@stacksjs/ts-cloud 0.16.39 → 0.16.41

package/dist/index.js

@@ -1,17 +1,17 @@
-import{aI,cI,Bd,Gp,xd,Od,zr,L,d,_d,Vp,U,Ld,g,DA,_i,$d,Md,me,Fd,PA,r,t,dI,lI,p,uI,gI,pI,mI,fI,Kt,Ud,Li,NA,hI,yI,De,je,Qd,qp,jp,SI,zp,Kp,Wp,So,Hd,te,Kr,yt,Io,St,fe,kA,Gd,bo,Jp,Xp,Yp,Zp,Vd,II,Q,b,BA,xA,em,a,y,ze,m,tm,Ke,H,It,bI,rm,G,qd,Pe,Wt,Co,re,jd,ne,OA,Eo,V,q,k,$i,T,Jt,bt,j,e,Wr,CI,nm,zd,EI,vI,TI,wI,Kd,RI,DI,PI,NI,kI,BI,xI,OI,_I,LI,$I,MI,_A,LA,$A,MA,FA,UA,QA,Xt,im,sm,Jr,Mi,FI,om,UI,QI,Xr,HI,GI,VI,qI,jI,zI,HA,GA,VA,qA,jA,Fi,KI,vo,zA,am,M,KA,We,To,Ct,WA,cm,JA,XA,YA,dm,F,WI,JI,XI,YI,ZA,ZI,z,eb,tb,rb,Wd,Jd,ey,lm,um,nb,ib,sb,ob,ab,ty,Xd,cb,db,lb,ub,gb,ry,ny,pb,mb,fb,hb,Ab,yb,Sb,iy,Ib,gm,Yd,bb,Cb,Eb,vb,pm,mm,fm,Tb,Zd,sy,oy,ay,cy,el,dy,wb,Rb,Db,Pb,Nb,kb,Bb,ly,uy,gy,py,hm,xb,Ob,_b,Lb,$b,Mb,Fb,Ub,Qb,my,fy,hy,Ay,Hb,Gb,Am,Vb,ym,Sm,Im,bm,qb,jb,zb,Kb,Ne,Ui,Wb,Jb,Xb,Yb,Zb,eC,tC,rC,yy,nC,iC,Cm,Em,sC,oC,Sy,aC,cC,dC,lC,uC,gC,pC,mC,fC,hC,AC,yC,SC,IC,bC,CC,EC,vC,TC,wC,RC,tl,Iy,rl,by,nl,Cy,il,Ey,sl,vy,Yt,Ty,ol,wy,Qi,Ry,al,Dy,cl,Py,vm,DC,Tm,PC,dl,Ny,Zt,ky,wm,NC,ll,By,Rm,kC,Dm,BC,Pm,xC,ul,xy,Nm,OC,km,_C,Bm,LC,xm,$C,gl,Oy,pl,_y,Om,MC,_m,FC,Lm,UC,$m,QC,Mm,HC,Fm,GC,ml,Ly,Um,VC,Qm,qC,Hm,jC,Gm,zC,Vm,KC,qm,WC,jm,zm,Km,Wm,Jm,JC,Xm,XC,Ym,YC,Zm,ZC,Je,ef,$y,wo,fl,Yr,My,Hi,er,hl,Al,Fy,Uy,yl,tf,Sl,rf,eE,tE,Ro,Do,Po,Il,Zr,bl,Cl,Gi,No,ko,nf,Qy,Hy,Gy,rE,sf,of,nE,Vy,af,qy,jy,zy,iE,cf,en,El,df,sE,Ky,Bo,xo,vl,lf,oE,Tl,Wy,uf,aE,gf,cE,pf,dE}from"./chunk-tbn385ak.js";import{wl,R,Rl,Oo,Jy,mf,Xy,Yy,Zy,eS,tS,rS,nS,iS}from"./chunk-c45ay9fx.js";import{Uo,ff,Ol,cS,zi,_l,Qo,hf,Af,rn,Ho,Ll,Ye,$l,Ml,Fl,Ki,nn,yf,Ze,Ul,Go,Vo,qo,Ql,Hl,Gl,Wi,jo,Vl,sn,Ji,zo,Et,Sf,ql,jl,If,zl,Ko,tr,Kl,Wl,Jl,Xl,et,bf,Yl,rr,Wo,Jo,Xo,Xi,Yi,on,Zl,Zi,Yo,Zo,an,eu,cn,Cf,Ef,vt,dn,ea,vf,tu,ru,ta,nu,iu,su,dS,ie,ou,lS,uS,es,ts,gS,he,Tf,Tt,ke,Be,wt,au,cu,du,lu,wf,Rf,ra,Df,Pf,na,uu,gu,Nf,se,kf,pu,Ae,ia,tt,Rt,Dt,ln,rs,mu,pS,sa,Bf,xf,Of,_f,oa,aa,fu,un,ca,hu,ns,Au,da,la,ua,ga,pa,ma,fa,ha,yu,nr,Aa,Su,gn,Iu,ya,Sa,bu,ir,Ia,ba,Lf,mS,is,fS,hS,AS,Ca,Ea,Cu,$f,va,pn,Eu,ss,vu,Tu,wu,Ta,Mf,wa,Ru,Ff,Ra,Uf,mn,fn,Du,os,Ou,Mu,Fu,Uu,Qu,Hu,cs,sr,Pa,hn,An,or,rt,Kf,ka,Wf,Jf,qu,Ba,ls,ju,xa,Nt,Oe,zu,Oa,_a,Ku,La,$a,Ma,Fa,Wu,Ju,Sn,Ua,Qa,Ha,Ga,Xu,us,In,gs,Va}from"./chunk-ffjgw5m6.js";import{_,xr,zc,zs,u,Ap,yp}from"./chunk-ffba3270.js";import{pt,jc,yi,Si,Ii,hp}from"./chunk-kpjhfgbh.js";import{Dh,Ph,Nh,Xg,Yg,Zg,kh,ep,tp,Bh,xh,rp,Oh,_h,Vc,np,Lh,$h,ip,Mh,Fh,Uh,Qh,Hh,Gh,Vh,Ai,qc,sp,op,ap,cp,dp,lp,up,gp,pp,mp,fp,qh,jh,zh,Kh,Wh,Jh,Xh}from"./chunk-jsnhb1p4.js";import{Ge,Kc,pe,Qt,Wc,P,Ht,mt,Jc,Ks,eA,Sp,Xc,s,bi,Ws,Or,Yc,Zc,_r,tA,ed,nI,iI,Js,sI,oI,td,rd,Ci,Xs,ee,c,Ys,Ve,Lr,rA,nA,nd,Gt,iA,Zs,sA,oA,eo,id,$r,to,aA,sd,Ip,Vt,Mr,cA,ro,dA,N,lA,od,bp,no,uA,gA,pA,ad,Ei,io,cd,qt,ft,mA,Fr,fA,dd,Cp,Ep,so,ld,ud,ht,vp,vi,gd,oo,Ur,Tp,Ti,pd,md,wi,wp,fd,hd,Ad,yd,ao,Rp,Dp,hA,Pp,Sd,Ri,Np,kp,co,Qr,lo,uo,go,Id,Bp,bd,po,AA,jt,yA,Cd,Hr,Ed,SA,vd,xp,Di,Gr,mo,Pi,qe,IA,Op,_p,zt,Td,wd,Rd,Ni,ki,Bi,bA,CA,At,fo,EA,Vr,Lp,ho,vA,$p,Mp,Fp,TA,Up,Qp,wA,i,RA,xi,Ao,yo}from"./chunk-qhtgfjhd.js";import{n}from"./chunk-dg834141.js";import{Ie,ot,kn}from"./chunk-n8g8t8hf.js";import{o}from"./chunk-xr7ew64s.js";import{ye,Ss,Is,eg,Wa,Ja,bs,Xa,nt,K,it,oe,E,Se,vn,Ya,_e,Za,Tn,wn,Rn,kt,Bt,xt,Dn,cr,rc,dr,lr,st,Pn,ic,Ot,ur,Nn,oc,sg,og,ac,gr}from"./chunk-0rvnerbw.js";import{at,de,Me,ag,Bn,dc,lc,Es,be,_t,xn,vs,Ts,pr,mr,On,fr,ws,Rs,Ds,Ps,J,Ns,ks,Bs,xs,le,Os,_s,Ls,D,uc,_n,gc,ue,hr}from"./chunk-5vk7nss8.js";import{W}from"./chunk-p4rknh9f.js";import{cg,pc,Ce,mc,Ln,dg,fc,lg,ug,dh,Mn,Ms,Un,Qn,Hn,X,Fe,x,br,Vn,Cr,ge,yc,qn,Sc,vr,zn,Fs,Kn,Wn,Jn,Xn,Tr,vc,Ue,Y,Qe,He,dt,Te,wr,we,ei,ti,ri,ni,ii,si,oi,Rr,O,Hs,$g,kc,ci,di,li,ui,Mc,Gs,Fc,Ut,gi,Vs,qs,Uc,pi,Qc}from"./chunk-q08s698e.js";import{Dl,_o,Vi,qi,Lo,Pl,Nl,ji,$o,Mo,Bl,xl,Fo}from"./chunk-kkeb1dk1.js";import{qa,bn,Cn,ps,ms,fs,hs,ja,za}from"./chunk-nzmangkw.js";import{Ka}from"./chunk-gcqq9m4b.js";import{cc,Le,S}from"./chunk-n1r9313b.js";import{$e}from"./chunk-kyn6a4zf.js";import{I}from"./chunk-2n4ktft4.js";import{Z,mi,js,Hc,fi,Kg}from"./chunk-v83qx041.js";import{Pr,Re}from"./chunk-j1aq97br.js";import{h}from"./chunk-zvyrpmvd.js";import{Dd,qr,Pd,Nd,kd,Oi,Hp,jr}from"./chunk-yrcv3hrj.js";import{sS,Xe}from"./chunk-3cyszqzh.js";import{createHmac as nc,createSign as Nc,timingSafeEqual as xc}from"node:crypto";function jn(l){let f=l instanceof Date?l.getTime():l;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function sc(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Lc(l){return Buffer.from(l).toString("base64url")}function hc(l,f=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let C=f?l.replaceAll("*","wildcard"):l,A=new URL(C);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Cc(l,f){let C=Nc("RSA-SHA1");return C.update(l),C.end(),sc(C.sign(f))}function Ac(l){hc(l.resource,!0);let C={DateLessThan:{"AWS:EpochTime":jn(l.expiresAt)}};if(l.activeAt!==void 0)C.DateGreaterThan={"AWS:EpochTime":jn(l.activeAt)};if(l.ipAddress)C.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:C}]})}function ig(l,f,C){hc(l);let A=jn(f),w=l.includes("?")?"&":"?",ve=Ac({resource:l,expiresAt:f}),ae=Cc(ve,C.privateKey);return`${l}${w}Expires=${A}&Signature=${encodeURIComponent(ae)}&Key-Pair-Id=${encodeURIComponent(C.keyPairId)}`}function ng(l,f){let C=Ac(l);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":sc(Buffer.from(C)),"CloudFront-Signature":Cc(C,f.privateKey)}}function pg(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let f=Lc(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:jn(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),C=nc("sha256",l.secret).update(f).digest("base64url");return`${f}.${C}`}function mg(l,f){let[C,A,w]=l.split(".");if(!C||!A||w)return null;let ve=nc("sha256",f.secret).update(C).digest(),ae;try{ae=Buffer.from(A,"base64url")}catch{return null}if(ve.length!==ae.length||!xc(ve,ae))return null;try{let ce=JSON.parse(Buffer.from(C,"base64url").toString("utf8")),Ee=jn(f.now??Date.now());if(!ce.resource||!Number.isSafeInteger(ce.expiresAt)||ce.expiresAt<=Ee)return null;if(f.resource&&ce.resource!==f.resource)return null;if(f.audience&&ce.audience!==f.audience)return null;return ce}catch{return null}}function fg(l,f=!1){let C=new URL(l,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(C),w=/\.(?:key|license)$/.test(C)||C.includes("/keys/")||C.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||w)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function gg(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let f=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",C=l.protected??!1,A="public, max-age=31536000, immutable",w=C?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:f,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.mpd",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.vtt",cacheControl:w,compress:!0,signed:C},{pathPattern:"*",cacheControl:A,compress:!1,signed:C}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Bc{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Fd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let f=this.config.features||{};if(!l.requiresFeatures.every((A)=>f[A]===!0))return!1}if(l.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(f))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(l||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,f){return l==="public"||f.routeCompute===!0}storageBucketName(l,f,C){return this.mergedConfig.infrastructure?.storage?.[C]?.bucket??`${l}-${f}-${C}`}fileSystemLogicalId(l,f,C){return t(r({slug:`${l}-${C}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(l,f,C){let A=l.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,C,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,C,A.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,f){return{PathPattern:l,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,f,C,A,w,ve){let ae=this.serverEipLogicalIds.get("app"),ce=this.serverEipLogicalIds.get("appInstance");if(!ae)return;let Ee=`EC2-${A}-${w}-api`,ut=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",xe=ut==="us-east-1"?".compute-1.amazonaws.com":`.${ut}.compute.amazonaws.com`,Mt={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:ae}]}]},xe]]},ar=this.resolveApiOriginPort();if(l.push({Id:Ee,DomainName:Mt,CustomOriginConfig:{HTTPPort:ar,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),C.push(ae),ce)C.push(ce);for(let Sr of ve)f.push(this.createComputeCacheBehavior(Sr,Ee))}buildCaddyfile(l){let f=l.filter(([,w])=>typeof w.domain==="string"&&w.domain&&typeof w.port==="number");if(f.length===0)return;let C=new Map;for(let[,w]of f){let ve=C.get(w.domain)??[];ve.push({port:w.port,path:w.path}),C.set(w.domain,ve)}let A=[];for(let[w,ve]of C){let ce=[...ve].sort((Ee,ut)=>{let xe=!Ee.path||Ee.path==="/",Mt=!ut.path||ut.path==="/";if(xe&&!Mt)return 1;if(!xe&&Mt)return-1;return(ut.path?.length??0)-(Ee.path?.length??0)}).map((Ee)=>{let ut=!Ee.path||Ee.path==="/",xe=`reverse_proxy localhost:${Ee.port}`;return ut?`  handle {
+import{dI,lI,Od,qp,_d,Ld,Jr,L,d,$d,jp,U,Md,g,NA,Mi,Fd,Ud,fe,Qd,kA,r,t,uI,gI,p,pI,mI,fI,hI,yI,Xt,Hd,Fi,BA,SI,II,De,je,Gd,zp,Kp,bI,Wp,Jp,Xp,bo,Vd,re,Xr,yt,Co,St,he,xA,qd,Eo,Yp,Zp,em,tm,jd,CI,Q,b,OA,_A,rm,a,y,ze,m,nm,Ke,H,It,EI,im,G,zd,Pe,Yt,vo,ne,Kd,ie,LA,To,V,q,k,Ui,T,Zt,bt,j,e,Yr,vI,sm,Wd,TI,wI,RI,DI,Jd,PI,NI,kI,BI,xI,OI,_I,LI,$I,MI,FI,UI,$A,MA,FA,UA,QA,HA,GA,er,om,am,Zr,Qi,QI,cm,HI,GI,en,VI,qI,jI,zI,KI,WI,VA,qA,jA,zA,KA,Hi,JI,wo,WA,dm,M,JA,We,Ro,Ct,XA,lm,YA,ZA,ey,um,F,XI,YI,ZI,eb,ty,tb,z,rb,nb,ib,Xd,Yd,ry,gm,pm,sb,ob,ab,cb,db,ny,Zd,lb,ub,gb,pb,mb,iy,sy,fb,hb,Ab,yb,Sb,Ib,bb,oy,Cb,mm,el,Eb,vb,Tb,wb,fm,hm,Am,Rb,tl,ay,cy,dy,ly,rl,uy,Db,Pb,Nb,kb,Bb,xb,Ob,gy,py,my,fy,ym,_b,Lb,$b,Mb,Fb,Ub,Qb,Hb,Gb,hy,Ay,yy,Sy,Vb,qb,Sm,jb,Im,bm,Cm,Em,zb,Kb,Wb,Jb,Ne,Gi,Xb,Yb,Zb,eC,tC,rC,nC,iC,Iy,sC,oC,vm,Tm,aC,cC,by,dC,lC,uC,gC,pC,mC,fC,hC,AC,yC,SC,IC,bC,CC,EC,vC,TC,wC,RC,DC,PC,nl,Cy,il,Ey,sl,vy,ol,Ty,al,wy,tr,Ry,cl,Dy,Vi,Py,dl,Ny,ll,ky,wm,NC,Rm,kC,ul,By,rr,xy,Dm,BC,gl,Oy,Pm,xC,Nm,OC,km,_C,pl,_y,Bm,LC,xm,$C,Om,MC,_m,FC,ml,Ly,fl,$y,Lm,UC,$m,QC,Mm,HC,Fm,GC,Um,VC,Qm,qC,hl,My,Hm,jC,Gm,zC,Vm,KC,qm,WC,jm,JC,zm,XC,Km,Wm,Jm,Xm,Ym,YC,Zm,ZC,ef,eE,tf,tE,Je,rf,Fy,Do,Al,tn,Uy,qi,nr,yl,Sl,Qy,Hy,Il,nf,bl,sf,rE,nE,Po,No,ko,Cl,rn,El,vl,ji,Bo,xo,of,Gy,Vy,qy,iE,af,cf,sE,jy,df,zy,Ky,Wy,oE,lf,nn,Tl,uf,aE,Jy,Oo,_o,wl,gf,cE,Rl,Xy,pf,dE,mf,lE,ff,uE}from"./chunk-5n1y5ehd.js";import{Dl,R,Pl,Lo,Yy,hf,Zy,eS,tS,rS,nS,iS,sS,oS}from"./chunk-my61jkg1.js";import{Ho,Af,Ll,lS,Ji,$l,Go,yf,Sf,on,Vo,Ml,Ye,Fl,Ul,Ql,Xi,an,If,Ze,Hl,qo,jo,zo,Gl,Vl,ql,Yi,Ko,jl,cn,Zi,Wo,Et,bf,zl,Kl,Cf,Wl,Jo,ir,Jl,Xl,Yl,Zl,et,Ef,eu,sr,Xo,Yo,Zo,es,ts,dn,tu,rs,ea,ta,ln,ru,un,vf,Tf,vt,gn,ra,wf,nu,iu,na,su,ou,au,uS,se,cu,gS,pS,ns,is,mS,Ae,Rf,Tt,ke,Be,wt,du,lu,uu,gu,Df,Pf,ia,Nf,kf,sa,pu,mu,Bf,oe,xf,fu,ye,oa,tt,Rt,Dt,pn,ss,hu,fS,aa,Of,_f,Lf,$f,ca,da,Au,mn,la,yu,os,Su,ua,ga,pa,ma,fa,ha,Aa,ya,Iu,or,Sa,bu,fn,Cu,Ia,ba,Eu,ar,Ca,Ea,Mf,hS,as,AS,yS,SS,va,Ta,vu,Ff,wa,hn,Tu,cs,wu,Ru,Du,Ra,Uf,Da,Pu,Qf,Pa,Hf,An,yn,Nu,ds,Lu,Uu,Qu,Hu,Gu,Vu,us,cr,ka,Sn,In,dr,rt,Jf,xa,Xf,Yf,zu,Oa,ps,Ku,_a,Nt,Oe,Wu,La,$a,Ju,Ma,Fa,Ua,Qa,Xu,Yu,Cn,Ha,Ga,Va,qa,Zu,ms,En,fs,ja}from"./chunk-ckqjqw4w.js";import{_,Lr,Wc,Ws,u,Sp,Ip}from"./chunk-jbtnyhrh.js";import{pt,Kc,bi,Ci,Ei,yp}from"./chunk-bfbahave.js";import{Nh,kh,Bh,Zg,ep,tp,xh,rp,np,Oh,_h,ip,Lh,$h,jc,sp,Mh,Fh,op,Uh,Qh,Hh,Gh,Vh,qh,jh,Ii,zc,ap,cp,dp,lp,up,gp,pp,mp,fp,hp,Ap,zh,Kh,Wh,Jh,Xh,Yh,Zh}from"./chunk-qg03hfb6.js";import{Ge,Jc,me,Vt,Xc,P,qt,mt,Yc,Js,rA,bp,Zc,s,vi,Xs,$r,ed,td,Mr,nA,rd,sI,oI,Ys,aI,cI,nd,id,Ti,Zs,te,c,eo,Ve,Fr,iA,sA,sd,jt,oA,to,aA,cA,ro,od,Ur,no,dA,ad,Cp,zt,Qr,lA,io,uA,N,gA,cd,Ep,so,pA,mA,fA,dd,wi,oo,ld,Kt,ft,hA,Hr,AA,ud,vp,Tp,ao,gd,pd,ht,wp,Ri,md,co,Gr,Rp,Di,fd,hd,Pi,Dp,Ad,yd,Sd,Id,lo,Pp,Np,yA,kp,bd,Ni,Bp,xp,uo,Vr,go,po,mo,Cd,Op,Ed,fo,SA,Wt,IA,vd,qr,Td,bA,wd,_p,ki,jr,ho,Bi,qe,CA,Lp,$p,Jt,Rd,Dd,Pd,xi,Oi,_i,EA,vA,At,Ao,TA,zr,Mp,yo,wA,Fp,Up,Qp,RA,Hp,Gp,DA,i,PA,Li,So,Io}from"./chunk-yt6m703r.js";import{n}from"./chunk-cgcthvq9.js";import{be,ot,On}from"./chunk-w78e5n94.js";import{o}from"./chunk-bwtxb2hf.js";import{Se,Cs,Es,rg,Xa,Ya,vs,Za,nt,K,it,ae,E,Ie,Rn,ec,_e,tc,Dn,Pn,Nn,kt,Bt,xt,kn,ur,ic,gr,pr,st,Bn,oc,Ot,mr,xn,cc,ag,cg,dc,fr}from"./chunk-ype3pqh5.js";import{at,le,Me,dg,_t,uc,gc,Lt,J,_n,$t,Mt,Ln,ws,Rs,hr,Ar,$n,yr,Ds,Ps,Ns,ks,X,Bs,xs,Os,_s,ue,Ls,$s,Ms,D,pc,Mn,mc,ge,Sr}from"./chunk-3w7q4sjs.js";import{W}from"./chunk-mxprxjd4.js";import{lg,fc,Ce,hc,Un,ug,Ac,gg,pg,uh,Hn,Us,Gn,Vn,qn,Y,Fe,x,vr,zn,Tr,pe,Ic,Kn,bc,Rr,Jn,Qs,Xn,Yn,Zn,ei,Dr,wc,Ue,Z,Qe,He,dt,Te,Pr,we,ni,ii,si,oi,ai,ci,di,Nr,O,Vs,Fg,xc,ui,gi,pi,mi,Uc,qs,Qc,Gt,fi,js,zs,Hc,hi,Gc}from"./chunk-jaswfk6g.js";import{Nl,$o,zi,Ki,Mo,kl,Bl,Wi,Fo,Uo,Ol,_l,Qo}from"./chunk-qbbap3bt.js";import{za,vn,Tn,hs,As,ys,Ss,Ka,Wa}from"./chunk-v6hysd5c.js";import{Ja}from"./chunk-kexwq2h0.js";import{lc,Le,S}from"./chunk-3s8dtcz8.js";import{$e}from"./chunk-varjr6np.js";import{I}from"./chunk-97gre81w.js";import{ee,Ai,Ks,Vc,yi,Jg}from"./chunk-2vrv31sk.js";import{Br,Re}from"./chunk-fwcf0n8f.js";import{h}from"./chunk-9e4afej1.js";import{Nd,Kr,kd,Bd,xd,$i,Vp,Wr}from"./chunk-0evxayn1.js";import{aS,Xe}from"./chunk-9mv07nz0.js";import{createHmac as Oc,createSign as zf,timingSafeEqual as Wf}from"node:crypto";function Si(l){let f=l instanceof Date?l.getTime():l;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Ec(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Gf(l){return Buffer.from(l).toString("base64url")}function kc(l,f=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let C=f?l.replaceAll("*","wildcard"):l,A=new URL(C);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Nc(l,f){let C=zf("RSA-SHA1");return C.update(l),C.end(),Ec(C.sign(f))}function Lc(l){kc(l.resource,!0);let C={DateLessThan:{"AWS:EpochTime":Si(l.expiresAt)}};if(l.activeAt!==void 0)C.DateGreaterThan={"AWS:EpochTime":Si(l.activeAt)};if(l.ipAddress)C.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:C}]})}function Wg(l,f,C){kc(l);let A=Si(f),w=l.includes("?")?"&":"?",de=Lc({resource:l,expiresAt:f}),v=Nc(de,C.privateKey);return`${l}${w}Expires=${A}&Signature=${encodeURIComponent(v)}&Key-Pair-Id=${encodeURIComponent(C.keyPairId)}`}function Gg(l,f){let C=Lc(l);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Ec(Buffer.from(C)),"CloudFront-Signature":Nc(C,f.privateKey)}}function Ug(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let f=Gf(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:Si(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),C=Oc("sha256",l.secret).update(f).digest("base64url");return`${f}.${C}`}function jg(l,f){let[C,A,w]=l.split(".");if(!C||!A||w)return null;let de=Oc("sha256",f.secret).update(C).digest(),v;try{v=Buffer.from(A,"base64url")}catch{return null}if(de.length!==v.length||!Wf(de,v))return null;try{let B=JSON.parse(Buffer.from(C,"base64url").toString("utf8")),ve=Si(f.now??Date.now());if(!B.resource||!Number.isSafeInteger(B.expiresAt)||B.expiresAt<=ve)return null;if(f.resource&&B.resource!==f.resource)return null;if(f.audience&&B.audience!==f.audience)return null;return B}catch{return null}}function Kg(l,f=!1){let C=new URL(l,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(C),w=/\.(?:key|license)$/.test(C)||C.includes("/keys/")||C.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||w)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function qg(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let f=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",C=l.protected??!1,A="public, max-age=31536000, immutable",w=C?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:f,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.mpd",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.vtt",cacheControl:w,compress:!0,signed:C},{pathPattern:"*",cacheControl:A,compress:!1,signed:C}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class jf{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Qd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let f=this.config.features||{};if(!l.requiresFeatures.every((A)=>f[A]===!0))return!1}if(l.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(f))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(l||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,f){return l==="public"||f.routeCompute===!0}storageBucketName(l,f,C){return this.mergedConfig.infrastructure?.storage?.[C]?.bucket??`${l}-${f}-${C}`}fileSystemLogicalId(l,f,C){return t(r({slug:`${l}-${C}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(l,f,C){let A=l.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,C,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,C,A.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,f){return{PathPattern:l,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,f,C,A,w,de){let v=this.serverEipLogicalIds.get("app"),B=this.serverEipLogicalIds.get("appInstance");if(!v)return;let ve=`EC2-${A}-${w}-api`,ct=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",xe=ct==="us-east-1"?".compute-1.amazonaws.com":`.${ct}.compute.amazonaws.com`,Qt={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:v}]}]},xe]]},Ut=this.resolveApiOriginPort();if(l.push({Id:ve,DomainName:Qt,CustomOriginConfig:{HTTPPort:Ut,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),C.push(v),B)C.push(B);for(let Pt of de)f.push(this.createComputeCacheBehavior(Pt,ve))}buildCaddyfile(l){let f=l.filter(([,w])=>typeof w.domain==="string"&&w.domain&&typeof w.port==="number");if(f.length===0)return;let C=new Map;for(let[,w]of f){let de=C.get(w.domain)??[];de.push({port:w.port,path:w.path}),C.set(w.domain,de)}let A=[];for(let[w,de]of C){let B=[...de].sort((ve,ct)=>{let xe=!ve.path||ve.path==="/",Qt=!ct.path||ct.path==="/";if(xe&&!Qt)return 1;if(!xe&&Qt)return-1;return(ct.path?.length??0)-(ve.path?.length??0)}).map((ve)=>{let ct=!ve.path||ve.path==="/",xe=`reverse_proxy localhost:${ve.port}`;return ct?`  handle {
     ${xe}
-  }`:`  handle ${Ee.path} {
+  }`:`  handle ${ve.path} {
     ${xe}
   }`});A.push(`${w} {
-${ce.join(`
+${B.join(`
 `)}
 }`)}return A.join(`
 
