRole(e){return{RoleName:s(e,"RoleName")||"",RoleId:s(e,"RoleId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate"),AssumeRolePolicyDocument:s(e,"AssumeRolePolicyDocument"),Description:s(e,"Description"),MaxSessionDuration:s(e,"MaxSessionDuration")?Number.parseInt(s(e,"MaxSessionDuration"),10):void 0}}parseRoles(e){return u(e,"Roles","member").map((r)=>({RoleName:s(r,"RoleName")||"",RoleId:s(r,"RoleId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate"),AssumeRolePolicyDocument:s(r,"AssumeRolePolicyDocument"),Description:s(r,"Description"),MaxSessionDuration:s(r,"MaxSessionDuration")?Number.parseInt(s(r,"MaxSessionDuration"),10):void 0}))}parseTags(e){return u(e,"Tags","member").map((r)=>({Key:s(r,"Key")||"",Value:s(r,"Value")||""}))}async createPolicy(e){let t=await this.request("CreatePolicy",e);return this.parsePolicy(t)}async getPolicy(e){let t=await this.request("GetPolicy",e);return this.parsePolicy(t)}async getPolicyVersion(e){let t=await this.request("GetPolicyVersion",e);return{VersionId:s(t,"VersionId")||"",IsDefaultVersion:s(t,"IsDefaultVersion")==="true",CreateDate:s(t,"CreateDate"),Document:s(t,"Document")}}async listPolicies(e={}){let t=await this.request("ListPolicies",e),r=this.parsePolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Policies:r,IsTruncated:a,Marker:i}}async listPolicyVersions(e){let t=await this.request("ListPolicyVersions",e),r=this.parsePolicyVersions(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{Versions:r,IsTruncated:a,Marker:i}}async createPolicyVersion(e){let t=await this.request("CreatePolicyVersion",e);return{VersionId:s(t,"VersionId")||"",IsDefaultVersion:s(t,"IsDefaultVersion")==="true",CreateDate:s(t,"CreateDate")}}async deletePolicyVersion(e){await this.request("DeletePolicyVersion",e)}async setDefaultPolicyVersion(e){await this.request("SetDefaultPolicyVersion",e)}async deletePolicy(e){await this.request("DeletePolicy",e)}async attachUserPolicy(e){await this.request("AttachUserPolicy",e)}async detachUserPolicy(e){await this.request("DetachUserPolicy",e)}async attachGroupPolicy(e){await this.request("AttachGroupPolicy",e)}async detachGroupPolicy(e){await this.request("DetachGroupPolicy",e)}async attachRolePolicy(e){await this.request("AttachRolePolicy",e)}async detachRolePolicy(e){await this.request("DetachRolePolicy",e)}async listAttachedUserPolicies(e){let t=await this.request("ListAttachedUserPolicies",e),r=this.parseAttachedPolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AttachedPolicies:r,IsTruncated:a,Marker:i}}async listAttachedGroupPolicies(e){let t=await this.request("ListAttachedGroupPolicies",e),r=this.parseAttachedPolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AttachedPolicies:r,IsTruncated:a,Marker:i}}async listAttachedRolePolicies(e){let t=await this.request("ListAttachedRolePolicies",e),r=this.parseAttachedPolicies(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AttachedPolicies:r,IsTruncated:a,Marker:i}}parsePolicy(e){return{PolicyName:s(e,"PolicyName")||"",PolicyId:s(e,"PolicyId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),DefaultVersionId:s(e,"DefaultVersionId"),AttachmentCount:s(e,"AttachmentCount")?Number.parseInt(s(e,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:s(e,"PermissionsBoundaryUsageCount")?Number.parseInt(s(e,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:s(e,"IsAttachable")==="true",Description:s(e,"Description"),CreateDate:s(e,"CreateDate"),UpdateDate:s(e,"UpdateDate")}}parsePolicies(e){return