@stacksjs/ts-cloud 0.16.37 → 0.16.38

package/dist/aws/bedrock.d.ts

@@ -824,9 +824,6 @@ export interface InvokeAgentCommandOutput {
     sessionId: string;
     memoryId?: string;
 }
-/**
- * Bedrock Runtime client for AI model invocations
- */
 export declare class BedrockRuntimeClient {
     private client;
     private region;
@@ -839,26 +836,6 @@ export declare class BedrockRuntimeClient {
      * Invoke model with streaming response (matches AWS SDK InvokeModelWithResponseStreamCommand)
      */
     invokeModelWithResponseStream(params: InvokeModelWithResponseStreamCommandInput): Promise<InvokeModelWithResponseStreamCommandOutput>;
-    /**
-     * Internal method to make streaming request
-     */
-    private makeStreamRequest;
-    /**
-     * Parse AWS event stream format
-     */
-    private parseEventStream;
-    /**
-     * Extract JSON chunks from event stream buffer
-     */
-    private extractJsonChunks;
-    /**
-     * Get credentials from environment
-     */
-    private getCredentialsFromEnv;
-    /**
-     * Sign request for streaming (simplified SigV4)
-     */
-    private signStreamRequest;
     /**
      * Invoke Claude model with messages API (convenience method)
      */

package/dist/aws/client.d.ts

@@ -17,6 +17,12 @@ export interface AWSRequestOptions {
     cacheTTL?: number;
     returnHeaders?: boolean;
     rawResponse?: boolean;
+    /**
+     * Resolve with the `Response` itself, body unread, once its status is known
+     * to be a success. For bodies consumed incrementally, such as an event
+     * stream; an error status still throws the same parsed error as any request.
+     */
+    streamResponse?: boolean;
     /** S3 bucket name for virtual-hosted style URLs */
     bucket?: string;
 }
@@ -79,16 +85,19 @@ export interface AWSError extends Error {
     type?: string;
 }
 /**
- * AWS API Client - Makes authenticated requests to AWS services
+ * The SigV4 signing name for a request sent to `<endpointPrefix>.<region>.amazonaws.com`.
  */
+export declare function signingNameFor(endpointPrefix: string): string;
 /**
- * Convert parsed XML text the way the parser's own option did, minus the
- * lossy cases: `true`/`false` become booleans, and text becomes a number only
- * when the number prints back as exactly the same text. So `16` and
- * `923076644019` are numbers, while `+18082188241` (a phone number), `7.0`
- * (an engine version), `1.50`, `0x1F`, `1e3` and a 20-digit ID stay strings.
- * Exported for tests.
+ * The SigV4 canonical URI for `path`, the path exactly as it is sent.
+ *
+ * Every service but S3 canonicalises the path by URI-encoding each segment of
+ * it again, so an already-encoded `%3A` is signed as `%253A`. Signing the path
+ * verbatim failed every request whose path carried an encoded character - a
+ * Bedrock model id such as `amazon.nova-lite-v1:0`, a Lambda function ARN -
+ * with a signature mismatch. S3 signs the path as sent.
  */
+export declare function canonicalUriFor(endpointPrefix: string, path: string): string;
 export declare function coerceXmlValues(node: any): any;
 export declare class AWSClient {
     private credentials?;

package/dist/aws/event-stream.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Decoder for the AWS event stream encoding (`application/vnd.amazon.eventstream`),
+ * the binary framing Bedrock uses for `invoke-with-response-stream`,
+ * `converse-stream` and Agents' `InvokeAgent`.
+ *
+ * Each message is:
+ *
+ *   total length (u32) | headers length (u32) | prelude CRC32 (u32)
+ *   headers | payload | message CRC32 (u32)
+ *
+ * all big-endian. Both checksums are verified, so a truncated or corrupted
+ * frame is an error rather than a silently wrong chunk.
+ */
+export type EventStreamHeaderValue = string | number | boolean | bigint | Uint8Array | Date;
+export interface EventStreamMessage {
+    headers: Record<string, EventStreamHeaderValue>;
+    payload: Uint8Array;
+}
+export declare function crc32(bytes: Uint8Array): number;
+/**
+ * Decode one complete message. `frame` must be exactly one message long.
+ */
+export declare function decodeEventStreamMessage(frame: Uint8Array): EventStreamMessage;
+/**
+ * Split a byte stream into event stream messages, however the transport
+ * happened to chunk it. A stream that ends partway through a message throws.
+ */
+export declare function decodeEventStream(source: AsyncIterable<Uint8Array> | ReadableStream<Uint8Array>): AsyncGenerator<EventStreamMessage>;
+/**
+ * The error an `exception` (or `error`) message stands for.
+ *
+ * Bedrock sends a mid-stream failure - throttling, a model timeout, a
+ * validation error - as a message rather than an HTTP status, so a decoder
+ * that skipped these ended the stream early and reported success.
+ */
+export declare function eventStreamError(message: EventStreamMessage): Error | null;

package/dist/aws/index.d.ts

@@ -31,6 +31,7 @@ export * from './dynamodb';
 export * from './opensearch';
 export * from './transcribe';
 export * from './bedrock';
+export * from './event-stream';
 export * from './comprehend';
 export { RekognitionClient, detectLabelsFromS3, countFacesInS3Image, isContentSafe } from './rekognition';
 export type { S3Object as RekognitionS3Object, BoundingBox as RekognitionBoundingBox, Image, Video, Landmark, Pose, ImageQuality, Emotion, FaceDetail, DetectFacesCommandInput, DetectFacesCommandOutput, Label, DetectLabelsCommandInput, DetectLabelsCommandOutput, DetectTextCommandInput, TextDetection, DetectTextCommandOutput, DetectModerationLabelsCommandInput, ModerationLabel, DetectModerationLabelsCommandOutput, Celebrity, RecognizeCelebritiesCommandInput, RecognizeCelebritiesCommandOutput, CompareFacesCommandInput, CompareFacesMatch, CompareFacesCommandOutput, CreateCollectionCommandInput, CreateCollectionCommandOutput, DeleteCollectionCommandInput, DeleteCollectionCommandOutput, ListCollectionsCommandInput, ListCollectionsCommandOutput, IndexFacesCommandInput, FaceRecord, IndexFacesCommandOutput, SearchFacesByImageCommandInput, FaceMatch, SearchFacesByImageCommandOutput, SearchFacesCommandInput, SearchFacesCommandOutput, StartLabelDetectionCommandInput, StartLabelDetectionCommandOutput, GetLabelDetectionCommandInput, LabelDetection, GetLabelDetectionCommandOutput, StartFaceDetectionCommandInput, StartFaceDetectionCommandOutput, GetFaceDetectionCommandInput, FaceDetection, GetFaceDetectionCommandOutput, StartContentModerationCommandInput, StartContentModerationCommandOutput, GetContentModerationCommandInput, ContentModerationDetection, GetContentModerationCommandOutput, } from './rekognition';