-`)}normalizeMountPath(l){let f=l?.mountPath||l?.path;if(!f||f==="/")return;let C=`/${f}`.replace(/\/+/g,"/").replace(/\/$/,"");return C==="/"?void 0:C}storageBucketLogicalId(l,f,C){return`${l}-${f}-s3-${C}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((A)=>A.charAt(0).toUpperCase()+A.slice(1)).join("")}pathMountRewriteFunctionCode(l,f="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(l)}; var rewriteStyle = ${JSON.stringify(f)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let l=this.mergedConfig.project.slug,f=this.environment,C=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),A=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),w=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(l,f),this.generateContainerInfrastructure(l,f);if(C)this.generateServerless(l,f);if(A)this.generateServer(l,f);if(w)this.generateComputeApp(l,f);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(l,f);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(l,f),this.storageFailoverReplicas.length>0)this.builder.addMetadata(Gd,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(l){}generateNetworkInfrastructure(l,f){if(this.builder.hasResource("VPC"))return;let A=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:w,logicalId:ve}=y.createVpc({slug:l,environment:f,cidr:A,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",w);let ae=`${l}${f}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ae,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${l}-${f}-igw`},{Key:"Environment",Value:f}]}});let ce=`${l}${f}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ce,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:ae}}});let Ee=`${l}${f}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ee,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${l}-${f}-public-rt`},{Key:"Environment",Value:f}]}}),this.builder.addResource(`${l}${f}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:Ee},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:ae}},DependsOn:ce});let ut=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",xe=["a","b"];for(let Mt=0;Mt<2;Mt++){let ar=`PublicSubnet${Mt+1}`;this.builder.addResource(ar,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${Mt}.0/24`,AvailabilityZone:`${ut}${xe[Mt]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${l}-${f}-public-${xe[Mt]}`},{Key:"Environment",Value:f}]}}),this.builder.addResource(`${ar}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:ar},RouteTableId:{Ref:Ee}}})}}generateContainerInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.containers;if(!C)return;let A=this.mergedConfig.infrastructure?.loadBalancer,w=this.mergedConfig.infrastructure?.ssl,ve=this.mergedConfig.infrastructure?.dns,ae;if(w?.enabled&&w.domains?.length)if(w.certificateArn);else{let xe=w.domains[0],Mt=w.domains.slice(1).map((gt)=>{if(gt.includes(".")&&gt.endsWith(xe))return gt.replace(`.${xe}`,"");return gt}),{certificate:ar,logicalId:Sr}=b.createCertificate({domain:xe,subdomains:Mt,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:ve?.hostedZoneId});ae=Sr,this.builder.addResource(Sr,ar)}let ce="ECSCluster";this.builder.addResource(ce,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${l}-${f}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${l}-${f}`},{Key:"Environment",Value:f}]}});let Ee=`${l}${f}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ee,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${l}-${f}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-alb-sg`},{Key:"Environment",Value:f}]}});let ut=`${l}${f}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[xe,Mt]of Object.entries(C)){let ar=Mt.port||3000;this.builder.addResource(ut,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${l}-${f}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:ar,ToPort:ar,SourceSecurityGroupId:{Ref:Ee},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-ecs-sg`},{Key:"Environment",Value:f}]}});let Sr=`${l}${f}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Sr,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let gt=`${l}${f}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(gt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let ct=`${l}${f}${xe}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),B=`/ecs/${l}-${f}-${xe}`;this.builder.addResource(ct,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:B,RetentionInDays:30}});let $t=`${l}${f}${xe}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),v=String(Mt.cpu||512),lt=String(Mt.memory||1024);this.builder.addResource($t,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${f}-${xe}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:v,Memory:lt,ExecutionRoleArn:{"Fn::GetAtt":[Sr,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[gt,"Arn"]},ContainerDefinitions:[{Name:xe,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}:latest`},Essential:!0,PortMappings:[{ContainerPort:ar,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":B,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":xe}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${ar}${Mt.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[Sr,gt,ct]});let Pt=`${l}${f}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(A?.enabled!==!1){this.builder.addResource(Pt,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${l}-${f}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:Ee}],Tags:[{Key:"Name",Value:`${l}-${f}-alb`},{Key:"Environment",Value:f}]}});let Lt=`${l}${f}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),Ft=A?.healthCheck?.path||Mt.healthCheck||"/health";this.builder.addResource(Lt,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${l}-${f}-tg`,Port:ar,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:Ft,HealthCheckIntervalSeconds:A?.healthCheck?.interval||30,HealthyThresholdCount:A?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:A?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${l}-${f}-tg`},{Key:"Environment",Value:f}]}});let yr=`${l}${f}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(w?.enabled&&w?.redirectHttp)this.builder.addResource(yr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Pt},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(yr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Pt},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Lt}}]}});if(w?.enabled){let Dr=w.certificateArn||(ae?{Ref:ae}:void 0);if(Dr){let Er=`${l}${f}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Er,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Pt},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:Dr}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Lt}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let Ar=`${l}${f}${xe}Service`.replace(/[^a-zA-Z0-9]/g,""),Ir=Mt.desiredCount||1;this.builder.addResource(Ar,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-${xe}`,Cluster:{Ref:ce},TaskDefinition:{Ref:$t},DesiredCount:Ir,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ut}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:xe,ContainerPort:ar,TargetGroupArn:{Ref:Lt}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[$t,yr,Lt]});let kr=Mt.autoScaling;if(kr){let Dr=`${l}${f}${xe}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Dr,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:kr.max||10,MinCapacity:kr.min||1,ResourceId:{"Fn::Sub":`service/\${${ce}}/${l}-${f}-${xe}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:Ar}),kr.targetCpuUtilization)this.builder.addResource(`${l}${f}${xe}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-${xe}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Dr},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:kr.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(kr.targetMemoryUtilization)this.builder.addResource(`${l}${f}${xe}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-${xe}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Dr},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:kr.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(ve?.domain&&ve?.hostedZoneId)this.builder.addResource(`${l}${f}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ve.hostedZoneId,Name:`api.${ve.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Pt,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Pt,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[ce,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${l}-${f}-${xe}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Pt,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let Lt=`${l}${f}${xe}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Lt,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-${xe}`,Cluster:{Ref:ce},TaskDefinition:{Ref:$t},DesiredCount:Mt.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ut}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[$t]})}break}}generateServerless(l,f){if(this.mergedConfig.infrastructure?.functions)for(let[C,A]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(A))continue;let{role:w,logicalId:ve}=re.createRole({slug:l,environment:f,roleName:`${l}-${f}-${C}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(ve,w);let{lambdaFunction:ae,logicalId:ce}=a.createLambdaFunction({slug:l,environment:f,functionName:`${l}-${f}-${C}`,handler:A.handler||"index.handler",runtime:A.runtime||"nodejs20.x",code:{zipFile:A.code||"export const handler = async () => ({ statusCode: 200 });"},role:ve,timeout:A.timeout,memorySize:A.memorySize});this.builder.addResource(ce,ae)}if(this.mergedConfig.infrastructure?.api){let{restApi:C,logicalId:A}=jd.createRestApi({slug:l,environment:f,apiName:`${l}-${f}-api`});this.builder.addResource(A,C)}}generateServer(l,f){if(!this.mergedConfig.infrastructure?.servers)return;let C=this.mergedConfig.infrastructure.servers,A=this.mergedConfig.infrastructure?.compute,w=this.mergedConfig.infrastructure?.ssl;if(Object.values(C).some((ae)=>!ae.privateNetwork||ae.privateNetwork==="create"))this.generateNetworkInfrastructure(l,f);for(let[ae,ce]of Object.entries(C)){let Ee=ce.instanceType||ce.size||A?.size,xe=(Ee?a.InstanceSize.specs[Ee]:void 0)?.instanceType||Ee||"t3.micro",Mt=ce.type||"app",ar=ce.userData||ce.startupScript;if(!ar)ar=a.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:ce.bunVersion||"latest",webServer:"none",domain:ce.domain,enableSsl:!!w?.enabled,sslEmail:w?.letsEncrypt?.email,installRedis:Mt==="cache",installDatabaseClients:!!ce.database});let Sr=ce.privateNetwork&&ce.privateNetwork!=="create"?ce.privateNetwork:{Ref:"VPC"},gt=ce.subnet||{Ref:"PublicSubnet1"},B=!!this.mergedConfig.infrastructure?.email?.server?.enabled,$t=[22,80,443,this.resolveApiOriginPort()];if(B)$t.push(25,465,587,143,993);let v=a.createServerModeStack({slug:`${l}-${ae}`,environment:f,vpcId:Sr,subnetId:gt,instanceType:xe,keyName:ce.keyName||`${l}-${f}`,domain:ce.domain,userData:ar,volumeSize:ce.diskSize||20,imageId:ce.image,allowedPorts:$t});for(let[lt,Pt]of Object.entries(v.resources))this.builder.addResource(lt,Pt);this.serverEipLogicalIds.set(ae,v.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${ae}Instance`,v.outputs.instanceLogicalId),this.builder.addOutput(`${ae}InstanceId`,{Value:{Ref:v.outputs.instanceLogicalId},Description:`Instance ID for ${ae} server`}),this.builder.addOutput(`${ae}PublicIp`,{Value:{Ref:v.outputs.eipLogicalId},Description:`Public IP for ${ae} server`})}}generateComputeApp(l,f){let C=this.mergedConfig.infrastructure?.compute;if(!C)return;let A=this.mergedConfig.sites||{},w=Object.entries(A),ae=this.mergedConfig.infrastructure?.dns?.domain,ce=this.mergedConfig.infrastructure?.database,Ee=C.size,xe=(Ee?a.InstanceSize.specs[Ee]:void 0)?.instanceType||Ee||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(l,f);let Mt=this.buildCaddyfile(w),ar=a.UserData.generateBunAppScript({runtime:C.runtime||"bun",runtimeVersion:C.runtimeVersion||"latest",systemPackages:C.systemPackages,database:ce,caddyfile:Mt}),Sr=Ms(C.appUpdates),gt=Sr.length>0?`${ar}
-${Sr.join(`
+`)}normalizeMountPath(l){let f=l?.mountPath||l?.path;if(!f||f==="/")return;let C=`/${f}`.replace(/\/+/g,"/").replace(/\/$/,"");return C==="/"?void 0:C}storageBucketLogicalId(l,f,C){return`${l}-${f}-s3-${C}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((A)=>A.charAt(0).toUpperCase()+A.slice(1)).join("")}pathMountRewriteFunctionCode(l,f="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(l)}; var rewriteStyle = ${JSON.stringify(f)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let l=this.mergedConfig.project.slug,f=this.environment,C=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),A=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),w=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(l,f),this.generateContainerInfrastructure(l,f);if(C)this.generateServerless(l,f);if(A)this.generateServer(l,f);if(w)this.generateComputeApp(l,f);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(l,f);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(l,f),this.storageFailoverReplicas.length>0)this.builder.addMetadata(qd,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(l){}generateNetworkInfrastructure(l,f){if(this.builder.hasResource("VPC"))return;let A=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:w,logicalId:de}=y.createVpc({slug:l,environment:f,cidr:A,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",w);let v=`${l}${f}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(v,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${l}-${f}-igw`},{Key:"Environment",Value:f}]}});let B=`${l}${f}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(B,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:v}}});let ve=`${l}${f}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ve,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${l}-${f}-public-rt`},{Key:"Environment",Value:f}]}}),this.builder.addResource(`${l}${f}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:ve},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:v}},DependsOn:B});let ct=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",xe=["a","b"];for(let Qt=0;Qt<2;Qt++){let Ut=`PublicSubnet${Qt+1}`;this.builder.addResource(Ut,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${Qt}.0/24`,AvailabilityZone:`${ct}${xe[Qt]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${l}-${f}-public-${xe[Qt]}`},{Key:"Environment",Value:f}]}}),this.builder.addResource(`${Ut}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:Ut},RouteTableId:{Ref:ve}}})}}generateContainerInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.containers;if(!C)return;let A=this.mergedConfig.infrastructure?.loadBalancer,w=this.mergedConfig.infrastructure?.ssl,de=this.mergedConfig.infrastructure?.dns,v;if(w?.enabled&&w.domains?.length)if(w.certificateArn);else{let xe=w.domains[0],Qt=w.domains.slice(1).map((ut)=>{if(ut.includes(".")&&ut.endsWith(xe))return ut.replace(`.${xe}`,"");return ut}),{certificate:Ut,logicalId:Pt}=b.createCertificate({domain:xe,subdomains:Qt,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:de?.hostedZoneId});v=Pt,this.builder.addResource(Pt,Ut)}let B="ECSCluster";this.builder.addResource(B,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${l}-${f}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${l}-${f}`},{Key:"Environment",Value:f}]}});let ve=`${l}${f}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ve,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${l}-${f}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-alb-sg`},{Key:"Environment",Value:f}]}});let ct=`${l}${f}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[xe,Qt]of Object.entries(C)){let Ut=Qt.port||3000;this.builder.addResource(ct,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${l}-${f}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:Ut,ToPort:Ut,SourceSecurityGroupId:{Ref:ve},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-ecs-sg`},{Key:"Environment",Value:f}]}});let Pt=`${l}${f}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Pt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let ut=`${l}${f}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ut,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let lt=`${l}${f}${xe}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),Ee=`/ecs/${l}-${f}-${xe}`;this.builder.addResource(lt,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:Ee,RetentionInDays:30}});let Ht=`${l}${f}${xe}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),ce=String(Qt.cpu||512),gt=String(Qt.memory||1024);this.builder.addResource(Ht,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${f}-${xe}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:ce,Memory:gt,ExecutionRoleArn:{"Fn::GetAtt":[Pt,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[ut,"Arn"]},ContainerDefinitions:[{Name:xe,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}:latest`},Essential:!0,PortMappings:[{ContainerPort:Ut,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":Ee,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":xe}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${Ut}${Qt.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[Pt,ut,lt]});let Ft=`${l}${f}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(A?.enabled!==!1){this.builder.addResource(Ft,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${l}-${f}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:ve}],Tags:[{Key:"Name",Value:`${l}-${f}-alb`},{Key:"Environment",Value:f}]}});let lr=`${l}${f}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),Cr=A?.healthCheck?.path||Qt.healthCheck||"/health";this.builder.addResource(lr,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${l}-${f}-tg`,Port:Ut,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:Cr,HealthCheckIntervalSeconds:A?.healthCheck?.interval||30,HealthyThresholdCount:A?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:A?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${l}-${f}-tg`},{Key:"Environment",Value:f}]}});let br=`${l}${f}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(w?.enabled&&w?.redirectHttp)this.builder.addResource(br,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ft},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(br,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ft},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:lr}}]}});if(w?.enabled){let wr=w.certificateArn||(v?{Ref:v}:void 0);if(wr){let Er=`${l}${f}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Er,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ft},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:wr}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:lr}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let Ir=`${l}${f}${xe}Service`.replace(/[^a-zA-Z0-9]/g,""),Or=Qt.desiredCount||1;this.builder.addResource(Ir,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-${xe}`,Cluster:{Ref:B},TaskDefinition:{Ref:Ht},DesiredCount:Or,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ct}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:xe,ContainerPort:Ut,TargetGroupArn:{Ref:lr}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[Ht,br,lr]});let xr=Qt.autoScaling;if(xr){let wr=`${l}${f}${xe}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(wr,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:xr.max||10,MinCapacity:xr.min||1,ResourceId:{"Fn::Sub":`service/\${${B}}/${l}-${f}-${xe}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:Ir}),xr.targetCpuUtilization)this.builder.addResource(`${l}${f}${xe}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-${xe}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:wr},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:xr.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(xr.targetMemoryUtilization)this.builder.addResource(`${l}${f}${xe}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-${xe}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:wr},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:xr.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(de?.domain&&de?.hostedZoneId)this.builder.addResource(`${l}${f}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:de.hostedZoneId,Name:`api.${de.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ft,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Ft,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[B,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${l}-${f}-${xe}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Ft,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let lr=`${l}${f}${xe}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(lr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-${xe}`,Cluster:{Ref:B},TaskDefinition:{Ref:Ht},DesiredCount:Qt.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ct}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[Ht]})}break}}generateServerless(l,f){if(this.mergedConfig.infrastructure?.functions)for(let[C,A]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(A))continue;let{role:w,logicalId:de}=ne.createRole({slug:l,environment:f,roleName:`${l}-${f}-${C}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(de,w);let{lambdaFunction:v,logicalId:B}=a.createLambdaFunction({slug:l,environment:f,functionName:`${l}-${f}-${C}`,handler:A.handler||"index.handler",runtime:A.runtime||"nodejs20.x",code:{zipFile:A.code||"export const handler = async () => ({ statusCode: 200 });"},role:de,timeout:A.timeout,memorySize:A.memorySize});this.builder.addResource(B,v)}if(this.mergedConfig.infrastructure?.api){let{restApi:C,logicalId:A}=Kd.createRestApi({slug:l,environment:f,apiName:`${l}-${f}-api`});this.builder.addResource(A,C)}}generateServer(l,f){if(!this.mergedConfig.infrastructure?.servers)return;let C=this.mergedConfig.infrastructure.servers,A=this.mergedConfig.infrastructure?.compute,w=this.mergedConfig.infrastructure?.ssl;if(Object.values(C).some((v)=>!v.privateNetwork||v.privateNetwork==="create"))this.generateNetworkInfrastructure(l,f);for(let[v,B]of Object.entries(C)){let ve=B.instanceType||B.size||A?.size,xe=(ve?a.InstanceSize.specs[ve]:void 0)?.instanceType||ve||"t3.micro",Qt=B.type||"app",Ut=B.userData||B.startupScript;if(!Ut)Ut=a.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:B.bunVersion||"latest",webServer:"none",domain:B.domain,enableSsl:!!w?.enabled,sslEmail:w?.letsEncrypt?.email,installRedis:Qt==="cache",installDatabaseClients:!!B.database});let Pt=B.privateNetwork&&B.privateNetwork!=="create"?B.privateNetwork:{Ref:"VPC"},ut=B.subnet||{Ref:"PublicSubnet1"},Ee=!!this.mergedConfig.infrastructure?.email?.server?.enabled,Ht=[22,80,443,this.resolveApiOriginPort()];if(Ee)Ht.push(25,465,587,143,993);let ce=a.createServerModeStack({slug:`${l}-${v}`,environment:f,vpcId:Pt,subnetId:ut,instanceType:xe,keyName:B.keyName||`${l}-${f}`,domain:B.domain,userData:Ut,volumeSize:B.diskSize||20,imageId:B.image,allowedPorts:Ht});for(let[gt,Ft]of Object.entries(ce.resources))this.builder.addResource(gt,Ft);this.serverEipLogicalIds.set(v,ce.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${v}Instance`,ce.outputs.instanceLogicalId),this.builder.addOutput(`${v}InstanceId`,{Value:{Ref:ce.outputs.instanceLogicalId},Description:`Instance ID for ${v} server`}),this.builder.addOutput(`${v}PublicIp`,{Value:{Ref:ce.outputs.eipLogicalId},Description:`Public IP for ${v} server`})}}generateComputeApp(l,f){let C=this.mergedConfig.infrastructure?.compute;if(!C)return;let A=this.mergedConfig.sites||{},w=Object.entries(A),v=this.mergedConfig.infrastructure?.dns?.domain,B=this.mergedConfig.infrastructure?.database,ve=C.size,xe=(ve?a.InstanceSize.specs[ve]:void 0)?.instanceType||ve||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(l,f);let Qt=this.buildCaddyfile(w),Ut=a.UserData.generateBunAppScript({runtime:C.runtime||"bun",runtimeVersion:C.runtimeVersion||"latest",systemPackages:C.systemPackages,database:B,caddyfile:Qt}),Pt=Us(C.appUpdates),ut=Pt.length>0?`${Ut}
+${Pt.join(`
 `)}
-`:ar,ct=w.map(([,Ft])=>Ft.port).filter((Ft)=>typeof Ft==="number"&&![80,443].includes(Ft)),B=this.resolveApiOriginPort(),$t=`${l}${f}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),v=`${l}-${f}-deploy`;this.builder.addResource($t,{Type:"AWS::S3::Bucket",Properties:{BucketName:v,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"ManagedBy",Value:"ts-cloud"}]}});let lt=a.createServerModeStack({slug:`${l}-app`,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:xe,keyName:C.allowSsh?`${l}-${f}`:void 0,domain:ae,userData:gt,volumeSize:C.disk?.size||20,imageId:C.image,allowedPorts:[...C.allowSsh?[22]:[],80,443,B,...ct]}),Pt=lt.resources[lt.outputs.instanceLogicalId];if(Pt?.Properties){let Ft=Pt.Properties.Tags||[];Pt.Properties.Tags=[...Ft,{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let Lt=lt.resources[lt.outputs.roleLogicalId];if(Lt?.Properties)Lt.Properties.Policies=Lt.Properties.Policies||[],Lt.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${v}`,`arn:aws:s3:::${v}/*`]}]}});for(let[Ft,yr]of Object.entries(lt.resources))this.builder.addResource(Ft,yr);this.builder.addOutput("deployBucketName",{Value:{Ref:$t},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:lt.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:lt.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",lt.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",lt.outputs.instanceLogicalId)}jumpBoxFileSystemId(l,f,C){let A=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof C==="string")return A.includes(C)?{Ref:this.fileSystemLogicalId(l,f,C)}:C;if(A.length===1)return{Ref:this.fileSystemLogicalId(l,f,A[0])};throw Error(A.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${A.length} (${A.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(l,f){let C=this.mergedConfig.infrastructure?.jumpBox;if(!C)return;let A=C===!0?{}:C;if(A.enabled===!1)return;this.generateNetworkInfrastructure(l,f);let w=A.size||"micro",ae=a.InstanceSize.specs[w]?.instanceType||w||"t3.micro",ce=a.createJumpBox({slug:l,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:A.keyName,instanceType:ae,allowedCidrs:A.allowedCidrs,mountEfs:A.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(l,f,A.mountEfs),mountPath:A.mountPath||"/mnt/efs"}:void 0,databaseTools:A.databaseTools});for(let[Ee,ut]of Object.entries(ce.resources))this.builder.addResource(Ee,ut);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:ce.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.ssl,A=this.mergedConfig.infrastructure?.dns,w=A?.domain,ve=A?.hostedZoneId,ae=[],ce,Ee;if(C?.certificateArn)Ee=C.certificateArn;else if(C?.enabled&&w&&ve){let ct=C.domains||[w],B=ct[0],$t=ct.slice(1).map((Pt)=>{if(Pt.includes(".")&&Pt.endsWith(B))return Pt.replace(`.${B}`,"");return Pt}),{certificate:v,logicalId:lt}=b.createCertificate({domain:B,subdomains:$t,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:ve});ce=lt,this.builder.addResource(lt,v)}if(this.mergedConfig.infrastructure?.storage){let ct=Object.entries(this.mergedConfig.infrastructure.storage).some(([,v])=>v.website),B;if(ct&&(ce||Ee))B=`${l}${f}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(B,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${l}-${f}-s3-oac`,Description:`OAC for ${l} ${f} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let $t=Object.entries(this.mergedConfig.infrastructure.storage).map(([v,lt])=>({name:v,config:lt,mountPath:this.normalizeMountPath(lt),rewriteStyle:lt.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(l,f,v)})).filter((v)=>v.name!=="public"&&v.config.website&&v.mountPath);for(let[v,lt]of Object.entries(this.mergedConfig.infrastructure.storage)){let Pt=!!(lt.website&&B),Lt=this.storageBucketName(l,f,v),{bucket:Ft,logicalId:yr}=De.createBucket({slug:l,name:v,environment:f,bucketName:Lt,versioning:lt.versioning,encryption:lt.encryption,public:Pt?!1:lt.public}),Ar=this.normalizeMountPath(lt),Ir;if(lt.failover){let Dr=`infrastructure.storage.${v}`;if(!Pt||!w||Ar&&v!=="public")throw Error(`${Dr}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(Ir=Jp({failover:lt.failover,primaryBucket:Lt,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:Dr}),Ir.replicate&&Ft.Properties){let Er=`${yr}FailoverReplicationRole`;this.builder.addResource(Er,Yp({primaryBucket:Lt,replicaBucket:Ir.replicaBucket}));let ai=Ft.Properties;ai.VersioningConfiguration={Status:"Enabled"},ai.ReplicationConfiguration=Zp({replicaBucket:Ir.replicaBucket,roleArn:{"Fn::GetAtt":[Er,"Arn"]}})}}if(Pt&&Ft.Properties)Ft.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(yr,Ft),lt.website){let Dr=typeof lt.website==="object"?lt.website:{},Er=De.enableWebsiteHosting(Ft,Dr.indexDocument||"index.html",Dr.errorDocument);this.builder.addResource(yr,Er)}let kr=this.normalizeMountPath(lt);if(Pt&&B&&w&&!(kr&&v!=="public")){let Dr=`${l}${f}${v}CDN`.replace(/[^a-zA-Z0-9]/g,""),Er=[];if(lt.aliases&&lt.aliases.length>0)Er.push(...lt.aliases);else if(v==="public"){if(Er.push(w),C?.domains?.includes(`www.${w}`))Er.push(`www.${w}`)}else if(v==="docs")Er.push(`docs.${w}`);else if(v==="blog")Er.push(`blog.${w}`);let ai=typeof lt.website==="object"?lt.website:{},yn=lt.spa===!0,hi=ai.errorDocument||(yn?"index.html":"404.html"),Br=[];if(yn)Br.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else Br.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${hi}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${hi}`,ErrorCachingMinTTL:300});let $n=Ee&&Er.length>0?{AcmCertificateArn:Ee,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:ce&&Er.length>0?{AcmCertificateArn:{Ref:ce},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},En=`S3-${l}-${f}-${v}`,ds=this.mergedConfig.project.region||"us-east-1",Fn;if(!yn)Fn=`${l}${f}${v}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Fn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${v}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${l} ${f} ${v} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
-else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let Gn=[{Id:En,DomainName:{"Fn::Sub":`\${${yr}}.s3.${ds}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:B}}],Yn=[],ys=[];if(this.shouldRouteStorageBucketToCompute(v,lt)){this.appendComputeAppOrigin(Gn,Yn,ys,l,f,this.resolveComputeCachePathPatterns(lt.computeRoutes));for(let Nr of $t){let Na=`S3-${l}-${f}-${Nr.name}`,As=`${l}${f}${Nr.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(As,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${Nr.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${l} ${f} ${Nr.name} at ${Nr.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(Nr.mountPath,Nr.rewriteStyle)}}),Gn.push({Id:Na,DomainName:{"Fn::Sub":`\${${Nr.logicalId}}.s3.${ds}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:B}}),ys.push(Nr.logicalId,As);for(let Ec of[Nr.mountPath,`${Nr.mountPath}/*`])Yn.push({PathPattern:Ec,TargetOriginId:Na,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[As,"FunctionARN"]}}]})}}let Da,tc=En;if(Ir){let Nr=`${En}-failover`;Object.assign(Gn[0],Ir.primaryConnection),Gn.push({Id:Nr,DomainName:Xp(Ir.replicaBucket,Ir.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:B}}),Da=Kr({primaryOriginId:En,secondaryOriginId:Nr,statusCodes:Ir.statusCodes}),tc=Da.Items[0].Id}let Cs={Type:"AWS::CloudFront::Distribution",DependsOn:[yr,B,...Fn?[Fn]:[],...ys],Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${v} site`,DefaultRootObject:"index.html",Origins:Gn,...Da?{OriginGroups:Da}:{},DefaultCacheBehavior:{TargetOriginId:tc,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...Fn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Fn,"FunctionARN"]}}]}:{}},...Yn.length>0?{CacheBehaviors:Yn}:{},...Er.length>0?{Aliases:Er}:{},ViewerCertificate:$n,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:Br}}};if(ce)Cs.DependsOn.push(ce);if(Ir)St(Cs.Properties.DistributionConfig,`infrastructure.storage.${v}`),this.storageFailoverReplicas.push({name:v,primaryBucket:Lt,primaryRegion:ds,replicaBucket:Ir.replicaBucket,replicaRegion:Ir.replicaRegion,replicate:Ir.replicate,distributionArnOutput:`${v}CloudFrontDistributionArn`}),this.builder.addOutput(`${v}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${Dr}}`},Description:`CloudFront distribution ARN for ${v} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${v}FailoverBucketName`,{Value:Ir.replicaBucket,Description:`Failover replica bucket for ${v} (${Ir.replicaRegion}), outside this stack`});this.builder.addResource(Dr,Cs);let Oc=`${yr}CloudFrontPolicy`;if(this.builder.addResource(Oc,{Type:"AWS::S3::BucketPolicy",DependsOn:[yr,Dr],Properties:{Bucket:{Ref:yr},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${yr}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Dr}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(v,lt))for(let Nr of $t){let Na=`${Nr.logicalId}CloudFrontPolicy`;this.builder.addResource(Na,{Type:"AWS::S3::BucketPolicy",DependsOn:[Nr.logicalId,Dr],Properties:{Bucket:{Ref:Nr.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Nr.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Dr}}`}}}}]}}})}if(Er.length>0)ae.push({name:v,bucketLogicalId:yr,distLogicalId:Dr,oacLogicalId:B,aliases:Er});this.builder.addOutput(`${v}CloudFrontDomain`,{Value:{"Fn::GetAtt":[Dr,"DomainName"]},Description:`CloudFront domain for ${v}`}),this.builder.addOutput(`${v}CloudFrontDistributionId`,{Value:{Ref:Dr},Description:`CloudFront distribution ID for ${v}`})}if(this.builder.addOutput(`${v}BucketName`,{Value:{Ref:yr},Description:`S3 bucket name for ${v}`}),v==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:yr},Description:"Frontend S3 bucket name"});if(v==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:yr},Description:"Documentation S3 bucket name"});if(v==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:yr},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let ct=this.mergedConfig.infrastructure.sftp,B=qd.create({...ct,storage:this.resolveSftpStorage(ct,l,f)??ct.storage,slug:l,environment:f});for(let[$t,v]of Object.entries(B.resources))this.builder.addResource($t,v);this.builder.addOutput("SftpServerId",{Value:{Ref:B.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${B.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:B.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(ve&&ae.length>0)for(let{name:ct,distLogicalId:B,aliases:$t}of ae)for(let v of $t){let lt=v.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${lt}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[B],Properties:{HostedZoneId:ve,Name:v,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[B,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${lt}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[B],Properties:{HostedZoneId:ve,Name:v,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[B,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[ct,B]of Object.entries(this.mergedConfig.infrastructure.databases))if(B.engine==="dynamodb"){let{table:$t,logicalId:v}=Wt.createTable({slug:l,environment:f,tableName:`${l}-${f}-${ct}`,partitionKey:B.partitionKey||{name:"id",type:"S"},sortKey:B.sortKey});this.builder.addResource(v,$t)}else if(B.engine==="postgres"){let{dbInstance:$t,logicalId:v}=Wt.createPostgres({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${ct}`,masterUsername:B.username||"admin",masterUserPassword:B.password||"changeme123",allocatedStorage:B.storage||20,dbInstanceClass:B.instanceClass||"db.t3.micro"});this.builder.addResource(v,$t)}else if(B.engine==="mysql"){let{dbInstance:$t,logicalId:v}=Wt.createMysql({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${ct}`,masterUsername:B.username||"admin",masterUserPassword:B.password||"changeme123",allocatedStorage:B.storage||20,dbInstanceClass:B.instanceClass||"db.t3.micro"});this.builder.addResource(v,$t)}}if(this.mergedConfig.infrastructure?.cdn)for(let[ct,B]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!B.origin)continue;let $t=typeof B.customDomain==="string"?B.customDomain:B.customDomain?.domain||B.domain,v=typeof B.customDomain==="object"?B.customDomain?.certificateArn:B.certificateArn,lt=v||Ee,Pt=`${l}${f}${ct}CDN`.replace(/[^a-zA-Z0-9]/g,""),Lt=`S3-${l}-${f}-${ct}-cdn`,Ft=[{Id:Lt,DomainName:B.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:B.originShield?{Enabled:!0,OriginShieldRegion:B.originShieldRegion||this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...te(B,`infrastructure.cdn.${ct}`)}],yr=[],Ar=[],Ir=["GET","HEAD","OPTIONS"],kr=Lt,Dr;if(B.failoverOrigin){yt(Ir,`the default cache behavior of infrastructure.cdn.${ct}`);let hi=`${Lt}-failover`,Br=typeof B.failoverOrigin==="string"?{domain:B.failoverOrigin}:B.failoverOrigin;if(!Br.domain)throw Error(`infrastructure.cdn.${ct}.failoverOrigin.domain is required`);if(Br.domain===B.origin)throw Error(`infrastructure.cdn.${ct}: failoverOrigin must differ from origin (both are ${B.origin})`);Ft.push({Id:hi,DomainName:Br.domain,OriginPath:Br.originPath||"",...Io(Br.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...te(Br,`infrastructure.cdn.${ct}.failoverOrigin`)}),Dr=Kr({primaryOriginId:Lt,secondaryOriginId:hi,statusCodes:B.failoverStatusCodes}),kr=Dr.Items[0].Id}else if(B.failoverStatusCodes)throw Error(`infrastructure.cdn.${ct}: failoverStatusCodes needs failoverOrigin to fail over to`);if(B.routeCompute)this.appendComputeAppOrigin(Ft,yr,Ar,l,f,this.resolveComputeCachePathPatterns(B.computeRoutes));let Er=lt&&$t?{AcmCertificateArn:ce&&!v?{Ref:ce}:lt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},ai=[...Ar];if(ce&&!v&&$t)ai.push(ce);let yn={Type:"AWS::CloudFront::Distribution",...ai.length>0?{DependsOn:ai}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${ct} CDN`,DefaultRootObject:"index.html",Origins:Ft,...Dr?{OriginGroups:Dr}:{},DefaultCacheBehavior:{TargetOriginId:kr,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:Ir,CachedMethods:["GET","HEAD","OPTIONS"],Compress:B.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...yr.length>0?{CacheBehaviors:yr}:{},...$t&&lt?{Aliases:[$t]}:{},ViewerCertificate:Er,PriceClass:"PriceClass_100",HttpVersion:B.http3?"http2and3":"http2"}}};if(St(yn.Properties.DistributionConfig,`infrastructure.cdn.${ct}`),this.builder.addResource(Pt,yn),ve&&$t&&lt){let hi=$t.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${hi}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Pt,...ce&&!v?[ce]:[]],Properties:{HostedZoneId:ve,Name:$t,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Pt,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[ct,B]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(B))continue;let{queue:$t,logicalId:v}=H.createQueue({slug:l,environment:f,name:`${l}-${f}-${ct}`,fifo:B.fifo,visibilityTimeout:B.visibilityTimeout,messageRetentionPeriod:B.messageRetentionPeriod,delaySeconds:B.delaySeconds,maxMessageSize:B.maxMessageSize,receiveMessageWaitTime:B.receiveMessageWaitTime,contentBasedDeduplication:B.contentBasedDeduplication,encrypted:B.encrypted,kmsKeyId:B.kmsKeyId});this.builder.addResource(v,$t);let lt;if(B.deadLetterQueue){let{deadLetterQueue:Pt,updatedSourceQueue:Lt,deadLetterLogicalId:Ft}=H.createDeadLetterQueue(v,{slug:l,environment:f,maxReceiveCount:B.maxReceiveCount});lt=Ft,this.builder.addResource(Ft,Pt);let Ar=this.builder.getResources()[v];if(Ar?.Properties)Ar.Properties.RedrivePolicy=Lt.Properties?.RedrivePolicy}if(B.trigger){let Pt=B.trigger,Lt=`${l}${f}${Pt.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Ft={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[v,"Arn"]},FunctionName:{Ref:Lt},BatchSize:Pt.batchSize||10,MaximumBatchingWindowInSeconds:Pt.batchWindow||0,Enabled:!0,...Pt.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Pt.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Pt.maxConcurrency}},...Pt.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Pt.filterPattern)}]}}},DependsOn:[v,Lt]};this.builder.addResource(`${v}Trigger`,Ft)}if(B.alarms?.enabled){let Pt=B.alarms,Lt=Pt.notificationTopicArn;if(!Lt&&Pt.notificationEmails?.length){let Ar=`${v}AlarmTopic`;this.builder.addResource(Ar,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-${ct}-alarms`,DisplayName:`${ct} Queue Alarms`}}),Pt.notificationEmails.forEach((Ir,kr)=>{this.builder.addResource(`${Ar}Sub${kr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Ar},Protocol:"email",Endpoint:Ir}})}),Lt={Ref:Ar}}let Ft=Pt.queueDepthThreshold||1000;this.builder.addResource(`${v}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ct}-queue-depth`,AlarmDescription:`Queue ${ct} depth exceeds ${Ft} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Ft,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[v,"QueueName"]}}],...Lt&&{AlarmActions:[Lt],OKActions:[Lt]}}});let yr=Pt.messageAgeThreshold||3600;if(this.builder.addResource(`${v}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ct}-message-age`,AlarmDescription:`Queue ${ct} oldest message exceeds ${yr} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:yr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[v,"QueueName"]}}],...Lt&&{AlarmActions:[Lt],OKActions:[Lt]}}}),lt&&Pt.dlqAlarm!==!1)this.builder.addResource(`${lt}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ct}-dlq-messages`,AlarmDescription:`Dead letter queue for ${ct} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[lt,"QueueName"]}}],...Lt&&{AlarmActions:[Lt]}}})}if(B.subscribe){let Pt=B.subscribe,Lt=Pt.topicArn;if(!Lt&&Pt.topicName)Lt={Ref:Pt.topicName};if(Lt){this.builder.addResource(`${v}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:v}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[v,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":Lt}}}]}}});let Ft={TopicArn:Lt,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[v,"Arn"]},RawMessageDelivery:Pt.rawMessageDelivery||!1};if(Pt.filterPolicy)Ft.FilterPolicy=Pt.filterPolicy,Ft.FilterPolicyScope=Pt.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${v}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Ft,DependsOn:`${v}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(l,f);else this.generateRealtimeResources(l,f);let ut=this.mergedConfig.infrastructure?.redirects;if(ut){let ct=ut.target||this.mergedConfig.infrastructure?.dns?.domain||"",B=ut.protocol||"https";if(ut.domains?.length&&ct)for(let $t of ut.domains){let{bucket:v,bucketPolicy:lt,logicalId:Pt,policyLogicalId:Lt}=bt.createDomainRedirectBucket({slug:l,environment:f,sourceDomain:$t,targetDomain:ct,protocol:B});this.builder.addResource(Pt,v),this.builder.addResource(Lt,lt)}if(ut.paths&&Object.keys(ut.paths).length>0){let $t=bt.fromMapping(ut.paths,{statusCode:ut.statusCode||301}),{function:v,logicalId:lt}=bt.createPathRedirectFunction({slug:l,environment:f,rules:$t});this.builder.addResource(lt,v)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[ct,B]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:$t,logicalId:v}=Eo.createAlarm({slug:l,environment:f,alarmName:`${l}-${f}-${ct}`,metricName:B.metricName||"Errors",namespace:B.namespace||"AWS/Lambda",threshold:B.threshold||1,comparisonOperator:B.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(v,$t)}let xe=this.mergedConfig.infrastructure?.cache;if(xe){let ct=xe.type||"redis";if(ct==="redis"){this.generateNetworkInfrastructure(l,f);let B=xe.redis||{},{replicationGroup:$t,subnetGroup:v,logicalId:lt,subnetGroupId:Pt}=Co.createRedis({slug:l,environment:f,nodeType:B.