u(e,"Policies","member").map((r)=>({PolicyName:s(r,"PolicyName")||"",PolicyId:s(r,"PolicyId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),DefaultVersionId:s(r,"DefaultVersionId"),AttachmentCount:s(r,"AttachmentCount")?Number.parseInt(s(r,"AttachmentCount"),10):void 0,PermissionsBoundaryUsageCount:s(r,"PermissionsBoundaryUsageCount")?Number.parseInt(s(r,"PermissionsBoundaryUsageCount"),10):void 0,IsAttachable:s(r,"IsAttachable")==="true",Description:s(r,"Description"),CreateDate:s(r,"CreateDate"),UpdateDate:s(r,"UpdateDate")}))}parsePolicyVersions(e){return u(e,"Versions","member").map((r)=>({VersionId:s(r,"VersionId")||"",IsDefaultVersion:s(r,"IsDefaultVersion")==="true",CreateDate:s(r,"CreateDate")}))}parseAttachedPolicies(e){return u(e,"AttachedPolicies","member").map((r)=>({PolicyName:s(r,"PolicyName")||"",PolicyArn:s(r,"PolicyArn")||""}))}async putUserPolicy(e){await this.request("PutUserPolicy",e)}async getUserPolicy(e){let t=await this.request("GetUserPolicy",e);return{UserName:s(t,"UserName")||"",PolicyName:s(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(s(t,"PolicyDocument")||"")}}async deleteUserPolicy(e){await this.request("DeleteUserPolicy",e)}async listUserPolicies(e){let t=await this.request("ListUserPolicies",e),r=u(t,"PolicyNames","member"),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{PolicyNames:r,IsTruncated:a,Marker:i}}async putGroupPolicy(e){await this.request("PutGroupPolicy",e)}async getGroupPolicy(e){let t=await this.request("GetGroupPolicy",e);return{GroupName:s(t,"GroupName")||"",PolicyName:s(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(s(t,"PolicyDocument")||"")}}async deleteGroupPolicy(e){await this.request("DeleteGroupPolicy",e)}async listGroupPolicies(e){let t=await this.request("ListGroupPolicies",e),r=u(t,"PolicyNames","member"),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{PolicyNames:r,IsTruncated:a,Marker:i}}async putRolePolicy(e){await this.request("PutRolePolicy",e)}async getRolePolicy(e){let t=await this.request("GetRolePolicy",e);return{RoleName:s(t,"RoleName")||"",PolicyName:s(t,"PolicyName")||"",PolicyDocument:decodeURIComponent(s(t,"PolicyDocument")||"")}}async deleteRolePolicy(e){await this.request("DeleteRolePolicy",e)}async listRolePolicies(e){let t=await this.request("ListRolePolicies",e),r=u(t,"PolicyNames","member"),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{PolicyNames:r,IsTruncated:a,Marker:i}}async createAccessKey(e={}){let t=await this.request("CreateAccessKey",e);if(typeof t==="object"){let r=t?.CreateAccessKeyResult?.AccessKey||t?.AccessKey;if(r)return{AccessKey:{UserName:r.UserName||"",AccessKeyId:r.AccessKeyId||"",Status:r.Status||"Active",SecretAccessKey:r.SecretAccessKey||"",CreateDate:r.CreateDate}}}return{AccessKey:{UserName:s(t,"UserName")||"",AccessKeyId:s(t,"AccessKeyId")||"",Status:s(t,"Status")||"Active",SecretAccessKey:s(t,"SecretAccessKey")||"",CreateDate:s(t,"CreateDate")}}}async listAccessKeys(e={}){let t=await this.request("ListAccessKeys",e),r=this.parseAccessKeys(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{AccessKeyMetadata:r,IsTruncated:a,Marker:i}}async updateAccessKey(e){await this.request("UpdateAccessKey",e)}async deleteAccessKey(e){await this.request("DeleteAccessKey",e)}async getAccessKeyLastUsed(e){let t=await this.request("GetAccessKeyLastUsed",e);return{UserName:s(t,"UserName")||"",AccessKeyLastUsed:{LastUsedDate:s(t,"LastUsedDate"),ServiceName:s(t,"ServiceName"),Region:s(t,"Region")}}}parseAccessKeys(e){return u(e,"AccessKeyMetadata","member").map((r)=>({UserName:s(r,"UserName"),AccessKeyId:s(r,"AccessKeyId")||"",Status:s(r,"Status")||"Active",CreateDate:s(r,"CreateDate")}))}async