package/dist/aws/index.js

@@ -1 +1 @@
-import{Se,ar,Ss,Is,Yu,Wa,Ja,bs,Cs,Xa,nt,K,it,oe,E,Ie,vn,Ya,Le,Za,Tn,wn,Rn,jf,zf,SS,IS,bS,CS,kt,ES,vS,TS,wS,Bt,Kf,Wf,Jf,xt,Xf,Yf,Zf,Dn,RS,DS,PS,cr,NS,kS,BS,ec,tc,Zu,xS,OS,_S,dr,eh,th,lr,st,Pn,rc,eg,LS,tg,$S,Ot,MS,FS,US,QS,ce,HS,GS,VS,qS,ur,jS,zS,KS,Nn,nc,ic,rg,ng,sc,gr}from"../chunk-mbs6pr03.js";import{be,ot,kn,rh}from"../chunk-0fhz75e0.js";import{oc,$e,S}from"../chunk-98xzqtnw.js";import{Me}from"../chunk-aqxp4s43.js";import{W}from"../chunk-78r4k21k.js";import{at,de,Fe,Ce,_t,xn,vs,Ts,pr,mr,On,fr,ws,Rs,Ds,Ps,J,Ns,ks,Bs,xs,le,Os,_s,Ls,D,dc,_n,lc,ue,hr}from"../chunk-ybdxrf42.js";import{I}from"../chunk-n0vz557v.js";import{Pr,De}from"../chunk-azt6sm0r.js";import{h}from"../chunk-k92sywmh.js";import{o}from"../chunk-svzmsd7g.js";import{kr,hi,n,l,bh}from"../chunk-5np6w0g7.js";export{ue as ACMClient,hr as ACMDnsValidator,n as AWSClient,rc as ApplicationAutoScalingClient,ar as AwsBackupClient,zf as BedrockAgentClient,jf as BedrockAgentRuntimeClient,Rn as BedrockClient,wn as BedrockRuntimeClient,h as CloudFormationClient,S as CloudFrontClient,Ie as CloudWatchLogsClient,Ce as CloudflareProvider,kt as ComprehendClient,vn as ConnectClient,Cs as CostExplorerClient,_n as DnsProviderFactory,Le as DynamoDBClient,Pr as EC2Client,Me as ECRClient,nt as ECSClient,gr as EFSClient,Ya as ELBv2Client,st as ElastiCacheClient,kn as EmailClient,lr as EventBridgeClient,Fe as GoDaddyProvider,be as IAMClient,eg as ImapServer,dr as KendraClient,E as LambdaClient,Za as OpenSearchClient,at as PROXIABLE_RECORD_TYPES,ec as PersonalizeClient,Zu as PersonalizeEventsClient,tc as PersonalizeRuntimeClient,Dn as PollyClient,de as PorkbunProvider,W as RDSClient,Bt as RekognitionClient,I as Route53Client,Xa as Route53DomainsClient,J as Route53Provider,o as S3Client,ot as SESClient,it as SNSClient,oe as SQSClient,De as SSMClient,Se as STSClient,Pn as SchedulerClient,K as SecretsManagerClient,Ot as SmsClient,sc as SmsVoiceClient,tg as SmtpServer,Nn as SupportClient,nc as SupportTemplates,xt as TextractClient,Tn as TranscribeClient,cr as TranslateClient,le as UnifiedDnsValidator,ur as VoiceClient,ES as analyzeSentiment,Ds as applyDeclaredZoneSettings,Bs as applyZoneMigration,l as buildQueryParams,hi as coerceXmlValues,bS as completeWithClaude,oc as configOrigins,wS as containsPii,Wf as countFacesInS3Image,QS as createDeliveryReceiptHandler,D as createDnsProvider,_s as createGoDaddyValidator,bs as createObjectStorageClient,Os as createPorkbunValidator,zS as createRecordingHandler,Ls as createRoute53Validator,PS as createSSML,FS as createScheduledSmsHandler,US as createSmsClient,MS as createSmsInboxHandler,ng as createSmsInfrastructure,KS as createVoiceClient,jS as createVoicemailHandler,fr as delegateZone,ws as delegateZoneFromConfig,Rs as describeDelegation,Ps as describeZoneSettings,bh as detectCredentialSource,dc as detectDnsProvider,Kf as detectLabelsFromS3,TS as detectLanguage,lc as dnsProviders,rh as email,Ns as exportRoute53Zone,vS as extractEntities,Yf as extractFormsFromS3,Zf as extractTablesFromS3,Xf as extractTextFromS3,HS as formatPhoneNumber,CS as generateEmbeddings,VS as getCountryCode,xS as getRecommendations,OS as getSimilarItems,rg as getSmsInfrastructureStatus,Jf as isContentSafe,pr as isNameserverRegistrar,qS as isSamePhoneNumber,GS as isValidPhoneNumber,mr as isZoneHost,Is as keyMatchesFilters,IS as listClaudeModels,BS as listLanguages,DS as listVoices,Yu as migrateObjectStorage,ce as normalizePhoneNumber,ks as planZoneMigration,_t as policyTag,Wa as providerEndpoint,xn as qualifyName,Ts as reconcileDeclaredRecords,Ss as remapKey,SS as requestModelAccess,vs as resolveDeclaredRecords,Ja as resolveObjectStorage,kr as resolveS3Endpoint,th as retrieveForRag,$e as s3OriginBucket,On as sameNameservers,eh as search,ic as setupSmsInfrastructure,LS as startImapServer,$S as startSmtpServer,RS as textToSpeech,_S as trackEvent,NS as translate,kS as translateToMultiple,xs as verifyZoneParity};
+import{ye,ar,Ss,Is,eg,Wa,Ja,bs,Cs,Xa,nt,K,it,oe,E,Se,vn,Ya,_e,Za,Tn,tg,Xf,ec,tc,wn,Rn,Yf,Zf,TS,wS,RS,DS,kt,PS,NS,kS,BS,Bt,eh,th,rh,xt,nh,ih,sh,Dn,xS,OS,_S,cr,LS,$S,MS,rc,nc,rg,FS,US,QS,dr,oh,ah,lr,st,Pn,ic,ng,HS,ig,GS,Ot,VS,qS,jS,zS,ce,KS,WS,JS,XS,ur,YS,ZS,eI,Nn,sc,oc,sg,og,ac,gr}from"../chunk-ej9dqt2r.js";import{Ie,ot,kn,ch}from"../chunk-n8g8t8hf.js";import{cc,Le,S}from"../chunk-n1r9313b.js";import{$e}from"../chunk-kyn6a4zf.js";import{W}from"../chunk-p4rknh9f.js";import{at,de,Me,be,_t,xn,vs,Ts,pr,mr,On,fr,ws,Rs,Ds,Ps,J,Ns,ks,Bs,xs,le,Os,_s,Ls,D,uc,_n,gc,ue,hr}from"../chunk-5vk7nss8.js";import{I}from"../chunk-2n4ktft4.js";import{Pr,Re}from"../chunk-j1aq97br.js";import{h}from"../chunk-zvyrpmvd.js";import{o}from"../chunk-xr7ew64s.js";import{kr,Wg,Jg,hi,n,l,Rh}from"../chunk-dg834141.js";export{ue as ACMClient,hr as ACMDnsValidator,n as AWSClient,ic as ApplicationAutoScalingClient,ar as AwsBackupClient,Zf as BedrockAgentClient,Yf as BedrockAgentRuntimeClient,Rn as BedrockClient,wn as BedrockRuntimeClient,h as CloudFormationClient,S as CloudFrontClient,Se as CloudWatchLogsClient,be as CloudflareProvider,kt as ComprehendClient,vn as ConnectClient,Cs as CostExplorerClient,_n as DnsProviderFactory,_e as DynamoDBClient,Pr as EC2Client,$e as ECRClient,nt as ECSClient,gr as EFSClient,Ya as ELBv2Client,st as ElastiCacheClient,kn as EmailClient,lr as EventBridgeClient,Me as GoDaddyProvider,Ie as IAMClient,ng as ImapServer,dr as KendraClient,E as LambdaClient,Za as OpenSearchClient,at as PROXIABLE_RECORD_TYPES,rc as PersonalizeClient,rg as PersonalizeEventsClient,nc as PersonalizeRuntimeClient,Dn as PollyClient,de as PorkbunProvider,W as RDSClient,Bt as RekognitionClient,I as Route53Client,Xa as Route53DomainsClient,J as Route53Provider,o as S3Client,ot as SESClient,it as SNSClient,oe as SQSClient,Re as SSMClient,ye as STSClient,Pn as SchedulerClient,K as SecretsManagerClient,Ot as SmsClient,ac as SmsVoiceClient,ig as SmtpServer,Nn as SupportClient,sc as SupportTemplates,xt as TextractClient,Tn as TranscribeClient,cr as TranslateClient,le as UnifiedDnsValidator,ur as VoiceClient,PS as analyzeSentiment,Ds as applyDeclaredZoneSettings,Bs as applyZoneMigration,l as buildQueryParams,Jg as canonicalUriFor,hi as coerceXmlValues,RS as completeWithClaude,cc as configOrigins,BS as containsPii,th as countFacesInS3Image,tg as crc32,zS as createDeliveryReceiptHandler,D as createDnsProvider,_s as createGoDaddyValidator,bs as createObjectStorageClient,Os as createPorkbunValidator,ZS as createRecordingHandler,Ls as createRoute53Validator,_S as createSSML,qS as createScheduledSmsHandler,jS as createSmsClient,VS as createSmsInboxHandler,og as createSmsInfrastructure,eI as createVoiceClient,YS as createVoicemailHandler,ec as decodeEventStream,Xf as decodeEventStreamMessage,fr as delegateZone,ws as delegateZoneFromConfig,Rs as describeDelegation,Ps as describeZoneSettings,Rh as detectCredentialSource,uc as detectDnsProvider,eh as detectLabelsFromS3,kS as detectLanguage,gc as dnsProviders,ch as email,tc as eventStreamError,Ns as exportRoute53Zone,NS as extractEntities,ih as extractFormsFromS3,sh as extractTablesFromS3,nh as extractTextFromS3,KS as formatPhoneNumber,DS as generateEmbeddings,JS as getCountryCode,FS as getRecommendations,US as getSimilarItems,sg as getSmsInfrastructureStatus,rh as isContentSafe,pr as isNameserverRegistrar,XS as isSamePhoneNumber,WS as isValidPhoneNumber,mr as isZoneHost,Is as keyMatchesFilters,wS as listClaudeModels,MS as listLanguages,OS as listVoices,eg as migrateObjectStorage,ce as normalizePhoneNumber,ks as planZoneMigration,_t as policyTag,Wa as providerEndpoint,xn as qualifyName,Ts as reconcileDeclaredRecords,Ss as remapKey,TS as requestModelAccess,vs as resolveDeclaredRecords,Ja as resolveObjectStorage,kr as resolveS3Endpoint,ah as retrieveForRag,Le as s3OriginBucket,On as sameNameservers,oh as search,oc as setupSmsInfrastructure,Wg as signingNameFor,HS as startImapServer,GS as startSmtpServer,xS as textToSpeech,QS as trackEvent,LS as translate,$S as translateToMultiple,xs as verifyZoneParity};

package/dist/bin/{chunk-7xj986z7.js → chunk-07qwk0sj.js}

@@ -1,8 +1,8 @@
-var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function We(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function oo(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?uc(n.path):".*";if(!oo(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${We(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${We(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${We(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${We(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${We(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function uc(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function ci(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
+var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function We(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function as(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?uc(n.path):".*";if(!as(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${We(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${We(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${We(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${We(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${We(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function uc(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function ci(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
 `)}
-`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${We(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=uc(a);if(!oo(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${We(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${We(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${We(a.reason)}`),a.pathPattern){if(!oo(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${We(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
+`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${We(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=uc(a);if(!as(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${We(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${We(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${We(a.reason)}`),a.pathPattern){if(!as(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${We(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