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:B.engineVersion||"7.1",port:B.port||6379,numCacheClusters:B.numCacheNodes||2,automaticFailover:B.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:B.snapshotRetentionLimit||7,snapshotWindow:B.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(lt,$t),v&&Pt)this.builder.addResource(Pt,v);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[lt,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[lt,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(ct==="memcached"){this.generateNetworkInfrastructure(l,f);let B=xe.elasticache||{},{cluster:$t,subnetGroup:v,logicalId:lt,subnetGroupId:Pt}=Co.createMemcached({slug:l,environment:f,nodeType:B.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:B.engineVersion||"1.6.22",numCacheNodes:B.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(lt,$t),v&&Pt)this.builder.addResource(Pt,v);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[lt,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let Mt=this.mergedConfig.infrastructure?.email;if(Mt){let ct=Mt.domain||this.mergedConfig.infrastructure?.dns?.domain;if(ct){let{emailIdentity:B,logicalId:$t}=m.verifyDomain({domain:ct,slug:l,environment:f,enableDkim:Mt.enableDkim!==!1,dkimKeyLength:Mt.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource($t,B),Mt.configurationSet!==!1){let{configurationSet:Pt,logicalId:Lt}=m.createConfigurationSet({slug:l,environment:f});this.builder.addResource(Lt,Pt)}let v=Mt.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(v){if(Mt.enableDkim!==!1)for(let Ar=1;Ar<=3;Ar++){let Ir=`DkimRecord${Ar}${ct.replace(/\./g,"")}`;this.builder.addResource(Ir,{Type:"AWS::Route53::RecordSet",DependsOn:[$t],Properties:{HostedZoneId:v,Name:{"Fn::GetAtt":[$t,`DkimDNSTokenName${Ar}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[$t,`DkimDNSTokenValue${Ar}`]}]}})}let{record:Pt,logicalId:Lt}=m.createSpfRecord(ct,v);this.builder.addResource(Lt,Pt);let{record:Ft,logicalId:yr}=m.createDmarcRecord(ct,v,{policy:"none",reportingEmail:Mt.dmarcReportingEmail||`dmarc-reports@${ct}`});this.builder.addResource(yr,Ft)}this.builder.addOutput("EmailDomain",{Value:ct,Description:"SES verified email domain"});let lt=Mt.server;if(lt?.enabled&&v){let Pt=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",Lt=`${l}-${f}-email`,{role:Ft,policy:yr,roleLogicalId:Ar,policyLogicalId:Ir}=m.createEmailLambdaRole({slug:l,environment:f,s3BucketArn:`arn:aws:s3:::${Lt}`,sesIdentityArn:`arn:aws:ses:${Pt}:*:identity/${ct}`});this.builder.addResource(Ar,Ft),this.builder.addResource(Ir,yr);let{function:kr,permission:Dr,logicalId:Er,permissionLogicalId:ai}=m.createInboundEmailLambda({slug:l,environment:f,roleArn:{"Fn::GetAtt":[Ar,"Arn"]},s3BucketName:Lt,organizedPrefix:"mailboxes/"});this.builder.addResource(Er,kr),this.builder.addResource(ai,Dr);let yn=m.createInboundEmailSetup({slug:l,environment:f,domain:ct,s3BucketName:Lt,s3KeyPrefix:"inbox/",region:Pt,hostedZoneId:v,lambdaFunctionArn:{"Fn::GetAtt":[Er,"Arn"]}});for(let[Br,$n]of Object.entries(yn.resources)){if($n.Type==="AWS::SES::ReceiptRule")$n.DependsOn=[ai,Er];this.builder.addResource(Br,$n)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:Er},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:Lt,Description:"S3 bucket for email storage"});let hi=this.serverEipLogicalIds.get("app");if(hi&&v){let $n=`${lt?.subdomain||"mail"}.${ct}`,En=$n.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${En}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:v,Name:$n,Type:"A",TTL:"300",ResourceRecords:[{Ref:hi}]}})}this.builder.addOutput("MailHost",{Value:`mail.${ct}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let ar=this.mergedConfig.infrastructure?.search;if(ar){let ct=ar.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(ct)this.generateNetworkInfrastructure(l,f);let{domain:B,logicalId:$t}=Jt.createDomain({slug:l,environment:f,engineVersion:ar.engineVersion||"OpenSearch_2.11",instanceType:ar.instanceType||"t3.small.search",instanceCount:ar.instanceCount||1,volumeSize:ar.volumeSize||10,volumeType:ar.volumeType||"gp3",dedicatedMaster:ar.dedicatedMaster||!1,dedicatedMasterType:ar.dedicatedMasterType,dedicatedMasterCount:ar.dedicatedMasterCount||3,multiAz:ar.multiAz||!1,encryption:ar.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:ar.advancedSecurity,autoTune:ar.autoTune!==!1,vpc:ct});this.builder.addResource($t,B),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[$t,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[$t,"Arn"]},Description:"OpenSearch domain ARN"})}let Sr=this.mergedConfig.infrastructure?.fileSystem;if(Sr&&Object.keys(Sr).length>0){this.generateNetworkInfrastructure(l,f);for(let[ct,B]of Object.entries(Sr)){let{fileSystem:$t,logicalId:v}=ze.createFileSystem({slug:`${l}-${ct}`,environment:f,encrypted:B.encrypted!==!1,performanceMode:B.performanceMode||"generalPurpose",throughputMode:B.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(v,$t);let{securityGroup:lt,logicalId:Pt}=ze.createEfsSecurityGroup({slug:`${l}-${ct}`,environment:f,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Pt,lt);let{mountTargets:Lt,logicalIds:Ft}=ze.createMultiAzMountTargets(v,{slug:`${l}-${ct}`,environment:f,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Pt}});for(let yr=0;yr<Lt.length;yr++)this.builder.addResource(Ft[yr],Lt[yr]);this.builder.addOutput(`${ct}FileSystemId`,{Value:{Ref:v},Description:`EFS file system ID for ${ct}`})}}let gt=this.mergedConfig.infrastructure?.ai;if(gt){let ct=gt.service||"ecs",B=gt.models||["*"],$t=gt.allowStreaming!==!1,v;if(ct==="ecs")v=Pe.enableBedrockForEcs({slug:l,environment:f,models:B,allowStreaming:$t});else if(ct==="ec2")v=Pe.enableBedrockForEc2({slug:l,environment:f,models:B,allowStreaming:$t});else if(ct==="lambda")v=Pe.enableBedrockForLambda({slug:l,environment:f,models:B,allowStreaming:$t});else v=Pe.createBedrockRole(ct,{slug:l,environment:f,models:B,allowStreaming:$t});if(this.builder.addResource(v.logicalId,v.role),gt.allowAsync){let{policy:lt,logicalId:Pt}=Pe.createBedrockPolicy({slug:l,environment:f,models:B,allowStreaming:$t,allowAsync:!0});this.builder.addResource(Pt,lt)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[v.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(l,f){let C=this.mergedConfig.infrastructure?.realtime;if(!C)return;let A=C.name||`${l}-${f}-realtime`,w=C.scaling||{},ve=C.storage||{type:"dynamodb"},ae=w.handlerMemory||256,ce=w.handlerTimeout||30,Ee=`${l}${f}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),ut=`${l}${f}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(ve.type==="dynamodb"){let Ft=ve.dynamodb||{},yr=Ft.billingMode||"PAY_PER_REQUEST";this.builder.addResource(Ee,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-connections`,BillingMode:yr,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...yr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ft.readCapacity||5,WriteCapacityUnits:Ft.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...yr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ft.readCapacity||5,WriteCapacityUnits:Ft.writeCapacity||5}},...Ft.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-connections`},{Key:"Environment",Value:f}]}}),this.builder.addResource(ut,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-channels`,BillingMode:yr,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...yr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ft.readCapacity||5,WriteCapacityUnits:Ft.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...yr==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Ft.readCapacity||5,WriteCapacityUnits:Ft.writeCapacity||5}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-channels`},{Key:"Environment",Value:f}]}})}let xe=`${l}${f}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(xe,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[Ee,"Arn"]},{"Fn::Sub":`\${${Ee}.Arn}/index/*`},{"Fn::GetAtt":[ut,"Arn"]},{"Fn::Sub":`\${${ut}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let Mt=`${l}${f}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),ar=`${l}${f}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),Sr=`${l}${f}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Mt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:ae,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Ee},CHANNELS_TABLE:{Ref:ut},ENVIRONMENT:f}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[xe,Ee]}),this.builder.addResource(ar,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:ae,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Ee},CHANNELS_TABLE:{Ref:ut},ENVIRONMENT:f}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[xe,Ee,ut]}),this.builder.addResource(Sr,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:ae,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:Ee},CHANNELS_TABLE:{Ref:ut},ENVIRONMENT:f}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[xe,Ee,ut]});let gt=`${l}${f}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(gt,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:A,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:A,Environment:f}}});let ct=`${Mt}Permission`,B=`${ar}Permission`,$t=`${Sr}Permission`;this.builder.addResource(ct,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Mt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${gt}}/*/$connect`}}}),this.builder.addResource(B,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:ar},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${gt}}/*/$disconnect`}}}),this.builder.addResource($t,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Sr},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${gt}}/*/$default`}}});let v=`${gt}ConnectInteg`,lt=`${gt}DisconnectInteg`,Pt=`${gt}MessageInteg`;this.builder.addResource(v,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:gt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Mt}.Arn}/invocations`}}}),this.builder.addResource(lt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:gt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${ar}.Arn}/invocations`}}}),this.builder.addResource(Pt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:gt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Sr}.Arn}/invocations`}}}),this.builder.addResource(`${gt}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:gt},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${v}}`}}}),this.builder.addResource(`${gt}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:gt},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${lt}}`}}}),this.builder.addResource(`${gt}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:gt},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Pt}}`}}});let Lt=`${gt}Stage`;if(this.builder.addResource(Lt,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:gt},StageName:f,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:w.messagesPerSecond||1000,ThrottlingRateLimit:w.messagesPerSecond||1000}}}),C.monitoring?.enabled){let Ft=C.monitoring,yr=Ft.notificationTopicArn;if(!yr&&Ft.notificationEmails?.length){let Ar=`${gt}AlarmTopic`;this.builder.addResource(Ar,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Ft.notificationEmails.forEach((Ir,kr)=>{this.builder.addResource(`${Ar}Sub${kr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Ar},Protocol:"email",Endpoint:Ir}})}),yr={Ref:Ar}}if(Ft.connectionThreshold)this.builder.addResource(`${gt}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Ft.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Ft.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:gt}}],...yr&&{AlarmActions:[yr]}}});if(Ft.errorThreshold)this.builder.addResource(`${gt}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Ft.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Ft.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:gt}}],...yr&&{AlarmActions:[yr]}}})}this.builder.addOutput(`${gt}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${gt}}.execute-api.\${AWS::Region}.amazonaws.com/${f}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${gt}Id`,{Description:"WebSocket API ID",Value:{Ref:gt},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
+`:Ut,lt=w.map(([,Cr])=>Cr.port).filter((Cr)=>typeof Cr==="number"&&![80,443].includes(Cr)),Ee=this.resolveApiOriginPort(),Ht=`${l}${f}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),ce=`${l}-${f}-deploy`;this.builder.addResource(Ht,{Type:"AWS::S3::Bucket",Properties:{BucketName:ce,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"ManagedBy",Value:"ts-cloud"}]}});let gt=a.createServerModeStack({slug:`${l}-app`,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:xe,keyName:C.allowSsh?`${l}-${f}`:void 0,domain:v,userData:ut,volumeSize:C.disk?.size||20,imageId:C.image,allowedPorts:[...C.allowSsh?[22]:[],80,443,Ee,...lt]}),Ft=gt.resources[gt.outputs.instanceLogicalId];if(Ft?.Properties){let Cr=Ft.Properties.Tags||[];Ft.Properties.Tags=[...Cr,{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let lr=gt.resources[gt.outputs.roleLogicalId];if(lr?.Properties)lr.Properties.Policies=lr.Properties.Policies||[],lr.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${ce}`,`arn:aws:s3:::${ce}/*`]}]}});for(let[Cr,br]of Object.entries(gt.resources))this.builder.addResource(Cr,br);this.builder.addOutput("deployBucketName",{Value:{Ref:Ht},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:gt.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:gt.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",gt.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",gt.outputs.instanceLogicalId)}jumpBoxFileSystemId(l,f,C){let A=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof C==="string")return A.includes(C)?{Ref:this.fileSystemLogicalId(l,f,C)}:C;if(A.length===1)return{Ref:this.fileSystemLogicalId(l,f,A[0])};throw Error(A.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${A.length} (${A.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(l,f){let C=this.mergedConfig.infrastructure?.jumpBox;if(!C)return;let A=C===!0?{}:C;if(A.enabled===!1)return;this.generateNetworkInfrastructure(l,f);let w=A.size||"micro",v=a.InstanceSize.specs[w]?.instanceType||w||"t3.micro",B=a.createJumpBox({slug:l,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:A.keyName,instanceType:v,allowedCidrs:A.allowedCidrs,mountEfs:A.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(l,f,A.mountEfs),mountPath:A.mountPath||"/mnt/efs"}:void 0,databaseTools:A.databaseTools});for(let[ve,ct]of Object.entries(B.resources))this.builder.addResource(ve,ct);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:B.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.ssl,A=this.mergedConfig.infrastructure?.dns,w=A?.domain,de=A?.hostedZoneId,v=[],B,ve;if(C?.certificateArn)ve=C.certificateArn;else if(C?.enabled&&w&&de){let lt=C.domains||[w],Ee=lt[0],Ht=lt.slice(1).map((Ft)=>{if(Ft.includes(".")&&Ft.endsWith(Ee))return Ft.replace(`.${Ee}`,"");return Ft}),{certificate:ce,logicalId:gt}=b.createCertificate({domain:Ee,subdomains:Ht,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:de});B=gt,this.builder.addResource(gt,ce)}if(this.mergedConfig.infrastructure?.storage){let lt=Object.entries(this.mergedConfig.infrastructure.storage).some(([,ce])=>ce.website),Ee;if(lt&&(B||ve))Ee=`${l}${f}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Ee,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${l}-${f}-s3-oac`,Description:`OAC for ${l} ${f} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let Ht=Object.entries(this.mergedConfig.infrastructure.storage).map(([ce,gt])=>({name:ce,config:gt,mountPath:this.normalizeMountPath(gt),rewriteStyle:gt.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(l,f,ce)})).filter((ce)=>ce.name!=="public"&&ce.config.website&&ce.mountPath);for(let[ce,gt]of Object.entries(this.mergedConfig.infrastructure.storage)){let Ft=!!(gt.website&&Ee),lr=this.storageBucketName(l,f,ce),{bucket:Cr,logicalId:br}=De.createBucket({slug:l,name:ce,environment:f,bucketName:lr,versioning:gt.versioning,encryption:gt.encryption,public:Ft?!1:gt.public}),Ir=this.normalizeMountPath(gt),Or;if(gt.failover){let wr=`infrastructure.storage.${ce}`;if(!Ft||!w||Ir&&ce!=="public")throw Error(`${wr}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(Or=Yp({failover:gt.failover,primaryBucket:lr,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:wr}),Or.replicate&&Cr.Properties){let Er=`${br}FailoverReplicationRole`;this.builder.addResource(Er,em({primaryBucket:lr,replicaBucket:Or.replicaBucket}));let sn=Cr.Properties;sn.VersioningConfiguration={Status:"Enabled"},sn.ReplicationConfiguration=tm({replicaBucket:Or.replicaBucket,roleArn:{"Fn::GetAtt":[Er,"Arn"]}})}}if(Ft&&Cr.Properties)Cr.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(br,Cr),gt.website){let wr=typeof gt.website==="object"?gt.website:{},Er=De.enableWebsiteHosting(Cr,wr.indexDocument||"index.html",wr.errorDocument);this.builder.addResource(br,Er)}let xr=this.normalizeMountPath(gt);if(Ft&&Ee&&w&&!(xr&&ce!=="public")){let wr=`${l}${f}${ce}CDN`.replace(/[^a-zA-Z0-9]/g,""),Er=[];if(gt.aliases&&gt.aliases.length>0)Er.push(...gt.aliases);else if(ce==="public"){if(Er.push(w),C?.domains?.includes(`www.${w}`))Er.push(`www.${w}`)}else if(ce==="docs")Er.push(`docs.${w}`);else if(ce==="blog")Er.push(`blog.${w}`);let sn=typeof gt.website==="object"?gt.website:{},Fn=gt.spa===!0,bn=sn.errorDocument||(Fn?"index.html":"404.html"),_r=[];if(Fn)_r.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else _r.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${bn}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${bn}`,ErrorCachingMinTTL:300});let Wn=ve&&Er.length>0?{AcmCertificateArn:ve,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:B&&Er.length>0?{AcmCertificateArn:{Ref:B},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},ti=`S3-${l}-${f}-${ce}`,nc=this.mergedConfig.project.region||"us-east-1",ri;if(!Fn)ri=`${l}${f}${ce}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(ri,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${ce}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${l} ${f} ${ce} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
+else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let li=[{Id:ti,DomainName:{"Fn::Sub":`\${${br}}.s3.${nc}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}],Ts=[],sc=[];if(this.shouldRouteStorageBucketToCompute(ce,gt)){this.appendComputeAppOrigin(li,Ts,sc,l,f,this.resolveComputeCachePathPatterns(gt.computeRoutes));for(let kr of Ht){let Fs=`S3-${l}-${f}-${kr.name}`,yc=`${l}${f}${kr.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(yc,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${kr.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${l} ${f} ${kr.name} at ${kr.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(kr.mountPath,kr.rewriteStyle)}}),li.push({Id:Fs,DomainName:{"Fn::Sub":`\${${kr.logicalId}}.s3.${nc}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}),sc.push(kr.logicalId,yc);for(let Vf of[kr.mountPath,`${kr.mountPath}/*`])Ts.push({PathPattern:Vf,TargetOriginId:Fs,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[yc,"FunctionARN"]}}]})}}let Is,vc=ti;if(Or){let kr=`${ti}-failover`;Object.assign(li[0],Or.primaryConnection),li.push({Id:kr,DomainName:Zp(Or.replicaBucket,Or.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}),Is=Xr({primaryOriginId:ti,secondaryOriginId:kr,statusCodes:Or.statusCodes}),vc=Is.Items[0].Id}let ac={Type:"AWS::CloudFront::Distribution",DependsOn:[br,Ee,...ri?[ri]:[],...sc],Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${ce} site`,DefaultRootObject:"index.html",Origins:li,...Is?{OriginGroups:Is}:{},DefaultCacheBehavior:{TargetOriginId:vc,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...ri?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[ri,"FunctionARN"]}}]}:{}},...Ts.length>0?{CacheBehaviors:Ts}:{},...Er.length>0?{Aliases:Er}:{},ViewerCertificate:Wn,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:_r}}};if(B)ac.DependsOn.push(B);if(Or)St(ac.Properties.DistributionConfig,`infrastructure.storage.${ce}`),this.storageFailoverReplicas.push({name:ce,primaryBucket:lr,primaryRegion:nc,replicaBucket:Or.replicaBucket,replicaRegion:Or.replicaRegion,replicate:Or.replicate,distributionArnOutput:`${ce}CloudFrontDistributionArn`}),this.builder.addOutput(`${ce}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${wr}}`},Description:`CloudFront distribution ARN for ${ce} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${ce}FailoverBucketName`,{Value:Or.replicaBucket,Description:`Failover replica bucket for ${ce} (${Or.replicaRegion}), outside this stack`});this.builder.addResource(wr,ac);let qu=`${br}CloudFrontPolicy`;if(this.builder.addResource(qu,{Type:"AWS::S3::BucketPolicy",DependsOn:[br,wr],Properties:{Bucket:{Ref:br},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${br}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${wr}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(ce,gt))for(let kr of Ht){let Fs=`${kr.logicalId}CloudFrontPolicy`;this.builder.addResource(Fs,{Type:"AWS::S3::BucketPolicy",DependsOn:[kr.logicalId,wr],Properties:{Bucket:{Ref:kr.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${kr.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${wr}}`}}}}]}}})}if(Er.length>0)v.push({name:ce,bucketLogicalId:br,distLogicalId:wr,oacLogicalId:Ee,aliases:Er});this.builder.addOutput(`${ce}CloudFrontDomain`,{Value:{"Fn::GetAtt":[wr,"DomainName"]},Description:`CloudFront domain for ${ce}`}),this.builder.addOutput(`${ce}CloudFrontDistributionId`,{Value:{Ref:wr},Description:`CloudFront distribution ID for ${ce}`})}if(this.builder.addOutput(`${ce}BucketName`,{Value:{Ref:br},Description:`S3 bucket name for ${ce}`}),ce==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:br},Description:"Frontend S3 bucket name"});if(ce==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:br},Description:"Documentation S3 bucket name"});if(ce==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:br},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let lt=this.mergedConfig.infrastructure.sftp,Ee=zd.create({...lt,storage:this.resolveSftpStorage(lt,l,f)??lt.storage,slug:l,environment:f});for(let[Ht,ce]of Object.entries(Ee.resources))this.builder.addResource(Ht,ce);this.builder.addOutput("SftpServerId",{Value:{Ref:Ee.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${Ee.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:Ee.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(de&&v.length>0)for(let{name:lt,distLogicalId:Ee,aliases:Ht}of v)for(let ce of Ht){let gt=ce.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${gt}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ee],Properties:{HostedZoneId:de,Name:ce,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ee,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${gt}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ee],Properties:{HostedZoneId:de,Name:ce,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[Ee,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[lt,Ee]of Object.entries(this.mergedConfig.infrastructure.databases))if(Ee.engine==="dynamodb"){let{table:Ht,logicalId:ce}=Yt.createTable({slug:l,environment:f,tableName:`${l}-${f}-${lt}`,partitionKey:Ee.partitionKey||{name:"id",type:"S"},sortKey:Ee.sortKey});this.builder.addResource(ce,Ht)}else if(Ee.engine==="postgres"){let{dbInstance:Ht,logicalId:ce}=Yt.createPostgres({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${lt}`,masterUsername:Ee.username||"admin",masterUserPassword:Ee.password||"changeme123",allocatedStorage:Ee.storage||20,dbInstanceClass:Ee.instanceClass||"db.t3.micro"});this.builder.addResource(ce,Ht)}else if(Ee.engine==="mysql"){let{dbInstance:Ht,logicalId:ce}=Yt.createMysql({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${lt}`,masterUsername:Ee.username||"admin",masterUserPassword:Ee.password||"changeme123",allocatedStorage:Ee.storage||20,dbInstanceClass:Ee.instanceClass||"db.t3.micro"});this.builder.addResource(ce,Ht)}}if(this.mergedConfig.infrastructure?.cdn)for(let[lt,Ee]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!Ee.origin)continue;let Ht=typeof Ee.customDomain==="string"?Ee.customDomain:Ee.customDomain?.domain||Ee.domain,ce=typeof Ee.customDomain==="object"?Ee.customDomain?.certificateArn:Ee.certificateArn,gt=ce||ve,Ft=`${l}${f}${lt}CDN`.replace(/[^a-zA-Z0-9]/g,""),lr=`S3-${l}-${f}-${lt}-cdn`,Cr=[{Id:lr,DomainName:Ee.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:Ee.originShield?{Enabled:!0,OriginShieldRegion:Ee.originShieldRegion||this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...re(Ee,`infrastructure.cdn.${lt}`)}],br=[],Ir=[],Or=["GET","HEAD","OPTIONS"],xr=lr,wr;if(Ee.failoverOrigin){yt(Or,`the default cache behavior of infrastructure.cdn.${lt}`);let bn=`${lr}-failover`,_r=typeof Ee.failoverOrigin==="string"?{domain:Ee.failoverOrigin}:Ee.failoverOrigin;if(!_r.domain)throw Error(`infrastructure.cdn.${lt}.failoverOrigin.domain is required`);if(_r.domain===Ee.origin)throw Error(`infrastructure.cdn.${lt}: failoverOrigin must differ from origin (both are ${Ee.origin})`);Cr.push({Id:bn,DomainName:_r.domain,OriginPath:_r.originPath||"",...Co(_r.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...re(_r,`infrastructure.cdn.${lt}.failoverOrigin`)}),wr=Xr({primaryOriginId:lr,secondaryOriginId:bn,statusCodes:Ee.failoverStatusCodes}),xr=wr.Items[0].Id}else if(Ee.failoverStatusCodes)throw Error(`infrastructure.cdn.${lt}: failoverStatusCodes needs failoverOrigin to fail over to`);if(Ee.routeCompute)this.appendComputeAppOrigin(Cr,br,Ir,l,f,this.resolveComputeCachePathPatterns(Ee.computeRoutes));let Er=gt&&Ht?{AcmCertificateArn:B&&!ce?{Ref:B}:gt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},sn=[...Ir];if(B&&!ce&&Ht)sn.push(B);let Fn={Type:"AWS::CloudFront::Distribution",...sn.length>0?{DependsOn:sn}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${lt} CDN`,DefaultRootObject:"index.html",Origins:Cr,...wr?{OriginGroups:wr}:{},DefaultCacheBehavior:{TargetOriginId:xr,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:Or,CachedMethods:["GET","HEAD","OPTIONS"],Compress:Ee.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...br.length>0?{CacheBehaviors:br}:{},...Ht&&gt?{Aliases:[Ht]}:{},ViewerCertificate:Er,PriceClass:"PriceClass_100",HttpVersion:Ee.http3?"http2and3":"http2"}}};if(St(Fn.Properties.DistributionConfig,`infrastructure.cdn.${lt}`),this.builder.addResource(Ft,Fn),de&&Ht&&gt){let bn=Ht.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${bn}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ft,...B&&!ce?[B]:[]],Properties:{HostedZoneId:de,Name:Ht,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Ft,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[lt,Ee]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(Ee))continue;let{queue:Ht,logicalId:ce}=H.createQueue({slug:l,environment:f,name:`${l}-${f}-${lt}`,fifo:Ee.fifo,visibilityTimeout:Ee.visibilityTimeout,messageRetentionPeriod:Ee.messageRetentionPeriod,delaySeconds:Ee.delaySeconds,maxMessageSize:Ee.maxMessageSize,receiveMessageWaitTime:Ee.receiveMessageWaitTime,contentBasedDeduplication:Ee.contentBasedDeduplication,encrypted:Ee.encrypted,kmsKeyId:Ee.kmsKeyId});this.builder.addResource(ce,Ht);let gt;if(Ee.deadLetterQueue){let{deadLetterQueue:Ft,updatedSourceQueue:lr,deadLetterLogicalId:Cr}=H.createDeadLetterQueue(ce,{slug:l,environment:f,maxReceiveCount:Ee.maxReceiveCount});gt=Cr,this.builder.addResource(Cr,Ft);let Ir=this.builder.getResources()[ce];if(Ir?.Properties)Ir.Properties.RedrivePolicy=lr.Properties?.RedrivePolicy}if(Ee.trigger){let Ft=Ee.trigger,lr=`${l}${f}${Ft.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Cr={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[ce,"Arn"]},FunctionName:{Ref:lr},BatchSize:Ft.batchSize||10,MaximumBatchingWindowInSeconds:Ft.batchWindow||0,Enabled:!0,...Ft.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Ft.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Ft.maxConcurrency}},...Ft.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Ft.filterPattern)}]}}},DependsOn:[ce,lr]};this.builder.addResource(`${ce}Trigger`,Cr)}if(Ee.alarms?.enabled){let Ft=Ee.alarms,lr=Ft.notificationTopicArn;if(!lr&&Ft.notificationEmails?.length){let Ir=`${ce}AlarmTopic`;this.builder.addResource(Ir,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-${lt}-alarms`,DisplayName:`${lt} Queue Alarms`}}),Ft.notificationEmails.forEach((Or,xr)=>{this.builder.addResource(`${Ir}Sub${xr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Ir},Protocol:"email",Endpoint:Or}})}),lr={Ref:Ir}}let Cr=Ft.queueDepthThreshold||1000;this.builder.addResource(`${ce}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${lt}-queue-depth`,AlarmDescription:`Queue ${lt} depth exceeds ${Cr} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Cr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ce,"QueueName"]}}],...lr&&{AlarmActions:[lr],OKActions:[lr]}}});let br=Ft.messageAgeThreshold||3600;if(this.builder.addResource(`${ce}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${lt}-message-age`,AlarmDescription:`Queue ${lt} oldest message exceeds ${br} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:br,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ce,"QueueName"]}}],...lr&&{AlarmActions:[lr],OKActions:[lr]}}}),gt&&Ft.dlqAlarm!==!1)this.builder.addResource(`${gt}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${lt}-dlq-messages`,AlarmDescription:`Dead letter queue for ${lt} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[gt,"QueueName"]}}],...lr&&{AlarmActions:[lr]}}})}if(Ee.subscribe){let Ft=Ee.subscribe,lr=Ft.topicArn;if(!lr&&Ft.topicName)lr={Ref:Ft.topicName};if(lr){this.builder.addResource(`${ce}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:ce}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[ce,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":lr}}}]}}});let Cr={TopicArn:lr,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[ce,"Arn"]},RawMessageDelivery:Ft.rawMessageDelivery||!1};if(Ft.filterPolicy)Cr.FilterPolicy=Ft.filterPolicy,Cr.FilterPolicyScope=Ft.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${ce}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Cr,DependsOn:`${ce}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(l,f);else this.generateRealtimeResources(l,f);let ct=this.mergedConfig.infrastructure?.redirects;if(ct){let lt=ct.target||this.mergedConfig.infrastructure?.dns?.domain||"",Ee=ct.protocol||"https";if(ct.domains?.length&&lt)for(let Ht of ct.domains){let{bucket:ce,bucketPolicy:gt,logicalId:Ft,policyLogicalId:lr}=bt.createDomainRedirectBucket({slug:l,environment:f,sourceDomain:Ht,targetDomain:lt,protocol:Ee});this.builder.addResource(Ft,ce),this.builder.addResource(lr,gt)}if(ct.paths&&Object.keys(ct.paths).length>0){let Ht=bt.fromMapping(ct.paths,{statusCode:ct.statusCode||301}),{function:ce,logicalId:gt}=bt.createPathRedirectFunction({slug:l,environment:f,rules:Ht});this.builder.addResource(gt,ce)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[lt,Ee]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:Ht,logicalId:ce}=To.createAlarm({slug:l,environment:f,alarmName:`${l}-${f}-${lt}`,metricName:Ee.metricName||"Errors",namespace:Ee.namespace||"AWS/Lambda",threshold:Ee.threshold||1,comparisonOperator:Ee.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(ce,Ht)}let xe=this.mergedConfig.infrastructure?.cache;if(xe){let lt=xe.type||"redis";if(lt==="redis"){this.generateNetworkInfrastructure(l,f);let Ee=xe.redis||{},{replicationGroup:Ht,subnetGroup:ce,logicalId:gt,subnetGroupId:Ft}=vo.createRedis({slug:l,environment:f,nodeType:Ee.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:Ee.engineVersion||"7.1",port:Ee.port||6379,numCacheClusters:Ee.numCacheNodes||2,automaticFailover:Ee.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:Ee.snapshotRetentionLimit||7,snapshotWindow:Ee.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(gt,Ht),ce&&Ft)this.builder.addResource(Ft,ce);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[gt,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[gt,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(lt==="memcached"){this.generateNetworkInfrastructure(l,f);let Ee=xe.elasticache||{},{cluster:Ht,subnetGroup:ce,logicalId:gt,subnetGroupId:Ft}=vo.createMemcached({slug:l,environment:f,nodeType:Ee.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:Ee.engineVersion||"1.6.22",numCacheNodes:Ee.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(gt,Ht),ce&&Ft)this.builder.addResource(Ft,ce);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[gt,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let Qt=this.mergedConfig.infrastructure?.email;if(Qt){let lt=Qt.domain||this.mergedConfig.infrastructure?.dns?.domain;if(lt){let{emailIdentity:Ee,logicalId:Ht}=m.verifyDomain({domain:lt,slug:l,environment:f,enableDkim:Qt.enableDkim!==!1,dkimKeyLength:Qt.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(Ht,Ee),Qt.configurationSet!==!1){let{configurationSet:Ft,logicalId:lr}=m.createConfigurationSet({slug:l,environment:f});this.builder.addResource(lr,Ft)}let ce=Qt.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(ce){if(Qt.enableDkim!==!1)for(let Ir=1;Ir<=3;Ir++){let Or=`DkimRecord${Ir}${lt.replace(/\./g,"")}`;this.builder.addResource(Or,{Type:"AWS::Route53::RecordSet",DependsOn:[Ht],Properties:{HostedZoneId:ce,Name:{"Fn::GetAtt":[Ht,`DkimDNSTokenName${Ir}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[Ht,`DkimDNSTokenValue${Ir}`]}]}})}let{record:Ft,logicalId:lr}=m.createSpfRecord(lt,ce);this.builder.addResource(lr,Ft);let{record:Cr,logicalId:br}=m.createDmarcRecord(lt,ce,{policy:"none",reportingEmail:Qt.dmarcReportingEmail||`dmarc-reports@${lt}`});this.builder.addResource(br,Cr)}this.builder.addOutput("EmailDomain",{Value:lt,Description:"SES verified email domain"});let gt=Qt.server;if(gt?.enabled&&ce){let Ft=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",lr=`${l}-${f}-email`,{role:Cr,policy:br,roleLogicalId:Ir,policyLogicalId:Or}=m.createEmailLambdaRole({slug:l,environment:f,s3BucketArn:`arn:aws:s3:::${lr}`,sesIdentityArn:`arn:aws:ses:${Ft}:*:identity/${lt}`});this.builder.addResource(Ir,Cr),this.builder.addResource(Or,br);let{function:xr,permission:wr,logicalId:Er,permissionLogicalId:sn}=m.createInboundEmailLambda({slug:l,environment:f,roleArn:{"Fn::GetAtt":[Ir,"Arn"]},s3BucketName:lr,organizedPrefix:"mailboxes/"});this.builder.addResource(Er,xr),this.builder.addResource(sn,wr);let Fn=m.createInboundEmailSetup({slug:l,environment:f,domain:lt,s3BucketName:lr,s3KeyPrefix:"inbox/",region:Ft,hostedZoneId:ce,lambdaFunctionArn:{"Fn::GetAtt":[Er,"Arn"]}});for(let[_r,Wn]of Object.entries(Fn.resources)){if(Wn.Type==="AWS::SES::ReceiptRule")Wn.DependsOn=[sn,Er];this.builder.addResource(_r,Wn)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:Er},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:lr,Description:"S3 bucket for email storage"});let bn=this.serverEipLogicalIds.get("app");if(bn&&ce){let Wn=`${gt?.subdomain||"mail"}.${lt}`,ti=Wn.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${ti}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ce,Name:Wn,Type:"A",TTL:"300",ResourceRecords:[{Ref:bn}]}})}this.builder.addOutput("MailHost",{Value:`mail.${lt}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let Ut=this.mergedConfig.infrastructure?.search;if(Ut){let lt=Ut.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(lt)this.generateNetworkInfrastructure(l,f);let{domain:Ee,logicalId:Ht}=Zt.createDomain({slug:l,environment:f,engineVersion:Ut.engineVersion||"OpenSearch_2.11",instanceType:Ut.instanceType||"t3.small.search",instanceCount:Ut.instanceCount||1,volumeSize:Ut.volumeSize||10,volumeType:Ut.volumeType||"gp3",dedicatedMaster:Ut.dedicatedMaster||!1,dedicatedMasterType:Ut.dedicatedMasterType,dedicatedMasterCount:Ut.dedicatedMasterCount||3,multiAz:Ut.multiAz||!1,encryption:Ut.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:Ut.advancedSecurity,autoTune:Ut.autoTune!==!1,vpc:lt});this.builder.addResource(Ht,Ee),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[Ht,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[Ht,"Arn"]},Description:"OpenSearch domain ARN"})}let Pt=this.mergedConfig.infrastructure?.fileSystem;if(Pt&&Object.keys(Pt).length>0){this.generateNetworkInfrastructure(l,f);for(let[lt,Ee]of Object.entries(Pt)){let{fileSystem:Ht,logicalId:ce}=ze.createFileSystem({slug:`${l}-${lt}`,environment:f,encrypted:Ee.encrypted!==!1,performanceMode:Ee.performanceMode||"generalPurpose",throughputMode:Ee.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(ce,Ht);let{securityGroup:gt,logicalId:Ft}=ze.createEfsSecurityGroup({slug:`${l}-${lt}`,environment:f,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Ft,gt);let{mountTargets:lr,logicalIds:Cr}=ze.createMultiAzMountTargets(ce,{slug:`${l}-${lt}`,environment:f,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Ft}});for(let br=0;br<lr.length;br++)this.builder.addResource(Cr[br],lr[br]);this.builder.addOutput(`${lt}FileSystemId`,{Value:{Ref:ce},Description:`EFS file system ID for ${lt}`})}}let ut=this.mergedConfig.infrastructure?.ai;if(ut){let lt=ut.service||"ecs",Ee=ut.models||["*"],Ht=ut.allowStreaming!==!1,ce;if(lt==="ecs")ce=Pe.enableBedrockForEcs({slug:l,environment:f,models:Ee,allowStreaming:Ht});else if(lt==="ec2")ce=Pe.enableBedrockForEc2({slug:l,environment:f,models:Ee,allowStreaming:Ht});else if(lt==="lambda")ce=Pe.enableBedrockForLambda({slug:l,environment:f,models:Ee,allowStreaming:Ht});else ce=Pe.createBedrockRole(lt,{slug:l,environment:f,models:Ee,allowStreaming:Ht});if(this.builder.addResource(ce.logicalId,ce.role),ut.allowAsync){let{policy:gt,logicalId:Ft}=Pe.createBedrockPolicy({slug:l,environment:f,models:Ee,allowStreaming:Ht,allowAsync:!0});this.builder.addResource(Ft,gt)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[ce.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(l,f){let C=this.mergedConfig.infrastructure?.realtime;if(!C)return;let A=C.name||`${l}-${f}-realtime`,w=C.scaling||{},de=C.storage||{type:"dynamodb"},v=w.handlerMemory||256,B=w.handlerTimeout||30,ve=`${l}${f}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),ct=`${l}${f}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(de.type==="dynamodb"){let Cr=de.dynamodb||{},br=Cr.billingMode||"PAY_PER_REQUEST";this.builder.addResource(ve,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-connections`,BillingMode:br,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}},...Cr.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-connections`},{Key:"Environment",Value:f}]}}),this.builder.addResource(ct,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-channels`,BillingMode:br,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-channels`},{Key:"Environment",Value:f}]}})}let xe=`${l}${f}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(xe,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[ve,"Arn"]},{"Fn::Sub":`\${${ve}.Arn}/index/*`},{"Fn::GetAtt":[ct,"Arn"]},{"Fn::Sub":`\${${ct}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let Qt=`${l}${f}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),Ut=`${l}${f}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),Pt=`${l}${f}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Qt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:B,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:ve},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[xe,ve]}),this.builder.addResource(Ut,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:B,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:ve},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[xe,ve,ct]}),this.builder.addResource(Pt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:B,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:ve},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[xe,ve,ct]});let ut=`${l}${f}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ut,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:A,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:A,Environment:f}}});let lt=`${Qt}Permission`,Ee=`${Ut}Permission`,Ht=`${Pt}Permission`;this.builder.addResource(lt,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Qt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${ut}}/*/$connect`}}}),this.builder.addResource(Ee,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Ut},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${ut}}/*/$disconnect`}}}),this.builder.addResource(Ht,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Pt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${ut}}/*/$default`}}});let ce=`${ut}ConnectInteg`,gt=`${ut}DisconnectInteg`,Ft=`${ut}MessageInteg`;this.builder.addResource(ce,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:ut},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Qt}.Arn}/invocations`}}}),this.builder.addResource(gt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:ut},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Ut}.Arn}/invocations`}}}),this.builder.addResource(Ft,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:ut},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Pt}.Arn}/invocations`}}}),this.builder.addResource(`${ut}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:ut},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${ce}}`}}}),this.builder.addResource(`${ut}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:ut},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${gt}}`}}}),this.builder.addResource(`${ut}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:ut},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Ft}}`}}});let lr=`${ut}Stage`;if(this.builder.addResource(lr,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:ut},StageName:f,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:w.messagesPerSecond||1000,ThrottlingRateLimit:w.messagesPerSecond||1000}}}),C.monitoring?.enabled){let Cr=C.monitoring,br=Cr.notificationTopicArn;if(!br&&Cr.notificationEmails?.length){let Ir=`${ut}AlarmTopic`;this.builder.addResource(Ir,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Cr.notificationEmails.forEach((Or,xr)=>{this.builder.addResource(`${Ir}Sub${xr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Ir},Protocol:"email",Endpoint:Or}})}),br={Ref:Ir}}if(Cr.connectionThreshold)this.builder.addResource(`${ut}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Cr.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Cr.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:ut}}],...br&&{AlarmActions:[br]}}});if(Cr.errorThreshold)this.builder.addResource(`${ut}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Cr.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Cr.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:ut}}],...br&&{AlarmActions:[br]}}})}this.builder.addOutput(`${ut}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${ut}}.execute-api.\${AWS::Region}.amazonaws.com/${f}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${ut}Id`,{Description:"WebSocket API ID",Value:{Ref:ut},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
 const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
 const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
 