createInstanceProfile(e){let t=await this.request("CreateInstanceProfile",e);return this.parseInstanceProfile(t)}async getInstanceProfile(e){let t=await this.request("GetInstanceProfile",e);return this.parseInstanceProfile(t)}async listInstanceProfiles(e={}){let t=await this.request("ListInstanceProfiles",e),r=this.parseInstanceProfiles(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{InstanceProfiles:r,IsTruncated:a,Marker:i}}async listInstanceProfilesForRole(e){let t=await this.request("ListInstanceProfilesForRole",e),r=this.parseInstanceProfiles(t),a=s(t,"IsTruncated")==="true",i=s(t,"Marker");return{InstanceProfiles:r,IsTruncated:a,Marker:i}}async addRoleToInstanceProfile(e){await this.request("AddRoleToInstanceProfile",e)}async removeRoleFromInstanceProfile(e){await this.request("RemoveRoleFromInstanceProfile",e)}async deleteInstanceProfile(e){await this.request("DeleteInstanceProfile",e)}parseInstanceProfile(e){return{InstanceProfileName:s(e,"InstanceProfileName")||"",InstanceProfileId:s(e,"InstanceProfileId")||"",Arn:s(e,"Arn")||"",Path:s(e,"Path"),CreateDate:s(e,"CreateDate")}}parseInstanceProfiles(e){return u(e,"InstanceProfiles","member").map((r)=>({InstanceProfileName:s(r,"InstanceProfileName")||"",InstanceProfileId:s(r,"InstanceProfileId")||"",Arn:s(r,"Arn")||"",Path:s(r,"Path"),CreateDate:s(r,"CreateDate")}))}async getAccountPasswordPolicy(){let e=await this.request("GetAccountPasswordPolicy");return{MinimumPasswordLength:s(e,"MinimumPasswordLength")?Number.parseInt(s(e,"MinimumPasswordLength"),10):void 0,RequireSymbols:s(e,"RequireSymbols")==="true",RequireNumbers:s(e,"RequireNumbers")==="true",RequireUppercaseCharacters:s(e,"RequireUppercaseCharacters")==="true",RequireLowercaseCharacters:s(e,"RequireLowercaseCharacters")==="true",AllowUsersToChangePassword:s(e,"AllowUsersToChangePassword")==="true",ExpirePasswords:s(e,"ExpirePasswords")==="true",MaxPasswordAge:s(e,"MaxPasswordAge")?Number.parseInt(s(e,"MaxPasswordAge"),10):void 0,PasswordReusePrevention:s(e,"PasswordReusePrevention")?Number.parseInt(s(e,"PasswordReusePrevention"),10):void 0,HardExpiry:s(e,"HardExpiry")==="true"}}async updateAccountPasswordPolicy(e){await this.request("UpdateAccountPasswordPolicy",e)}async deleteAccountPasswordPolicy(){await this.request("DeleteAccountPasswordPolicy")}async getAccountSummary(){let e=await this.request("GetAccountSummary"),t={},r=u(e,"SummaryMap","entry");for(let a of r){let i=s(a,"key"),c=s(a,"value");if(i&&c)t[i]=Number.parseInt(c,10)}return t}async listAccountAliases(){let e=await this.request("ListAccountAliases"),t=u(e,"AccountAliases","member"),r=s(e,"IsTruncated")==="true",a=s(e,"Marker");return{AccountAliases:t,IsTruncated:r,Marker:a}}async createAccountAlias(e){await this.request("CreateAccountAlias",e)}async deleteAccountAlias(e){await this.request("DeleteAccountAlias",e)}async simulatePrincipalPolicy(e){let t=await this.request("SimulatePrincipalPolicy",e);return this.parseSimulationResults(t)}parseSimulationResults(e){let r=u(e,"EvaluationResults","member").map((c)=>{let d=u(c,"MatchedStatements","member").map((m)=>({SourcePolicyId:s(m,"SourcePolicyId"),SourcePolicyType:s(m,"SourcePolicyType")}));return{EvalActionName:s(c,"EvalActionName")||"",EvalResourceName:s(c,"EvalResourceName"),EvalDecision:s(c,"EvalDecision")||"",MatchedStatements:d.length>0?d:void 0}}),a=s(e,"IsTruncated")==="true",i=s(e,"Marker");return{EvaluationResults:r,IsTruncated:a,Marker:i}}}class ot{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(t)}async