 `)}
-`,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function ao(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=ci(e,r);return`#!/usr/bin/env bash
+`,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function cs(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=ci(e,r);return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs the zig-waf ruleset.
 set -euo pipefail
 
@@ -33,5 +33,5 @@ fi
 
 mv "${s}.new" "${s}"
 echo "ts-cloud: WAF config installed (mode: ${n.mode})"
-`}function Up(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
-export{We,oo,uc,ci,ao,Up};
+`}function Bp(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
+export{We,as,uc,ci,cs,Bp};

package/dist/bin/{chunk-1fjhc7w7.js → chunk-0c1fv0xt.js}

@@ -1,4 +1,4 @@
-import{on,W,bs,Ft,M}from"./chunk-gbpmgae9.js";import{v}from"./chunk-v4gpkkzh.js";import{Tr,E}from"./chunk-6r35j09y.js";import{g}from"./chunk-f76wtb7d.js";import{F}from"./chunk-ymfnqae6.js";function H(t){let{bucketName:i,domain:a,aliases:e,certificateArn:d,defaultRootObject:o="index.html",errorDocument:n="404.html",passthroughUrls:r=!1,singlePageApp:l=!1,dynamicApp:m=!1,computeOriginDomain:D,computeOriginPort:P=3008,computeOriginId:N="app-compute",retainOnStackDelete:O=!1}=t,C=O?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},w=m&&!!D,T=w?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],R=w?["GET","HEAD"]:["GET","HEAD"],y={},I={};y.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},I.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},I.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},y.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let A;if(r&&w)A="InstallRootRedirectFunction",y[A]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{sn,W,So,Ft,M}from"./chunk-w8jfw39t.js";import{v}from"./chunk-0ynfqf9t.js";import{Tr,E}from"./chunk-5wqjqh6c.js";import{g}from"./chunk-tt3m3fda.js";import{F}from"./chunk-gc8p1tdr.js";function H(t){let{bucketName:i,domain:a,aliases:e,certificateArn:d,defaultRootObject:o="index.html",errorDocument:n="404.html",passthroughUrls:r=!1,singlePageApp:l=!1,dynamicApp:m=!1,computeOriginDomain:D,computeOriginPort:P=3008,computeOriginId:N="app-compute",retainOnStackDelete:O=!1}=t,C=O?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},w=m&&!!D,T=w?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],R=w?["GET","HEAD"]:["GET","HEAD"],y={},I={};y.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},I.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},I.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},y.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let A;if(r&&w)A="InstallRootRedirectFunction",y[A]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{on,W,bs,Ft,M}from"./chunk-gbpmgae9.js";import{v}from"./chunk-v4gpkkzh.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:I,stackName:o,bucket:w,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:I,stackName:o,bucket:w,message:`Stack deployment failed: ${s.message}`}}let c=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],S=(s)=>c.find((u)=>u.OutputKey===s)?.OutputValue,p=S("DistributionDomain");if(p&&l)console.log(`Creating DNS records via ${l.name}...`),await V(l,e,p);else if(p&&!l)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:I,stackName:o,bucket:S("BucketName")||w,distributionId:S("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function V(t,i,a){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(i.split(".").length===2)if(t instanceof on){console.log(`Creating Route53 alias record for apex domain ${i} -> ${a}`);let o=await t.createCloudFrontAlias({domain:i,name:i,cloudFrontDomainName:a});if(!o.success)console.warn(`Warning: Could not create Route53 alias record: ${o.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created Route53 alias record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating Route53 alias record for ${n} -> ${a}`);let r=await t.createCloudFrontAlias({domain:i,name:n,cloudFrontDomainName:a});if(!r.success)console.warn(`Warning: Could not create www Route53 alias: ${r.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created Route53 alias record: ${n} -> ${a}`)}else{try{let l=await t.listRecords(i,"A");if(l.success)for(let m of l.records){let D=m.name.replace(/\.$/,"");if(D===i||D==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(i,{name:i,type:"A",content:m.content})}}catch(l){console.log(`Note: Could not check for conflicting A records: ${l instanceof Error?l.message:l}`)}console.log(`Creating ALIAS record for apex domain ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"ALIAS",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create ALIAS record: ${o.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created ALIAS record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating CNAME record for ${n} -> ${a}`);let r=await t.upsertRecord(i,{name:n,type:"CNAME",content:a,ttl:600});if(!r.success)console.warn(`Warning: Could not create www DNS record: ${r.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created CNAME record: ${n} -> ${a}`)}else{console.log(`Creating CNAME record for ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"CNAME",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create DNS record: ${o.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created CNAME record: ${i} -> ${a}`)}}async function Fi(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await j(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:n}=await import("./chunk-tkz95bkg.js"),r=await n({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(m,D,P)=>{e?.("upload",`${m}/${D}: ${P}`)}});if(r.errors.length>0)return{...o,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(o.distributionId&&r.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-tkz95bkg.js");await m(o.distributionId)}e?.("complete","Deployment complete!");let l=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged) with external DNS`:`Deployed ${r.uploaded} files successfully with external DNS`;return{...o,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:l}}function bd(t){let{bucketName:i,domain:a,certificateArn:e,hostedZoneId:d,defaultRootObject:o="index.html",errorDocument:n="404.html"}=t,r={},l={};r.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},l.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},l.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},r.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},r.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:I,stackName:o,bucket:w,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:I,stackName:o,bucket:w,message:`Stack deployment failed: ${s.message}`}}let c=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],S=(s)=>c.find((u)=>u.OutputKey===s)?.OutputValue,p=S("DistributionDomain");if(p&&l)console.log(`Creating DNS records via ${l.name}...`),await V(l,e,p);else if(p&&!l)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:I,stackName:o,bucket:S("BucketName")||w,distributionId:S("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function V(t,i,a){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(i.split(".").length===2)if(t instanceof sn){console.log(`Creating Route53 alias record for apex domain ${i} -> ${a}`);let o=await t.createCloudFrontAlias({domain:i,name:i,cloudFrontDomainName:a});if(!o.success)console.warn(`Warning: Could not create Route53 alias record: ${o.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created Route53 alias record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating Route53 alias record for ${n} -> ${a}`);let r=await t.createCloudFrontAlias({domain:i,name:n,cloudFrontDomainName:a});if(!r.success)console.warn(`Warning: Could not create www Route53 alias: ${r.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created Route53 alias record: ${n} -> ${a}`)}else{try{let l=await t.listRecords(i,"A");if(l.success)for(let m of l.records){let D=m.name.replace(/\.$/,"");if(D===i||D==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(i,{name:i,type:"A",content:m.content})}}catch(l){console.log(`Note: Could not check for conflicting A records: ${l instanceof Error?l.message:l}`)}console.log(`Creating ALIAS record for apex domain ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"ALIAS",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create ALIAS record: ${o.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created ALIAS record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating CNAME record for ${n} -> ${a}`);let r=await t.upsertRecord(i,{name:n,type:"CNAME",content:a,ttl:600});if(!r.success)console.warn(`Warning: Could not create www DNS record: ${r.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created CNAME record: ${n} -> ${a}`)}else{console.log(`Creating CNAME record for ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"CNAME",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create DNS record: ${o.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created CNAME record: ${i} -> ${a}`)}}async function Fi(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await j(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:n}=await import("./chunk-fh5bjm3d.js"),r=await n({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(m,D,P)=>{e?.("upload",`${m}/${D}: ${P}`)}});if(r.errors.length>0)return{...o,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(o.distributionId&&r.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-fh5bjm3d.js");await m(o.distributionId)}e?.("complete","Deployment complete!");let l=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged) with external DNS`:`Deployed ${r.uploaded} files successfully with external DNS`;return{...o,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:l}}function bd(t){let{bucketName:i,domain:a,certificateArn:e,hostedZoneId:d,defaultRootObject:o="index.html",errorDocument:n="404.html"}=t,r={},l={};r.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},l.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},l.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},r.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},r.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 
@@ -56,5 +56,5 @@ import{on,W,bs,Ft,M}from"./chunk-gbpmgae9.js";import{v}from"./chunk-v4gpkkzh.js"
   }
 