@@ -170,7 +170,7 @@ catch (error) {
     return { statusCode: 500, body: JSON.stringify({ error: 'Internal error' }) };
   }
 };
-`.trim()}generateRealtimeServerResources(l,f){let C=this.mergedConfig.infrastructure?.realtime;if(!C)return;let A=C.server||{},w=A.port||6001,ve=A.instances||1,ae=`${l}${f}RealtimeSG`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ae,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`Security group for ${l} realtime WebSocket server`,GroupName:`${l}-${f}-realtime-sg`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:w,ToPort:w,CidrIp:"0.0.0.0/0",Description:"WebSocket connections"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS/WSS connections"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-realtime-sg`},{Key:"Environment",Value:f}]}});let ce=`${l}${f}RealtimeTaskDef`.replace(/[^a-zA-Z0-9]/g,""),Ee=`${l}${f}RealtimeTaskRole`.replace(/[^a-zA-Z0-9]/g,""),ut=`${l}${f}RealtimeExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ut,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}}),this.builder.addResource(Ee,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"RealtimeTaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},...A.redis?.enabled?[{Effect:"Allow",Action:["elasticache:DescribeCacheClusters","elasticache:DescribeReplicationGroups"],Resource:"*"}]:[]]}}]}});let xe=[{Name:"BROADCAST_HOST",Value:A.host||"0.0.0.0"},{Name:"BROADCAST_PORT",Value:String(w)},{Name:"NODE_ENV",Value:f==="production"?"production":"development"}];if(A.redis?.enabled){if(A.redis.useElastiCache)xe.push({Name:"REDIS_HOST",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Address"]}}),xe.push({Name:"REDIS_PORT",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Port"]}});else xe.push({Name:"REDIS_HOST",Value:A.redis.host||"localhost"}),xe.push({Name:"REDIS_PORT",Value:String(A.redis.port||6379)});if(A.redis.keyPrefix)xe.push({Name:"REDIS_KEY_PREFIX",Value:A.redis.keyPrefix})}this.builder.addResource(ce,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${f}-realtime`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:"512",Memory:"1024",ExecutionRoleArn:{"Fn::GetAtt":[ut,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Ee,"Arn"]},ContainerDefinitions:[{Name:"realtime",Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}-realtime:latest`},Essential:!0,PortMappings:[{ContainerPort:w,Protocol:"tcp"}],Environment:xe,LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":`/ecs/${l}-${f}-realtime`,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":"realtime"}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${w}${A.healthCheckPath||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${f}-realtime`},{Key:"Environment",Value:f}]},DependsOn:[ut,Ee]});let Mt=`${l}${f}RealtimeLogs`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Mt,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/ecs/${l}-${f}-realtime`,RetentionInDays:30}});let ar=`${l}${f}RealtimeService`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(ar,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-realtime`,Cluster:{Ref:"ECSCluster"},TaskDefinition:{Ref:ce},DesiredCount:ve,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ae}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},HealthCheckGracePeriodSeconds:60,Tags:[{Key:"Name",Value:`${l}-${f}-realtime`},{Key:"Environment",Value:f}]},DependsOn:[ce,ae,Mt]}),A.autoScaling){let Sr=A.autoScaling,gt=`${l}${f}RealtimeScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(gt,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:Sr.max||10,MinCapacity:Sr.min||1,ResourceId:{"Fn::Sub":`service/\${ECSCluster}/${l}-${f}-realtime`},RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs"},DependsOn:ar}),Sr.targetCPU)this.builder.addResource(`${l}${f}RealtimeCPUPolicy`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-realtime-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:gt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:Sr.targetCPU,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(C.monitoring?.enabled){let Sr=C.monitoring,gt=Sr.notificationTopicArn;if(!gt&&Sr.notificationEmails?.length){let ct=`${l}${f}RealtimeAlarmTopic`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ct,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-realtime-alarms`,DisplayName:"Realtime Server Alarms"}}),Sr.notificationEmails.forEach((B,$t)=>{this.builder.addResource(`${ct}Sub${$t}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:ct},Protocol:"email",Endpoint:B}})}),gt={Ref:ct}}this.builder.addResource(`${l}${f}RealtimeCPUAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-high-cpu`,AlarmDescription:"Realtime server CPU utilization is high",MetricName:"CPUUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${f}-realtime`}],...gt&&{AlarmActions:[gt]}},DependsOn:ar}),this.builder.addResource(`${l}${f}RealtimeMemoryAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-high-memory`,AlarmDescription:"Realtime server memory utilization is high",MetricName:"MemoryUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${f}-realtime`}],...gt&&{AlarmActions:[gt]}},DependsOn:ar})}this.builder.addOutput(`${l}${f}RealtimeEndpoint`.replace(/[^a-zA-Z0-9]/g,""),{Description:"Realtime WebSocket server endpoint",Value:{"Fn::Sub":`wss://${l}-${f}-realtime.\${AWS::Region}.elb.amazonaws.com:${w}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}})}generateBroadcastConfig(){let l=this.mergedConfig.infrastructure?.realtime;if(!l||l.mode!=="server")return"";let f=l.server||{};return`import type { BroadcastConfig } from 'ts-broadcasting'
+`.trim()}generateRealtimeServerResources(l,f){let C=this.mergedConfig.infrastructure?.realtime;if(!C)return;let A=C.server||{},w=A.port||6001,de=A.instances||1,v=`${l}${f}RealtimeSG`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(v,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`Security group for ${l} realtime WebSocket server`,GroupName:`${l}-${f}-realtime-sg`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:w,ToPort:w,CidrIp:"0.0.0.0/0",Description:"WebSocket connections"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS/WSS connections"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-realtime-sg`},{Key:"Environment",Value:f}]}});let B=`${l}${f}RealtimeTaskDef`.replace(/[^a-zA-Z0-9]/g,""),ve=`${l}${f}RealtimeTaskRole`.replace(/[^a-zA-Z0-9]/g,""),ct=`${l}${f}RealtimeExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ct,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]}}),this.builder.addResource(ve,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"RealtimeTaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},...A.redis?.enabled?[{Effect:"Allow",Action:["elasticache:DescribeCacheClusters","elasticache:DescribeReplicationGroups"],Resource:"*"}]:[]]}}]}});let xe=[{Name:"BROADCAST_HOST",Value:A.host||"0.0.0.0"},{Name:"BROADCAST_PORT",Value:String(w)},{Name:"NODE_ENV",Value:f==="production"?"production":"development"}];if(A.redis?.enabled){if(A.redis.useElastiCache)xe.push({Name:"REDIS_HOST",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Address"]}}),xe.push({Name:"REDIS_PORT",Value:{"Fn::GetAtt":["CacheCluster","RedisEndpoint.Port"]}});else xe.push({Name:"REDIS_HOST",Value:A.redis.host||"localhost"}),xe.push({Name:"REDIS_PORT",Value:String(A.redis.port||6379)});if(A.redis.keyPrefix)xe.push({Name:"REDIS_KEY_PREFIX",Value:A.redis.keyPrefix})}this.builder.addResource(B,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${f}-realtime`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:"512",Memory:"1024",ExecutionRoleArn:{"Fn::GetAtt":[ct,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[ve,"Arn"]},ContainerDefinitions:[{Name:"realtime",Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}-realtime:latest`},Essential:!0,PortMappings:[{ContainerPort:w,Protocol:"tcp"}],Environment:xe,LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":`/ecs/${l}-${f}-realtime`,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":"realtime"}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${w}${A.healthCheckPath||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${f}-realtime`},{Key:"Environment",Value:f}]},DependsOn:[ct,ve]});let Qt=`${l}${f}RealtimeLogs`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Qt,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:`/ecs/${l}-${f}-realtime`,RetentionInDays:30}});let Ut=`${l}${f}RealtimeService`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Ut,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-realtime`,Cluster:{Ref:"ECSCluster"},TaskDefinition:{Ref:B},DesiredCount:de,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:v}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},HealthCheckGracePeriodSeconds:60,Tags:[{Key:"Name",Value:`${l}-${f}-realtime`},{Key:"Environment",Value:f}]},DependsOn:[B,v,Qt]}),A.autoScaling){let Pt=A.autoScaling,ut=`${l}${f}RealtimeScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(ut,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:Pt.max||10,MinCapacity:Pt.min||1,ResourceId:{"Fn::Sub":`service/\${ECSCluster}/${l}-${f}-realtime`},RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs"},DependsOn:Ut}),Pt.targetCPU)this.builder.addResource(`${l}${f}RealtimeCPUPolicy`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-realtime-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:ut},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:Pt.targetCPU,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(C.monitoring?.enabled){let Pt=C.monitoring,ut=Pt.notificationTopicArn;if(!ut&&Pt.notificationEmails?.length){let lt=`${l}${f}RealtimeAlarmTopic`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(lt,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-realtime-alarms`,DisplayName:"Realtime Server Alarms"}}),Pt.notificationEmails.forEach((Ee,Ht)=>{this.builder.addResource(`${lt}Sub${Ht}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:lt},Protocol:"email",Endpoint:Ee}})}),ut={Ref:lt}}this.builder.addResource(`${l}${f}RealtimeCPUAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-high-cpu`,AlarmDescription:"Realtime server CPU utilization is high",MetricName:"CPUUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${f}-realtime`}],...ut&&{AlarmActions:[ut]}},DependsOn:Ut}),this.builder.addResource(`${l}${f}RealtimeMemoryAlarm`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-high-memory`,AlarmDescription:"Realtime server memory utilization is high",MetricName:"MemoryUtilization",Namespace:"AWS/ECS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:80,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ClusterName",Value:{Ref:"ECSCluster"}},{Name:"ServiceName",Value:`${l}-${f}-realtime`}],...ut&&{AlarmActions:[ut]}},DependsOn:Ut})}this.builder.addOutput(`${l}${f}RealtimeEndpoint`.replace(/[^a-zA-Z0-9]/g,""),{Description:"Realtime WebSocket server endpoint",Value:{"Fn::Sub":`wss://${l}-${f}-realtime.\${AWS::Region}.elb.amazonaws.com:${w}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}})}generateBroadcastConfig(){let l=this.mergedConfig.infrastructure?.realtime;if(!l||l.mode!=="server")return"";let f=l.server||{};return`import type { BroadcastConfig } from 'ts-broadcasting'
 