createEmailIdentity(e){return await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/identities",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailIdentity(e){let t=await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}});return{IdentityType:t.IdentityType,IdentityName:e,SendingEnabled:t.VerifiedForSendingStatus,VerificationStatus:t.VerificationStatus,DkimAttributes:t.DkimAttributes,MailFromAttributes:t.MailFromAttributes}}async putEmailIdentityMailFromAttributes(e,t){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e)}/mail-from`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})}async listEmailIdentities(e){let t="/v2/email/identities",r=[];if(e?.PageSize)r.push(`PageSize=${e.PageSize}`);if(e?.NextToken)r.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(r.length>0)t+=`?${r.join("&")}`;let a=await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}});return{EmailIdentities:a.EmailIdentities,NextToken:a.NextToken}}async deleteEmailIdentity(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/identities/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async putEmailIdentityDkimAttributes(e){await this.client.request({service:"email",region:this.region,method:"PUT",path:`/v2/email/identities/${encodeURIComponent(e.EmailIdentity)}/dkim`,headers:{"Content-Type":"application/json"},body:JSON.stringify({SigningEnabled:e.SigningEnabled})})}async sendEmail(e){return{MessageId:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).MessageId}}async sendBulkEmail(e){return{BulkEmailEntryResults:(await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/outbound-bulk-emails",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})).BulkEmailEntryResults}}async createEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"POST",path:"/v2/email/templates",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}async getEmailTemplate(e){return await this.client.request({service:"email",region:this.region,method:"GET",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async deleteEmailTemplate(e){await this.client.request({service:"email",region:this.region,method:"DELETE",path:`/v2/email/templates/${encodeURIComponent(e)}`,headers:{"Content-Type":"application/json"}})}async listEmailTemplates(e){let t="/v2/email/templates",r=[];if(e?.PageSize)r.push(`PageSize=${e.PageSize}`);if(e?.NextToken)r.push(`NextToken=${encodeURIComponent(e.NextToken)}`);if(r.length>0)t+=`?${r.join("&")}`;return await this.client.request({service:"email",region:this.region,method:"GET",path:t,headers:{"Content-Type":"application/json"}})}async getSendStatistics(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendStatistics&Version=2010-12-01"}),t=f(e,"GetSendStatistics")?.SendDataPoints?.member;return{SendDataPoints:t==null?[]:Array.isArray(t)?t:[t]}}async getSendQuota(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=GetSendQuota&Version=2010-12-01"}),t=f(e,"GetSendQuota"),r=(a)=>a==null||a===""?void 0:Number(a);return{Max24HourSend:r(t?.Max24HourSend),MaxSendRate:r(t?.MaxSendRate),SentLast24Hours:r(t?.SentLast24Hours)}}async verifyDomain(e){let t=await this.createEmailIdentity({EmailIdentity:e});return{dkimTokens:t.DkimAttributes?.Tokens,verificationStatus:t.DkimAttributes?.Status}}async sendSimpleEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],r=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0,a={};if(e.text)a.Text={Data:e.text};if(e.html)a.Html={Data:e.html};return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Simple:{Subject:{Data:e.subject},Body:a}},ReplyToAddresses:r})}async sendTemplatedEmail(e){let t=Array.isArray(e.to)?e.to:[e.to],r=e.replyTo?Array.isArray(e.replyTo)?e.replyTo:[e.replyTo]:void 0;return this.sendEmail({FromEmailAddress:e.from,Destination:{ToAddresses:t},Content:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.templateData)}},ReplyToAddresses:r})}async getDkimRecords(e){let t=await this.getEmailIdentity(e);if(!t.DkimAttributes?.Tokens)return[];return t.DkimAttributes.Tokens.map((r)=>({name:`${r}._domainkey.