   return request;
-}`}};let m={Enabled:!0,DefaultRootObject:o,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${i}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${i}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${o}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${n}`,ErrorCachingMinTTL:300}]};if(a&&e)m.Aliases=[a],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(r.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},l.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},l.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},r.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},a&&d)r.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},r.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},l.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${a||i}`,Resources:r,Outputs:l}}async function Sd(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let c=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!c)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return j({siteName:t.siteName,region:t.region,domain:c,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let i=t.region||"us-east-1",a="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let d=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),o=t.stackName||`${t.siteName}-static-site`,n=new v(a),r=new F,l=new W("us-east-1"),m=new bs("us-east-1"),{hostedZoneId:D,certificateArn:P}=t;if(e&&!D){let c=await r.findHostedZoneForDomain(e);if(c)D=c.Id.replace("/hostedzone/","");else return{success:!1,stackName:o,bucket:d,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!P&&D){let c=await l.findCertificateByDomain(e);if(c&&c.Status==="ISSUED")P=c.CertificateArn;else P=(await m.requestAndValidate({domainName:e,hostedZoneId:D,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let N=!1,O;try{let c=await n.describeStacks({stackName:o});if(c.Stacks.length>0){let S=c.Stacks[0],p=S.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await n.waitForStack(o,"stack-delete-complete"),N=!1;else if(p==="DELETE_COMPLETE")N=!1;else N=!0,O=(S.Outputs||[]).find((u)=>u.OutputKey==="BucketName")?.OutputValue}}catch(c){if(c.message?.includes("does not exist")||c.code==="ValidationError")N=!1;else throw c}let C=O||d;if(!N){let c=new g(i),S=new E,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let s=await S.listDistributions();for(let u of s)if((u.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${u.Id} for ${e}`);let k=await S.getDistributionConfig(u.Id),f=Tr(k.DistributionConfig);if(f){let x=e.replace(/\./g,"-");if(!f.startsWith(x)&&!f.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${f}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${f}`),D&&u.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(U){console.log(`Note: Could not update Route53 records: ${U.message}`)}return{success:!0,stackName:`existing-${u.Id}`,bucket:f,distributionId:u.Id,distributionDomain:u.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution"}}}}catch{}if(D)try{let u=(await r.listResourceRecordSets({HostedZoneId:D})).ResourceRecordSets||[];for(let b of u)if(b.Name===`${e}.`&&(b.Type==="A"||b.Type==="AAAA")){if(b.AliasTarget){console.log(`Found orphaned Route53 ${b.Type} record for ${e}, cleaning up...`);try{await r.deleteRecord({HostedZoneId:D,RecordSet:b}),console.log(`Deleted orphaned Route53 ${b.Type} record for ${e}`)}catch(k){console.log(`Note: Could not delete Route53 record: ${k.message}`)}}}}catch{}}if(!p)try{if((await c.headBucket(d)).exists){console.log(`Found orphaned S3 bucket ${d}, cleaning up...`);try{let u=c.emptyBucket(d).then(()=>c.deleteBucket(d)),b=new Promise((k,f)=>setTimeout(()=>f(Error("Bucket cleanup timeout")),30000));await Promise.race([u,b]),console.log(`Deleted orphaned S3 bucket ${d}`)}catch(u){console.log(`Note: Could not clean up S3 bucket: ${u.message}`);let b=Date.now().toString(36);C=`${d}-${b}`,console.log(`Using alternative bucket name: ${C}`)}}}catch{}}let w=bd({bucketName:C,domain:e,certificateArn:P,hostedZoneId:D,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),T=Object.entries(t.tags||{}).map(([c,S])=>({Key:c,Value:S}));T.push({Key:"ManagedBy",Value:"ts-cloud"}),T.push({Key:"Application",Value:t.siteName});let R,y=!1;if(N){y=!0,console.log(`Updating CloudFormation stack: ${o}`),console.log(`Using existing bucket: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`);try{R=(await n.updateStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T})).StackId,console.log(`Update initiated, stack ID: ${R}`)}catch(c){if(c.message?.includes("No updates are to be performed")){let S=await n.describeStacks({stackName:o});R=S.Stacks[0].StackId;let p=S.Stacks[0]?.Outputs||[],s=(u)=>p.find((b)=>b.OutputKey===u)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:s("BucketName")||C,distributionId:s("DistributionId"),distributionDomain:s("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure is already up to date"}}else throw c}}else console.log(`Creating CloudFormation stack: ${o}`),console.log(`Bucket name: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`),console.log("Stack does not exist, creating..."),R=(await n.createStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${R}`);console.log(`Waiting for stack to reach ${y?"stack-update-complete":"stack-create-complete"}...`);try{await n.waitForStack(o,y?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(c){if(c.message?.includes("must be verified")||c.message?.includes("Access denied for operation")||c.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let S=new E;if(e)try{let p=await S.listDistributions();for(let s of p)if((s.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${s.Id} with alias ${e}`);let b=await S.getDistributionConfig(s.Id),k=Tr(b.DistributionConfig);if(k)return console.log(`Using existing S3 bucket: ${k}`),{success:!0,stackName:`existing-${s.Id}`,bucket:k,distributionId:s.Id,distributionDomain:s.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new g(i);if((await p.headBucket(C)).exists)console.log(`Using existing S3 bucket: ${C}`);else console.log(`Creating S3 bucket: ${C}...`),await p.createBucket(C);await p.putBucketWebsite(C,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(C,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${C} configured`);let u=`OAC-${C}`;console.log(`Creating Origin Access Control: ${u}...`);let b=await S.findOrCreateOriginAccessControl(u);console.log(`Origin Access Control ${b.Id} ready`),console.log("Creating CloudFront distribution...");let k=await S.createDistributionForS3({bucketName:C,bucketRegion:i,originAccessControlId:b.Id,aliases:e?[e]:[],certificateArn:P,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||C}`});console.log(`CloudFront distribution ${k.Id} created`),console.log("Updating S3 bucket policy...");let f=E.getS3BucketPolicyForCloudFront(C,k.ARN);if(await p.putBucketPolicy(C,f),console.log("S3 bucket policy updated"),e&&D){console.log(`Creating Route53 records for ${e}...`);try{await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(x){console.log(`Note: Could not create Route53 records: ${x.message}`)}}return{success:!0,stackName:`direct-${k.Id}`,bucket:C,distributionId:k.Id,distributionDomain:k.DomainName,domain:e,certificateArn:P,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:R,stackName:o,bucket:C,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:R,stackName:o,bucket:C,message:`Stack deployment failed: ${c.message}`}}let A=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],h=(c)=>A.find((S)=>S.OutputKey===c)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:h("BucketName")||C,distributionId:h("DistributionId"),distributionDomain:h("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure deployed successfully"}}async function vd(t){let{sourceDir:i,bucket:a,region:e,cacheControl:d="max-age=31536000, public",onProgress:o}=t,n=new g(e),{readdir:r}=await import("node:fs/promises"),{join:l,relative:m}=await import("node:path"),{createHash:D}=await import("node:crypto");async function P(A){let h=[],c=await r(A,{withFileTypes:!0});for(let S of c){let p=l(A,S.name);if(S.isDirectory())h.push(...await P(p));else h.push(p)}return h}function N(A){let h=A.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[h||""]||"application/octet-stream"}function O(A){return D("md5").update(A).digest("hex")}async function C(){let A=new Map,h;do{let c=await n.listObjects({bucket:a,maxKeys:1000,continuationToken:h});for(let S of c.objects){let p=S.ETag?.replace(/"/g,"")||"";A.set(S.Key,p)}h=c.nextContinuationToken}while(h);return A}let w=await P(i),T=[],R=0,y=0,I=await C();for(let A of w){let h=m(i,A),c=N(A),S=A.endsWith(".html")?"max-age=3600, public":d;try{let p=Buffer.from(await Bun.file(A).arrayBuffer()),s=O(p),u=I.get(h);if(u&&u===s){y++,o?.(R+y,w.length,h);continue}await n.putObject({bucket:a,key:h,body:p,contentType:c,cacheControl:S}),R++,o?.(R+y,w.length,h)}catch(p){T.push(`Failed to upload ${h}: ${p.message}`)}}return{uploaded:R,skipped:y,errors:T}}async function Cd(t){return{invalidationId:(await new E().invalidateAll(t)).Id}}async function xp(t,i="us-east-1"){let a=new v(i);try{let n=((await a.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((r)=>r.OutputKey==="BucketName")?.OutputValue;if(n)await new g(i).emptyBucket(n)}catch{}await a.deleteStack(t);let e=await a.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function _p(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await Sd(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(l){console.log(`Note: Could not clean bucket: ${l.message}`)}}e?.("upload","Uploading files to S3...");let n=await vd({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(l,m,D)=>{e?.("upload",`${l}/${m}: ${D}`)}});if(n.errors.length>0)return{...o,success:!1,message:`Upload errors: ${n.errors.join(", ")}`,filesUploaded:n.uploaded};if(o.distributionId&&n.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Cd(o.distributionId);e?.("complete","Deployment complete!");let r=n.skipped>0?`Deployed ${n.uploaded} files (${n.skipped} unchanged)`:`Deployed ${n.uploaded} files successfully`;return{...o,filesUploaded:n.uploaded,filesSkipped:n.skipped,message:r}}
-export{bd,Sd,vd,Cd,xp,_p,Fi};
+}`}};let m={Enabled:!0,DefaultRootObject:o,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${i}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${i}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${o}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${n}`,ErrorCachingMinTTL:300}]};if(a&&e)m.Aliases=[a],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(r.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},l.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},l.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},r.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},a&&d)r.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},r.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},l.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${a||i}`,Resources:r,Outputs:l}}async function Sd(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let c=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!c)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return j({siteName:t.siteName,region:t.region,domain:c,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let i=t.region||"us-east-1",a="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let d=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),o=t.stackName||`${t.siteName}-static-site`,n=new v(a),r=new F,l=new W("us-east-1"),m=new So("us-east-1"),{hostedZoneId:D,certificateArn:P}=t;if(e&&!D){let c=await r.findHostedZoneForDomain(e);if(c)D=c.Id.replace("/hostedzone/","");else return{success:!1,stackName:o,bucket:d,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!P&&D){let c=await l.findCertificateByDomain(e);if(c&&c.Status==="ISSUED")P=c.CertificateArn;else P=(await m.requestAndValidate({domainName:e,hostedZoneId:D,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let N=!1,O;try{let c=await n.describeStacks({stackName:o});if(c.Stacks.length>0){let S=c.Stacks[0],p=S.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await n.waitForStack(o,"stack-delete-complete"),N=!1;else if(p==="DELETE_COMPLETE")N=!1;else N=!0,O=(S.Outputs||[]).find((u)=>u.OutputKey==="BucketName")?.OutputValue}}catch(c){if(c.message?.includes("does not exist")||c.code==="ValidationError")N=!1;else throw c}let C=O||d;if(!N){let c=new g(i),S=new E,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let s=await S.listDistributions();for(let u of s)if((u.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${u.Id} for ${e}`);let k=await S.getDistributionConfig(u.Id),f=Tr(k.DistributionConfig);if(f){let x=e.replace(/\./g,"-");if(!f.startsWith(x)&&!f.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${f}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${f}`),D&&u.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(U){console.log(`Note: Could not update Route53 records: ${U.message}`)}return{success:!0,stackName:`existing-${u.Id}`,bucket:f,distributionId:u.Id,distributionDomain:u.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution"}}}}catch{}if(D)try{let u=(await r.listResourceRecordSets({HostedZoneId:D})).ResourceRecordSets||[];for(let b of u)if(b.Name===`${e}.`&&(b.Type==="A"||b.Type==="AAAA")){if(b.AliasTarget){console.log(`Found orphaned Route53 ${b.Type} record for ${e}, cleaning up...`);try{await r.deleteRecord({HostedZoneId:D,RecordSet:b}),console.log(`Deleted orphaned Route53 ${b.Type} record for ${e}`)}catch(k){console.log(`Note: Could not delete Route53 record: ${k.message}`)}}}}catch{}}if(!p)try{if((await c.headBucket(d)).exists){console.log(`Found orphaned S3 bucket ${d}, cleaning up...`);try{let u=c.emptyBucket(d).then(()=>c.deleteBucket(d)),b=new Promise((k,f)=>setTimeout(()=>f(Error("Bucket cleanup timeout")),30000));await Promise.race([u,b]),console.log(`Deleted orphaned S3 bucket ${d}`)}catch(u){console.log(`Note: Could not clean up S3 bucket: ${u.message}`);let b=Date.now().toString(36);C=`${d}-${b}`,console.log(`Using alternative bucket name: ${C}`)}}}catch{}}let w=bd({bucketName:C,domain:e,certificateArn:P,hostedZoneId:D,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),T=Object.entries(t.tags||{}).map(([c,S])=>({Key:c,Value:S}));T.push({Key:"ManagedBy",Value:"ts-cloud"}),T.push({Key:"Application",Value:t.siteName});let R,y=!1;if(N){y=!0,console.log(`Updating CloudFormation stack: ${o}`),console.log(`Using existing bucket: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`);try{R=(await n.updateStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T})).StackId,console.log(`Update initiated, stack ID: ${R}`)}catch(c){if(c.message?.includes("No updates are to be performed")){let S=await n.describeStacks({stackName:o});R=S.Stacks[0].StackId;let p=S.Stacks[0]?.Outputs||[],s=(u)=>p.find((b)=>b.OutputKey===u)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:s("BucketName")||C,distributionId:s("DistributionId"),distributionDomain:s("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure is already up to date"}}else throw c}}else console.log(`Creating CloudFormation stack: ${o}`),console.log(`Bucket name: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`),console.log("Stack does not exist, creating..."),R=(await n.createStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${R}`);console.log(`Waiting for stack to reach ${y?"stack-update-complete":"stack-create-complete"}...`);try{await n.waitForStack(o,y?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(c){if(c.message?.includes("must be verified")||c.message?.includes("Access denied for operation")||c.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let S=new E;if(e)try{let p=await S.listDistributions();for(let s of p)if((s.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${s.Id} with alias ${e}`);let b=await S.getDistributionConfig(s.Id),k=Tr(b.DistributionConfig);if(k)return console.log(`Using existing S3 bucket: ${k}`),{success:!0,stackName:`existing-${s.Id}`,bucket:k,distributionId:s.Id,distributionDomain:s.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new g(i);if((await p.headBucket(C)).exists)console.log(`Using existing S3 bucket: ${C}`);else console.log(`Creating S3 bucket: ${C}...`),await p.createBucket(C);await p.putBucketWebsite(C,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(C,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${C} configured`);let u=`OAC-${C}`;console.log(`Creating Origin Access Control: ${u}...`);let b=await S.findOrCreateOriginAccessControl(u);console.log(`Origin Access Control ${b.Id} ready`),console.log("Creating CloudFront distribution...");let k=await S.createDistributionForS3({bucketName:C,bucketRegion:i,originAccessControlId:b.Id,aliases:e?[e]:[],certificateArn:P,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||C}`});console.log(`CloudFront distribution ${k.Id} created`),console.log("Updating S3 bucket policy...");let f=E.getS3BucketPolicyForCloudFront(C,k.ARN);if(await p.putBucketPolicy(C,f),console.log("S3 bucket policy updated"),e&&D){console.log(`Creating Route53 records for ${e}...`);try{await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(x){console.log(`Note: Could not create Route53 records: ${x.message}`)}}return{success:!0,stackName:`direct-${k.Id}`,bucket:C,distributionId:k.Id,distributionDomain:k.DomainName,domain:e,certificateArn:P,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:R,stackName:o,bucket:C,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:R,stackName:o,bucket:C,message:`Stack deployment failed: ${c.message}`}}let A=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],h=(c)=>A.find((S)=>S.OutputKey===c)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:h("BucketName")||C,distributionId:h("DistributionId"),distributionDomain:h("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure deployed successfully"}}async function vd(t){let{sourceDir:i,bucket:a,region:e,cacheControl:d="max-age=31536000, public",onProgress:o}=t,n=new g(e),{readdir:r}=await import("node:fs/promises"),{join:l,relative:m}=await import("node:path"),{createHash:D}=await import("node:crypto");async function P(A){let h=[],c=await r(A,{withFileTypes:!0});for(let S of c){let p=l(A,S.name);if(S.isDirectory())h.push(...await P(p));else h.push(p)}return h}function N(A){let h=A.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[h||""]||"application/octet-stream"}function O(A){return D("md5").update(A).digest("hex")}async function C(){let A=new Map,h;do{let c=await n.listObjects({bucket:a,maxKeys:1000,continuationToken:h});for(let S of c.objects){let p=S.ETag?.replace(/"/g,"")||"";A.set(S.Key,p)}h=c.nextContinuationToken}while(h);return A}let w=await P(i),T=[],R=0,y=0,I=await C();for(let A of w){let h=m(i,A),c=N(A),S=A.endsWith(".html")?"max-age=3600, public":d;try{let p=Buffer.from(await Bun.file(A).arrayBuffer()),s=O(p),u=I.get(h);if(u&&u===s){y++,o?.(R+y,w.length,h);continue}await n.putObject({bucket:a,key:h,body:p,contentType:c,cacheControl:S}),R++,o?.(R+y,w.length,h)}catch(p){T.push(`Failed to upload ${h}: ${p.message}`)}}return{uploaded:R,skipped:y,errors:T}}async function Cd(t){return{invalidationId:(await new E().invalidateAll(t)).Id}}async function Op(t,i="us-east-1"){let a=new v(i);try{let n=((await a.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((r)=>r.OutputKey==="BucketName")?.OutputValue;if(n)await new g(i).emptyBucket(n)}catch{}await a.deleteStack(t);let e=await a.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function $p(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await Sd(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(l){console.log(`Note: Could not clean bucket: ${l.message}`)}}e?.("upload","Uploading files to S3...");let n=await vd({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(l,m,D)=>{e?.("upload",`${l}/${m}: ${D}`)}});if(n.errors.length>0)return{...o,success:!1,message:`Upload errors: ${n.errors.join(", ")}`,filesUploaded:n.uploaded};if(o.distributionId&&n.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Cd(o.distributionId);e?.("complete","Deployment complete!");let r=n.skipped>0?`Deployed ${n.uploaded} files (${n.skipped} unchanged)`:`Deployed ${n.uploaded} files successfully`;return{...o,filesUploaded:n.uploaded,filesSkipped:n.skipped,message:r}}
+export{bd,Sd,vd,Cd,Op,$p,Fi};

