@stacksjs/ts-cloud 0.16.37 → 0.16.39

package/dist/{chunk-50m6sq01.js → chunk-v83qx041.js}

@@ -1,8 +1,8 @@
-var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function Z(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function mi(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?js(n.path):".*";if(!mi(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${Z(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Z(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Z(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${Z(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${Z(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function js(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function Uc(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
+var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function Z(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function mi(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?js(n.path):".*";if(!mi(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${Z(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Z(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${Z(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${Z(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${Z(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function js(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function Hc(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
 `)}
 `,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${Z(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=js(a);if(!mi(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${Z(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${Z(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${Z(a.reason)}`),a.pathPattern){if(!mi(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${Z(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
 `)}
-`,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function fi(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=Uc(e,r);return`#!/usr/bin/env bash
+`,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function fi(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=Hc(e,r);return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs the zig-waf ruleset.
 set -euo pipefail
 
@@ -33,5 +33,5 @@ fi
 
 mv "${s}.new" "${s}"
 echo "ts-cloud: WAF config installed (mode: ${n.mode})"
-`}function qg(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
-export{Z,mi,js,Uc,fi,qg};
+`}function Kg(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
+export{Z,mi,js,Hc,fi,Kg};

package/dist/{chunk-svzmsd7g.js → chunk-xr7ew64s.js}

@@ -1,4 +1,4 @@
-import{kr,n}from"./chunk-5np6w0g7.js";import{he}from"./chunk-2bvmp0br.js";import*as d from"node:crypto";import{readFileSync as B}from"node:fs";import{readdir as L}from"node:fs/promises";import{join as z}from"node:path";function Nr(e){if(e){let r=D(e);if(!r)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return r}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return D(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function D(e){let{existsSync:t,readFileSync:s}=he("node:fs"),{homedir:r}=he("node:os"),{join:i}=he("node:path"),a=process.env.AWS_SHARED_CREDENTIALS_FILE||i(r(),".aws","credentials");if(!t(a))return null;let c=s(a,"utf-8"),g=null,u,l,p;for(let h of c.split(`
+import{kr,n}from"./chunk-dg834141.js";import{Xe}from"./chunk-3cyszqzh.js";import*as d from"node:crypto";import{readFileSync as B}from"node:fs";import{readdir as L}from"node:fs/promises";import{join as z}from"node:path";function Nr(e){if(e){let r=D(e);if(!r)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return r}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return D(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function D(e){let{existsSync:t,readFileSync:s}=Xe("node:fs"),{homedir:r}=Xe("node:os"),{join:i}=Xe("node:path"),a=process.env.AWS_SHARED_CREDENTIALS_FILE||i(r(),".aws","credentials");if(!t(a))return null;let c=s(a,"utf-8"),g=null,u,l,p;for(let h of c.split(`
 `)){let y=h.trim();if(!y||y.startsWith("#")||y.startsWith(";"))continue;let m=y.match(/^\[([^\]]+)\]$/);if(m){if(g===e&&u&&l)return{accessKeyId:u,secretAccessKey:l,sessionToken:p};g=m[1],u=void 0,l=void 0,p=void 0;continue}if(g===e){let[b,...S]=y.split("="),f=S.join("=").trim();switch(b.trim().toLowerCase()){case"aws_access_key_id":u=f;break;case"aws_secret_access_key":l=f;break;case"aws_session_token":p=f;break}}}if(g===e&&u&&l)return{accessKeyId:u,secretAccessKey:l,sessionToken:p};return null}function U(e){let{buffer:t,byteOffset:s,byteLength:r}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+r);let i=new ArrayBuffer(r);return new Uint8Array(i).set(new Uint8Array(e)),i}function j(e,t){let s=e?.[t]??e;if(s===null||typeof s!=="object"||Array.isArray(s))return s;let r={...s};return delete r["@_xmlns"],r}class o{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let r=typeof e==="string"?s:e,i=typeof e==="string"?e:e.region??"us-east-1",a=typeof e==="string"?t:e.profile,c=r?.endpoint?kr({region:i,path:"/",endpoint:r.endpoint}):void 0;this.region=i,this.explicitProfile=a,this.endpoint=c?.host,this.endpointProtocol=c?.protocol??"https",this.forcePathStyle=r?.forcePathStyle,this.explicitCredentials=r?.credentials,this.client=new n(r?.credentials,{profile:a,endpoint:r?.endpoint,forcePathStyle:r?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=Nr(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],r=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(r){let i=Array.isArray(r)?r:[r];for(let a of i)t.push({Name:a.Name,CreationDate:a.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let r;if(this.region!=="us-east-1"&&!this.endpoint)r=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LocationConstraint>${this.region}</LocationConstraint>

package/dist/{chunk-pfav9qnt.js → chunk-yrcv3hrj.js}

@@ -1,6 +1,6 @@
-var wd={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{...wd,...e.thresholds}}var _=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function qr(e){if(!_.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(qr))]}function y(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function Rd(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function Dd(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(Rd(e)))t.push(`${n} = ${s}`);return`${t.join(`
+var Dd={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function h(e){return{...Dd,...e.thresholds}}var _=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function qr(e){if(!_.test(e))return!1;let[t,n]=e.split("/");if(t.includes(":"))return n==null||Number(n)>=0&&Number(n)<=128;let s=t.split(".");if(s.length!==4||s.some((a)=>Number(a)>255||a===""))return!1;return n==null||Number(n)>=0&&Number(n)<=32}function f(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(qr))]}function y(e){let t=(e??[80,443]).filter((n)=>Number.isInteger(n)&&n>=1&&n<=65535);return[...new Set(t)].sort((n,s)=>n-s)}function Pd(e={}){let t=h(e);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,t.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function Nd(e={}){let t=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[n,s]of Object.entries(Pd(e)))t.push(`${n} = ${s}`);return`${t.join(`
 `)}
-`}function Pd(e={}){let t=h(e),n=y(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
+`}function kd(e={}){let t=h(e),n=y(e.ports),s=f(e.allowlist),a=f(e.blocklist),l=e.monitorOnly?"counter":"counter drop",i=e.originProtection?.enabled?f(e.originProtection.cdnRanges):[],c=s.filter((r)=>!r.includes(":")),p=s.filter((r)=>r.includes(":")),u=a.filter((r)=>!r.includes(":")),o=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${t.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${t.banSeconds}s; }`];if(c.length>0)o.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${c.join(", ")} } }`);if(p.length>0)o.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${p.join(", ")} } }`);if(u.length>0)o.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${u.join(", ")} } }`);if(i.length>0)o.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${i.filter((r)=>!r.includes(":")).join(", ")} } }`);if(o.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),c.length>0)o.push("    ip saddr @allow4 accept");if(p.length>0)o.push("    ip6 saddr @allow6 accept");if(u.length>0)o.push("    ip saddr @block4 counter drop");if(o.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),o.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${t.icmpPerSecond}/second burst ${t.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),n.length>0){let r=n.join(", ");if(o.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${r} } ct state new limit rate ${t.synPerSecond}/second burst ${t.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${r} } ct state new meter conn_rate4 { ip saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned4 { ip saddr } ${l}`,`    tcp dport { ${r} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${t.newConnectionsPerSecond}/second burst ${t.burst} packets } add @banned6 { ip6 saddr } ${l}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${r} } ct state new meter conn_count4 { ip saddr ct count over ${t.concurrentPerSource} } ${l}`,`    tcp dport { ${r} } ct state new meter conn_count6 { ip6 saddr ct count over ${t.concurrentPerSource} } ${l}`,""),i.length>0)o.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${r} } ip saddr != @cdn4 counter drop`,"")}return o.push("  }","}",""),o.join(`
 `)}function Oi(e={}){return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs L3/L4 flood mitigation.
 set -euo pipefail
@@ -13,11 +13,11 @@ fi
 