 export default {
   verbose: ${this.environment!=="production"},
@@ -219,7 +219,7 @@ ${f.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function _c(l){let f=[],C=[];if(!l.AWSTemplateFormatVersion)f.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(l.AWSTemplateFormatVersion!=="2010-09-09")C.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!l.Resources||Object.keys(l.Resources).length===0)f.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[A,w]of Object.entries(l.Resources))Gc(A,w,f,C);if(l.Resources){let A=$u(l.Resources);if(A.length>0)f.push({path:"Resources",message:`Circular dependencies detected: ${A.join(" -> ")}`,severity:"error"})}if(l.Parameters)for(let[A,w]of Object.entries(l.Parameters))kl(A,w,f,C);if(l.Outputs)for(let[A,w]of Object.entries(l.Outputs))Pu(A,w,f,C);return{valid:f.length===0,errors:f,warnings:C}}function Gc(l,f,C,A){if(!f.Type)C.push({path:`Resources.${l}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(l))A.push({path:`Resources.${l}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(f.Type&&!f.Type.startsWith("AWS::")&&!f.Type.startsWith("Custom::"))C.push({path:`Resources.${l}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(f.Properties){for(let[w,ve]of Object.entries(f.Properties))if(ve===void 0||ve===null)A.push({path:`Resources.${l}.Properties.${w}`,message:"Property has undefined or null value",severity:"warning"})}if(f.DependsOn){if(typeof f.DependsOn==="string"){if(f.DependsOn===l)C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(f.DependsOn)){if(f.DependsOn.includes(l))C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function kl(l,f,C,A){if(!f.Type)C.push({path:`Parameters.${l}.Type`,message:"Parameter Type is required",severity:"error"});let w=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(f.Type&&!w.includes(f.Type)&&!f.Type.startsWith("AWS::"))A.push({path:`Parameters.${l}.Type`,message:`Uncommon parameter type: ${f.Type}`,severity:"warning"});if(f.NoEcho&&f.Default)A.push({path:`Parameters.${l}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Pu(l,f,C,A){if(!f.Value)C.push({path:`Outputs.${l}.Value`,message:"Output Value is required",severity:"error"})}function $u(l){let f={};for(let[ae,ce]of Object.entries(l)){if(f[ae]=[],ce.DependsOn){if(typeof ce.DependsOn==="string")f[ae].push(ce.DependsOn);else if(Array.isArray(ce.DependsOn))f[ae].push(...ce.DependsOn)}let Ee=$s(ce);f[ae].push(...Ee)}let C=new Set,A=new Set,w=[];function ve(ae,ce){C.add(ae),A.add(ae),ce.push(ae);let Ee=f[ae]||[];for(let ut of Ee)if(!C.has(ut)){if(ve(ut,ce))return!0}else if(A.has(ut)){let xe=ce.indexOf(ut);return w.push(...ce.slice(xe),ut),!0}return ce.pop(),A.delete(ae),!1}for(let ae of Object.keys(f))if(!C.has(ae)){if(ve(ae,[]))return w}return[]}function $s(l,f=[]){if(typeof l!=="object"||l===null)return f;if(Array.isArray(l)){for(let C of l)$s(C,f);return f}if(l.Ref&&typeof l.Ref==="string"&&!l.Ref.startsWith("AWS::"))f.push(l.Ref);if(l["Fn::GetAtt"]){let C=l["Fn::GetAtt"];if(Array.isArray(C)&&C.length>0)f.push(C[0])}for(let C of Object.values(l))$s(C,f);return f}function Nu(l){let f=[],C=[],A=new TextEncoder().encode(l).length,w=51200,ve=460800;if(A>51200)if(A>460800)f.push({path:"template",message:`Template size (${A} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else C.push({path:"template",message:`Template size (${A} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:f.length===0,errors:f,warnings:C}}function ku(l){let f=[],C=[],A=l.Resources?Object.keys(l.Resources).length:0,w=l.Parameters?Object.keys(l.Parameters).length:0,ve=l.Outputs?Object.keys(l.Outputs).length:0;if(A>500)f.push({path:"Resources",message:`Template has ${A} resources, exceeding the limit of 500`,severity:"error"});else if(A>200)C.push({path:"Resources",message:`Template has ${A} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(w>200)f.push({path:"Parameters",message:`Template has ${w} parameters, exceeding the limit of 200`,severity:"error"});if(ve>200)f.push({path:"Outputs",message:`Template has ${ve} outputs, exceeding the limit of 200`,severity:"error"});return{valid:f.length===0,errors:f,warnings:C}}function Og(l){let{domains:f,email:C,staging:A=!1,challengeType:w="http-01",certPath:ve="/etc/letsencrypt/live",autoRenew:ae=!0}=l,ce=f[0],Ee=f.map((xe)=>`-d ${xe}`).join(" "),ut=A?"--staging":"";if(w==="http-01")return xu({domains:f,email:C,staging:A,certPath:ve,autoRenew:ae,domainFlags:Ee,stagingFlag:ut,primaryDomain:ce});else{let xe=l.dnsProvider?.provider||(l.hostedZoneId?"route53":void 0);return Lu({domains:f,email:C,staging:A,certPath:ve,autoRenew:ae,domainFlags:Ee,stagingFlag:ut,primaryDomain:ce,hostedZoneId:l.hostedZoneId,dnsProvider:l.dnsProvider,dnsProviderType:xe})}}function xu(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:ve,primaryDomain:ae}=l;return`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Kf(l){let f=[],C=[];if(!l.AWSTemplateFormatVersion)f.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(l.AWSTemplateFormatVersion!=="2010-09-09")C.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!l.Resources||Object.keys(l.Resources).length===0)f.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[A,w]of Object.entries(l.Resources))qf(A,w,f,C);if(l.Resources){let A=tg(l.Resources);if(A.length>0)f.push({path:"Resources",message:`Circular dependencies detected: ${A.join(" -> ")}`,severity:"error"})}if(l.Parameters)for(let[A,w]of Object.entries(l.Parameters))Zf(A,w,f,C);if(l.Outputs)for(let[A,w]of Object.entries(l.Outputs))eg(A,w,f,C);return{valid:f.length===0,errors:f,warnings:C}}function qf(l,f,C,A){if(!f.Type)C.push({path:`Resources.${l}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(l))A.push({path:`Resources.${l}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(f.Type&&!f.Type.startsWith("AWS::")&&!f.Type.startsWith("Custom::"))C.push({path:`Resources.${l}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(f.Properties){for(let[w,de]of Object.entries(f.Properties))if(de===void 0||de===null)A.push({path:`Resources.${l}.Properties.${w}`,message:"Property has undefined or null value",severity:"warning"})}if(f.DependsOn){if(typeof f.DependsOn==="string"){if(f.DependsOn===l)C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(f.DependsOn)){if(f.DependsOn.includes(l))C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Zf(l,f,C,A){if(!f.Type)C.push({path:`Parameters.${l}.Type`,message:"Parameter Type is required",severity:"error"});let w=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(f.Type&&!w.includes(f.Type)&&!f.Type.startsWith("AWS::"))A.push({path:`Parameters.${l}.Type`,message:`Uncommon parameter type: ${f.Type}`,severity:"warning"});if(f.NoEcho&&f.Default)A.push({path:`Parameters.${l}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function eg(l,f,C,A){if(!f.Value)C.push({path:`Outputs.${l}.Value`,message:"Output Value is required",severity:"error"})}function tg(l){let f={};for(let[v,B]of Object.entries(l)){if(f[v]=[],B.DependsOn){if(typeof B.DependsOn==="string")f[v].push(B.DependsOn);else if(Array.isArray(B.DependsOn))f[v].push(...B.DependsOn)}let ve=Cc(B);f[v].push(...ve)}let C=new Set,A=new Set,w=[];function de(v,B){C.add(v),A.add(v),B.push(v);let ve=f[v]||[];for(let ct of ve)if(!C.has(ct)){if(de(ct,B))return!0}else if(A.has(ct)){let xe=B.indexOf(ct);return w.push(...B.slice(xe),ct),!0}return B.pop(),A.delete(v),!1}for(let v of Object.keys(f))if(!C.has(v)){if(de(v,[]))return w}return[]}function Cc(l,f=[]){if(typeof l!=="object"||l===null)return f;if(Array.isArray(l)){for(let C of l)Cc(C,f);return f}if(l.Ref&&typeof l.Ref==="string"&&!l.Ref.startsWith("AWS::"))f.push(l.Ref);if(l["Fn::GetAtt"]){let C=l["Fn::GetAtt"];if(Array.isArray(C)&&C.length>0)f.push(C[0])}for(let C of Object.values(l))Cc(C,f);return f}function ng(l){let f=[],C=[],A=new TextEncoder().encode(l).length,w=51200,de=460800;if(A>51200)if(A>460800)f.push({path:"template",message:`Template size (${A} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else C.push({path:"template",message:`Template size (${A} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:f.length===0,errors:f,warnings:C}}function ig(l){let f=[],C=[],A=l.Resources?Object.keys(l.Resources).length:0,w=l.Parameters?Object.keys(l.Parameters).length:0,de=l.Outputs?Object.keys(l.Outputs).length:0;if(A>500)f.push({path:"Resources",message:`Template has ${A} resources, exceeding the limit of 500`,severity:"error"});else if(A>200)C.push({path:"Resources",message:`Template has ${A} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(w>200)f.push({path:"Parameters",message:`Template has ${w} parameters, exceeding the limit of 200`,severity:"error"});if(de>200)f.push({path:"Outputs",message:`Template has ${de} outputs, exceeding the limit of 200`,severity:"error"});return{valid:f.length===0,errors:f,warnings:C}}function dh(l){let{domains:f,email:C,staging:A=!1,challengeType:w="http-01",certPath:de="/etc/letsencrypt/live",autoRenew:v=!0}=l,B=f[0],ve=f.map((xe)=>`-d ${xe}`).join(" "),ct=A?"--staging":"";if(w==="http-01")return og({domains:f,email:C,staging:A,certPath:de,autoRenew:v,domainFlags:ve,stagingFlag:ct,primaryDomain:B});else{let xe=l.dnsProvider?.provider||(l.hostedZoneId?"route53":void 0);return sg({domains:f,email:C,staging:A,certPath:de,autoRenew:v,domainFlags:ve,stagingFlag:ct,primaryDomain:B,hostedZoneId:l.hostedZoneId,dnsProvider:l.dnsProvider,dnsProviderType:xe})}}function og(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:de,primaryDomain:v}=l;return`
 # ==========================================
 # Let's Encrypt Certificate Setup (HTTP-01)
 # ==========================================
@@ -236,28 +236,28 @@ certbot certonly \\
   --non-interactive \\
   --agree-tos \\
   --email ${f} \\
-  ${ve} \\
+  ${de} \\
   ${w}
 