package/dist/bin/chunk-0c5vn8rp.js

@@ -0,0 +1 @@
+import{ni}from"./chunk-4h60xsat.js";import"./chunk-sqmays54.js";import"./chunk-48nz63ab.js";import"./chunk-wga7gj0h.js";import"./chunk-e6mfcw0v.js";import"./chunk-0ynfqf9t.js";import"./chunk-tt3m3fda.js";import"./chunk-dmwfnbg0.js";import"./chunk-q8hp4dfy.js";import"./chunk-55cckkb2.js";export{ni as resolveDashboardData};

package/dist/bin/{chunk-v4gpkkzh.js → chunk-0ynfqf9t.js}

@@ -1,2 +1,2 @@
-import{u}from"./chunk-7rwc5bvv.js";import{_}from"./chunk-tv0rtc0s.js";class v{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new u(void 0,{profile:t})}async createStack(e){let t={Action:"CreateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(e.parameters)e.parameters.forEach((a,r)=>{t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});if(e.timeoutInMinutes)t.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)t.OnFailure=e.onFailure;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.CreateStackResult?.StackId}}async updateStack(e){let t={Action:"UpdateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((a,r)=>{if(t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,a.UsePreviousValue)t[`Parameters.member.${r+1}.UsePreviousValue`]="true";else t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.UpdateStackResult?.StackId}}async deleteStack(e,t,s){let a={Action:"DeleteStack",StackName:e,Version:"2010-05-15"};if(t)a.RoleARN=t;if(s&&s.length>0)s.forEach((r,m)=>{a[`RetainResources.member.${m+1}`]=r});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(a).toString()})}async describeStacks(e={}){let t={Action:"DescribeStacks",Version:"2010-05-15"};if(e.stackName)t.StackName=e.stackName;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{Stacks:this.parseStacksResponse(s)}}async describeStackEvents(e){let t={Action:"DescribeStackEvents",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackEvents:this.parseStackEvents(s)}}async listStackResources(e){let t={Action:"ListStackResources",StackName:e,Version:"2010-05-15"},a=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,r=[];if(a)r=Array.isArray(a)?a:[a];return{StackResourceSummaries:r}}async waitForStack(e,t){let s={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},a=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],r=s[t],m=360,i=0;while(i<360)try{let c=await this.describeStacks({stackName:e});if(c.Stacks.length===0){if(t==="stack-delete-complete")return;if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack not visible yet`);await new Promise((o)=>setTimeout(o,2000)),i++;continue}let n=c.Stacks[0];if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Status = ${n.StackStatus}${n.StackStatusReason?` (${n.StackStatusReason})`:""}`);if(r.includes(n.StackStatus))return;if((t==="stack-create-complete"||t==="stack-update-complete")&&(n.StackStatus==="DELETE_IN_PROGRESS"||n.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let o="";try{let S=await this.describeStackEvents(e);console.log("[waitForStack] Stack events (most recent first):");for(let k of S.StackEvents.slice(0,15))if(k.ResourceStatus.includes("FAILED")||k.ResourceStatusReason){if(console.log(`  ${k.LogicalResourceId}: ${k.ResourceStatus} - ${k.ResourceStatusReason||"No reason provided"}`),k.ResourceStatus.includes("FAILED")&&k.ResourceStatusReason&&!o)o=k.ResourceStatusReason}}catch{}let l=o||n.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${l}`)}if(n.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let o=Error("Stack deletion failed - may have resources that need to be retained");throw o.code="DELETE_FAILED",o.stackStatus=n.StackStatus,o.statusReason=n.StackStatusReason,o}if(a.includes(n.StackStatus))throw Error(`Stack reached failure status: ${n.StackStatus}`);await new Promise((o)=>setTimeout(o,5000)),i++}catch(c){if(t==="stack-delete-complete"&&c.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&c.message?.includes("does not exist")){if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack does not exist (error), retrying...`);await new Promise((n)=>setTimeout(n,2000)),i++;continue}throw console.log(`[waitForStack] Unexpected error: ${c.message}`),c}throw console.log(`[waitForStack] Timeout after ${i} attempts`),Error(`Timeout waiting for stack to reach ${t}`)}async validateTemplate(e){let t={Action:"ValidateTemplate",TemplateBody:e,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async listStacks(e){let t={Action:"ListStacks",Version:"2010-05-15"};if(e)e.forEach((c,n)=>{t[`StackStatusFilter.member.${n+1}`]=c});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=s.ListStacksResponse||s,r=a.ListStacksResult||a,m=r.StackSummaries?.member||r.StackSummaries||[];return{StackSummaries:(Array.isArray(m)?m:m?[m]:[]).map((c)=>({StackId:c.StackId||"",StackName:c.StackName||"",TemplateDescription:c.TemplateDescription,CreationTime:c.CreationTime||"",LastUpdatedTime:c.LastUpdatedTime,DeletionTime:c.DeletionTime,StackStatus:c.StackStatus||""}))}}async createChangeSet(e){let t={Action:"CreateChangeSet",StackName:e.stackName,ChangeSetName:e.changeSetName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((r,m)=>{t[`Parameters.member.${m+1}.ParameterKey`]=r.ParameterKey,t[`Parameters.member.${m+1}.ParameterValue`]=r.ParameterValue});if(e.capabilities)e.capabilities.forEach((r,m)=>{t[`Capabilities.member.${m+1}`]=r});if(e.changeSetType)t.ChangeSetType=e.changeSetType;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=_(s,"CreateChangeSet");return{Id:a?.Id,StackId:a?.StackId}}async describeChangeSet(e,t){let s={Action:"DescribeChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async executeChangeSet(e,t){let s={Action:"ExecuteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async deleteChangeSet(e,t){let s={Action:"DeleteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async getStackOutputs(e){let t=await this.describeStacks({stackName:e});if(!t.Stacks||t.Stacks.length===0)throw Error(`Stack ${e} not found`);let s=t.Stacks[0],a={};if(s.Outputs)for(let r of s.Outputs)a[r.OutputKey]=r.OutputValue;return a}async getTemplate(e){let t={Action:"GetTemplate",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{TemplateBody:s?.GetTemplateResult?.TemplateBody||s?.TemplateBody||""}}parseStacksResponse(e){let t=[],s=e?.DescribeStacksResult?.Stacks?.member||e?.Stacks?.member||e?.Stacks||e;if(s&&!Array.isArray(s))s=[s];if(Array.isArray(s)){for(let a of s)if(a.StackId||a.StackName){let r;if(a.Outputs?.member)r=(Array.isArray(a.Outputs.member)?a.Outputs.member:[a.Outputs.member]).map((i)=>({OutputKey:i.OutputKey,OutputValue:i.OutputValue,Description:i.Description,ExportName:i.ExportName}));t.push({StackId:a.StackId,StackName:a.StackName,StackStatus:a.StackStatus,CreationTime:a.CreationTime,LastUpdatedTime:a.LastUpdatedTime,StackStatusReason:a.StackStatusReason,Outputs:r})}}else if(e.StackId)t.push({StackId:e.StackId,StackName:e.StackName,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime});return t}parseStackEvents(e){let t=[],s=e?.DescribeStackEventsResult?.StackEvents?.member||e?.StackEvents?.member||e?.StackEvents||[];if(s&&!Array.isArray(s))s=[s];for(let a of s)if(a.LogicalResourceId)t.push({Timestamp:a.Timestamp,ResourceType:a.ResourceType,LogicalResourceId:a.LogicalResourceId,ResourceStatus:a.ResourceStatus,ResourceStatusReason:a.ResourceStatusReason});return t}async waitForStackWithProgress(e,t,s){let a={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},r=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],m=a[t],i=360,c=0,n=new Set;while(c<360)try{if(s)try{let k=[...(await this.describeStackEvents(e)).StackEvents||[]].reverse();for(let d of k){let g=`${d.LogicalResourceId}-${d.ResourceStatus}-${d.Timestamp}`;if(!n.has(g))n.add(g),s({resourceId:d.LogicalResourceId,resourceType:d.ResourceType,status:d.ResourceStatus,reason:d.ResourceStatusReason,timestamp:d.Timestamp})}}catch{}let o=await this.describeStacks({stackName:e});if(o.Stacks.length===0){if(t==="stack-delete-complete")return;await new Promise((S)=>setTimeout(S,2000)),c++;continue}let l=o.Stacks[0];if(m.includes(l.StackStatus))return;if(l.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let S=Error("Stack deletion failed - may have resources that need to be retained");throw S.code="DELETE_FAILED",S.stackStatus=l.StackStatus,S.statusReason=l.StackStatusReason,S}if(r.includes(l.StackStatus))throw Error(`Stack reached failure status: ${l.StackStatus}`);await new Promise((S)=>setTimeout(S,3000)),c++}catch(o){if(t==="stack-delete-complete"&&o.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&o.message?.includes("does not exist")){await new Promise((l)=>setTimeout(l,2000)),c++;continue}throw o}throw Error(`Timeout waiting for stack to reach ${t}`)}async waitForStackComplete(e,t=120,s=5000){let a=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],r=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let m=0;m<t;m++)try{let i=await this.describeStacks({stackName:e});if(i.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let c=i.Stacks[0],n=c.StackStatus;if(a.includes(n))return{success:!0,status:n};if(r.includes(n))return{success:!1,status:n,reason:c.StackStatusReason};await new Promise((o)=>setTimeout(o,s))}catch(i){if(i.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw i}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}
+import{u}from"./chunk-dmwfnbg0.js";import{_}from"./chunk-cvc9bxd4.js";class v{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new u(void 0,{profile:t})}async createStack(e){let t={Action:"CreateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(e.parameters)e.parameters.forEach((a,r)=>{t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});if(e.timeoutInMinutes)t.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)t.OnFailure=e.onFailure;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.CreateStackResult?.StackId}}async updateStack(e){let t={Action:"UpdateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((a,r)=>{if(t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,a.UsePreviousValue)t[`Parameters.member.${r+1}.UsePreviousValue`]="true";else t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.UpdateStackResult?.StackId}}async deleteStack(e,t,s){let a={Action:"DeleteStack",StackName:e,Version:"2010-05-15"};if(t)a.RoleARN=t;if(s&&s.length>0)s.forEach((r,m)=>{a[`RetainResources.member.${m+1}`]=r});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(a).toString()})}async describeStacks(e={}){let t={Action:"DescribeStacks",Version:"2010-05-15"};if(e.stackName)t.StackName=e.stackName;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{Stacks:this.parseStacksResponse(s)}}async describeStackEvents(e){let t={Action:"DescribeStackEvents",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackEvents:this.parseStackEvents(s)}}async listStackResources(e){let t={Action:"ListStackResources",StackName:e,Version:"2010-05-15"},a=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,r=[];if(a)r=Array.isArray(a)?a:[a];return{StackResourceSummaries:r}}async waitForStack(e,t){let s={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},a=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],r=s[t],m=360,i=0;while(i<360)try{let c=await this.describeStacks({stackName:e});if(c.Stacks.length===0){if(t==="stack-delete-complete")return;if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack not visible yet`);await new Promise((o)=>setTimeout(o,2000)),i++;continue}let n=c.Stacks[0];if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Status = ${n.StackStatus}${n.StackStatusReason?` (${n.StackStatusReason})`:""}`);if(r.includes(n.StackStatus))return;if((t==="stack-create-complete"||t==="stack-update-complete")&&(n.StackStatus==="DELETE_IN_PROGRESS"||n.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let o="";try{let S=await this.describeStackEvents(e);console.log("[waitForStack] Stack events (most recent first):");for(let k of S.StackEvents.slice(0,15))if(k.ResourceStatus.includes("FAILED")||k.ResourceStatusReason){if(console.log(`  ${k.LogicalResourceId}: ${k.ResourceStatus} - ${k.ResourceStatusReason||"No reason provided"}`),k.ResourceStatus.includes("FAILED")&&k.ResourceStatusReason&&!o)o=k.ResourceStatusReason}}catch{}let l=o||n.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${l}`)}if(n.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let o=Error("Stack deletion failed - may have resources that need to be retained");throw o.code="DELETE_FAILED",o.stackStatus=n.StackStatus,o.statusReason=n.StackStatusReason,o}if(a.includes(n.StackStatus))throw Error(`Stack reached failure status: ${n.StackStatus}`);await new Promise((o)=>setTimeout(o,5000)),i++}catch(c){if(t==="stack-delete-complete"&&c.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&c.message?.includes("does not exist")){if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack does not exist (error), retrying...`);await new Promise((n)=>setTimeout(n,2000)),i++;continue}throw console.log(`[waitForStack] Unexpected error: ${c.message}`),c}throw console.log(`[waitForStack] Timeout after ${i} attempts`),Error(`Timeout waiting for stack to reach ${t}`)}async validateTemplate(e){let t={Action:"ValidateTemplate",TemplateBody:e,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async listStacks(e){let t={Action:"ListStacks",Version:"2010-05-15"};if(e)e.forEach((c,n)=>{t[`StackStatusFilter.member.${n+1}`]=c});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=s.ListStacksResponse||s,r=a.ListStacksResult||a,m=r.StackSummaries?.member||r.StackSummaries||[];return{StackSummaries:(Array.isArray(m)?m:m?[m]:[]).map((c)=>({StackId:c.StackId||"",StackName:c.StackName||"",TemplateDescription:c.TemplateDescription,CreationTime:c.CreationTime||"",LastUpdatedTime:c.LastUpdatedTime,DeletionTime:c.DeletionTime,StackStatus:c.StackStatus||""}))}}async createChangeSet(e){let t={Action:"CreateChangeSet",StackName:e.stackName,ChangeSetName:e.changeSetName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((r,m)=>{t[`Parameters.member.${m+1}.ParameterKey`]=r.ParameterKey,t[`Parameters.member.${m+1}.ParameterValue`]=r.ParameterValue});if(e.capabilities)e.capabilities.forEach((r,m)=>{t[`Capabilities.member.${m+1}`]=r});if(e.changeSetType)t.ChangeSetType=e.changeSetType;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=_(s,"CreateChangeSet");return{Id:a?.Id,StackId:a?.StackId}}async describeChangeSet(e,t){let s={Action:"DescribeChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async executeChangeSet(e,t){let s={Action:"ExecuteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async deleteChangeSet(e,t){let s={Action:"DeleteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async getStackOutputs(e){let t=await this.describeStacks({stackName:e});if(!t.Stacks||t.Stacks.length===0)throw Error(`Stack ${e} not found`);let s=t.Stacks[0],a={};if(s.Outputs)for(let r of s.Outputs)a[r.OutputKey]=r.OutputValue;return a}async getTemplate(e){let t={Action:"GetTemplate",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{TemplateBody:s?.GetTemplateResult?.TemplateBody||s?.TemplateBody||""}}parseStacksResponse(e){let t=[],s=e?.DescribeStacksResult?.Stacks?.member||e?.Stacks?.member||e?.Stacks||e;if(s&&!Array.isArray(s))s=[s];if(Array.isArray(s)){for(let a of s)if(a.StackId||a.StackName){let r;if(a.Outputs?.member)r=(Array.isArray(a.Outputs.member)?a.Outputs.member:[a.Outputs.member]).map((i)=>({OutputKey:i.OutputKey,OutputValue:i.OutputValue,Description:i.Description,ExportName:i.ExportName}));t.push({StackId:a.StackId,StackName:a.StackName,StackStatus:a.StackStatus,CreationTime:a.CreationTime,LastUpdatedTime:a.LastUpdatedTime,StackStatusReason:a.StackStatusReason,Outputs:r})}}else if(e.StackId)t.push({StackId:e.StackId,StackName:e.StackName,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime});return t}parseStackEvents(e){let t=[],s=e?.DescribeStackEventsResult?.StackEvents?.member||e?.StackEvents?.member||e?.StackEvents||[];if(s&&!Array.isArray(s))s=[s];for(let a of s)if(a.LogicalResourceId)t.push({Timestamp:a.Timestamp,ResourceType:a.ResourceType,LogicalResourceId:a.LogicalResourceId,ResourceStatus:a.ResourceStatus,ResourceStatusReason:a.ResourceStatusReason});return t}async waitForStackWithProgress(e,t,s){let a={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},r=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],m=a[t],i=360,c=0,n=new Set;while(c<360)try{if(s)try{let k=[...(await this.describeStackEvents(e)).StackEvents||[]].reverse();for(let d of k){let g=`${d.LogicalResourceId}-${d.ResourceStatus}-${d.Timestamp}`;if(!n.has(g))n.add(g),s({resourceId:d.LogicalResourceId,resourceType:d.ResourceType,status:d.ResourceStatus,reason:d.ResourceStatusReason,timestamp:d.Timestamp})}}catch{}let o=await this.describeStacks({stackName:e});if(o.Stacks.length===0){if(t==="stack-delete-complete")return;await new Promise((S)=>setTimeout(S,2000)),c++;continue}let l=o.Stacks[0];if(m.includes(l.StackStatus))return;if(l.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let S=Error("Stack deletion failed - may have resources that need to be retained");throw S.code="DELETE_FAILED",S.stackStatus=l.StackStatus,S.statusReason=l.StackStatusReason,S}if(r.includes(l.StackStatus))throw Error(`Stack reached failure status: ${l.StackStatus}`);await new Promise((S)=>setTimeout(S,3000)),c++}catch(o){if(t==="stack-delete-complete"&&o.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&o.message?.includes("does not exist")){await new Promise((l)=>setTimeout(l,2000)),c++;continue}throw o}throw Error(`Timeout waiting for stack to reach ${t}`)}async waitForStackComplete(e,t=120,s=5000){let a=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],r=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let m=0;m<t;m++)try{let i=await this.describeStacks({stackName:e});if(i.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let c=i.Stacks[0],n=c.StackStatus;if(a.includes(n))return{success:!0,status:n};if(r.includes(n))return{success:!1,status:n,reason:c.StackStatusReason};await new Promise((o)=>setTimeout(o,s))}catch(i){if(i.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw i}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}
 export{v};