 install -d -m 0755 /etc/ts-cloud /etc/nftables.d
 cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
-${Dd(e)}SYSCTL_EOF
+${Nd(e)}SYSCTL_EOF
 sysctl --system >/dev/null
 
 cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
-${Pd(e)}NFT_EOF
+${kd(e)}NFT_EOF
 
 # Syntax-check before applying: a bad ruleset would leave the box unprotected.
 if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
@@ -40,5 +40,5 @@ include "/etc/nftables.d/ts-cloud-ddos.nft"
 fi
 systemctl enable nftables >/dev/null 2>&1 || true
 echo "ts-cloud: L3/L4 mitigation active"
-`}var b=["off","monitor","rate_limit","challenge","lockdown"];function $p(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function jr(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
-export{wd,qr,Rd,Dd,Pd,Oi,$p,jr};
+`}var b=["off","monitor","rate_limit","challenge","lockdown"];function Hp(e,t=[]){let n=[],s=Math.max(1,e.baselineRequestsPerSecond),a=e.requestsPerSecond/s,l=0,i=(g,v)=>{n.push(v),l=Math.max(l,b.indexOf(g))},c=a>=3;if(c)i("monitor",`Traffic is ${a.toFixed(1)}x the baseline.`);let p=e.topSourceShare>=0.25,u=e.errorRate>=0.25,o=(e.suspiciousAgentShare??0)>=0.5,r=e.uniqueSources>0&&e.requestsPerSecond/e.uniqueSources>=50;if(c&&p)i("rate_limit",`One source accounts for ${(e.topSourceShare*100).toFixed(0)}% of traffic.`);if(c&&r)i("rate_limit","Request rate per unique source is far above what a browser produces.");if(c&&u)i("challenge",`Error rate is ${(e.errorRate*100).toFixed(0)}% under load.`);if(c&&o)i("challenge","Most requests carry no recognisable browser agent.");if(a>=20&&(p||u||o||r))i("lockdown",`Traffic is ${a.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!c&&e.topSourceShare>=0.6&&e.requestsPerSecond>s)i("rate_limit","A single source dominates traffic without an overall surge.");let d=b[l],m={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[d];return{level:d,reasons:n,rateLimitFactor:m,challengeEnabled:d==="challenge"||d==="lockdown",staticOnly:d==="lockdown",banCandidates:d==="off"||d==="monitor"?[]:f(t)}}function jr(e,t){return Math.max(1,Math.floor(e*t.rateLimitFactor))}
+export{Dd,qr,Pd,Nd,kd,Oi,Hp,jr};