${e}`,type:"CNAME",value:`${r}.dkim.amazonses.com`}))}async isDomainVerified(e){try{let t=await this.getEmailIdentity(e);return t.VerificationStatus==="SUCCESS"&&t.SendingEnabled===!0}catch{return!1}}async waitForDomainVerification(e,t=60,r=30000){for(let a=0;a<t;a++){if(await this.isDomainVerified(e))return!0;await new Promise((c)=>setTimeout(c,r))}return!1}buildFormBody(e){return Object.entries(e).filter(([,r])=>r!==void 0).map(([r,a])=>`${encodeURIComponent(r)}=${encodeURIComponent(a)}`).join("&")}async createReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async deleteReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async setActiveReceiptRuleSet(e){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetActiveReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})})}async listReceiptRuleSets(e){let t={Action:"ListReceiptRuleSets",Version:"2010-12-01"};if(e)t.NextToken=e;let r=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),a=r?.ListReceiptRuleSetsResponse?.ListReceiptRuleSetsResult||r?.ListReceiptRuleSetsResult,i=a?.RuleSets?.member;return{RuleSets:Array.isArray(i)?i:i?[i]:[],NextToken:a?.NextToken}}async describeReceiptRuleSet(e){let t=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeReceiptRuleSet",Version:"2010-12-01",RuleSetName:e})}),r=t?.DescribeReceiptRuleSetResponse?.DescribeReceiptRuleSetResult||t?.DescribeReceiptRuleSetResult,a=r?.Rules?.member;return{Metadata:r?.Metadata,Rules:Array.isArray(a)?a:a?[a]:[]}}async createReceiptRule(e){let t={Action:"CreateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name,"Rule.Enabled":e.Rule.Enabled!==!1?"true":"false"};if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.After)t.After=e.After;if(e.Rule.Recipients)e.Rule.Recipients.forEach((r,a)=>{t[`Rule.Recipients.member.${a+1}`]=r});e.Rule.Actions.forEach((r,a)=>{let i=a+1;if(r.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=r.S3Action.BucketName,r.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=r.S3Action.ObjectKeyPrefix;if(r.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=r.S3Action.KmsKeyArn}if(r.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=r.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=r.LambdaAction.InvocationType||"Event";if(r.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=r.SNSAction.TopicArn,r.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=r.SNSAction.Encoding}if(r.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=r.StopAction.Scope,r.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=r.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async deleteReceiptRule(e,t){await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteReceiptRule",Version:"2010-12-01",RuleSetName:e,RuleName:t})})}async receiptRuleSetExists(e){try{return await this.describeReceiptRuleSet(e),!0}catch(t){if(t.code==="RuleSetDoesNotExist"||t.statusCode===400)return!1;throw t}}async getActiveReceiptRuleSet(){let e=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DescribeActiveReceiptRuleSet",Version:"2010-12-01"})}),t=e?.DescribeActiveReceiptRuleSetResponse?.DescribeActiveReceiptRuleSetResult||e?.DescribeActiveReceiptRuleSetResult;if(!t?.Metadata)return null;let r=t?.Rules?.member;return{Metadata:t?.Metadata,Rules:Array.isArray(r)?r:r?