package/dist/bin/chunk-1wf1s8db.js

@@ -0,0 +1 @@
+import{Q}from"./chunk-dnmb3sr0.js";import"./chunk-dmwfnbg0.js";export{Q as EC2Client};

package/dist/bin/{chunk-0ffqbgbs.js → chunk-48nz63ab.js}

@@ -1,3 +1,3 @@
-import{ke,ca,Ii,Ba,vn,Li,ja,Va,Xa,Qa}from"./chunk-hsek7hvh.js";import{n,r,a,e,p,i,ve}from"./chunk-r3gxhy1k.js";import{u}from"./chunk-7rwc5bvv.js";import{v}from"./chunk-v4gpkkzh.js";import{I}from"./chunk-j01jx36v.js";import{g}from"./chunk-f76wtb7d.js";import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";class K{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new u(void 0,{profile:s})}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId,ClientRequestToken:t.ClientRequestToken||crypto.randomUUID()};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}function k(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:ke(t,s),artifactBucket:ca(c,s),assetsBucket:Ii(c,s)}}function bt(t,s){let o=k(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function q(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let d=l?.code||l?.name||"",m=String(l?.message||"");if(d==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(m)){o=l,await new Promise((f)=>setTimeout(f,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new K(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((d)=>({envName:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(t.secrets).map(([d,m])=>({envName:d,secretId:m}));if(Array.isArray(t.secrets)){let d=new Map;for(let{envName:f,secretId:S}of l)d.set(f,[...d.get(f)??[],S]);let m=[...d.entries()].filter(([,f])=>f.length>1);if(m.length){let f=m.map(([S,R])=>`${S} ← ${R.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${f}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:d,secretId:m}of l){let S=(await o.getSecretValue({SecretId:m})).SecretString??"";try{let R=JSON.parse(S);if(R&&typeof R==="object"&&!Array.isArray(R)){for(let[w,N]of Object.entries(R))c[w]=String(N);continue}}catch{}c[d]=S}return c}function Hd(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function Do(t,s,o,c,l,d,m,f={}){let S=t.kind==="php"?Xa({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...f,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...m?{TSCLOUD_QUEUE:m,SQS_QUEUE:m}:{},...d?{ASSET_URL:d}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function he(t,s,o,c,l=!1){let d=0;for(let m of oe(o)){let f=Se(o,m).replace(/\\/g,"/");if(!l&&f.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${f}`,body:pe(m),contentType:Re(m),cacheControl:"public, max-age=31536000, immutable"}),d++}return d}function Ts(t,s){let o=Object.entries(s).reduce((c,[l,d])=>c+Buffer.byteLength(`${l}=${d}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,d])=>[l,Buffer.byteLength(`${l}=${d}`,"utf8")]).sort((l,d)=>d[1]-l[1]).slice(0,5).map(([l,d])=>`${l} (${d}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function U(t,s,o,c){Ts(s,o),await q(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await q(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await q(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await q(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function em(t,s,o={}){let c=k(t,s),{app:l,slug:d,region:m,stackName:f,artifactBucket:S}=c,R=o.projectRoot??process.cwd();i(`Deploying serverless app: ${d} (${s})`),e(`Stack: ${f}`),e(`Region: ${m}`);let w=new g(m),N=new v(m),T=new I(m),P=l.kind==="php",O=l.packaging==="image",h=Li(l),V,E,b,Y,M=[];if(O&&h.usesLayer&&h.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${h.kind}${h.kind==="node"?` ${h.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){p("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-r263q1aa.js"),C=await y({app:l,projectRoot:R,region:m,repository:`${d}-${s}`,skipBuild:o.skipBuild,onStep:(D)=>e(`  ${D}`)});V=C.handlers,E={kind:"image",imageUri:C.imageUri},b=C.tag,M.push({ParameterKey:"ImageUri",ParameterValue:C.imageUri})}else{p("Packaging application");let y=P?Qa({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await vn({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),C=Ba(d,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,b=y.sha256,h.usesLayer){let x=h.layerEnvVar?process.env[h.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=h.layerKind==="php"?"serverless:build-php-layer":h.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${h.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${h.layerEnvVar} env var (build one with \`cloud ${ge}\`)${h.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await w.bucketExists(S))p(`Creating artifact bucket ${S}`),await w.createBucket(S);if(await w.headObject(S,C).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else p("Uploading artifact"),await w.putObject({bucket:S,key:C,body:y.zip,contentType:"application/zip"});E={kind:"zip",bucket:S,key:C},M.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:C})}let A=Va({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(A.template),re=["CAPABILITY_NAMED_IAM"],L=await N.describeStacks({stackName:f}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),J=L!==void 0;if(L&&/DELETE_IN_PROGRESS/.test(L))p("Waiting for an in-progress stack delete to finish"),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;else if(L&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(L))p(`Deleting unusable stack (status ${L}) before recreate`),await N.deleteStack(f),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;p(J?"Updating infrastructure stack":"Creating infrastructure stack");try{if(J)await N.updateStack({stackName:f,templateBody:te,parameters:M,capabilities:re}),await N.waitForStack(f,"stack-update-complete");else await N.createStack({stackName:f,templateBody:te,parameters:M,capabilities:re,onFailure:"DELETE"}),await N.waitForStack(f,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await N.getStackOutputs(f).catch(()=>({})),B;if(l.assets){let y=ne(R,l.assets);if(de(y)){let C=l.assetDomain||Q.AssetsCdnDomain;B=C?`https://${C}/${b}`:void 0,p(`Syncing assets from ${l.assets}`);let D=await he(w,c.assetsBucket,y,b,l.dotFilesAsAssets);e(`Uploaded ${D} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}p("Resolving secrets");let _=await ye(l,m);if(l.database?.connection==="aurora-serverless")try{let C=await new K(m).getSecretValue({SecretId:`${d}/${s}/db`}),D=JSON.parse(C.SecretString??"{}");if(D.username)_.DB_USERNAME=D.username;if(D.password)_.DB_PASSWORD=D.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await w.bucketExists(S))await w.createBucket(S);let H=await G(w,S,d,s),F={},Z=A.queueNames[0],ee=Hd(l,Q);if(p("Activating functions"),F.http=Do(l,c,s,"http",_,B,Z,ee),await U(T,A.functionNames.http,F.http,E),F.cli=Do(l,c,s,"cli",_,B,Z,ee),await U(T,A.functionNames.cli,F.cli,E),A.queueNames.length)F.queue=Do(l,c,s,"queue",_,B,Z,ee),await U(T,A.functionNames.queue,F.queue,E);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(p("Publishing versions + flipping live alias"),W.http=await X(T,A.functionNames.http),W.cli=await X(T,A.functionNames.cli),A.queueNames.length)W.queue=await X(T,A.functionNames.queue)}if(await ae(w,S,d,s,{sha:b,code:E,previousSha:H?.sha,previousCode:H?.code,previousFunctionEnv:H?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:H?.functionVersions}:{},functionEnv:F,functionNames:{http:A.functionNames.http,cli:A.functionNames.cli,...A.queueNames.length?{queue:A.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){p("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let C=await T.invoke({FunctionName:A.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(C.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${C.Payload}`)}}let j=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&j){p("Health check");try{let y=await fetch(j,{method:"GET"});e(`GET ${j} → ${y.status}`)}catch(y){a(`Health check could not reach ${j}: ${y.message}`)}}ve(["Serverless deploy complete","",j?`URL:   ${j}`:"",`Stack: ${f}`,`Build: ${b.slice(0,12)}`].filter(Boolean).join(`
-`),"green")}async function No(t,s){let o=k(t,s),c=new g(o.region),l=new I(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d)throw Error("No previous release to redeploy. Run a full deploy first.");i(`Redeploying ${o.slug} (${s}) — build ${d.sha.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;p(`Re-activating ${m} (${f})`),await U(l,f,d.functionEnv[m]??{},d.code);let S=d.functionVersions?.[m];if(S)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:S}))}n("Redeploy complete")}async function ko(t,s){let o=k(t,s),c=new g(o.region),l=new I(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d?.previousCode)throw Error("No previous release to roll back to.");i(`Rolling back ${o.slug} (${s}) → ${d.previousSha?.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;p(`Restoring ${m} (${f})`);let S=d.previousFunctionEnv?.[m]??d.functionEnv[m]??{};await U(l,f,S,d.previousCode);let R=d.previousFunctionVersions?.[m];if(R)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:R}))}await ae(c,o.artifactBucket,o.slug,s,{...d,sha:d.previousSha??d.sha,code:d.previousCode,functionEnv:d.previousFunctionEnv??d.functionEnv,functionVersions:d.previousFunctionVersions??d.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),n("Rollback complete")}async function Es(t,s,o,c){let l=k(t,s),d=new I(l.region),m=`${l.slug}-${s}-http`,S={...(await d.getFunction(m)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=o?"1":"0",o&&c)S.MAINTENANCE_BYPASS_SECRET=c;if(!o)delete S.MAINTENANCE_BYPASS_SECRET;if(await q(()=>d.updateFunctionConfiguration({FunctionName:m,Environment:{Variables:S}})),(l.app.provisionedConcurrency??0)>0)await d.waitForFunctionActive(m,120),await X(d,m);n(o?"Application is now in maintenance mode (503)":"Application is live")}async function Bt(t,s,o){let c=k(t,s),l=new I(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"});if(m.FunctionError)throw Error(`Command failed: ${m.Payload}`);return m.Payload??""}var ce=(t,s)=>`commands/${t}/${s}/history.json`,Ne=50;async function le(t,s,o,c){try{return(await t.getObjectJson(s,ce(o,c)))?.records??[]}catch{return[]}}async function tm(t,s,o){let c=k(t,s),l=new I(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"}),f=m.Payload??"",S=m.FunctionError?"error":"ok",R=-1;try{let w=new g(c.region);if(await w.bucketExists(c.artifactBucket)){let N=await le(w,c.artifactBucket,c.slug,s);R=N.reduce((T,P)=>Math.max(T,P.id),0)+1,N.push({id:R,command:o,timestamp:new Date().toISOString(),status:S,output:f.slice(0,4000)}),await w.putObjectJson(c.artifactBucket,ce(c.slug,s),{records:N.slice(-Ne)})}}catch{}if(m.FunctionError)throw Error(`Command failed${R>0?` (#${R})`:""}: ${f}`);return{id:R,status:S,output:f}}async function qd(t,s){let o=k(t,s),c=new g(o.region);return le(c,o.artifactBucket,o.slug,s)}async function rm(t,s,o){let c=await qd(t,s);if(!c.length)return;return o==null?c[c.length-1]:c.find((l)=>l.id===o)}async function nm(t,s,o){let c=Buffer.from(o,"utf-8").toString("base64");return Bt(t,s,`tscloud:db-query --sql-base64=${c}`)}async function z(t,s){let o=k(t,s),c=new v(o.region),l=new I(o.region),d=new g(o.region),m="not deployed",f={};try{let{Stacks:O}=await c.describeStacks({stackName:o.stackName});m=O?.[0]?.StackStatus??m;for(let h of O?.[0]?.Outputs??[])if(h.OutputKey)f[h.OutputKey]=h.OutputValue??""}catch{}let S=ja(o.app,o.slug,s),R=o.app.provisionedConcurrency??0,w=["http","cli",...S.length?["queue"]:[]],N=`${o.slug}-${s}`,T=[];for(let O of w){let h=`${N}-${O}`,V={mode:O,name:h,version:"$LATEST"};if(R>0){let E=await l.getAlias(h,"live").catch(()=>null);if(E?.FunctionVersion){V.version=E.FunctionVersion;let b=await l.getProvisionedConcurrencyConfig(h,"live").catch(()=>null);if(b)V.provisioned={status:b.Status??"-",allocated:b.AllocatedProvisionedConcurrentExecutions??0,requested:b.RequestedProvisionedConcurrentExecutions??0}}}T.push(V)}let P=await G(d,o.artifactBucket,o.slug,s).catch(()=>null);return{slug:o.slug,environment:s,region:o.region,stackStatus:m,endpoint:f.HttpApiEndpoint,assetUrl:P?.assetUrl,scheduler:o.app.scheduler??"on",queues:S,provisionedConcurrency:R,functions:T,lastRelease:P?{sha:P.sha,timestamp:P.timestamp}:void 0}}function ue(t,s){return`${t}-${s}-db`}async function xo(t,s,o,c){let l=k(t,s);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:d}=await import("./chunk-tj589nbw.js"),m=new d(l.region),f=ue(l.slug,s);p(`Scaling ${f} → ${o}–${c} ACUs`),await m.modifyDBCluster({DBClusterIdentifier:f,ServerlessV2ScalingConfiguration:{MinCapacity:o,MaxCapacity:c},ApplyImmediately:!0}),n(`Scaling applied to ${f} (takes effect shortly).`)}async function im(t,s,o){let c=k(t,s);if(c.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!o.toTime&&!o.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:l}=await import("./chunk-tj589nbw.js"),d=new l(c.region),m=ue(c.slug,s),f=o.latest?"latest":o.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),S=o.target??`${m}-restore-${f}`;p(`Restoring ${m} → new cluster ${S} (${o.latest?"latest restorable time":o.toTime.toISOString()})`),await d.restoreDBClusterToPointInTime({DBClusterIdentifier:S,SourceDBClusterIdentifier:m,RestoreToTime:o.toTime,UseLatestRestorableTime:o.latest}),p("Waiting for the restored cluster to be ready");for(let R=0;R<120;R++){let{DBClusters:w}=await d.describeDBClusters({DBClusterIdentifier:S}),N=w?.[0]?.Status;if(N&&N!=="creating")break;await new Promise((T)=>setTimeout(T,15000))}return p("Adding a writer instance"),await d.createDBInstance({DBInstanceIdentifier:`${S}-1`,DBClusterIdentifier:S,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),n(`Restore complete → cluster ${S} with writer ${S}-1. Point an env's database at it once available.`),S}