package/dist/{chunk-k92sywmh.js → chunk-zvyrpmvd.js}

@@ -1,2 +1,2 @@
-import{n}from"./chunk-5np6w0g7.js";import{f}from"./chunk-kzjvasjs.js";class h{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(void 0,{profile:t})}async createStack(e){let t={Action:"CreateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(e.parameters)e.parameters.forEach((a,r)=>{t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});if(e.timeoutInMinutes)t.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)t.OnFailure=e.onFailure;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.CreateStackResult?.StackId}}async updateStack(e){let t={Action:"UpdateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((a,r)=>{if(t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,a.UsePreviousValue)t[`Parameters.member.${r+1}.UsePreviousValue`]="true";else t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.UpdateStackResult?.StackId}}async deleteStack(e,t,s){let a={Action:"DeleteStack",StackName:e,Version:"2010-05-15"};if(t)a.RoleARN=t;if(s&&s.length>0)s.forEach((r,u)=>{a[`RetainResources.member.${u+1}`]=r});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(a).toString()})}async describeStacks(e={}){let t={Action:"DescribeStacks",Version:"2010-05-15"};if(e.stackName)t.StackName=e.stackName;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{Stacks:this.parseStacksResponse(s)}}async describeStackEvents(e){let t={Action:"DescribeStackEvents",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackEvents:this.parseStackEvents(s)}}async listStackResources(e){let t={Action:"ListStackResources",StackName:e,Version:"2010-05-15"},a=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,r=[];if(a)r=Array.isArray(a)?a:[a];return{StackResourceSummaries:r}}async waitForStack(e,t){let s={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},a=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],r=s[t],u=360,i=0;while(i<360)try{let c=await this.describeStacks({stackName:e});if(c.Stacks.length===0){if(t==="stack-delete-complete")return;if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack not visible yet`);await new Promise((m)=>setTimeout(m,2000)),i++;continue}let o=c.Stacks[0];if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Status = ${o.StackStatus}${o.StackStatusReason?` (${o.StackStatusReason})`:""}`);if(r.includes(o.StackStatus))return;if((t==="stack-create-complete"||t==="stack-update-complete")&&(o.StackStatus==="DELETE_IN_PROGRESS"||o.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let m="";try{let S=await this.describeStackEvents(e);console.log("[waitForStack] Stack events (most recent first):");for(let k of S.StackEvents.slice(0,15))if(k.ResourceStatus.includes("FAILED")||k.ResourceStatusReason){if(console.log(`  ${k.LogicalResourceId}: ${k.ResourceStatus} - ${k.ResourceStatusReason||"No reason provided"}`),k.ResourceStatus.includes("FAILED")&&k.ResourceStatusReason&&!m)m=k.ResourceStatusReason}}catch{}let l=m||o.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${l}`)}if(o.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let m=Error("Stack deletion failed - may have resources that need to be retained");throw m.code="DELETE_FAILED",m.stackStatus=o.StackStatus,m.statusReason=o.StackStatusReason,m}if(a.includes(o.StackStatus))throw Error(`Stack reached failure status: ${o.StackStatus}`);await new Promise((m)=>setTimeout(m,5000)),i++}catch(c){if(t==="stack-delete-complete"&&c.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&c.message?.includes("does not exist")){if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack does not exist (error), retrying...`);await new Promise((o)=>setTimeout(o,2000)),i++;continue}throw console.log(`[waitForStack] Unexpected error: ${c.message}`),c}throw console.log(`[waitForStack] Timeout after ${i} attempts`),Error(`Timeout waiting for stack to reach ${t}`)}async validateTemplate(e){let t={Action:"ValidateTemplate",TemplateBody:e,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async listStacks(e){let t={Action:"ListStacks",Version:"2010-05-15"};if(e)e.forEach((c,o)=>{t[`StackStatusFilter.member.${o+1}`]=c});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=s.ListStacksResponse||s,r=a.ListStacksResult||a,u=r.StackSummaries?.member||r.StackSummaries||[];return{StackSummaries:(Array.isArray(u)?u:u?[u]:[]).map((c)=>({StackId:c.StackId||"",StackName:c.StackName||"",TemplateDescription:c.TemplateDescription,CreationTime:c.CreationTime||"",LastUpdatedTime:c.LastUpdatedTime,DeletionTime:c.DeletionTime,StackStatus:c.StackStatus||""}))}}async createChangeSet(e){let t={Action:"CreateChangeSet",StackName:e.stackName,ChangeSetName:e.changeSetName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((r,u)=>{t[`Parameters.member.${u+1}.ParameterKey`]=r.ParameterKey,t[`Parameters.member.${u+1}.ParameterValue`]=r.ParameterValue});if(e.capabilities)e.capabilities.forEach((r,u)=>{t[`Capabilities.member.${u+1}`]=r});if(e.changeSetType)t.ChangeSetType=e.changeSetType;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=f(s,"CreateChangeSet");return{Id:a?.Id,StackId:a?.StackId}}async describeChangeSet(e,t){let s={Action:"DescribeChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async executeChangeSet(e,t){let s={Action:"ExecuteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async deleteChangeSet(e,t){let s={Action:"DeleteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async getStackOutputs(e){let t=await this.describeStacks({stackName:e});if(!t.Stacks||t.Stacks.length===0)throw Error(`Stack ${e} not found`);let s=t.Stacks[0],a={};if(s.Outputs)for(let r of s.Outputs)a[r.OutputKey]=r.OutputValue;return a}async getTemplate(e){let t={Action:"GetTemplate",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{TemplateBody:s?.GetTemplateResult?.TemplateBody||s?.TemplateBody||""}}parseStacksResponse(e){let t=[],s=e?.DescribeStacksResult?.Stacks?.member||e?.Stacks?.member||e?.Stacks||e;if(s&&!Array.isArray(s))s=[s];if(Array.isArray(s)){for(let a of s)if(a.StackId||a.StackName){let r;if(a.Outputs?.member)r=(Array.isArray(a.Outputs.member)?a.Outputs.member:[a.Outputs.member]).map((i)=>({OutputKey:i.OutputKey,OutputValue:i.OutputValue,Description:i.Description,ExportName:i.ExportName}));t.push({StackId:a.StackId,StackName:a.StackName,StackStatus:a.StackStatus,CreationTime:a.CreationTime,LastUpdatedTime:a.LastUpdatedTime,StackStatusReason:a.StackStatusReason,Outputs:r})}}else if(e.StackId)t.push({StackId:e.StackId,StackName:e.StackName,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime});return t}parseStackEvents(e){let t=[],s=e?.DescribeStackEventsResult?.StackEvents?.member||e?.StackEvents?.member||e?.StackEvents||[];if(s&&!Array.isArray(s))s=[s];for(let a of s)if(a.LogicalResourceId)t.push({Timestamp:a.Timestamp,ResourceType:a.ResourceType,LogicalResourceId:a.LogicalResourceId,ResourceStatus:a.ResourceStatus,ResourceStatusReason:a.ResourceStatusReason});return t}async waitForStackWithProgress(e,t,s){let a={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},r=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],u=a[t],i=360,c=0,o=new Set;while(c<360)try{if(s)try{let k=[...