 # Check if certificate was obtained
-if [ -f "${C}/${ae}/fullchain.pem" ]; then
+if [ -f "${C}/${v}/fullchain.pem" ]; then
   echo "Certificate obtained successfully!"
 
   # Create symlinks for easier access
   mkdir -p /etc/ssl/stacks
-  ln -sf ${C}/${ae}/fullchain.pem /etc/ssl/stacks/fullchain.pem
-  ln -sf ${C}/${ae}/privkey.pem /etc/ssl/stacks/privkey.pem
-  ln -sf ${C}/${ae}/cert.pem /etc/ssl/stacks/cert.pem
-  ln -sf ${C}/${ae}/chain.pem /etc/ssl/stacks/chain.pem
+  ln -sf ${C}/${v}/fullchain.pem /etc/ssl/stacks/fullchain.pem
+  ln -sf ${C}/${v}/privkey.pem /etc/ssl/stacks/privkey.pem
+  ln -sf ${C}/${v}/cert.pem /etc/ssl/stacks/cert.pem
+  ln -sf ${C}/${v}/chain.pem /etc/ssl/stacks/chain.pem
 else
   echo "Failed to obtain certificate!"
 fi
 
-${A?Us(ae):"# Auto-renewal disabled"}
+${A?Sc(v):"# Auto-renewal disabled"}
 
 # Restart the application
 systemctl start stacks
-`}function Lu(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:ve,primaryDomain:ae,hostedZoneId:ce,dnsProvider:Ee,dnsProviderType:ut}=l;if(ut==="route53"||ce){if(!ce)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
+`}function sg(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:de,primaryDomain:v,hostedZoneId:B,dnsProvider:ve,dnsProviderType:ct}=l;if(ct==="route53"||B){if(!B)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via Route53)
 # ==========================================
@@ -271,25 +271,25 @@ certbot certonly \\
   --non-interactive \\
   --agree-tos \\
   --email ${f} \\
-  ${ve} \\
+  ${de} \\
   ${w}
 
 # Check if certificate was obtained
-if [ -f "${C}/${ae}/fullchain.pem" ]; then
+if [ -f "${C}/${v}/fullchain.pem" ]; then
   echo "Certificate obtained successfully!"
 
   # Create symlinks for easier access
   mkdir -p /etc/ssl/stacks
-  ln -sf ${C}/${ae}/fullchain.pem /etc/ssl/stacks/fullchain.pem
-  ln -sf ${C}/${ae}/privkey.pem /etc/ssl/stacks/privkey.pem
-  ln -sf ${C}/${ae}/cert.pem /etc/ssl/stacks/cert.pem
-  ln -sf ${C}/${ae}/chain.pem /etc/ssl/stacks/chain.pem
+  ln -sf ${C}/${v}/fullchain.pem /etc/ssl/stacks/fullchain.pem
+  ln -sf ${C}/${v}/privkey.pem /etc/ssl/stacks/privkey.pem
+  ln -sf ${C}/${v}/cert.pem /etc/ssl/stacks/cert.pem
+  ln -sf ${C}/${v}/chain.pem /etc/ssl/stacks/chain.pem
 else
   echo "Failed to obtain certificate!"
 fi
 
-${A?Us(ae):"# Auto-renewal disabled"}
-`}if(!Ee)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let xe=Ee.provider.toUpperCase(),Mt=Bu(Ee);return`
+${A?Sc(v):"# Auto-renewal disabled"}
+`}if(!ve)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let xe=ve.provider.toUpperCase(),Qt=mg(ve);return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via ${xe})
 # ==========================================
@@ -297,7 +297,7 @@ ${A?Us(ae):"# Auto-renewal disabled"}
 # Install certbot
 dnf install -y certbot jq curl
 
-${Mt}
+${Qt}
 
 # Create DNS challenge hook scripts directory
 mkdir -p /etc/letsencrypt/hooks
@@ -312,7 +312,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${_u(Ee)}
+${fg(ve)}
 
 # Wait for DNS propagation
 echo "Waiting 60 seconds for DNS propagation..."
@@ -331,7 +331,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${Vu(Ee)}
+${hg(ve)}
 CLEANUPHOOK
 
 chmod +x /etc/letsencrypt/hooks/cleanup-hook.sh
@@ -345,25 +345,25 @@ certbot certonly \\
   --non-interactive \\
   --agree-tos \\
   --email ${f} \\
-  ${ve} \\
+  ${de} \\
   ${w}
 
 # Check if certificate was obtained
-if [ -f "${C}/${ae}/fullchain.pem" ]; then
+if [ -f "${C}/${v}/fullchain.pem" ]; then
   echo "Certificate obtained successfully!"
 
   # Create symlinks for easier access
   mkdir -p /etc/ssl/stacks
-  ln -sf ${C}/${ae}/fullchain.pem /etc/ssl/stacks/fullchain.pem
-  ln -sf ${C}/${ae}/privkey.pem /etc/ssl/stacks/privkey.pem
-  ln -sf ${C}/${ae}/cert.pem /etc/ssl/stacks/cert.pem
-  ln -sf ${C}/${ae}/chain.pem /etc/ssl/stacks/chain.pem
+  ln -sf ${C}/${v}/fullchain.pem /etc/ssl/stacks/fullchain.pem
+  ln -sf ${C}/${v}/privkey.pem /etc/ssl/stacks/privkey.pem
+  ln -sf ${C}/${v}/cert.pem /etc/ssl/stacks/cert.pem
+  ln -sf ${C}/${v}/chain.pem /etc/ssl/stacks/chain.pem
 else
   echo "Failed to obtain certificate!"
 fi
 
-${A?Us(ae):"# Auto-renewal disabled"}
-`}function Bu(l){switch(l.provider){case"porkbun":return`
+${A?Sc(v):"# Auto-renewal disabled"}
+`}function mg(l){switch(l.provider){case"porkbun":return`
 # Porkbun API credentials
 export PORKBUN_API_KEY="${l.apiKey}"
 export PORKBUN_SECRET_KEY="${l.secretKey}"
@@ -374,7 +374,7 @@ export GODADDY_API_SECRET="${l.apiSecret}"
 export GODADDY_ENV="${l.environment||"production"}"
 `;case"route53":return`
 # Route53 uses IAM role credentials
-`;default:return""}}function _u(l){switch(l.provider){case"porkbun":return`
+`;default:return""}}function fg(l){switch(l.provider){case"porkbun":return`
 # Extract root domain (last two parts)
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -418,7 +418,7 @@ curl -s -X PATCH "$API_URL/v1/domains/$ROOT_DOMAIN/records" \\
     "data": "'"$VALIDATION"'",
     "ttl": 600
   }]'
-`;default:return'echo "Unsupported DNS provider"'}}function Vu(l){switch(l.provider){case"porkbun":return`
+`;default:return'echo "Unsupported DNS provider"'}}function hg(l){switch(l.provider){case"porkbun":return`
 # Extract root domain, and the challenge's subdomain the way the auth hook did
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -470,7 +470,7 @@ fi
 
 curl -s -X DELETE "$API_URL/v1/domains/$ROOT_DOMAIN/records/TXT/$RECORD_NAME" \\
   -H "Authorization: sso-key $GODADDY_API_KEY:$GODADDY_API_SECRET"
-`;default:return'echo "Unsupported DNS provider"'}}function Us(l){return`
+`;default:return'echo "Unsupported DNS provider"'}}function Sc(l){return`
 # ==========================================
 # Certificate Auto-Renewal Setup
 # ==========================================
@@ -515,7 +515,7 @@ systemctl enable certbot-renewal.timer
 systemctl start certbot-renewal.timer
 
 echo "Certificate auto-renewal configured"
-`}function Eg(l){let{httpPort:f=80,httpsPort:C=443,certPath:A="/etc/ssl/stacks",redirectHttp:w=!0}=l;return`
+`}function ph(l){let{httpPort:f=80,httpsPort:C=443,certPath:A="/etc/ssl/stacks",redirectHttp:w=!0}=l;return`
 // HTTPS Server with Let's Encrypt certificates
 import { existsSync } from 'node:fs'
 