-export{K,bt,Hd,Do,Ts,em,No,ko,Es,Bt,tm,qd,rm,nm,z,xo,im};
+import{ke,ca,Ii,Ba,vn,Li,ja,Va,Xa,Qa}from"./chunk-q8hp4dfy.js";import{n,r,a,e,p,i,ve}from"./chunk-e6mfcw0v.js";import{u}from"./chunk-dmwfnbg0.js";import{v}from"./chunk-0ynfqf9t.js";import{I}from"./chunk-wga7gj0h.js";import{g}from"./chunk-tt3m3fda.js";import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";class K{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new u(void 0,{profile:s})}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId,ClientRequestToken:t.ClientRequestToken||crypto.randomUUID()};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}function k(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:ke(t,s),artifactBucket:ca(c,s),assetsBucket:Ii(c,s)}}function bt(t,s){let o=k(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function q(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let d=l?.code||l?.name||"",m=String(l?.message||"");if(d==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(m)){o=l,await new Promise((f)=>setTimeout(f,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new K(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((d)=>({envName:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(t.secrets).map(([d,m])=>({envName:d,secretId:m}));if(Array.isArray(t.secrets)){let d=new Map;for(let{envName:f,secretId:S}of l)d.set(f,[...d.get(f)??[],S]);let m=[...d.entries()].filter(([,f])=>f.length>1);if(m.length){let f=m.map(([S,R])=>`${S} ← ${R.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${f}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:d,secretId:m}of l){let S=(await o.getSecretValue({SecretId:m})).SecretString??"";try{let R=JSON.parse(S);if(R&&typeof R==="object"&&!Array.isArray(R)){for(let[w,N]of Object.entries(R))c[w]=String(N);continue}}catch{}c[d]=S}return c}function Hd(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function Ds(t,s,o,c,l,d,m,f={}){let S=t.kind==="php"?Xa({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...f,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...m?{TSCLOUD_QUEUE:m,SQS_QUEUE:m}:{},...d?{ASSET_URL:d}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function he(t,s,o,c,l=!1){let d=0;for(let m of oe(o)){let f=Se(o,m).replace(/\\/g,"/");if(!l&&f.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${f}`,body:pe(m),contentType:Re(m),cacheControl:"public, max-age=31536000, immutable"}),d++}return d}function Eo(t,s){let o=Object.entries(s).reduce((c,[l,d])=>c+Buffer.byteLength(`${l}=${d}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,d])=>[l,Buffer.byteLength(`${l}=${d}`,"utf8")]).sort((l,d)=>d[1]-l[1]).slice(0,5).map(([l,d])=>`${l} (${d}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function U(t,s,o,c){Eo(s,o),await q(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await q(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await q(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await q(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function rm(t,s,o={}){let c=k(t,s),{app:l,slug:d,region:m,stackName:f,artifactBucket:S}=c,R=o.projectRoot??process.cwd();i(`Deploying serverless app: ${d} (${s})`),e(`Stack: ${f}`),e(`Region: ${m}`);let w=new g(m),N=new v(m),T=new I(m),P=l.kind==="php",O=l.packaging==="image",h=Li(l),V,E,b,Y,M=[];if(O&&h.usesLayer&&h.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${h.kind}${h.kind==="node"?` ${h.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){p("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-989j6ezd.js"),C=await y({app:l,projectRoot:R,region:m,repository:`${d}-${s}`,skipBuild:o.skipBuild,onStep:(D)=>e(`  ${D}`)});V=C.handlers,E={kind:"image",imageUri:C.imageUri},b=C.tag,M.push({ParameterKey:"ImageUri",ParameterValue:C.imageUri})}else{p("Packaging application");let y=P?Qa({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await vn({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),C=Ba(d,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,b=y.sha256,h.usesLayer){let x=h.layerEnvVar?process.env[h.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=h.layerKind==="php"?"serverless:build-php-layer":h.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${h.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${h.layerEnvVar} env var (build one with \`cloud ${ge}\`)${h.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await w.bucketExists(S))p(`Creating artifact bucket ${S}`),await w.createBucket(S);if(await w.headObject(S,C).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else p("Uploading artifact"),await w.putObject({bucket:S,key:C,body:y.zip,contentType:"application/zip"});E={kind:"zip",bucket:S,key:C},M.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:C})}let A=Va({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(A.template),re=["CAPABILITY_NAMED_IAM"],L=await N.describeStacks({stackName:f}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),J=L!==void 0;if(L&&/DELETE_IN_PROGRESS/.test(L))p("Waiting for an in-progress stack delete to finish"),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;else if(L&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(L))p(`Deleting unusable stack (status ${L}) before recreate`),await N.deleteStack(f),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;p(J?"Updating infrastructure stack":"Creating infrastructure stack");try{if(J)await N.updateStack({stackName:f,templateBody:te,parameters:M,capabilities:re}),await N.waitForStack(f,"stack-update-complete");else await N.createStack({stackName:f,templateBody:te,parameters:M,capabilities:re,onFailure:"DELETE"}),await N.waitForStack(f,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await N.getStackOutputs(f).catch(()=>({})),B;if(l.assets){let y=ne(R,l.assets);if(de(y)){let C=l.assetDomain||Q.AssetsCdnDomain;B=C?`https://${C}/${b}`:void 0,p(`Syncing assets from ${l.assets}`);let D=await he(w,c.assetsBucket,y,b,l.dotFilesAsAssets);e(`Uploaded ${D} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}p("Resolving secrets");let _=await ye(l,m);if(l.database?.connection==="aurora-serverless")try{let C=await new K(m).getSecretValue({SecretId:`${d}/${s}/db`}),D=JSON.parse(C.SecretString??"{}");if(D.username)_.DB_USERNAME=D.username;if(D.password)_.DB_PASSWORD=D.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await w.bucketExists(S))await w.createBucket(S);let H=await G(w,S,d,s),F={},Z=A.queueNames[0],ee=Hd(l,Q);if(p("Activating functions"),F.http=Ds(l,c,s,"http",_,B,Z,ee),await U(T,A.functionNames.http,F.http,E),F.cli=Ds(l,c,s,"cli",_,B,Z,ee),await U(T,A.functionNames.cli,F.cli,E),A.queueNames.length)F.queue=Ds(l,c,s,"queue",_,B,Z,ee),await U(T,A.functionNames.queue,F.queue,E);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(p("Publishing versions + flipping live alias"),W.http=await X(T,A.functionNames.http),W.cli=await X(T,A.functionNames.cli),A.queueNames.length)W.queue=await X(T,A.functionNames.queue)}if(await ae(w,S,d,s,{sha:b,code:E,previousSha:H?.sha,previousCode:H?.code,previousFunctionEnv:H?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:H?.functionVersions}:{},functionEnv:F,functionNames:{http:A.functionNames.http,cli:A.functionNames.cli,...A.queueNames.length?{queue:A.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){p("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let C=await T.invoke({FunctionName:A.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(C.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${C.Payload}`)}}let j=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&j){p("Health check");try{let y=await fetch(j,{method:"GET"});e(`GET ${j} → ${y.status}`)}catch(y){a(`Health check could not reach ${j}: ${y.message}`)}}ve(["Serverless deploy complete","",j?`URL:   ${j}`:"",`Stack: ${f}`,`Build: ${b.slice(0,12)}`].filter(Boolean).join(`
+`),"green")}async function Ns(t,s){let o=k(t,s),c=new g(o.region),l=new I(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d)throw Error("No previous release to redeploy. Run a full deploy first.");i(`Redeploying ${o.slug} (${s}) — build ${d.sha.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;p(`Re-activating ${m} (${f})`),await U(l,f,d.functionEnv[m]??{},d.code);let S=d.functionVersions?.[m];if(S)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:S}))}n("Redeploy complete")}async function ks(t,s){let o=k(t,s),c=new g(o.region),l=new I(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d?.previousCode)throw Error("No previous release to roll back to.");i(`Rolling back ${o.slug} (${s}) → ${d.previousSha?.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;p(`Restoring ${m} (${f})`);let S=d.previousFunctionEnv?.[m]??d.functionEnv[m]??{};await U(l,f,S,d.previousCode);let R=d.previousFunctionVersions?.[m];if(R)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:R}))}await ae(c,o.artifactBucket,o.slug,s,{...d,sha:d.previousSha??d.sha,code:d.previousCode,functionEnv:d.previousFunctionEnv??d.functionEnv,functionVersions:d.previousFunctionVersions??d.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),n("Rollback complete")}async function wo(t,s,o,c){let l=k(t,s),d=new I(l.region),m=`${l.slug}-${s}-http`,S={...(await d.getFunction(m)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=o?"1":"0",o&&c)S.MAINTENANCE_BYPASS_SECRET=c;if(!o)delete S.MAINTENANCE_BYPASS_SECRET;if(await q(()=>d.updateFunctionConfiguration({FunctionName:m,Environment:{Variables:S}})),(l.app.provisionedConcurrency??0)>0)await d.waitForFunctionActive(m,120),await X(d,m);n(o?"Application is now in maintenance mode (503)":"Application is live")}async function Bt(t,s,o){let c=k(t,s),l=new I(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"});if(m.FunctionError)throw Error(`Command failed: ${m.Payload}`);return m.Payload??""}var ce=(t,s)=>`commands/${t}/${s}/history.json`,Ne=50;async function le(t,s,o,c){try{return(await t.getObjectJson(s,ce(o,c)))?.records??[]}catch{return[]}}async function nm(t,s,o){let c=k(t,s),l=new I(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"}),f=m.Payload??"",S=m.FunctionError?"error":"ok",R=-1;try{let w=new g(c.region);if(await w.bucketExists(c.artifactBucket)){let N=await le(w,c.artifactBucket,c.slug,s);R=N.reduce((T,P)=>Math.max(T,P.id),0)+1,N.push({id:R,command:o,timestamp:new Date().toISOString(),status:S,output:f.slice(0,4000)}),await w.putObjectJson(c.artifactBucket,ce(c.slug,s),{records:N.slice(-Ne)})}}catch{}if(m.FunctionError)throw Error(`Command failed${R>0?` (#${R})`:""}: ${f}`);return{id:R,status:S,output:f}}async function Gd(t,s){let o=k(t,s),c=new g(o.region);return le(c,o.artifactBucket,o.slug,s)}async function im(t,s,o){let c=await Gd(t,s);if(!c.length)return;return o==null?c[c.length-1]:c.find((l)=>l.id===o)}async function om(t,s,o){let c=Buffer.from(o,"utf-8").toString("base64");return Bt(t,s,`tscloud:db-query --sql-base64=${c}`)}async function z(t,s){let o=k(t,s),c=new v(o.region),l=new I(o.region),d=new g(o.region),m="not deployed",f={};try{let{Stacks:O}=await c.describeStacks({stackName:o.stackName});m=O?.[0]?.StackStatus??m;for(let h of O?.[0]?.Outputs??[])if(h.OutputKey)f[h.OutputKey]=h.OutputValue??""}catch{}let S=ja(o.app,o.slug,s),R=o.app.provisionedConcurrency??0,w=["http","cli",...S.length?["queue"]:[]],N=`${o.slug}-${s}`,T=[];for(let O of w){let h=`${N}-${O}`,V={mode:O,name:h,version:"$LATEST"};if(R>0){let E=await l.getAlias(h,"live").catch(()=>null);if(E?.FunctionVersion){V.version=E.FunctionVersion;let b=await l.getProvisionedConcurrencyConfig(h,"live").catch(()=>null);if(b)V.provisioned={status:b.Status??"-",allocated:b.AllocatedProvisionedConcurrentExecutions??0,requested:b.RequestedProvisionedConcurrentExecutions??0}}}T.push(V)}let P=await G(d,o.artifactBucket,o.slug,s).catch(()=>null);return{slug:o.slug,environment:s,region:o.region,stackStatus:m,endpoint:f.HttpApiEndpoint,assetUrl:P?.assetUrl,scheduler:o.app.scheduler??"on",queues:S,provisionedConcurrency:R,functions:T,lastRelease:P?{sha:P.sha,timestamp:P.timestamp}:void 0}}function ue(t,s){return`${t}-${s}-db`}async function xs(t,s,o,c){let l=k(t,s);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:d}=await import("./chunk-zb1nh252.js"),m=new d(l.region),f=ue(l.slug,s);p(`Scaling ${f} → ${o}–${c} ACUs`),await m.modifyDBCluster({DBClusterIdentifier:f,ServerlessV2ScalingConfiguration:{MinCapacity:o,MaxCapacity:c},ApplyImmediately:!0}),n(`Scaling applied to ${f} (takes effect shortly).`)}async function sm(t,s,o){let c=k(t,s);if(c.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!o.toTime&&!o.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:l}=await import("./chunk-zb1nh252.js"),d=new l(c.region),m=ue(c.slug,s),f=o.latest?"latest":o.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),S=o.target??`${m}-restore-${f}`;p(`Restoring ${m} → new cluster ${S} (${o.latest?"latest restorable time":o.toTime.toISOString()})`),await d.restoreDBClusterToPointInTime({DBClusterIdentifier:S,SourceDBClusterIdentifier:m,RestoreToTime:o.toTime,UseLatestRestorableTime:o.latest}),p("Waiting for the restored cluster to be ready");for(let R=0;R<120;R++){let{DBClusters:w}=await d.describeDBClusters({DBClusterIdentifier:S}),N=w?.[0]?.Status;if(N&&N!=="creating")break;await new Promise((T)=>setTimeout(T,15000))}return p("Adding a writer instance"),await d.createDBInstance({DBInstanceIdentifier:`${S}-1`,DBClusterIdentifier:S,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),n(`Restore complete → cluster ${S} with writer ${S}-1. Point an env's database at it once available.`),S}
+export{K,bt,Hd,Ds,Eo,rm,Ns,ks,wo,Bt,nm,Gd,im,om,z,xs,sm};