(await this.describeStackEvents(e)).StackEvents||[]].reverse();for(let d of k){let g=`${d.LogicalResourceId}-${d.ResourceStatus}-${d.Timestamp}`;if(!o.has(g))o.add(g),s({resourceId:d.LogicalResourceId,resourceType:d.ResourceType,status:d.ResourceStatus,reason:d.ResourceStatusReason,timestamp:d.Timestamp})}}catch{}let m=await this.describeStacks({stackName:e});if(m.Stacks.length===0){if(t==="stack-delete-complete")return;await new Promise((S)=>setTimeout(S,2000)),c++;continue}let l=m.Stacks[0];if(u.includes(l.StackStatus))return;if(l.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let S=Error("Stack deletion failed - may have resources that need to be retained");throw S.code="DELETE_FAILED",S.stackStatus=l.StackStatus,S.statusReason=l.StackStatusReason,S}if(r.includes(l.StackStatus))throw Error(`Stack reached failure status: ${l.StackStatus}`);await new Promise((S)=>setTimeout(S,3000)),c++}catch(m){if(t==="stack-delete-complete"&&m.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&m.message?.includes("does not exist")){await new Promise((l)=>setTimeout(l,2000)),c++;continue}throw m}throw Error(`Timeout waiting for stack to reach ${t}`)}async waitForStackComplete(e,t=120,s=5000){let a=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],r=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let u=0;u<t;u++)try{let i=await this.describeStacks({stackName:e});if(i.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let c=i.Stacks[0],o=c.StackStatus;if(a.includes(o))return{success:!0,status:o};if(r.includes(o))return{success:!1,status:o,reason:c.StackStatusReason};await new Promise((m)=>setTimeout(m,s))}catch(i){if(i.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw i}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}
+import{n}from"./chunk-dg834141.js";import{f}from"./chunk-bx3jmgd0.js";class h{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(void 0,{profile:t})}async createStack(e){let t={Action:"CreateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;else throw Error("Either templateBody or templateUrl must be provided");if(e.parameters)e.parameters.forEach((a,r)=>{t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});if(e.timeoutInMinutes)t.TimeoutInMinutes=e.timeoutInMinutes;if(e.onFailure)t.OnFailure=e.onFailure;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.CreateStackResult?.StackId}}async updateStack(e){let t={Action:"UpdateStack",StackName:e.stackName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((a,r)=>{if(t[`Parameters.member.${r+1}.ParameterKey`]=a.ParameterKey,a.UsePreviousValue)t[`Parameters.member.${r+1}.UsePreviousValue`]="true";else t[`Parameters.member.${r+1}.ParameterValue`]=a.ParameterValue});if(e.capabilities)e.capabilities.forEach((a,r)=>{t[`Capabilities.member.${r+1}`]=a});if(e.roleArn)t.RoleARN=e.roleArn;if(e.tags)e.tags.forEach((a,r)=>{t[`Tags.member.${r+1}.Key`]=a.Key,t[`Tags.member.${r+1}.Value`]=a.Value});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackId:s.StackId||s.UpdateStackResult?.StackId}}async deleteStack(e,t,s){let a={Action:"DeleteStack",StackName:e,Version:"2010-05-15"};if(t)a.RoleARN=t;if(s&&s.length>0)s.forEach((r,u)=>{a[`RetainResources.member.${u+1}`]=r});await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(a).toString()})}async describeStacks(e={}){let t={Action:"DescribeStacks",Version:"2010-05-15"};if(e.stackName)t.StackName=e.stackName;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{Stacks:this.parseStacksResponse(s)}}async describeStackEvents(e){let t={Action:"DescribeStackEvents",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{StackEvents:this.parseStackEvents(s)}}async listStackResources(e){let t={Action:"ListStackResources",StackName:e,Version:"2010-05-15"},a=(await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}))?.ListStackResourcesResult?.StackResourceSummaries?.member,r=[];if(a)r=Array.isArray(a)?a:[a];return{StackResourceSummaries:r}}async waitForStack(e,t){let s={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},a=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],r=s[t],u=360,i=0;while(i<360)try{let c=await this.describeStacks({stackName:e});if(c.Stacks.length===0){if(t==="stack-delete-complete")return;if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack not visible yet`);await new Promise((m)=>setTimeout(m,2000)),i++;continue}let o=c.Stacks[0];if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Status = ${o.StackStatus}${o.StackStatusReason?` (${o.StackStatusReason})`:""}`);if(r.includes(o.StackStatus))return;if((t==="stack-create-complete"||t==="stack-update-complete")&&(o.StackStatus==="DELETE_IN_PROGRESS"||o.StackStatus==="DELETE_COMPLETE")){console.log("[waitForStack] Stack is being deleted (creation/update failed)");let m="";try{let S=await this.describeStackEvents(e);console.log("[waitForStack] Stack events (most recent first):");for(let k of S.StackEvents.slice(0,15))if(k.ResourceStatus.includes("FAILED")||k.ResourceStatusReason){if(console.log(`  ${k.LogicalResourceId}: ${k.ResourceStatus} - ${k.ResourceStatusReason||"No reason provided"}`),k.ResourceStatus.includes("FAILED")&&k.ResourceStatusReason&&!m)m=k.ResourceStatusReason}}catch{}let l=m||o.StackStatusReason||"Check CloudFormation console for details.";throw Error(`Stack creation/update failed - stack is being deleted. Reason: ${l}`)}if(o.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let m=Error("Stack deletion failed - may have resources that need to be retained");throw m.code="DELETE_FAILED",m.stackStatus=o.StackStatus,m.statusReason=o.StackStatusReason,m}if(a.includes(o.StackStatus))throw Error(`Stack reached failure status: ${o.StackStatus}`);await new Promise((m)=>setTimeout(m,5000)),i++}catch(c){if(t==="stack-delete-complete"&&c.