[r]:[]}}async updateReceiptRule(e){let t={Action:"UpdateReceiptRule",Version:"2010-12-01",RuleSetName:e.RuleSetName,"Rule.Name":e.Rule.Name};if(e.Rule.Enabled!==void 0)t["Rule.Enabled"]=e.Rule.Enabled?"true":"false";if(e.Rule.TlsPolicy)t["Rule.TlsPolicy"]=e.Rule.TlsPolicy;if(e.Rule.ScanEnabled!==void 0)t["Rule.ScanEnabled"]=e.Rule.ScanEnabled?"true":"false";if(e.Rule.Recipients)e.Rule.Recipients.forEach((r,a)=>{t[`Rule.Recipients.member.${a+1}`]=r});e.Rule.Actions.forEach((r,a)=>{let i=a+1;if(r.S3Action){if(t[`Rule.Actions.member.${i}.S3Action.BucketName`]=r.S3Action.BucketName,r.S3Action.ObjectKeyPrefix)t[`Rule.Actions.member.${i}.S3Action.ObjectKeyPrefix`]=r.S3Action.ObjectKeyPrefix;if(r.S3Action.KmsKeyArn)t[`Rule.Actions.member.${i}.S3Action.KmsKeyArn`]=r.S3Action.KmsKeyArn}if(r.LambdaAction)t[`Rule.Actions.member.${i}.LambdaAction.FunctionArn`]=r.LambdaAction.FunctionArn,t[`Rule.Actions.member.${i}.LambdaAction.InvocationType`]=r.LambdaAction.InvocationType||"Event";if(r.SNSAction){if(t[`Rule.Actions.member.${i}.SNSAction.TopicArn`]=r.SNSAction.TopicArn,r.SNSAction.Encoding)t[`Rule.Actions.member.${i}.SNSAction.Encoding`]=r.SNSAction.Encoding}if(r.StopAction){if(t[`Rule.Actions.member.${i}.StopAction.Scope`]=r.StopAction.Scope,r.StopAction.TopicArn)t[`Rule.Actions.member.${i}.StopAction.TopicArn`]=r.StopAction.TopicArn}}),await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async sendRawEmail(e){let t=Buffer.from(e.rawMessage).toString("base64"),r={Action:"SendRawEmail",Version:"2010-12-01",Source:e.source,"RawMessage.Data":t};e.destinations.forEach((c,l)=>{r[`Destinations.member.${l+1}`]=c});let a=await this.client.request({service:"ses",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)});return{MessageId:(a?.SendRawEmailResponse?.SendRawEmailResult||a?.SendRawEmailResult)?.MessageId}}async getSuppressedDestination(e){try{return(await this.client.request({service:"ses",region:this.region,method:"GET",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`}))?.SuppressedDestination||null}catch(t){if(t.message?.includes("404")||t.message?.includes("NotFoundException"))return null;throw t}}async deleteSuppressedDestination(e){await this.client.request({service:"ses",region:this.region,method:"DELETE",path:`/v2/email/suppression/addresses/${encodeURIComponent(e)}`})}}class kn{ses;s3;iam;route53;region;domain;defaultFrom;constructor(e={}){this.region=e.region||"us-east-1",this.domain=e.domain,this.defaultFrom=e.defaultFrom,this.ses=new ot(this.region),this.s3=new o(this.region),this.iam=new be(this.region),this.route53=new I(this.region)}async send(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required. Set defaultFrom in constructor or provide from in options.");let r=e.fromName?`${e.fromName} <${t}>`:t,a=Array.isArray(e.to)?e.to:[e.to];if(!e.attachments||e.attachments.length===0)return{messageId:(await this.ses.sendSimpleEmail({from:r,to:a,subject:e.subject,text:e.text,html:e.html,replyTo:e.replyTo})).MessageId||""};let i=this.buildRawEmail(e,r,a);return{messageId:(await this.ses.sendEmail({FromEmailAddress:r,Destination:{ToAddresses:a,CcAddresses:e.cc?Array.isArray(e.cc)?e.cc:[e.cc]:void 0,BccAddresses:e.bcc?Array.isArray(e.bcc)?e.bcc:[e.bcc]:void 0},Content:{Raw:{Data:Buffer.from(i).toString("base64")}}})).MessageId||""}}async sendTemplate(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let r=e.fromName?