package/dist/bin/{chunk-2bkxxset.js → chunk-4bp4k1x2.js}

@@ -1,2 +1,2 @@
-import{Fs,fa}from"./chunk-hsek7hvh.js";import{g}from"./chunk-f76wtb7d.js";var l=()=>{};async function Op(a,c=l){for(let e of a){let t=new g(e.replicaRegion),i;try{i=await t.headBucket(e.replicaBucket)}catch(r){if(r?.statusCode===301)throw Error(`Failover replica bucket ${e.replicaBucket} already exists outside ${e.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${e.name}.`);if(r?.statusCode===403)throw Error(`Failover replica bucket ${e.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${e.name}.failover.bucket to a name you own.`);throw r}if(i.exists&&i.region&&i.region!==e.replicaRegion)throw Error(`Failover replica bucket ${e.replicaBucket} is in ${i.region}, not ${e.replicaRegion}.`);if(!i.exists)c(`Creating failover replica bucket ${e.replicaBucket} in ${e.replicaRegion}`),await t.createBucket(e.replicaBucket);if(await t.putPublicAccessBlock(e.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await t.putBucketEncryption(e.replicaBucket,"AES256"),e.replicate){if((await t.getBucketVersioning(e.replicaBucket)).Status!=="Enabled")c(`Enabling versioning on ${e.replicaBucket} (S3 replication requires it)`),await t.putBucketVersioning(e.replicaBucket,"Enabled")}}}async function $p(a,c,e=l){for(let t of a){let i=c[t.distributionArnOutput];if(!i)throw Error(`Stack output ${t.distributionArnOutput} is missing, so the failover replica ${t.replicaBucket} cannot be scoped to its distribution.`);let r=new g(t.replicaRegion),s={Version:"2012-10-17",Statement:[...((await r.getBucketPolicy(t.replicaBucket))?.Statement??[]).filter((n)=>n?.Sid!==Fs),fa({replicaBucket:t.replicaBucket,distributionArn:i})]};e(`Granting ${i} read access to ${t.replicaBucket}`),await r.putBucketPolicy(t.replicaBucket,s)}}async function Lp(a,c=l){let e={};for(let t of a){let i=new g(t.primaryRegion),r=new g(t.replicaRegion),[u,p]=await Promise.all([i.listAllObjects({bucket:t.primaryBucket}),r.listAllObjects({bucket:t.replicaBucket})]),s=new Map(p.map((o)=>[o.Key,o.Size])),n=u.filter((o)=>s.get(o.Key)!==o.Size);for(let o of n)await r.copyObject({sourceBucket:t.primaryBucket,sourceKey:o.Key,destinationBucket:t.replicaBucket,destinationKey:o.Key});if(n.length>0)c(`Copied ${n.length} object(s) from ${t.primaryBucket} to ${t.replicaBucket}`);e[t.replicaBucket]=n.length}return e}async function Mp(a,c=l){for(let e of a){let t=new g(e.replicaRegion);if(!(await t.headBucket(e.replicaBucket)).exists)continue;await t.emptyBucket(e.replicaBucket),await t.deleteBucket(e.replicaBucket),c(`Deleted failover replica bucket ${e.replicaBucket}`)}}
-export{Op,$p,Lp,Mp};
+import{Bo,fa}from"./chunk-q8hp4dfy.js";import{g}from"./chunk-tt3m3fda.js";var l=()=>{};async function Lp(a,c=l){for(let e of a){let t=new g(e.replicaRegion),i;try{i=await t.headBucket(e.replicaBucket)}catch(r){if(r?.statusCode===301)throw Error(`Failover replica bucket ${e.replicaBucket} already exists outside ${e.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${e.name}.`);if(r?.statusCode===403)throw Error(`Failover replica bucket ${e.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${e.name}.failover.bucket to a name you own.`);throw r}if(i.exists&&i.region&&i.region!==e.replicaRegion)throw Error(`Failover replica bucket ${e.replicaBucket} is in ${i.region}, not ${e.replicaRegion}.`);if(!i.exists)c(`Creating failover replica bucket ${e.replicaBucket} in ${e.replicaRegion}`),await t.createBucket(e.replicaBucket);if(await t.putPublicAccessBlock(e.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await t.putBucketEncryption(e.replicaBucket,"AES256"),e.replicate){if((await t.getBucketVersioning(e.replicaBucket)).Status!=="Enabled")c(`Enabling versioning on ${e.replicaBucket} (S3 replication requires it)`),await t.putBucketVersioning(e.replicaBucket,"Enabled")}}}async function Mp(a,c,e=l){for(let t of a){let i=c[t.distributionArnOutput];if(!i)throw Error(`Stack output ${t.distributionArnOutput} is missing, so the failover replica ${t.replicaBucket} cannot be scoped to its distribution.`);let r=new g(t.replicaRegion),s={Version:"2012-10-17",Statement:[...((await r.getBucketPolicy(t.replicaBucket))?.Statement??[]).filter((n)=>n?.Sid!==Bo),fa({replicaBucket:t.replicaBucket,distributionArn:i})]};e(`Granting ${i} read access to ${t.replicaBucket}`),await r.putBucketPolicy(t.replicaBucket,s)}}async function Up(a,c=l){let e={};for(let t of a){let i=new g(t.primaryRegion),r=new g(t.replicaRegion),[u,p]=await Promise.all([i.listAllObjects({bucket:t.primaryBucket}),r.listAllObjects({bucket:t.replicaBucket})]),s=new Map(p.map((o)=>[o.Key,o.Size])),n=u.filter((o)=>s.get(o.Key)!==o.Size);for(let o of n)await r.copyObject({sourceBucket:t.primaryBucket,sourceKey:o.Key,destinationBucket:t.replicaBucket,destinationKey:o.Key});if(n.length>0)c(`Copied ${n.length} object(s) from ${t.primaryBucket} to ${t.replicaBucket}`);e[t.replicaBucket]=n.length}return e}async function Fp(a,c=l){for(let e of a){let t=new g(e.replicaRegion);if(!(await t.headBucket(e.replicaBucket)).exists)continue;await t.emptyBucket(e.replicaBucket),await t.deleteBucket(e.replicaBucket),c(`Deleted failover replica bucket ${e.replicaBucket}`)}}
+export{Lp,Mp,Up,Fp};

package/dist/bin/chunk-4dtrry0t.js

@@ -0,0 +1 @@
+import{W,So}from"./chunk-w8jfw39t.js";import"./chunk-gc8p1tdr.js";import"./chunk-dmwfnbg0.js";export{W as ACMClient,So as ACMDnsValidator};