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&c.message?.includes("does not exist")){if(i%10===0)console.log(`[waitForStack] Attempt ${i}: Stack does not exist (error), retrying...`);await new Promise((o)=>setTimeout(o,2000)),i++;continue}throw console.log(`[waitForStack] Unexpected error: ${c.message}`),c}throw console.log(`[waitForStack] Timeout after ${i} attempts`),Error(`Timeout waiting for stack to reach ${t}`)}async validateTemplate(e){let t={Action:"ValidateTemplate",TemplateBody:e,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()})}async listStacks(e){let t={Action:"ListStacks",Version:"2010-05-15"};if(e)e.forEach((c,o)=>{t[`StackStatusFilter.member.${o+1}`]=c});let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=s.ListStacksResponse||s,r=a.ListStacksResult||a,u=r.StackSummaries?.member||r.StackSummaries||[];return{StackSummaries:(Array.isArray(u)?u:u?[u]:[]).map((c)=>({StackId:c.StackId||"",StackName:c.StackName||"",TemplateDescription:c.TemplateDescription,CreationTime:c.CreationTime||"",LastUpdatedTime:c.LastUpdatedTime,DeletionTime:c.DeletionTime,StackStatus:c.StackStatus||""}))}}async createChangeSet(e){let t={Action:"CreateChangeSet",StackName:e.stackName,ChangeSetName:e.changeSetName,Version:"2010-05-15"};if(e.templateBody)t.TemplateBody=e.templateBody;else if(e.templateUrl)t.TemplateURL=e.templateUrl;if(e.parameters)e.parameters.forEach((r,u)=>{t[`Parameters.member.${u+1}.ParameterKey`]=r.ParameterKey,t[`Parameters.member.${u+1}.ParameterValue`]=r.ParameterValue});if(e.capabilities)e.capabilities.forEach((r,u)=>{t[`Capabilities.member.${u+1}`]=r});if(e.changeSetType)t.ChangeSetType=e.changeSetType;let s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()}),a=f(s,"CreateChangeSet");return{Id:a?.Id,StackId:a?.StackId}}async describeChangeSet(e,t){let s={Action:"DescribeChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};return await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async executeChangeSet(e,t){let s={Action:"ExecuteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async deleteChangeSet(e,t){let s={Action:"DeleteChangeSet",StackName:e,ChangeSetName:t,Version:"2010-05-15"};await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(s).toString()})}async getStackOutputs(e){let t=await this.describeStacks({stackName:e});if(!t.Stacks||t.Stacks.length===0)throw Error(`Stack ${e} not found`);let s=t.Stacks[0],a={};if(s.Outputs)for(let r of s.Outputs)a[r.OutputKey]=r.OutputValue;return a}async getTemplate(e){let t={Action:"GetTemplate",StackName:e,Version:"2010-05-15"},s=await this.client.request({service:"cloudformation",region:this.region,method:"POST",path:"/",body:new URLSearchParams(t).toString()});return{TemplateBody:s?.GetTemplateResult?.TemplateBody||s?.TemplateBody||""}}parseStacksResponse(e){let t=[],s=e?.DescribeStacksResult?.Stacks?.member||e?.Stacks?.member||e?.Stacks||e;if(s&&!Array.isArray(s))s=[s];if(Array.isArray(s)){for(let a of s)if(a.StackId||a.StackName){let r;if(a.Outputs?.member)r=(Array.isArray(a.Outputs.member)?a.Outputs.member:[a.Outputs.member]).map((i)=>({OutputKey:i.OutputKey,OutputValue:i.OutputValue,Description:i.Description,ExportName:i.ExportName}));t.push({StackId:a.StackId,StackName:a.StackName,StackStatus:a.StackStatus,CreationTime:a.CreationTime,LastUpdatedTime:a.LastUpdatedTime,StackStatusReason:a.StackStatusReason,Outputs:r})}}else if(e.StackId)t.push({StackId:e.StackId,StackName:e.StackName,StackStatus:e.StackStatus,CreationTime:e.CreationTime,LastUpdatedTime:e.LastUpdatedTime});return t}parseStackEvents(e){let t=[],s=e?.DescribeStackEventsResult?.StackEvents?.member||e?.StackEvents?.member||e?.StackEvents||[];if(s&&!Array.isArray(s))s=[s];for(let a of s)if(a.LogicalResourceId)t.push({Timestamp:a.Timestamp,ResourceType:a.ResourceType,LogicalResourceId:a.LogicalResourceId,ResourceStatus:a.ResourceStatus,ResourceStatusReason:a.ResourceStatusReason});return t}async waitForStackWithProgress(e,t,s){let a={"stack-create-complete":["CREATE_COMPLETE"],"stack-update-complete":["UPDATE_COMPLETE"],"stack-delete-complete":["DELETE_COMPLETE"]},r=["CREATE_FAILED","ROLLBACK_FAILED","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE"],u=a[t],i=360,c=0,o=new Set;while(c<360)try{if(s)try{let k=[...(await this.describeStackEvents(e)).StackEvents||[]].reverse();for(let d of k){let g=`${d.LogicalResourceId}-${d.ResourceStatus}-${d.Timestamp}`;if(!o.has(g))o.add(g),s({resourceId:d.LogicalResourceId,resourceType:d.ResourceType,status:d.ResourceStatus,reason:d.ResourceStatusReason,timestamp:d.Timestamp})}}catch{}let m=await this.describeStacks({stackName:e});if(m.Stacks.length===0){if(t==="stack-delete-complete")return;await new Promise((S)=>setTimeout(S,2000)),c++;continue}let l=m.Stacks[0];if(u.includes(l.StackStatus))return;if(l.StackStatus==="DELETE_FAILED"&&t==="stack-delete-complete"){let S=Error("Stack deletion failed - may have resources that need to be retained");throw S.code="DELETE_FAILED",S.stackStatus=l.StackStatus,S.statusReason=l.StackStatusReason,S}if(r.includes(l.StackStatus))throw Error(`Stack reached failure status: ${l.StackStatus}`);await new Promise((S)=>setTimeout(S,3000)),c++}catch(m){if(t==="stack-delete-complete"&&m.message?.includes("does not exist"))return;if(t==="stack-create-complete"&&m.message?.includes("does not exist")){await new Promise((l)=>setTimeout(l,2000)),c++;continue}throw m}throw Error(`Timeout waiting for stack to reach ${t}`)}async waitForStackComplete(e,t=120,s=5000){let a=["CREATE_COMPLETE","UPDATE_COMPLETE","DELETE_COMPLETE"],r=["CREATE_FAILED","UPDATE_FAILED","DELETE_FAILED","ROLLBACK_COMPLETE","ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE","UPDATE_ROLLBACK_FAILED"];for(let u=0;u<t;u++)try{let i=await this.describeStacks({stackName:e});if(i.Stacks.length===0)return{success:!0,status:"DELETE_COMPLETE"};let c=i.Stacks[0],o=c.StackStatus;if(a.includes(o))return{success:!0,status:o};if(r.includes(o))return{success:!1,status:o,reason:c.StackStatusReason};await new Promise((m)=>setTimeout(m,s))}catch(i){if(i.message?.includes("does not exist"))return{success:!0,status:"DELETE_COMPLETE"};throw i}return{success:!1,status:"TIMEOUT",reason:"Timeout waiting for stack operation"}}}
 export{h};