`${e.fromName} <${t}>`:t;return{messageId:(await this.ses.sendTemplatedEmail({from:r,to:e.to,templateName:e.templateName,templateData:e.templateData,replyTo:e.replyTo})).MessageId||""}}async sendBulk(e){let t=e.from||this.defaultFrom;if(!t)throw Error("From address is required");let r=e.recipients.map((i)=>({Destination:{ToAddresses:Array.isArray(i.to)?i.to:[i.to]},ReplacementEmailContent:i.templateData?{ReplacementTemplate:{ReplacementTemplateData:JSON.stringify(i.templateData)}}:void 0}));return{results:(await this.ses.sendBulkEmail({FromEmailAddress:t,BulkEmailEntries:r,DefaultContent:{Template:{TemplateName:e.templateName,TemplateData:JSON.stringify(e.defaultTemplateData)}}})).BulkEmailEntryResults?.map((i)=>({status:i.Status||"UNKNOWN",messageId:i.MessageId,error:i.Error}))||[]}}async setupDomain(e){let t;try{t=await this.ses.getEmailIdentity(e)}catch{let a=await this.ses.createEmailIdentity({EmailIdentity:e});t={VerificationStatus:a.DkimAttributes?.Status,DkimAttributes:a.DkimAttributes,SendingEnabled:a.VerifiedForSendingStatus}}try{await this.ses.putEmailIdentityDkimAttributes({EmailIdentity:e,SigningEnabled:!0})}catch{}try{await this.ses.putEmailIdentityMailFromAttributes(e,{MailFromDomain:`mail.${e}`,BehaviorOnMxFailure:"USE_DEFAULT_VALUE"})}catch{}let r=await this.ses.getDkimRecords(e);return{domainVerified:t.SendingEnabled===!0,dkimStatus:t.DkimAttributes?.Status||"UNKNOWN",dkimTokens:t.DkimAttributes?.Tokens,mailFromStatus:t.MailFromAttributes?.MailFromDomainStatus}}async getDnsRecords(e){let t=[],r=await this.ses.getDkimRecords(e);for(let a of r)t.push({type:a.type,name:a.name,value:a.value,ttl:1800});return t.push({type:"MX",name:e,value:`inbound-smtp.${this.region}.amazonaws.com`,priority:10,ttl:3600}),t.push({type:"MX",name:`mail.${e}`,value:`feedback-smtp.${this.region}.amazonses.com`,priority:10,ttl:3600}),t.push({type:"TXT",name:`mail.${e}`,value:"v=spf1 include:amazonses.com ~all",ttl:3600}),t.push({type:"TXT",name:`_dmarc.${e}`,value:`v=DMARC1;p=quarantine;pct=25;rua=mailto:dmarcreports@${e}`,ttl:3600}),t}async isDomainReady(e){try{let t=await this.ses.getEmailIdentity(e);return t.SendingEnabled===!0&&t.DkimAttributes?.Status==="SUCCESS"}catch{return!1}}async setupReceiving(e){let t={Version:"2012-10-17",Statement:[{Sid:"AllowSESPuts",Effect:"Allow",Principal:{Service:"ses.amazonaws.com"},Action:"s3:PutObject",Resource:`arn:aws:s3:::${e.bucketName}/*`,Condition:{StringEquals:{"AWS:SourceAccount":e.accountId}}}]};await this.s3.putBucketPolicy(e.bucketName,t);try{await this.ses.createReceiptRuleSet(e.ruleSetName)}catch(a){if(!a.message?.includes("already exists")&&a.code!=="AlreadyExists")throw a}let r=[{S3Action:{BucketName:e.bucketName,ObjectKeyPrefix:e.prefix||"inbox/"}}];if(e.lambdaArn)r.push({LambdaAction:{FunctionArn:e.lambdaArn,InvocationType:"Event"}});try{await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:r}})}catch(a){if(a.message?.includes("already exists"))await this.ses.deleteReceiptRule(e.ruleSetName,e.ruleName),await this.ses.createReceiptRule({RuleSetName:e.ruleSetName,Rule:{Name:e.ruleName,Enabled:!0,TlsPolicy:"Optional",Recipients:e.recipients||[e.domain],ScanEnabled:e.scanEnabled!