@@ -601,5 +601,5 @@ async function handleRequest(request: Request): Promise<Response> {
   // Implement your request handling here
   return new Response('Hello from Stacks!')
 }
-`}async function Gu(l,f,C){let A=`_acme-challenge.${f}`;if(await Yu(l,f,A,C))return;let w=await l.createRecord(f,{name:A,type:"TXT",content:C,ttl:60});if(!w.success)throw Error(`Failed to create DNS challenge record: ${w.message}`)}async function Zu(l,f,C){let A=await l.deleteRecord(f,{name:`_acme-challenge.${f}`,type:"TXT",content:C});if(!A.success)console.warn(`Failed to delete DNS challenge record: ${A.message}`)}async function Yu(l,f,C,A){try{let w=await l.listRecords(f,"TXT"),ve=C.replace(/\.$/,"").toLowerCase();return(w.records??[]).some((ae)=>ae.name.replace(/\.$/,"").toLowerCase()===ve&&ae.content.replace(/^"|"$/g,"")===A)}catch{return!1}}function bc(l){let{hostedZoneId:f,dnsProvider:C,region:A="us-east-1"}=l;if(C)return D(C);if(f)return new J(A,f);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function Ng(l){await Gu(bc(l),l.domain,l.challengeValue)}async function kg(l){await Zu(bc(l),l.domain,l.challengeValue)}function xg(l){try{let{execSync:f}=Xe("node:child_process"),C=f(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as Rc,createSign as Vf,generateKeyPairSync as Pc}from"node:crypto";var Tc={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class Hf{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?Tc.staging:Tc.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=Pc("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let A=this.nonce;return this.nonce=null,A}let l=await this.getDirectory(),C=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!C)throw Error("Failed to get nonce from ACME server");return C}getJwk(){let l=this.accountKey.split(`
-`).filter((ve)=>!ve.startsWith("-----")).join(""),f=Buffer.from(l,"base64"),C=f.length-65,A=f.subarray(C+1,C+33),w=f.subarray(C+33,C+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(A),y:this.base64UrlEncode(w)}}getJwkThumbprint(){let l=this.getJwk(),f=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),C=Rc("sha256").update(f).digest();return this.base64UrlEncode(C)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,f){let C=await this.getNonce(),A=this.getJwk(),w={alg:"ES256",nonce:C,url:l};if(this.accountUrl)w.kid=this.accountUrl;else w.jwk=A;let ve=this.base64UrlEncode(JSON.stringify(w)),ae=f===""?"":this.base64UrlEncode(JSON.stringify(f)),ce=`${ve}.${ae}`,Ee=Vf("SHA256");Ee.update(ce);let ut=Ee.sign(this.accountKey),xe=ut.subarray(4,4+ut[3]),Mt=4+ut[3]+2,ar=ut.subarray(Mt,Mt+ut[Mt-1]),Sr=Buffer.alloc(32),gt=Buffer.alloc(32);xe.copy(Sr,32-xe.length),ar.copy(gt,32-ar.length);let ct=Buffer.concat([Sr,gt]);return JSON.stringify({protected:ve,payload:ae,signature:this.base64UrlEncode(ct)})}async acmeRequest(l,f){let C=await this.signPayload(l,f),A=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:C}),w=A.headers.get("replay-nonce");if(w)this.nonce=w;let ve,ae=A.headers.get("content-type");if(ae?.includes("application/json")||ae?.includes("application/problem+json"))ve=await A.json();else ve=await A.text();if(!A.ok)throw Error(`ACME request failed: ${JSON.stringify(ve)}`);return{body:ve,headers:A.headers}}async registerAccount(){let l=await this.getDirectory(),{body:f,headers:C}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),A=C.get("location");if(!A)throw Error("No account URL returned");return this.accountUrl=A,A}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let f=await this.getDirectory(),{body:C,headers:A}=await this.acmeRequest(f.newOrder,{identifiers:l.map((ve)=>({type:"dns",value:ve}))}),w=A.get("location");if(!w)throw Error("No order URL returned");return{orderUrl:w,authorizations:C.authorizations,finalize:C.finalize}}async getAuthorization(l){let{body:f}=await this.acmeRequest(l,""),C=f.identifier.value,A=this.getJwkThumbprint(),w=f.challenges.filter((ve)=>ve.type==="http-01"||ve.type==="dns-01").map((ve)=>{let ae=`${ve.token}.${A}`;if(ve.type==="http-01")return{type:"http-01",token:ve.token,keyAuthorization:ae,identifier:`/.well-known/acme-challenge/${ve.token}`};else{let ce=this.base64UrlEncode(Rc("sha256").update(ae).digest());return{type:"dns-01",token:ve.token,keyAuthorization:ae,identifier:`_acme-challenge.${C}`,dnsValue:ce}}});return{domain:C,challenges:w}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,f=30){for(let C=0;C<f;C++){let{body:A}=await this.acmeRequest(l,"");if(A.status==="valid")return;if(A.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(A)}`);await new Promise((w)=>setTimeout(w,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:f}=Pc("rsa",{modulusLength:2048}),C=f.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,f),privateKey:C}}createSimpleCsr(l,f){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,f){let{csr:C,privateKey:A}=this.generateCsr(f),{body:w}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(C,"base64"))}),ve=w.certificate;if(!ve)throw Error("Certificate not immediately available - polling not implemented");let ce=await(await fetch(ve)).text(),Ee=ce.split(/(?=-----BEGIN CERTIFICATE-----)/g),ut=Ee[0],xe=Ee.slice(1).join("");return{certificate:ut,privateKey:A,chain:xe,fullchain:ce,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var tn=(l)=>l===void 0?void 0:l?"on":"off";function Qs(l){let f={ssl:l.ssl,always_use_https:tn(l.alwaysUseHttps),automatic_https_rewrites:tn(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:tn(l.tls13),brotli:tn(l.brotli),http3:tn(l.http3),"0rtt":tn(l.zeroRtt),early_hints:tn(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:tn(l.alwaysOnline),websockets:tn(l.websockets),email_obfuscation:tn(l.emailObfuscation)};if(l.hsts)f.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let C of Object.keys(f))if(f[C]===void 0)delete f[C];return{...f,...l.raw??{}}}var Zn={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Gf}from"node:tls";async function ec(l){let{address:f,serverName:C,port:A=443,timeoutMs:w=5000}=l;return new Promise((ve)=>{let ae=!1,ce=(ut)=>{if(ae)return;ae=!0;try{Ee.destroy()}catch{}ve(ut)},Ee=Gf({host:f,port:A,servername:C,rejectUnauthorized:!1,timeout:w});Ee.once("secureConnect",()=>{if(Ee.authorized){ce({reachable:!0,trusted:!0});return}ce({reachable:!0,trusted:!1,reason:Ee.authorizationError?String(Ee.authorizationError):"origin certificate is not trusted for this hostname"})}),Ee.once("timeout",()=>{ce({reachable:!1,trusted:!1,reason:`no TLS handshake within ${w}ms`})}),Ee.once("error",(ut)=>{ce({reachable:!1,trusted:!1,reason:ut.message})})})}function zf(l,f){let C=f.replace(/\.$/,"").toLowerCase();return l.some((A)=>{let w=A.replace(/\.$/,"").toLowerCase();if(w===C)return!0;if(!w.startsWith("*."))return!1;let ve=w.slice(2);if(!C.endsWith(`.${ve}`))return!1;return!C.slice(0,C.length-ve.length-1).includes(".")})}async function jf(l){let{provider:f,zone:C,hosts:A,ipv4:w,ipv6:ve,proxied:ae=!0,settings:ce=Zn,cache:Ee,originGuard:ut,purge:xe=!0,ttl:Mt=300,skipOriginProbe:ar=!1,skipEdgeCertificateCheck:Sr=!1}=l,gt={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(A.length===0)return gt;let ct=[],B=ae&&!Sr?await f.listEdgeCertificateHosts(C):null;for(let v of A){let lt=ae;if(lt&&B&&!zf(B,v)){lt=!1;let Lt=B.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${B.join(", ")})`;gt.deferredProxy.push({host:v,reason:Lt}),gt.warnings.push(`${v}: publishing DNS-only — ${Lt}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(lt&&!ar){let Lt=await ec({address:w,serverName:v});if(!Lt.trusted){lt=!1;let Ft=Lt.reason||"origin is not serving a trusted certificate";gt.deferredProxy.push({host:v,reason:Ft}),gt.warnings.push(`${v}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Ft}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(lt)ct.push(v);let Pt=[{type:"A",content:w}];if(ve&&Ln(v))Pt.push({type:"AAAA",content:ve});for(let{type:Lt,content:Ft}of Pt){let yr=await f.upsertRecord(C,{name:v,type:Lt,content:Ft,ttl:Mt,proxied:lt});if(yr.success)gt.records.push({host:v,type:Lt,content:Ft,proxied:lt});else gt.warnings.push(`${v} ${Lt} → ${Ft} failed: ${yr.message||"unknown provider error"}`)}}if(ct.length===0){if(ae)gt.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return gt}try{let v=Qs(ce),lt=await f.applyZoneSettings(C,v);gt.settingsChanged=lt.changed;for(let Pt of lt.failed)gt.warnings.push(`zone setting '${Pt.id}' could not be applied: ${Pt.error}`)}catch(v){gt.warnings.push(`zone settings could not be read: ${v instanceof Error?v.message:String(v)}`)}let $t=dc(ct,Ee);if($t.length>0){let v=await f.putManagedPhaseRules(C,"http_request_cache_settings",$t);if(v.success)gt.cacheRules=$t.length;else gt.warnings.push(`cache rules could not be written: ${v.message}`)}if(ut){let v=lc(ct,ut.header,ut.value);if(v.length>0){let lt=await f.putManagedPhaseRules(C,"http_request_late_transform",v);if(lt.success)gt.originGuard=!0;else gt.warnings.push(`origin guard header could not be written: ${lt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(xe){if(gt.purged=await f.purgeCache(C,{hosts:ct}),!gt.purged)gt.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return gt}var Zf=(l)=>process.env[l];function $c(l,f){let C=l.replace(/\.$/,"").toLowerCase();if(f){let A=f.replace(/\.$/,"").toLowerCase();if(C===A||C.endsWith(`.${A}`))return A}return C.split(".").slice(-2).join(".")}function qf(l,f={}){let C=f.env??Zf,A=l.infrastructure?.compute?.proxy?.cdn,w=[];if(!A||A.provider!=="cloudflare")return{plan:null,errors:w};if(A.originDomain)w.push(`compute.proxy.cdn.originDomain (${A.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let ve=C("CLOUDFLARE_API_TOKEN");if(!ve)return w.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:w};let ae=l.sites??{},ce=A.frontedHosts?.length?[...new Set(A.frontedHosts.map((ar)=>ar.toLowerCase()))]:Hn(ae,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(ce.length===0)return w.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:w};let Ee=l.infrastructure?.dns?.domain,ut=new Set(ce.map((ar)=>$c(ar,Ee)));if(ut.size>1)return w.push(`Fronted hosts span more than one zone (${[...ut].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:w};let xe=A.cloudflare??{},Mt=A.secret?{header:A.secretHeader??"X-Origin-Verify",value:A.secret}:void 0;return{plan:{zone:[...ut][0],hosts:ce,apiToken:ve,zoneId:xe.zoneId??C("CLOUDFLARE_ZONE_ID"),accountId:xe.accountId??C("CLOUDFLARE_ACCOUNT_ID"),proxied:xe.proxied!==!1,settings:xe.settings??Zn,cache:xe.cache,originGuard:Mt,purge:xe.purgeOnDeploy!==!1,skipOriginProbe:xe.skipOriginProbe===!0},errors:w}}var Yf=26214400;var Xf=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class Dc{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,f,C){return as(l,`/accounts/${this.accountId}${f}`,`Bearer ${this.apiToken}`,C)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(f){if(f instanceof Error&&/\b8000007\b|not found/i.test(f.message))return null;throw f}}async ensureProject(l,f="main"){let C=await this.getProject(l);if(C)return C;return this.request("POST","/pages/projects",{name:l,production_branch:f})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,f){let C=await as("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:f});return new Set(C)}async upsertHashes(l,f){await as("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:f})}async uploadBatch(l,f){let C=f.map((A)=>({key:A.hash,value:A.base64,metadata:{contentType:tg(A.extension)},base64:!0}));await as("POST","/pages/assets/upload",`Bearer ${l}`,C)}async createDeployment(l,f,C){let A={};for(let ve of f)A[ve.path]=ve.hash;let w=new FormData;if(w.append("manifest",JSON.stringify(A)),C)w.append("branch",C);return this.request("POST",`/pages/projects/${l}/deployments`,w)}async deployDirectory(l){let f=await wc(l.directory);if(f.length===0)throw Error(`No files to deploy in ${l.directory}`);let C=await this.uploadToken(l.project),A=await this.missingHashes(C,f.map((Ee)=>Ee.hash)),w=f.filter((Ee)=>A.has(Ee.hash)),ve=[];for(let Ee=0;Ee<w.length;Ee+=100)ve.push(w.slice(Ee,Ee+100));let ae=0;for(let Ee=0;Ee<ve.length;Ee+=4){let ut=ve.slice(Ee,Ee+4);await Promise.all(ut.map((xe)=>this.uploadBatch(C,xe))),ae+=ut.reduce((xe,Mt)=>xe+Mt.length,0),l.onProgress?.(ae,w.length)}return await this.upsertHashes(C,f.map((Ee)=>Ee.hash)),{deployment:await this.createDeployment(l.project,f,l.branch),total:f.length,uploaded:w.length,uploadedBytes:w.reduce((Ee,ut)=>Ee+ut.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((C)=>C.name)}async attachCustomDomain(l,f){if((await this.listCustomDomains(l)).includes(f))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:f}),!0}}function Qf(l,f){return{type:"CNAME",name:l,value:f.endsWith(".pages.dev")?f:`${f}.pages.dev`,ttl:1,proxied:!0}}async function Ic(l,f){let{blake3:C}=await import("./chunk-t52wetq8.js").then((m)=>sS(m.default,1));return(await C(l+f)).slice(0,32)}async function wc(l){let{readdir:f}=await import("node:fs/promises"),{join:C,relative:A,sep:w}=await import("node:path"),ve=[];async function ae(ce){let Ee=await f(ce,{withFileTypes:!0});for(let ut of Ee){let xe=C(ce,ut.name);if(ut.isDirectory()){await ae(xe);continue}if(!ut.isFile())continue;let Mt=`/${A(l,xe).split(w).join("/")}`;if(Xf.has(Mt))continue;let ar=await Bun.file(xe).bytes();if(ar.byteLength>26214400)throw Error(`${Mt} is ${ar.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let Sr=Buffer.from(ar).toString("base64"),gt=ut.name.lastIndexOf("."),ct=gt>0?ut.name.slice(gt+1):"";ve.push({path:Mt,hash:await Ic(Sr,ct),base64:Sr,extension:ct,size:ar.byteLength})}}return await ae(l),ve.sort((ce,Ee)=>ce.path.localeCompare(Ee.path)),ve}function tg(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function as(l,f,C,A){let w={Authorization:C},ve;if(A instanceof FormData)ve=A;else if(A!==void 0)w["Content-Type"]="application/json",ve=JSON.stringify(A);let ae=await fetch(`https://api.cloudflare.com/client/v4${f}`,{method:l,headers:w,body:ve}),ce=await ae.text(),Ee;try{Ee=JSON.parse(ce)}catch{throw Error(`Cloudflare Pages API returned ${ae.status} with a non-JSON body: ${ce.slice(0,200)}`)}if(!Ee.success){let ut=(Ee.errors??[]).map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw Error(`Cloudflare Pages API error (${ae.status}): ${ut||ce.slice(0,200)}`)}return Ee.result}export{al as ABTestManager,ue as ACMClient,hr as ACMDnsValidator,Tc as ACME_DIRECTORIES,Pe as AI,Gl as API_IDEMPOTENCY_TTL_MS,Ql as API_TOKEN_DEFAULT_TTL_MS,Hl as API_TOKEN_MAX_TTL_MS,Zi as API_VERSION,pe as AUTHORIZATION_CAPABILITIES,$l as AUTH_ACTION_TOKEN_TTL_MS,Ml as AUTH_MFA_CHALLENGE_TTL_MS,Fl as AUTH_OIDC_TRANSACTION_TTL_MS,Ye as AUTH_SESSION_ABSOLUTE_TTL_MS,Ll as AUTH_SESSION_IDLE_TTL_MS,JA as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,S as AWSCloudFrontClient,nl as AWSConfigManager,CI as AWS_PSEUDO_PARAMETERS,Ne as AWS_REGIONS,Hf as AcmeClient,Gr as AlertEvaluator,Di as AlertStore,co as AnomalyConfigStore,jd as ApiGateway,i as ApiServiceError,ic as ApplicationAutoScalingClient,Wr as Arn,k as AssetHasher,V as Auth,Ki as AuthenticationStore,xi as AutomationApiService,Wi as AutomationIdentityStore,la as AwsAuroraDataAdapter,fa as AwsAuroraTransport,xa as AwsDatabaseBackupSource,br as AwsDriver,ua as AwsElastiCacheDataAdapter,ha as AwsElastiCacheTransport,vf as AwsIamCapabilityScanner,Ma as AwsInfrastructureBackupSource,da as AwsRdsDataAdapter,ma as AwsRdsTransport,$f as AwsRegionalDriver,Ua as AwsSecretsManagerConfigurationBackend,Up as AwsSpendTransport,Qa as AwsSsmConfigurationBackend,ls as BackupCoordinator,tl as BackupManager,ka as BackupStore,Ym as BatchProcessingManager,Rn as BedrockClient,wn as BedrockRuntimeClient,Jl as BitbucketSourceAdapter,ol as BlueGreenManager,Hm as BounceComplaintHandler,xm as BuildOptimizationManager,yu as BunDockerRuntime,Ku as BunDockerVolumeRuntime,zu as BunFilesystemArchiveRuntime,fe as CDN,Do as CHAIN_HEADER,Es as CLOUDFLARE_MANAGED_RULE_PREFIX,Qd as CLOUDFRONT_FAILOVER_STATUS_CODES,cC as COMMON_CROSS_ACCOUNT_ROLES,Ge as CONTROL_PLANE_SCHEMA_VERSION,Co as Cache,Qi as CanaryManager,Nm as CertificateManager,aA as CloudBlockVolumeDriver,Hs as CloudDriverFactory,We as CloudError,nm as CloudFormationBuilder,h as CloudFormationClient,S as CloudFrontClient,il as CloudTrailManager,Se as CloudWatchLogsClient,Dc as CloudflarePagesProvider,be as CloudflareProvider,Ay as CommandHistory,j as Communication,Mr as ComposeApplicationService,Vt as ComposeApplicationStore,kt as ComprehendClient,a as Compute,Qp as ComputeSpendTransport,To as ConfigurationError,Ga as ConfigurationService,Fa as ConfigurationStore,vn as ConnectClient,pa as ContainerDataAdapter,gl as ContainerRegistryManager,$a as ControlPlaneBackupSource,Ra as ControlPlaneCleanupDriver,bi as ControlPlaneStore,so as CounterTracker,Ct as CredentialError,ym as CrossRegionReferenceManager,LA as DASHBOARD_ENTRY,$A as DASHBOARD_PORT_BASE,MA as DASHBOARD_PORT_SPAN,_A as DASHBOARD_STATE_DIR,$o as DEFAULT_ATTACK_MODE_HOURS,Dd as DEFAULT_DDOS_THRESHOLDS,qp as DEFAULT_FAILOVER_STATUS_CODES,dd as DEFAULT_METER_MAPPINGS,ad as DEFAULT_PRICE_BOOK,Zr as DEFAULT_RECURSION_LIMITS,Un as DEFAULT_RPX_CERTS_DIR,z as DEFAULT_SERVICE_LIMITS,Bd as DEFAULT_STATE_DIR,ag as DEFAULT_STATIC_ASSET_EXTENSIONS,kA as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,IA as DEFAULT_TELEMETRY_POLICY,vp as DEFAULT_THRESHOLDS,rA as DEPLOYMENT_QUEUE_KINDS,Ro as DEPTH_HEADER,Qr as DETECTABLE_SIGNALS,pu as DIAGNOSTIC_PRESETS,Xm as DLQMonitoringManager,Q as DNS,Um as DNSSECManager,ns as DataServiceLifecycle,ca as DataServiceStore,Wt as Database,Dm as DatabaseUserManager,F as DebugLogger,NA as DependencyGraph,q as Deployment,WA as DeploymentError,rl as DisasterRecoveryManager,_n as DnsProviderFactory,nr as DockerDataTransport,ra as DockerDiscoveryAdapter,$r as DockerNamedVolumeDriver,La as DockerVolumeBackupSource,c as DurableOperationQueue,Ys as DurableQueueWorker,_e as DynamoDBClient,Pr as EC2Client,$e as ECRClient,nt as ECSClient,gr as EFSClient,Ya as ELBv2Client,dA as ENFORCEMENT_ACTIONS,wi as ENFORCEMENT_DESCRIPTIONS,N as ENFORCEMENT_SEVERITY,Yg as ENVIRONMENT_LABEL,uu as EcsRuntimeAdapter,Lo as EdgeRateLimiter,st as ElastiCacheClient,m as Email,jm as EmailAdvanced,Gm as EmailAnalyticsManager,kn as EmailClient,zm as EmailHandlers,qm as EmailTemplateManager,Aa as EncryptedDataSecretStore,XA as ErrorCodes,lr as EventBridgeClient,Of as EventBridgeJobAdapter,Ha as ExternalConfigurationBackend,bo as FAILOVER_REPLICA_POLICY_SID,Jm as FIFOQueueManager,Bp as FOCUS_VERSION,Wd as FileCache,ze as FileSystem,Oa as FilesystemBackupSource,Sa as FleetService,ya as FleetStore,e as Fn,Xl as GiteaSourceAdapter,Kl as GithubSourceAdapter,Wl as GitlabSourceAdapter,Sm as GlobalResourceManager,Me as GoDaddyProvider,sl as GuardDutyManager,pt as HOST_SITES_DIR,ty as HashCache,uf as HealthCheckManager,qe as HealthCheckRunner,Tr as HetznerClient,Te as HetznerDriver,Ie as IAMClient,mc as IPV6_EXCLUDED_HOST_LABELS,Bm as ImageScanningManager,Bc as InfrastructureGenerator,Jc as InvalidOperationTransitionError,It as JobLoader,_f as JobProviderReconciler,aa as JobService,sa as JobStore,dr as KendraClient,df as LARAVEL_SERVERLESS_BUILD_STEPS,E as LambdaClient,Lm as LambdaConcurrencyManager,Fm as LambdaDLQManager,$m as LambdaDestinationsManager,Om as LambdaLayersManager,gu as LambdaRuntimeAdapter,Mm as LambdaVPCManager,_m as LambdaVersionsManager,Sn as LocalEncryptedConfigurationBackend,_a as LogicalDatabaseBackupSource,dl as LogsManager,My as MANAGED_NODE_VERSIONS,Mc as MANAGEMENT_DASHBOARD_SITE,im as MANAGEMENT_DASHBOARD_SITE_PREFIX,ji as MAX_CONTROL_HOURS,Xc as MAX_CONTROL_PLANE_ERROR_BYTES,Sp as MAX_CONTROL_PLANE_JSON_BYTES,ro as METERS,cA as METER_KEYS,lA as MICRO_CENTS,Tp as MIN_PROJECTION_CONFIDENCE,ug as MTA_STS_PORT,wa as MaintenanceService,Ta as MaintenanceStore,ne as Messaging,Tm as MetricsManager,wm as MigrationManager,pm as MockCloudFormation,fm as MockDynamoDB,mm as MockS3,Eo as Monitoring,Cm as MultiAccountManager,Am as MultiRegionManager,uy as MultiStepProgress,y as Network,gf as NetworkSecurityManager,Pi as NotificationRouter,Kp as ORIGIN_CONNECTION_ATTEMPTS,Wp as ORIGIN_CONNECTION_TIMEOUT,jp as ORIGIN_GROUP_ALLOWED_METHODS,SI as ORIGIN_GROUP_ID_SUFFIX,zp as ORIGIN_GROUP_SELECTION_CRITERIA,Za as OpenSearchClient,mt as OptimisticConcurrencyError,Em as OrganizationManager,Yf as PAGES_MAX_FILE_BYTES,Ky as PHP_DEFAULT_EXCLUDES,Fy as PHP_LAYER_EXTENSIONS,Xg as PROJECT_LABEL,at as PROXIABLE_RECORD_TYPES,T as ParameterStore,Rm as PerformanceManager,re as Permissions,rc as PersonalizeClient,Ke as Phone,Km as PhoneAdvanced,tm as PhoneHandlers,ba as PlacementService,Ia as PlacementStore,Dn as PollyClient,de as PorkbunProvider,cn as PreDeployScanner,Zd as PreviewEnvironmentManager,Lr as PreviewEnvironmentService,Ve as PreviewEnvironmentStore,el as PreviewNotificationService,ly as ProgressBar,cl as ProgressiveDeploymentManager,Mo as ProtectionControlStore,PA as Pseudo,H as Queue,Ci as QueueCancellationError,Zm as QueueManagementManager,aI as QueuePresets,Xs as QueueTimeoutError,Dl as RATE_LIMIT_KEY_SEPARATOR,W as RDSClient,Sy as RECOMMENDED_ACCOUNT_STRUCTURES,aC as RECOMMENDED_SCPS,If as RELEASE_QUEUE_KINDS,my as REPL,hy as REPLCommandBuilder,fy as REPLContext,Zg as ROLE_LABEL,ry as RateLimiter,cI as RealtimePresets,xp as RecordingSpendTransport,Gi as RecursionGuard,bt as Redirects,Im as RegionPairManager,Ea as RegionService,Ca as RegionStore,je as Registry,Bt as RekognitionClient,Et as ReleaseService,zo as ReleaseStore,Lf as RemoteBuildService,ll as ReplicaManager,pf as ResourceManagementManager,ee as RetryableOperationError,I as Route53Client,Xa as Route53DomainsClient,J as Route53Provider,Qm as Route53ResolverManager,ml as Route53RoutingManager,Ae as RuntimeOperationService,ia as RuntimeStreamRegistry,Ba as S3BackupDestinationAdapter,o as S3Client,M as S3Error,eu as SECRET_PATTERNS,Np as SENSITIVITY_THRESHOLDS,ot as SESClient,G as SMS,it as SNSClient,Fp as SPEND_CYCLE_SECONDS,Cd as SPEND_GATE_SETTING,vA as SPEND_LEASE_SETTING,oe as SQSClient,we as SSH_BOOTSTRAP_VERSION,ri as SSH_PREFLIGHT_SCRIPT,Re as SSMClient,Gp as STATE_DIR_ENV_VAR,Zn as STATIC_SITE_ZONE_SETTINGS,Gd as STORAGE_FAILOVER_METADATA_KEY,ye as STSClient,Pn as SchedulerClient,Jt as Search,dn as SecretFindingScanner,$i as Secrets,ul as SecretsManager,K as SecretsManagerClient,Pm as SecretsRotationManager,b as Security,Yt as SecurityHubManager,an as SecurityPostureStore,vt as SecurityScannerRunner,km as SecurityScanningManager,Vm as SenderReputationManager,xf as ServerCronJobAdapter,ga as ServerDataAdapter,to as ServerPathVolumeDriver,pl as ServiceMeshManager,qd as Sftp,uo as SignalSource,Wm as SmsAdvanced,Ot as SmsClient,rm as SmsHandlers,ac as SmsVoiceClient,Ko as SourceConnectionStore,tr as SourceProviderError,Ed as SpendCapError,Hr as SpendGate,$p as SpendLoopLease,ho as SpendNotificationRouter,Mp as SpendRunner,jt as SpendService,vi as SpendStore,gy as Spinner,Rr as SshDriver,gn as SshFleetDriver,bm as StackDependencyManager,bI as StacksIntegration,lf as StaticSiteManager,De as Storage,Tl as StorageAdvancedManager,Nn as SupportClient,Zt as SyntheticsManager,Su as SystemFleetSshTransport,wr as SystemSshTransport,na as SystemdDiscoveryAdapter,Po as TRACE_HEADER,py as TaskList,At as TelemetryStore,Fd as TemplateBuilder,Jd as TemplateCache,xt as TextractClient,Tn as TranscribeClient,cr as TranslateClient,Uf as TransportDisasterRecoveryDriver,Ff as TransportPlatformMaintenanceDriver,is as TransportRemoteBuildDriver,ea as TrivyImageScanner,jo as TsCloudApiError,Vl as TsCloudClient,EA as URGENT_SPEND_EVENTS,wp as USER_VISIBLE_ACTIONS,va as UnavailableRegionalDriver,le as UnifiedDnsValidator,Ks as UnsupportedSchemaVersionError,cm as ValidationError,ur as VoiceClient,eo as VolumeService,Gt as VolumeStore,OA as Workflow,vm as XRayManager,Dy as abTestManager,ql as activateImmutableRelease,Gu as addDns01ChallengeRecord,mn as addSiteToCloudConfig,wt as ageSeconds,ud as aggregateDeltas,hp as allocateSitePorts,em as amazonLinuxImageId,xA as amazonLinuxImageParameter,hI as analyzeStackDiff,Ri as anomalyOptionsForSignal,Fo as applyControlsToDdos,xl as applyControlsToRateLimits,Ds as applyDeclaredZoneSettings,jr as applyMitigationFactor,$h as applyPlan,Bs as applyZoneMigration,fl as artifactKey,yt as assertOriginGroupMethods,Ji as assertReleaseStrategy,SA as assertSpendAllows,Hh as attachConflicts,Gh as attachIsViable,Qh as attachPreconditions,su as attachProvenanceToRelease,ta as attachSbomToRelease,nu as attachVulnerabilitySummary,yf as authEncryptionKeyFile,P as authorizeOrganization,kf as authorizeRuntimePath,$b as autocomplete,Cy as awsConfigManager,qu as backupCredentialStatus,Iy as backupManager,cb as batch,YC as batchProcessingManager,Vo as beginOidcAuthorization,wy as blueGreenManager,jC as bounceComplaintHandler,ft as budgetWindow,Ka as buildAndPushServerlessImage,tE as buildBunRuntimeLayerZip,Wh as buildCertificatePackScript,jh as buildCertificateStateScript,Jh as buildCertificateUnpackScript,zd as buildCloudFormationTemplate,kc as buildCloudInitFirstBoot,td as buildComposeLogsCommand,sI as buildComposeRuntimeCommand,oI as buildComposeScaleCommand,rd as buildComposeShellCommand,pp as buildDrainSourceScript,Dh as buildDrainedSiteScanScript,Vd as buildFailoverReplicaPolicyStatement,sr as buildFunctionEnv,gp as buildHealthGateScript,Kn as buildHostCleanupDeployScript,Fs as buildHostCleanupInstallScript,zn as buildHostCleanupScript,Si as buildHostSitePortsScript,Md as buildMailEnv,Vs as buildManagementDashboardArtifact,gg as buildMediaCdnPlan,lg as buildMtaStsPolicy,dh as buildMtaStsServer,eE as buildNodeRuntimeLayerZip,$C as buildOptimizationManager,Hd as buildOriginGroup,Kr as buildOriginGroups,lc as buildOriginGuardRule,sp as buildPauseWorkersScript,sE as buildPhpRuntimeLayerZip,Zp as buildReplicationConfiguration,Yp as buildReplicationRole,dp as buildRestoreScript,X as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Fh as buildSetHostnameScript,Jn as buildSiteDeployScript,cp as buildSnapshotScript,mp as buildSourceStateScript,Vn as buildSshArgs,ei as buildSshBootstrapScript,dc as buildStaticSiteCacheRules,Xn as buildStaticSiteDeployScript,lp as buildTargetStateScript,op as buildWorkersStateScript,au as bytes,Ry as canaryManager,pn as canonicalJson,Tt as capabilities,ir as capacity,Ab as categorizeChanges,OC as certificateManager,Kh as certificatesMatch,YI as checkIAMPermissions,sf as checkInvocation,eb as checkServiceQuotas,ny as chunk,kg as cleanupDns01Challenge,tS as clearSigningKeyCache,Jo as cloneSourceBinding,iy as cloudConfigSchema,$g as cloudDrivers,Ey as cloudTrailManager,wc as collectAssets,xo as collectPhpAppEntries,cg as collectServerDnsDomains,Ip as completeComposeVolumeDeletion,qo as completeOidcAuthorization,UI as composePresets,Js as composeProjectName,Al as composeServerlessAppTemplate,wA as compositeSpendTransport,Nt as compressBackup,cS as config,cc as configOrigins,hu as connectionGuidance,Oy as containerRegistryManager,eA as controlPlaneDatabaseFile,Kc as controlPlaneMigrations,DI as createApiBackendPreset,Zo as createApiV1Handler,AS as createAsgBuildDriver,ju as createBackupQueueHandlers,zy as createCliHandler,O as createCloudDriver,Ac as createCloudFrontPolicy,KI as createCredentialProvider,MI as createDashboardSite,xI as createDataPipelinePreset,Au as createDataServiceQueueHandlers,nd as createDeploymentQueueHandlers,D as createDnsProvider,hS as createEcsBuildDriver,vd as createEnforcementHandlers,dm as createError,Kd as createExistingStaticFullStackPreset,Iu as createFleetQueueHandlers,RI as createFullStackAppPreset,_s as createGoDaddyValidator,iE as createHandlers,qy as createHttpHandler,NI as createJamstackPreset,fu as createJobQueueHandlers,LI as createLaravelPreset,OI as createMLApiPreset,Ru as createMaintenanceQueueHandlers,pg as createMediaAccessToken,kI as createMicroservicesPreset,Tb as createMockAWS,vI as createNodeJsServerPreset,TI