package/dist/deploy/index.js

@@ -1 +1 @@
-import{mn,fn,wu,os,Ru,Du,Pu,Da,Nu,ku,Lf,Bu,C,xu,as,Oe,Ou,_u,gS,Lu,$u,Mu,Fu,Uu,$f,pS,mS,fS,Mf,Ff,hS,AS,Uf,Qf,yS,cs,sr,Pa,hn,An,or,rt,Pt,ds,Hf,yn,Qu,Hu,Na,us,In,gs,Va}from"../chunk-x7pnt65y.js";import{qa,bn,Cn,ps,ms,fs,hs,ja,za}from"../chunk-fsdd2cj8.js";import{Ka}from"../chunk-3bsf7585.js";import"../chunk-mbs6pr03.js";import"../chunk-0fhz75e0.js";import"../chunk-98xzqtnw.js";import"../chunk-aqxp4s43.js";import"../chunk-78r4k21k.js";import"../chunk-ybdxrf42.js";import"../chunk-n0vz557v.js";import{sg,uc,Ee,gc,Ln,og,pc,Lc,Gs,$c,Ut,gi,Vs}from"../chunk-a74kqzne.js";import"../chunk-azt6sm0r.js";import"../chunk-k92sywmh.js";import"../chunk-svzmsd7g.js";import"../chunk-5np6w0g7.js";import{pt,jh,Vc,yi,Si,Ii,up}from"../chunk-rkjnr9fp.js";import{_,Br,xr,qc,zs,u,zh,gp,pp,WS,JS}from"../chunk-t0azf37g.js";import"../chunk-mce0cpgf.js";import"../chunk-vmhfc7nk.js";import"../chunk-n3p8vr8s.js";export{jh as DEFAULT_SITE_PORT_RANGE,pt as HOST_SITES_DIR,gc as IPV6_EXCLUDED_HOST_LABELS,Lc as MANAGEMENT_DASHBOARD_SITE,mn as addSiteToCloudConfig,up as allocateSitePorts,yS as buildAndPushContainerImage,Ka as buildAndPushServerlessImage,sr as buildFunctionEnv,Si as buildHostSitePortsScript,Vs as buildManagementDashboardArtifact,Pt as buildServerTopology,ds as buildServerlessTopology,Hf as buildTopology,Na as collectEgressMetrics,sg as collectServerDnsDomains,Qf as createContainerImageDependencies,Mf as createExistingStaticFullStackDependencies,$f as createStaticApiOriginDependencies,In as dashboardActions,Gs as dashboardCredentialsFile,Ou as dashboardPageRoutes,Fu as deleteFailoverReplicaBuckets,ja as deleteStaticSite,hS as deployExistingStaticFullStack,Pa as deployServerlessApp,JS as deployShipsFiles,Uu as deploySite,pS as deployStaticApiOrigin,ms as deployStaticSite,za as deployStaticSiteFull,bn as deployStaticSiteWithExternalDns,Cn as deployStaticSiteWithExternalDnsFull,Qu as egressReportMetrics,C as ensureDashboardActor,Lu as ensureFailoverReplicaBuckets,gi as ensureManagementDashboard,AS as estimateExistingStaticFullStackMonthlyCost,fS as estimateStaticApiOriginMonthlyCost,Hu as fetchEgressReport,Ff as generateExistingStaticFullStackTemplate,qa as generateExternalDnsStaticSiteTemplate,ps as generateStaticSiteTemplate,$u as grantFailoverReplicaAccess,zh as hasComputeConfigured,qc as hasProxyUpstream,Uf as hashContainerContext,Ln as hostAcceptsIpv6,cs as infraEnvFromOutputs,xu as initializeDashboardControlPlane,hs as invalidateCache,Br as isPhpSite,Da as isValidHostname,Ee as normalizePublicIpv6,yi as occupiedHostPorts,Ii as parseHostSiteFragments,Vc as parseUpstreamPort,og as reconcileAddressRecords,hn as redeployServerlessApp,fn as removeSiteFromCloudConfig,uc as removeStaleServerAddressRecords,Nu as renderAliasesValue,Pu as renderEnvValue,ku as renderRedirectsValue,Lf as renderSiteSnippet,Ru as renderSslValue,Du as renderStringValue,gs as resolveDashboardAction,$c as resolveDashboardAuth,yn as resolveDashboardData,_u as resolveLegacyDashboardRoute,xr as resolveProxyUpstreams,zs as resolveSiteDeployTarget,u as resolveSiteKind,Ut as resolveUiSource,An as rollbackServerlessApp,gS as routesForDashboard,rt as runRemoteCommand,us as sanitizeCloudConfig,Mu as seedFailoverReplicas,Bu as setAttachToInCloudConfig,or as setMaintenance,os as setSitePropertyInCloudConfig,pp as shipsARelease,WS as shipsToBucket,_ as siteInstallBase,Va as startLocalDashboardServer,as as synchronizeDashboardUsers,Oe as trackDashboardOperation,wu as updateSiteInCloudConfig,fs as uploadStaticFiles,gp as validateDeploymentConfig,pc as verifyAddressRecord,mS as verifyStaticApiOrigin};
+import{mn,fn,Du,os,Pu,Nu,ku,Da,Bu,xu,Qf,Ou,C,_u,as,xe,Lu,$u,yS,Mu,Fu,Uu,Qu,Hu,Hf,SS,IS,bS,Gf,Vf,CS,ES,qf,jf,vS,cs,sr,Pa,hn,An,or,rt,Pt,ds,zf,yn,Gu,Vu,Na,us,In,gs,Va}from"../chunk-ffjgw5m6.js";import{qa,bn,Cn,ps,ms,fs,hs,ja,za}from"../chunk-nzmangkw.js";import{Ka}from"../chunk-gcqq9m4b.js";import"../chunk-0rvnerbw.js";import"../chunk-n8g8t8hf.js";import"../chunk-n1r9313b.js";import"../chunk-kyn6a4zf.js";import"../chunk-p4rknh9f.js";import"../chunk-5vk7nss8.js";import"../chunk-2n4ktft4.js";import{cg,pc,Ce,mc,Ln,dg,fc,Mc,Gs,Fc,Ut,gi,Vs}from"../chunk-q08s698e.js";import"../chunk-j1aq97br.js";import"../chunk-zvyrpmvd.js";import"../chunk-xr7ew64s.js";import"../chunk-dg834141.js";import{pt,Yh,jc,yi,Si,Ii,hp}from"../chunk-kpjhfgbh.js";import{_,Br,xr,zc,zs,u,Zh,Ap,yp,tI,rI}from"../chunk-ffba3270.js";import"../chunk-qhtgfjhd.js";import"../chunk-tbn385ak.js";import"../chunk-c45ay9fx.js";export{Yh as DEFAULT_SITE_PORT_RANGE,pt as HOST_SITES_DIR,mc as IPV6_EXCLUDED_HOST_LABELS,Mc as MANAGEMENT_DASHBOARD_SITE,mn as addSiteToCloudConfig,hp as allocateSitePorts,vS as buildAndPushContainerImage,Ka as buildAndPushServerlessImage,sr as buildFunctionEnv,Si as buildHostSitePortsScript,Vs as buildManagementDashboardArtifact,Pt as buildServerTopology,ds as buildServerlessTopology,zf as buildTopology,Na as collectEgressMetrics,cg as collectServerDnsDomains,jf as createContainerImageDependencies,Gf as createExistingStaticFullStackDependencies,Hf as createStaticApiOriginDependencies,In as dashboardActions,Gs as dashboardCredentialsFile,Lu as dashboardPageRoutes,Qu as deleteFailoverReplicaBuckets,ja as deleteStaticSite,CS as deployExistingStaticFullStack,Pa as deployServerlessApp,rI as deployShipsFiles,Hu as deploySite,SS as deployStaticApiOrigin,ms as deployStaticSite,za as deployStaticSiteFull,bn as deployStaticSiteWithExternalDns,Cn as deployStaticSiteWithExternalDnsFull,Gu as egressReportMetrics,C as ensureDashboardActor,Mu as ensureFailoverReplicaBuckets,gi as ensureManagementDashboard,ES as estimateExistingStaticFullStackMonthlyCost,bS as estimateStaticApiOriginMonthlyCost,Vu as fetchEgressReport,Vf as generateExistingStaticFullStackTemplate,qa as generateExternalDnsStaticSiteTemplate,ps as generateStaticSiteTemplate,Fu as grantFailoverReplicaAccess,Zh as hasComputeConfigured,zc as hasProxyUpstream,qf as hashContainerContext,Ln as hostAcceptsIpv6,cs as infraEnvFromOutputs,_u as initializeDashboardControlPlane,hs as invalidateCache,Br as isPhpSite,Da as isValidHostname,Ce as normalizePublicIpv6,yi as occupiedHostPorts,Ii as parseHostSiteFragments,jc as parseUpstreamPort,dg as reconcileAddressRecords,hn as redeployServerlessApp,fn as removeSiteFromCloudConfig,pc as removeStaleServerAddressRecords,Bu as renderAliasesValue,ku as renderEnvValue,xu as renderRedirectsValue,Qf as renderSiteSnippet,Pu as renderSslValue,Nu as renderStringValue,gs as resolveDashboardAction,Fc as resolveDashboardAuth,yn as resolveDashboardData,$u as resolveLegacyDashboardRoute,xr as resolveProxyUpstreams,zs as resolveSiteDeployTarget,u as resolveSiteKind,Ut as resolveUiSource,An as rollbackServerlessApp,yS as routesForDashboard,rt as runRemoteCommand,us as sanitizeCloudConfig,Uu as seedFailoverReplicas,Ou as setAttachToInCloudConfig,or as setMaintenance,os as setSitePropertyInCloudConfig,yp as shipsARelease,tI as shipsToBucket,_ as siteInstallBase,Va as startLocalDashboardServer,as as synchronizeDashboardUsers,xe as trackDashboardOperation,Du as updateSiteInCloudConfig,fs as uploadStaticFiles,Ap as validateDeploymentConfig,fc as verifyAddressRecord,IS as verifyStaticApiOrigin};