==!1,Actions:r}});else throw a}await this.ses.setActiveReceiptRuleSet(e.ruleSetName)}async getIncomingEmails(e){return(await this.s3.list({bucket:e.bucket,prefix:e.prefix||"incoming/",maxKeys:e.maxResults||100})).map((r)=>({key:r.Key||"",lastModified:r.LastModified||"",size:r.Size||0}))}async readEmail(e){return await this.s3.getObject(e.bucket,e.key)}async createSmtpCredentials(e){let t=`ses-smtp-${e.username.replace(/[^a-zA-Z0-9]/g,"-")}`,{AWSClient:r}=await import("./chunk-yhjagaff.js"),a=new r,i=(p,y)=>{let P={Action:p,Version:"2010-05-08",...y};return Object.entries(P).map(([A,h])=>`${encodeURIComponent(A)}=${encodeURIComponent(h)}`).join("&")};try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateUser",{UserName:t})})}catch(p){if(!p.message?.includes("EntityAlreadyExists"))throw p}let c={Version:"2012-10-17",Statement:[{Effect:"Allow",Action:"ses:SendRawEmail",Resource:"*",Condition:{StringLike:{"ses:FromAddress":`*@${e.domain}`}}}]},l=`ses-smtp-policy-${e.domain.replace(/\./g,"-")}`;try{await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("PutUserPolicy",{UserName:t,PolicyName:l,PolicyDocument:JSON.stringify(c)})})}catch{}let m=(await a.request({service:"iam",region:"us-east-1",method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i("CreateAccessKey",{UserName:t})}))?.CreateAccessKeyResult?.AccessKey;if(!m?.AccessKeyId||!m?.SecretAccessKey)throw Error("Failed to create access key");let g=this.deriveSmtpPassword(m.SecretAccessKey);return{username:m.AccessKeyId,password:g,server:`email-smtp.${this.region}.amazonaws.com`,port:587}}deriveSmtpPassword(e){let t=he("node:crypto"),r="SendRawEmail",a=Buffer.from([4]),i=t.createHmac("sha256",`AWS4${e}`).update("11111111").digest();return i=t.createHmac("sha256",i).update(this.region).digest(),i=t.createHmac("sha256",i).update("ses").digest(),i=t.createHmac("sha256",i).update("aws4_request").digest(),i=t.createHmac("sha256",i).update("SendRawEmail").digest(),Buffer.concat([a,i]).toString("base64")}async createTemplate(e){await this.ses.createEmailTemplate({TemplateName:e.name,TemplateContent:{Subject:e.subject,Text:e.text,Html:e.html}})}async getTemplate(e){try{let t=await this.ses.getEmailTemplate(e);return{name:t.TemplateName||e,subject:t.TemplateContent?.Subject,text:t.TemplateContent?.Text,html:t.TemplateContent?.Html}}catch{return null}}async deleteTemplate(e){await this.ses.deleteEmailTemplate(e)}async listTemplates(){return(await this.ses.listEmailTemplates()).TemplatesMetadata?.map((t)=>({name:t.TemplateName||"",createdAt:t.CreatedTimestamp}))||[]}async deploy(e){let t=`${e.appName}-${e.environment}-email-rules`,r=`${e.appName}-inbound-email`,a=e.storage?.bucketName||`${e.appName}-${e.environment}-email`,i=await this.setupDomain(e.domain);if(!(await this.s3.listBuckets()).Buckets?.some((m)=>m.Name===a))await this.s3.createBucket(a);await this.setupReceiving({domain:e.domain,ruleSetName:t,ruleName:r,bucketName:a,prefix:e.storage?.prefix||"inbox/",accountId:e.accountId,recipients:e.catchAll?[e.domain]:e.mailboxes,scanEnabled:!0});let d=await this.getDnsRecords(e.domain);return{success:!0,domainVerified:i.domainVerified,dkimStatus:i.dkimStatus,receiptRuleSet:t,storageBucket:a,dnsRecords:d}}async undeploy(e){let t=`${e.appName}-${e.environment}-email-rules`,r=`${e.appName}-inbound-email`,a=`${e.appName}-${e.environment}-email`;try{await this.ses.deleteReceiptRule(t,r)}catch{}try{await this.ses.deleteReceiptRuleSet(t)}catch{}if(e.deleteBucket)try{await this.s3.emptyAndDeleteBucket(a)}catch{}}async getSendingStats(){let e=await this.ses.getSendQuota();return{sentLast24Hours:e.SentLast24Hours||0,maxSendRate:e.MaxSendRate||0,max24HourSend:e.Max24HourSend||0}}buildRawEmail(e,t,r){let a=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`,i="";if(i+=`From: ${t}\r
 `,i+=`To: ${r.join(", ")}\r
 `,e.cc){let c=Array.isArray(e.cc)?e.cc:[e.cc];i+=`Cc: ${c.join(", ")}\r
 `}if(i+=`Subject: ${e.subject}\r