package/dist/dns/index.js

@@ -1 +1 @@
-import{at,de,Fe,Ce,_t,xn,vs,Ts,pr,mr,On,fr,ws,Rs,Ds,Ps,J,Ns,ks,Bs,xs,le,Os,_s,Ls,D,dc,_n,lc}from"../chunk-ybdxrf42.js";import"../chunk-n0vz557v.js";import"../chunk-5np6w0g7.js";export{Ce as CloudflareProvider,_n as DnsProviderFactory,Fe as GoDaddyProvider,at as PROXIABLE_RECORD_TYPES,de as PorkbunProvider,J as Route53Provider,le as UnifiedDnsValidator,Ds as applyDeclaredZoneSettings,Bs as applyZoneMigration,D as createDnsProvider,_s as createGoDaddyValidator,Os as createPorkbunValidator,Ls as createRoute53Validator,fr as delegateZone,ws as delegateZoneFromConfig,Rs as describeDelegation,Ps as describeZoneSettings,dc as detectDnsProvider,lc as dnsProviders,Ns as exportRoute53Zone,pr as isNameserverRegistrar,mr as isZoneHost,ks as planZoneMigration,_t as policyTag,xn as qualifyName,Ts as reconcileDeclaredRecords,vs as resolveDeclaredRecords,On as sameNameservers,xs as verifyZoneParity};
+import{at,de,Me,be,_t,xn,vs,Ts,pr,mr,On,fr,ws,Rs,Ds,Ps,J,Ns,ks,Bs,xs,le,Os,_s,Ls,D,uc,_n,gc}from"../chunk-5vk7nss8.js";import"../chunk-2n4ktft4.js";import"../chunk-dg834141.js";export{be as CloudflareProvider,_n as DnsProviderFactory,Me as GoDaddyProvider,at as PROXIABLE_RECORD_TYPES,de as PorkbunProvider,J as Route53Provider,le as UnifiedDnsValidator,Ds as applyDeclaredZoneSettings,Bs as applyZoneMigration,D as createDnsProvider,_s as createGoDaddyValidator,Os as createPorkbunValidator,Ls as createRoute53Validator,fr as delegateZone,ws as delegateZoneFromConfig,Rs as describeDelegation,Ps as describeZoneSettings,uc as detectDnsProvider,gc as dnsProviders,Ns as exportRoute53Zone,pr as isNameserverRegistrar,mr as isZoneHost,ks as planZoneMigration,_t as policyTag,xn as qualifyName,Ts as reconcileDeclaredRecords,vs as resolveDeclaredRecords,On as sameNameservers,xs as verifyZoneParity};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{$n,Lt,Ar,$t,Mn,Un,Qn,Hn,lg,mc,X,Ir,ih,Gn,fc,ve,Te,Ue,x,br,Vn,Cr,ge,hc,qn,Ac,jn,yc,Er,sh,oh,pg,mg,ah,ch,dh,vr,zn,fg,Fs,Kn,Wn,Jn,Xn,Yn,Sc,Ic,Tr,Cc,Qe,Y,Ec,ct,He,Ge,dt,we,Us,vc,hg,Ag,Tc,yg,lt,Zn,wc,Sg,Ig,Rc,wr,Re,Dc,bg,Cg,Qs,ei,ut,Eg,vg,Tg,wg,Rg,Dg,Pg,Ng,kg,ti,ri,ni,ii,si,oi,ai,Bg,xg,Rr,O,Hs,Og,_g,Lg,Pc,$g,Mg,lh,Nc,uh,gh,Fg,Ug,ph,mh,fh,kc,Qg,hh,Ah,yh,ci,di,li,ui,Bc,xc,Oc,_c,Sh,qs,Mc,pi,Fc,Hg,Gg,Vg,Ih}from"../chunk-a74kqzne.js";import"../chunk-azt6sm0r.js";import"../chunk-k92sywmh.js";import"../chunk-svzmsd7g.js";import"../chunk-5np6w0g7.js";import"../chunk-t0azf37g.js";import"../chunk-vmhfc7nk.js";import"../chunk-n3p8vr8s.js";export{_c as AwsBoxProvisioner,br as AwsDriver,Lg as BOOT_PARTITION_LABEL,Hs as CloudDriverFactory,mg as DEFAULT_HOST_CLEANUP_ESCALATED,ch as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,ah as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,pg as DEFAULT_HOST_CLEANUP_RETENTION,dh as DEFAULT_HOST_CLEANUP_SCHEDULE,Un as DEFAULT_RPX_CERTS_DIR,_g as FIRST_BOOT_SCRIPT_PATH,Er as HOST_ARTIFACT_CACHE_DIR,sh as HOST_CLEANUP_SCRIPT_PATH,oh as HOST_CLEANUP_UNIT,Oc as HetznerBoxProvisioner,Tr as HetznerClient,we as HetznerDriver,Ec as LEGACY_DRIVER_STATE_DIR,Us as LocalBoxDriver,Gg as MANAGED_CACHE_POLICY_DISABLED,Hg as MANAGED_CACHE_POLICY_OPTIMIZED,Vg as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Cg as RASPBERRY_PI_DEFAULT_SWAP_GB,yc as REMOTE_SCRIPT_RUNNER,Gn as RPX_DIR,fc as RPX_LAUNCHER_PATH,ve as RPX_SERVICE_NAME,Dc as SSH_BOOTSTRAP_MARKER_DIR,Re as SSH_BOOTSTRAP_VERSION,ut as SSH_DEFAULTS,ai as SSH_DEPLOY_STORAGE_PATH,hg as SSH_INSECURE_HOST_KEY_OPTS,Ag as SSH_KEEPALIVE_OPTS,ri as SSH_PREFLIGHT_SCRIPT,Bg as SSH_SKIP_BOOTSTRAP_ENV,Rr as SshDriver,wr as SystemSshTransport,Bc as UBUNTU_2404_AMI_PARAM,yh as acquireResizeLock,ph as applyHetznerHostOptimization,Qs as assertArchSupported,xg as assertSshComputeConfig,Sc as buildAwsArtifactFetch,xc as buildBoxUserData,Ih as buildCloudFrontOriginConfig,Pc as buildCloudInitFirstBoot,Ug as buildHetznerHostOptimizationScript,Kn as buildHostCleanupDeployScript,fg as buildHostCleanupExecutable,Fs as buildHostCleanupInstallScript,zn as buildHostCleanupScript,Ic as buildLocalArtifactFetch,X as buildRpxConfig,Ue as buildRpxFragmentRefreshScript,Ir as buildRpxLbConfig,Te as buildRpxProvisionScript,yg as buildScpArgsFor,Jn as buildSiteDeployScript,Vn as buildSshArgs,Tc as buildSshArgsFor,ei as buildSshBootstrapScript,Xn as buildStaticSiteDeployScript,Og as cloudDrivers,mh as collectHetznerHostOptimizationReport,Nc as collectHetznerResizeManifest,Sh as createBoxProvisioner,O as createCloudDriver,Mc as deployAllComputeSites,qs as deploySiteRelease,mc as deriveRouteId,$n as describeScriptSyntaxError,ct as driverStateDir,He as driverStatePath,di as ensureFirewall,li as ensureServer,ci as ensureSshKey,ii as evaluatePreflight,lh as executeHetznerServerResize,Ig as findKnownHostKey,oi as formatPreflightFindings,Lt as formatSshFailure,Hn as gatewayHostnames,x as generateUbuntuAppCloudInit,Qn as hasAutoWwwVariant,vc as isBoxMode,Mg as isHetznerCapacityError,Mn as isLocalDatabase,Sg as knownHostsLine,wc as knownHostsToken,lg as normalizeRoutePath,Qe as normalizeSshPublicKey,ni as parsePreflightFacts,$g as planHetznerServerResize,si as preflightFailed,uh as prepareHetznerResize,Ge as readDriverState,hh as readResizeCheckpoint,Yn as releaseTarballTmpPath,pi as reloadRpxGateway,jn as remoteScriptRunner,ih as renderRpxLauncher,Fc as renewRpxCertificates,kc as resizeCheckpointPath,Qg as resizeLockPath,Wn as resolveExecStart,Cc as resolveHetznerApiToken,Fg as resolveHetznerHostOptimizationPlan,vr as resolveHostCleanupConfig,Rg as resolveSshHostKeyPolicy,Eg as resolveSshHosts,kg as resolveSshLan,Tg as resolveSshPort,wg as resolveSshPrivateKeyPath,Pg as resolveSshProfile,Ng as resolveSshPublicIp,ti as resolveSshSettings,Dg as resolveSshSudo,vg as resolveSshUser,Zn as scanHostKey,hc as scpUpload,ui as serverPublicIpv4,bg as sshBootstrapMarkerPath,Cr as sshExec,ge as sshExecOrThrow,lt as sshHostKeyFingerprint,Rc as sshKnownHostsPath,$t as summarizeRemoteFailures,Ar as surfaceRemoteNotices,fh as verifyHetznerHostOptimization,gh as verifyHetznerResize,Ac as waitForCloudInit,qn as waitForSsh,Y as wrapCloudInitUserData,dt as writeDriverState,Ah as writeResizeCheckpoint};
+import{$n,Lt,Ar,$t,Mn,Un,Qn,Hn,pg,hc,X,Ir,lh,Gn,Ac,Ee,ve,Fe,x,br,Vn,Cr,ge,yc,qn,Sc,jn,Ic,Er,uh,gh,hg,Ag,ph,mh,fh,vr,zn,yg,Fs,Kn,Wn,Jn,Xn,Yn,bc,Cc,Tr,vc,Ue,Y,Tc,ct,Qe,He,dt,Te,Us,wc,Sg,Ig,Rc,bg,lt,Zn,Dc,Cg,Eg,Pc,wr,we,Nc,vg,Tg,Qs,ei,ut,wg,Rg,Dg,Pg,Ng,kg,Bg,xg,Og,ti,ri,ni,ii,si,oi,ai,_g,Lg,Rr,O,Hs,$g,Mg,Fg,kc,Ug,Qg,hh,Bc,Ah,yh,Hg,Gg,Sh,Ih,bh,xc,Vg,Ch,Eh,vh,ci,di,li,ui,Oc,_c,Lc,$c,Th,qs,Uc,pi,Qc,qg,jg,zg,wh}from"../chunk-q08s698e.js";import"../chunk-j1aq97br.js";import"../chunk-zvyrpmvd.js";import"../chunk-xr7ew64s.js";import"../chunk-dg834141.js";import"../chunk-ffba3270.js";import"../chunk-tbn385ak.js";import"../chunk-c45ay9fx.js";export{$c as AwsBoxProvisioner,br as AwsDriver,Fg as BOOT_PARTITION_LABEL,Hs as CloudDriverFactory,Ag as DEFAULT_HOST_CLEANUP_ESCALATED,mh as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,ph as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,hg as DEFAULT_HOST_CLEANUP_RETENTION,fh as DEFAULT_HOST_CLEANUP_SCHEDULE,Un as DEFAULT_RPX_CERTS_DIR,Mg as FIRST_BOOT_SCRIPT_PATH,Er as HOST_ARTIFACT_CACHE_DIR,uh as HOST_CLEANUP_SCRIPT_PATH,gh as HOST_CLEANUP_UNIT,Lc as HetznerBoxProvisioner,Tr as HetznerClient,Te as HetznerDriver,Tc as LEGACY_DRIVER_STATE_DIR,Us as LocalBoxDriver,jg as MANAGED_CACHE_POLICY_DISABLED,qg as MANAGED_CACHE_POLICY_OPTIMIZED,zg as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Tg as RASPBERRY_PI_DEFAULT_SWAP_GB,Ic as REMOTE_SCRIPT_RUNNER,Gn as RPX_DIR,Ac as RPX_LAUNCHER_PATH,Ee as RPX_SERVICE_NAME,Nc as SSH_BOOTSTRAP_MARKER_DIR,we as SSH_BOOTSTRAP_VERSION,ut as SSH_DEFAULTS,ai as SSH_DEPLOY_STORAGE_PATH,Sg as SSH_INSECURE_HOST_KEY_OPTS,Ig as SSH_KEEPALIVE_OPTS,ri as SSH_PREFLIGHT_SCRIPT,_g as SSH_SKIP_BOOTSTRAP_ENV,Rr as SshDriver,wr as SystemSshTransport,Oc as UBUNTU_2404_AMI_PARAM,vh as acquireResizeLock,Sh as applyHetznerHostOptimization,Qs as assertArchSupported,Lg as assertSshComputeConfig,bc as buildAwsArtifactFetch,_c as buildBoxUserData,wh as buildCloudFrontOriginConfig,kc as buildCloudInitFirstBoot,Gg as buildHetznerHostOptimizationScript,Kn as buildHostCleanupDeployScript,yg as buildHostCleanupExecutable,Fs as buildHostCleanupInstallScript,zn as buildHostCleanupScript,Cc as buildLocalArtifactFetch,X as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Ir as buildRpxLbConfig,ve as buildRpxProvisionScript,bg as buildScpArgsFor,Jn as buildSiteDeployScript,Vn as buildSshArgs,Rc as buildSshArgsFor,ei as buildSshBootstrapScript,Xn as buildStaticSiteDeployScript,$g as cloudDrivers,Ih as collectHetznerHostOptimizationReport,Bc as collectHetznerResizeManifest,Th as createBoxProvisioner,O as createCloudDriver,Uc as deployAllComputeSites,qs as deploySiteRelease,hc as deriveRouteId,$n as describeScriptSyntaxError,ct as driverStateDir,Qe as driverStatePath,di as ensureFirewall,li as ensureServer,ci as ensureSshKey,ii as evaluatePreflight,hh as executeHetznerServerResize,Eg as findKnownHostKey,oi as formatPreflightFindings,Lt as formatSshFailure,Hn as gatewayHostnames,x as generateUbuntuAppCloudInit,Qn as hasAutoWwwVariant,wc as isBoxMode,Qg as isHetznerCapacityError,Mn as isLocalDatabase,Cg as knownHostsLine,Dc as knownHostsToken,pg as normalizeRoutePath,Ue as normalizeSshPublicKey,ni as parsePreflightFacts,Ug as planHetznerServerResize,si as preflightFailed,Ah as prepareHetznerResize,He as readDriverState,Ch as readResizeCheckpoint,Yn as releaseTarballTmpPath,pi as reloadRpxGateway,jn as remoteScriptRunner,lh as renderRpxLauncher,Qc as renewRpxCertificates,xc as resizeCheckpointPath,Vg as resizeLockPath,Wn as resolveExecStart,vc as resolveHetznerApiToken,Hg as resolveHetznerHostOptimizationPlan,vr as resolveHostCleanupConfig,Ng as resolveSshHostKeyPolicy,wg as resolveSshHosts,Og as resolveSshLan,Dg as resolveSshPort,Pg as resolveSshPrivateKeyPath,Bg as resolveSshProfile,xg as resolveSshPublicIp,ti as resolveSshSettings,kg as resolveSshSudo,Rg as resolveSshUser,Zn as scanHostKey,yc as scpUpload,ui as serverPublicIpv4,vg as sshBootstrapMarkerPath,Cr as sshExec,ge as sshExecOrThrow,lt as sshHostKeyFingerprint,Pc as sshKnownHostsPath,$t as summarizeRemoteFailures,Ar as surfaceRemoteNotices,bh as verifyHetznerHostOptimization,yh as verifyHetznerResize,Sc as waitForCloudInit,qn as waitForSsh,Y as wrapCloudInitUserData,dt as writeDriverState,Eh as writeResizeCheckpoint};