as createNodeJsServerlessPreset,bs as createObjectStorageClient,Os as createPorkbunValidator,QI as createPreset,Oo as createPresignedUrl,Jy as createPresignedUrlAsync,jy as createQueueHandler,BI as createRealtimeAppPreset,Cu as createRegionQueueHandlers,iu as createReleaseProvenance,zl as createReleaseQueueHandlers,mS as createRemoteBuildQueueHandlers,Ls as createRoute53Validator,Nf as createRuntimeAdapters,KA as createS3Client,fS as createServerBuildDriver,$I as createServerlessLaravelPreset,wI as createServerlessNodePreset,og as createSmsInfrastructure,et as createSourceAdapter,EI as createStaticSitePreset,_I as createTraditionalWebAppPreset,id as createVolumeQueueHandlers,PI as createWordPressPreset,Je as createZip,qb as crossRegionReferenceManager,In as dashboardActions,Gs as dashboardCredentialsFile,un as dataServiceCapabilities,BC as databaseUserManager,_l as decodeBase32,Oe as decompressBackup,Jf as decryptBackup,Uo as defaultConfig,gm as defaultLocalConfig,Nl as defaultRateLimitRules,fr as delegateZone,ws as delegateZoneFromConfig,Qu as deleteFailoverReplicaBuckets,ja as deleteStaticSite,Uc as deployAllComputeSites,Pa as deployServerlessApp,Hu as deploySite,qs as deploySiteRelease,ms as deployStaticSite,za as deployStaticSiteFull,bn as deployStaticSiteWithExternalDns,Cn as deployStaticSiteWithExternalDnsFull,Ld as deploymentCoexistenceError,FA as deriveManagementDashboardPort,Rs as describeDelegation,Bl as describePosture,Ps as describeZoneSettings,Bf as desiredJobProviderState,Pp as detectAnomalies,Vp as detectDeploymentTargets,uc as detectDnsProvider,Sd as detectLatestAnomaly,JI as detectMisconfigurations,wl as detectServiceRegion,Zc as diffCompose,mb as diffTemplates,Wo as discoverGitRefs,Go as discoverOidcProvider,cu as discoverRuntimeInventory,XC as dlqMonitoringManager,gc as dnsProviders,VC as dnssecManager,Rf as dockerWorkloads,ss as documentDigest,by as drManager,Qe as driverStatePath,du as ecsWorkloads,Ht as effectiveCapabilities,zC as emailAnalyticsManager,WC as emailTemplateManager,zi as encodeBase32,Wf as encryptBackup,ou as ensureDefaultSecurityPolicies,Mu as ensureFailoverReplicaBuckets,di as ensureFirewall,gi as ensureManagementDashboard,li as ensureServer,ci as ensureSshKey,Z as escapeSecLang,pd as evaluateBudget,ii as evaluatePreflight,fo as evaluateTelemetryAlertRules,mu as eventBridgeScheduleInput,Vy as eventToRequest,hA as ewma,Yc as exportCompose,Ns as exportRoute53Zone,om as extendPreset,JC as fifoQueueManager,ab as findChangedFiles,Cp as findMapping,bp as findPriceEntry,gC as formatAccountStructure,Vh as formatAttachPlan,Pb as formatBytes,Vr as formatCents,yI as formatDiff,Nh as formatDrainedSiteRefusal,Nb as formatDuration,Fb as formatFlagSuggestions,Hb as formatHistory,Gb as formatHistoryStats,Oh as formatInventory,Bb as formatKeyValue,kb as formatList,Lh as formatPlan,oi as formatPreflightFindings,Db as formatProgressBar,yy as formatRegion,nC as formatRegionList,Ef as formatScanResults,xb as formatSuggestion,wb as formatTable,Ur as formatTimeToExhaustion,Rb as formatTree,VA as fromEC2Metadata,qA as fromECSMetadata,HA as fromEnvironment,GA as fromSharedCredentials,jA as fromWebIdentity,Il as functionFingerprint,Hn as gatewayHostnames,Sl as generateAppImageDockerfile,wC as generateApprovalConfig,ef as generateBootstrap,ay as generateCleanupWorkflow,cy as generateCostReportWorkflow,lC as generateCrossAccountRoleCF,tu as generateCycloneDxSbom,EC as generateDeploymentConfig,yC as generateDeploymentPipeline,pC as generateDeploymentWorkflow,qa as generateExternalDnsStaticSiteTemplate,Eg as generateHttpsServerCode,ru as generateImageSbom,Og as generateLetsEncryptUserData,t as generateLogicalId,CC as generateManualPipeline,AC as generateMatrixWorkflow,vC as generateMultiEnvConfig,SC as generateMultiEnvPipeline,mC as generateMultiEnvWorkflow,fC as generatePRPreviewWorkflow,RC as generateParallelConfig,cf as generatePhpFpmConfig,tf as generatePhpLayerDockerfile,IC as generatePreviewPipeline,oy as generatePreviewWorkflow,r as generateResourceName,TC as generateScheduledConfig,bC as generateScheduledPipeline,hC as generateScheduledWorkflow,ps as generateStaticSiteTemplate,x as generateUbuntuAppCloudInit,am as getAccountId,Wb as getAllRegions,eC as getClosestRegion,Ub as getCommandUsage,tA as getComposeTemplate,ff as getConfig,_b as getContextualHelp,Fi as getCredentials,yb as getDeploymentStrategy,Sb as getDiffStats,fb as getDiffSummary,YA as getErrorDetails,Yd as getLocalConfig,Eb as getLocalCredentials,Cb as getLocalEndpoint,vb as getLocalEnvVars,tb as getQuotaUsageSummary,dC as getRecommendedStructure,Ui as getRegion,iC as getRegionStats,Xb as getRegionsByCompliance,Jb as getRegionsByLocation,Yb as getRegionsByPricingTier,ZA as getRequiredPermissions,rS as getSigningKeyCacheSize,sg as getSmsInfrastructureStatus,dI as getTimestamp,_o as globMatches,js as globToRegex,jb as globalResourceManager,Ti as governingLimitCents,Fu as grantFailoverReplicaAccess,vy as guardDutyManager,Ao as handleSpendRequest,Qn as hasAutoWwwVariant,Xt as hasManagementDashboardSite,zc as hasProxyUpstream,nb as hashBuffer,ib as hashDirectory,lm as hashFile,sb as hashManifest,um as hashString,aE as healthCheckManager,Ln as hostAcceptsIpv6,Bn as hostCondition,Qo as hotp,Fr as hourBucket,fA as hourBucketsBetween,LC as imageScanningManager,cs as infraEnvFromOutputs,Cl as inspectInvocation,Hy as installRecursionFetch,hs as invalidateCache,nf as invocationContext,BA as isArmInstanceType,Ob as isLikelyTypo,Mn as isLocalDatabase,bb as isLocalDevelopment,Jr as isManagementDashboardSiteName,pr as isNameserverRegistrar,nS as isNodeCryptoAvailable,yd as isOperationAllowed,mo as isQuietHours,Io as isS3RestEndpoint,mi as isSafePattern,Od as isStateDirConfigured,_d as isStatePath,qr as isValidCidr,Zb as isValidRegion,Ei as isValidTimeZone,iS as isWebCryptoAvailable,mr as isZoneHost,ln as jobProviderCapability,Is as keyMatchesFilters,UC as lambdaConcurrencyManager,GC as lambdaDLQManager,QC as lambdaDestinationsManager,MC as lambdaLayersManager,HC as lambdaVPCManager,FC as lambdaVersionsManager,lu as lambdaWorkloads,El as laravelServerlessEnvDefaults,_r as listComposeTemplates,Yi as listSourceReferences,Ol as loadCloudConfig,zt as loadTelemetryPolicy,Ny as logsManager,Id as lookbackHoursForSignal,DA as mailEnabled,$d as mailFirewallPorts,Mf as maintenanceWindowOpen,mf as makeAWSRequest,Yy as makeAWSRequestAsync,Xy as makeAWSRequestOnce,sm as managementDashboardSiteName,Eu as manifestDigest,rn as matchTotpCounter,fg as mediaObjectHeaders,ao as median,Rp as medianAbsoluteDeviation,md as mergeDecisions,Xr as mergeInfrastructure,pA as mergePriceBooks,ld as meterTelemetry,PC as metricsManager,eg as migrateObjectStorage,NC as migrationManager,sC as multiAccountManager,Vb as multiRegionManager,xg as needsRenewal,cE as networkSecurityManager,Rt as nextScheduleRuns,Ce as normalizePublicIpv6,ke as normalizeRuntimeStatus,tt as normalizeScheduleExpression,bf as normalizeSourceEvent,Ue as normalizeSshPublicKey,Op as normalizeTelemetryPolicy,yi as occupiedHostPorts,Yo as openApiDocument,go as optionsForSignal,oC as organizationManager,vl as packagePhpApp,Yr as packageServerlessApp,Ic as pagesAssetHash,Qf as pagesDnsRecord,Xd as parallel,db as parallelMap,lb as parallelWithRetry,zh as parseCertificateState,bl as parseChain,Or as parseCompose,nI as parseComposeCatalog,wf as parseDockerInspect,Wu as parseDotenv,Ph as parseDrainedSites,Ii as parseHostSiteFragments,eS as parseJSONResponse,ni as parsePreflightFacts,fp as parseSourceDrained,Df as parseSystemdRecords,up as parseTargetReady,jc as parseUpstreamPort,ap as parseWorkersPaused,Zy as parseXMLResponse,ki as pathTemplate,Vc as pendingSteps,oo as percentOfLimit,kC as performanceManager,yl as phpLayerBuildStage,Uy as phpLayerPackages,en as phpRuntimeLayerAssets,iI as planComposeTemplateUpgrade,fd as planEnforcement,np as planIsDestructive,Hp as planMitigation,Mh as planServerRename,Xh as planSiteMove,ks as planZoneMigration,_t as policyTag,si as preflightFailed,sy as previewManager,dy as previewNotifications,Dt as previewSchedule,mA as previousBudgetWindow,no as priceUsage,uA as priceUsageLines,Bh as probeHostRoutes,ec as probeOriginTls,pb as processInChunks,Yl as processSourceWebhook,ts as productionChangeReview,Py as progressiveDeploymentManager,gd as projectSpend,No as propagationHeaders,Wa as providerEndpoint,vu as publicKeyFingerprint,xn as qualifyName,ZC as queueManagementManager,ob as quickHash,Pl as rateLimitHeaders,qi as rateLimitKey,He as readDriverState,xh as reconcile,dg as reconcileAddressRecords,jf as reconcileCloudflareCdn,Ts as reconcileDeclaredRecords,pS as reconcileJobObservation,on as reconcileSourceWebhook,es as recordDashboardHostPosture,lS as recordPreDeploySecretScan,uS as recordSkippedSecretScan,ko as recursionBlockedResponse,Be as redactRuntimeConfig,Rd as redactTelemetryText,Ni as redactTelemetryValue,hn as redeployServerlessApp,zb as regionPairManager,sn as releaseStrategyCapabilities,Sf as releaseTrafficPlan,pi as reloadRpxGateway,Ss as remapKey,Zu as removeDns01ChallengeRecord,fn as removeSiteFromCloudConfig,Zl as removeSourceWebhook,pc as removeStaleServerAddressRecords,ed as renderComposeTemplate,Oi as renderDdosInstallScript,kd as renderNftablesRuleset,rs as renderServerCron,Nd as renderSysctlFile,Hc as renderWafConfig,fi as renderWafInstallScript,Qc as renewRpxCertificates,By as replicaManager,RA as requestHash,hb as requiresReplacement,rE as resetRecursionRuntime,nE as resolveApp,g as resolveAppDatabase,Uh as resolveAttachTarget,Ze as resolveAuthEncryptionKey,me as resolveCloudProvider,qf as resolveCloudflareCdnPlan,vo as resolveCredentials,gs as resolveDashboardAction,Fc as resolveDashboardAuth,UA as resolveDashboardDomain,QA as resolveDashboardDomains,vs as resolveDeclaredRecords,fI as resolveDeployBucketName,U as resolveDeploymentMode,Wn as resolveExecStart,So as resolveFailoverStatusCodes,vc as resolveHetznerApiToken,vr as resolveHostCleanupConfig,_i as resolveMailService,FI as resolveManagementDashboardSite,Mi as resolveManagementDashboardSites,Ja as resolveObjectStorage,te as resolveOriginConnection,_h as resolvePlan,p as resolveProjectStackName,xr as resolveProxyUpstreams,hl as resolveQueueNames,nA as resolveQueuedDeploymentCommand,er as resolveQueues,Qy as resolveRecursionConfig,zA as resolveRegion,se as resolveRuntimeInventory,Kt as resolveServerlessAppStackName,Ud as resolveServerlessArtifactBucketName,Li as resolveServerlessAssetBucketName,Hi as resolveServerlessRuntime,pI as resolveSiteBucketName,zs as resolveSiteDeployTarget,u as resolveSiteKind,gI as resolveSiteResourceName,uI as resolveSiteStackName,ti as resolveSshSettings,d as resolveStatePath,mI as resolveStorageBucketName,Jp as resolveStorageFailover,Ut as resolveUiSource,$c as resolveZoneApex,dE as resourceManagementManager,af as responseToResult,Dp as robustZScore,Qt as roleCapabilities,jl as rollbackImmutableRelease,An as rollbackServerlessApp,gA as roundCents,qC as route53ResolverManager,Ly as route53RoutingManager,kp as routeMatches,ep as routesFromFragments,Vi as ruleMatches,$y as runBuildHooks,hd as runEnforcement,Bo as runPhpBuildHooks,rt as runRemoteCommand,he as runtimeId,Le as s3OriginBucket,Xp as s3RegionalDomain,On as sameNameservers,us as sanitizeCloudConfig,s as sanitizeControlPlaneValue,lI as sanitizeName,Ul as sanitizeOidcReturnPath,Td as saveTelemetryPolicy,Cf as scanForSecrets,Wc as scopeContains,ht as scopeKey,yc as scpUpload,Lb as searchCommands,Ws as searchControlPlane,xy as secretsManager,xC as secretsRotationManager,gS as secureContainerRelease,Ty as securityHubManager,_C as securityScanningManager,ie as securityScope,Uu as seedFailoverReplicas,nn as sendAuthenticationEmail,KC as senderReputationManager,ub as sequence,Ju as serializeDotenv,ui as serverPublicIpv4,_y as serviceMeshManager,Ou as setAttachToInCloudConfig,or as setMaintenance,os as setSitePropertyInCloudConfig,xd as setStateDir,Ng as setupDns01Challenge,oc as setupSmsInfrastructure,wo as sha256,Gy as sharedRecursionGuard,rf as sharedRuntimeLoop,yp as shipsARelease,ng as signCloudFrontCookies,ig as signCloudFrontUrl,R as signRequest,Rl as signRequestAsync,lo as signalDefinition,_ as siteInstallBase,Ai as siteMoveArchivePath,qh as siteMoveCertArchivePath,qc as siteUnitGlob,Lp as spendNotificationText,yo as spendOpenApiPaths,Cr as sshExec,ge as sshExecOrThrow,Kb as stackDependencyManager,Va as startLocalDashboardServer,TA as startSpendLoop,zr as stateDir,L as statePath,oE as staticSiteManager,Wy as storageAdvancedManager,II as storageFailoverReplicasFromTemplate,AA as streamFocusJsonl,Ad as strongestActiveAction,hm as suggestCommand,Mb as suggestFlags,ZI as suggestIAMPolicy,rb as suggestQuotaIncrease,rC as suggestRegionPairs,tC as suggestRegions,Xi as syncSourceRepositories,sd as synchronizeComposeVolumes,Xu as synchronizeConfiguredConfiguration,oa as synchronizeConfiguredJobs,ky as syntheticsManager,Pd as sysctlHardening,Pf as systemdWorkloads,CA as telemetryBucketLabel,Bi as telemetryCursor,wd as telemetryEstimatedMonthlyCost,bA as telemetryPercentile,_p as telemetryPolicyKey,ey as templateCache,tp as tenantsOf,Xo as testSourceConnection,od as tieredMicroCents,Qs as toCloudflareZoneSettings,po as toFocusJsonl,bd as toFocusRecords,kh as toInventoryServer,hf as totp,Ho as totpUri,rp as unaccountedSites,Tf as unsupportedCapabilities,iA as unsupportedVolumeCapabilities,wu as updateCompatibility,Du as updateSiteInCloudConfig,fs as uploadStaticFiles,Ep as usageDeltaKey,qt as utcInstantOfLocal,uC as validateAccountStructure,Ib as validateAgainstSchema,oA as validateAttachment,Kf as validateBackupDestination,Qb as validateCommand,WI as validateConfiguration,XI as validateCredentials,Ap as validateDeploymentConfig,sA as validateMountPath,St as validateOriginGroups,ku as validateResourceLimits,ip as validateServerName,_c as validateTemplate,Nu as validateTemplateSize,fc as verifyAddressRecord,dS as verifyArtifactSignature,mg as verifyMediaAccessToken,Af as verifyTotp,Tu as verifyUpdateSignature,xs as verifyZoneParity,Zs as volumeCapabilities,Kg as wafEventTelemetry,Sc as waitForCloudInit,qn as waitForSsh,rr as webhookEndpoint,jI as withCDN,qI as withCache,VI as withDatabase,of as withInvocation,HI as withMonitoring,zI as withQueue,GI as withSecurity,gb as withTimeout,Y as wrapCloudInitUserData,dt as writeDriverState,DC as xrayManager,bu as zeroCapacity,yA as zeroFill,cd as zoneOffsetMs,io as zonedParts};
+`}async function yg(l,f,C){let A=`_acme-challenge.${f}`;if(await Sg(l,f,A,C))return;let w=await l.createRecord(f,{name:A,type:"TXT",content:C,ttl:60});if(!w.success)throw Error(`Failed to create DNS challenge record: ${w.message}`)}async function Cg(l,f,C){let A=await l.deleteRecord(f,{name:`_acme-challenge.${f}`,type:"TXT",content:C});if(!A.success)console.warn(`Failed to delete DNS challenge record: ${A.message}`)}async function Sg(l,f,C,A){try{let w=await l.listRecords(f,"TXT"),de=C.replace(/\.$/,"").toLowerCase();return(w.records??[]).some((v)=>v.name.replace(/\.$/,"").toLowerCase()===de&&v.content.replace(/^"|"$/g,"")===A)}catch{return!1}}function Fc(l){let{hostedZoneId:f,dnsProvider:C,region:A="us-east-1"}=l;if(C)return D(C);if(f)return new X(A,f);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function mh(l){await yg(Fc(l),l.domain,l.challengeValue)}async function fh(l){await Cg(Fc(l),l.domain,l.challengeValue)}function gh(l){try{let{execSync:f}=Xe("node:child_process"),C=f(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as Bc,createSign as Rg,generateKeyPairSync as Mc}from"node:crypto";var _c={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class bg{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?_c.staging:_c.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=Mc("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let A=this.nonce;return this.nonce=null,A}let l=await this.getDirectory(),C=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!C)throw Error("Failed to get nonce from ACME server");return C}getJwk(){let l=this.accountKey.split(`
+`).filter((de)=>!de.startsWith("-----")).join(""),f=Buffer.from(l,"base64"),C=f.length-65,A=f.subarray(C+1,C+33),w=f.subarray(C+33,C+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(A),y:this.base64UrlEncode(w)}}getJwkThumbprint(){let l=this.getJwk(),f=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),C=Bc("sha256").update(f).digest();return this.base64UrlEncode(C)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,f){let C=await this.getNonce(),A=this.getJwk(),w={alg:"ES256",nonce:C,url:l};if(this.accountUrl)w.kid=this.accountUrl;else w.jwk=A;let de=this.base64UrlEncode(JSON.stringify(w)),v=f===""?"":this.base64UrlEncode(JSON.stringify(f)),B=`${de}.${v}`,ve=Rg("SHA256");ve.update(B);let ct=ve.sign(this.accountKey),xe=ct.subarray(4,4+ct[3]),Qt=4+ct[3]+2,Ut=ct.subarray(Qt,Qt+ct[Qt-1]),Pt=Buffer.alloc(32),ut=Buffer.alloc(32);xe.copy(Pt,32-xe.length),Ut.copy(ut,32-Ut.length);let lt=Buffer.concat([Pt,ut]);return JSON.stringify({protected:de,payload:v,signature:this.base64UrlEncode(lt)})}async acmeRequest(l,f){let C=await this.signPayload(l,f),A=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:C}),w=A.headers.get("replay-nonce");if(w)this.nonce=w;let de,v=A.headers.get("content-type");if(v?.includes("application/json")||v?.includes("application/problem+json"))de=await A.json();else de=await A.text();if(!A.ok)throw Error(`ACME request failed: ${JSON.stringify(de)}`);return{body:de,headers:A.headers}}async registerAccount(){let l=await this.getDirectory(),{body:f,headers:C}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),A=C.get("location");if(!A)throw Error("No account URL returned");return this.accountUrl=A,A}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let f=await this.getDirectory(),{body:C,headers:A}=await this.acmeRequest(f.newOrder,{identifiers:l.map((de)=>({type:"dns",value:de}))}),w=A.get("location");if(!w)throw Error("No order URL returned");return{orderUrl:w,authorizations:C.authorizations,finalize:C.finalize}}async getAuthorization(l){let{body:f}=await this.acmeRequest(l,""),C=f.identifier.value,A=this.getJwkThumbprint(),w=f.challenges.filter((de)=>de.type==="http-01"||de.type==="dns-01").map((de)=>{let v=`${de.token}.${A}`;if(de.type==="http-01")return{type:"http-01",token:de.token,keyAuthorization:v,identifier:`/.well-known/acme-challenge/${de.token}`};else{let B=this.base64UrlEncode(Bc("sha256").update(v).digest());return{type:"dns-01",token:de.token,keyAuthorization:v,identifier:`_acme-challenge.${C}`,dnsValue:B}}});return{domain:C,challenges:w}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,f=30){for(let C=0;C<f;C++){let{body:A}=await this.acmeRequest(l,"");if(A.status==="valid")return;if(A.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(A)}`);await new Promise((w)=>setTimeout(w,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:f}=Mc("rsa",{modulusLength:2048}),C=f.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,f),privateKey:C}}createSimpleCsr(l,f){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,f){let{csr:C,privateKey:A}=this.generateCsr(f),{body:w}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(C,"base64"))}),de=w.certificate;if(!de)throw Error("Certificate not immediately available - polling not implemented");let B=await(await fetch(de)).text(),ve=B.split(/(?=-----BEGIN CERTIFICATE-----)/g),ct=ve[0],xe=ve.slice(1).join("");return{certificate:ct,privateKey:A,chain:xe,fullchain:B,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var wn=(l)=>l===void 0?void 0:l?"on":"off";function Rc(l){let f={ssl:l.ssl,always_use_https:wn(l.alwaysUseHttps),automatic_https_rewrites:wn(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:wn(l.tls13),brotli:wn(l.brotli),http3:wn(l.http3),"0rtt":wn(l.zeroRtt),early_hints:wn(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:wn(l.alwaysOnline),websockets:wn(l.websockets),email_obfuscation:wn(l.emailObfuscation)};if(l.hsts)f.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let C of Object.keys(f))if(f[C]===void 0)delete f[C];return{...f,...l.raw??{}}}var ls={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Ag}from"node:tls";async function Pc(l){let{address:f,serverName:C,port:A=443,timeoutMs:w=5000}=l;return new Promise((de)=>{let v=!1,B=(ct)=>{if(v)return;v=!0;try{ve.destroy()}catch{}de(ct)},ve=Ag({host:f,port:A,servername:C,rejectUnauthorized:!1,timeout:w});ve.once("secureConnect",()=>{if(ve.authorized){B({reachable:!0,trusted:!0});return}B({reachable:!0,trusted:!1,reason:ve.authorizationError?String(ve.authorizationError):"origin certificate is not trusted for this hostname"})}),ve.once("timeout",()=>{B({reachable:!1,trusted:!1,reason:`no TLS handshake within ${w}ms`})}),ve.once("error",(ct)=>{B({reachable:!1,trusted:!1,reason:ct.message})})})}function Pg(l,f){let C=f.replace(/\.$/,"").toLowerCase();return l.some((A)=>{let w=A.replace(/\.$/,"").toLowerCase();if(w===C)return!0;if(!w.startsWith("*."))return!1;let de=w.slice(2);if(!C.endsWith(`.${de}`))return!1;return!C.slice(0,C.length-de.length-1).includes(".")})}async function Tg(l){let{provider:f,zone:C,hosts:A,ipv4:w,ipv6:de,proxied:v=!0,settings:B=ls,cache:ve,originGuard:ct,purge:xe=!0,ttl:Qt=300,skipOriginProbe:Ut=!1,skipEdgeCertificateCheck:Pt=!1}=l,ut={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(A.length===0)return ut;let lt=[],Ee=v&&!Pt?await f.listEdgeCertificateHosts(C):null;for(let ce of A){let gt=v;if(gt&&Ee&&!Pg(Ee,ce)){gt=!1;let lr=Ee.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Ee.join(", ")})`;ut.deferredProxy.push({host:ce,reason:lr}),ut.warnings.push(`${ce}: publishing DNS-only — ${lr}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(gt&&!Ut){let lr=await Pc({address:w,serverName:ce});if(!lr.trusted){gt=!1;let Cr=lr.reason||"origin is not serving a trusted certificate";ut.deferredProxy.push({host:ce,reason:Cr}),ut.warnings.push(`${ce}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Cr}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(gt)lt.push(ce);let Ft=[{type:"A",content:w}];if(de&&Un(ce))Ft.push({type:"AAAA",content:de});for(let{type:lr,content:Cr}of Ft){let br=await f.upsertRecord(C,{name:ce,type:lr,content:Cr,ttl:Qt,proxied:gt});if(br.success)ut.records.push({host:ce,type:lr,content:Cr,proxied:gt});else ut.warnings.push(`${ce} ${lr} → ${Cr} failed: ${br.message||"unknown provider error"}`)}}if(lt.length===0){if(v)ut.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return ut}try{let ce=Rc(B),gt=await f.applyZoneSettings(C,ce);ut.settingsChanged=gt.changed;for(let Ft of gt.failed)ut.warnings.push(`zone setting '${Ft.id}' could not be applied: ${Ft.error}`)}catch(ce){ut.warnings.push(`zone settings could not be read: ${ce instanceof Error?ce.message:String(ce)}`)}let Ht=uc(lt,ve);if(Ht.length>0){let ce=await f.putManagedPhaseRules(C,"http_request_cache_settings",Ht);if(ce.success)ut.cacheRules=Ht.length;else ut.warnings.push(`cache rules could not be written: ${ce.message}`)}if(ct){let ce=gc(lt,ct.header,ct.value);if(ce.length>0){let gt=await f.putManagedPhaseRules(C,"http_request_late_transform",ce);if(gt.success)ut.originGuard=!0;else ut.warnings.push(`origin guard header could not be written: ${gt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(xe){if(ut.purged=await f.purgeCache(C,{hosts:lt}),!ut.purged)ut.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return ut}var $g=(l)=>process.env[l];function qc(l,f){let C=l.replace(/\.$/,"").toLowerCase();if(f){let A=f.replace(/\.$/,"").toLowerCase();if(C===A||C.endsWith(`.${A}`))return A}return C.split(".").slice(-2).join(".")}function Dg(l,f={}){let C=f.env??$g,A=l.infrastructure?.compute?.proxy?.cdn,w=[];if(!A||A.provider!=="cloudflare")return{plan:null,errors:w};if(A.originDomain)w.push(`compute.proxy.cdn.originDomain (${A.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let de=C("CLOUDFLARE_API_TOKEN");if(!de)return w.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:w};let v=l.sites??{},B=A.frontedHosts?.length?[...new Set(A.frontedHosts.map((Ut)=>Ut.toLowerCase()))]:qn(v,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(B.length===0)return w.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:w};let ve=l.infrastructure?.dns?.domain,ct=new Set(B.map((Ut)=>qc(Ut,ve)));if(ct.size>1)return w.push(`Fronted hosts span more than one zone (${[...ct].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:w};let xe=A.cloudflare??{},Qt=A.secret?{header:A.secretHeader??"X-Origin-Verify",value:A.secret}:void 0;return{plan:{zone:[...ct][0],hosts:B,apiToken:de,zoneId:xe.zoneId??C("CLOUDFLARE_ZONE_ID"),accountId:xe.accountId??C("CLOUDFLARE_ACCOUNT_ID"),proxied:xe.proxied!==!1,settings:xe.settings??ls,cache:xe.cache,originGuard:Qt,purge:xe.purgeOnDeploy!==!1,skipOriginProbe:xe.skipOriginProbe===!0},errors:w}}var Ig=26214400;var wg=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class xl{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,f,C){return Hs(l,`/accounts/${this.accountId}${f}`,`Bearer ${this.apiToken}`,C)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(f){if(f instanceof Error&&/\b8000007\b|not found/i.test(f.message))return null;throw f}}async ensureProject(l,f="main"){let C=await this.getProject(l);if(C)return C;return this.request("POST","/pages/projects",{name:l,production_branch:f})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,f){let C=await Hs("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:f});return new Set(C)}async upsertHashes(l,f){await Hs("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:f})}async uploadBatch(l,f){let C=f.map((A)=>({key:A.hash,value:A.base64,metadata:{contentType:Og(A.extension)},base64:!0}));await Hs("POST","/pages/assets/upload",`Bearer ${l}`,C)}async createDeployment(l,f,C){let A={};for(let de of f)A[de.path]=de.hash;let w=new FormData;if(w.append("manifest",JSON.stringify(A)),C)w.append("branch",C);return this.request("POST",`/pages/projects/${l}/deployments`,w)}async deployDirectory(l){let f=await Ou(l.directory);if(f.length===0)throw Error(`No files to deploy in ${l.directory}`);let C=await this.uploadToken(l.project),A=await this.missingHashes(C,f.map((ve)=>ve.hash)),w=f.filter((ve)=>A.has(ve.hash)),de=[];for(let ve=0;ve<w.length;ve+=100)de.push(w.slice(ve,ve+100));let v=0;for(let ve=0;ve<de.length;ve+=4){let ct=de.slice(ve,ve+4);await Promise.all(ct.map((xe)=>this.uploadBatch(C,xe))),v+=ct.reduce((xe,Qt)=>xe+Qt.length,0),l.onProgress?.(v,w.length)}return await this.upsertHashes(C,f.map((ve)=>ve.hash)),{deployment:await this.createDeployment(l.project,f,l.branch),total:f.length,uploaded:w.length,uploadedBytes:w.reduce((ve,ct)=>ve+ct.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((C)=>C.name)}async attachCustomDomain(l,f){if((await this.listCustomDomains(l)).includes(f))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:f}),!0}}function vg(l,f){return{type:"CNAME",name:l,value:f.endsWith(".pages.dev")?f:`${f}.pages.dev`,ttl:1,proxied:!0}}async function $u(l,f){let{blake3:C}=await import("./chunk-7eaech9q.js").then((m)=>aS(m.default,1));return(await C(l+f)).slice(0,32)}async function Ou(l){let{readdir:f}=await import("node:fs/promises"),{join:C,relative:A,sep:w}=await import("node:path"),de=[];async function v(B){let ve=await f(B,{withFileTypes:!0});for(let ct of ve){let xe=C(B,ct.name);if(ct.isDirectory()){await v(xe);continue}if(!ct.isFile())continue;let Qt=`/${A(l,xe).split(w).join("/")}`;if(wg.has(Qt))continue;let Ut=await Bun.file(xe).bytes();if(Ut.byteLength>26214400)throw Error(`${Qt} is ${Ut.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let Pt=Buffer.from(Ut).toString("base64"),ut=ct.name.lastIndexOf("."),lt=ut>0?ct.name.slice(ut+1):"";de.push({path:Qt,hash:await $u(Pt,lt),base64:Pt,extension:lt,size:Ut.byteLength})}}return await v(l),de.sort((B,ve)=>B.path.localeCompare(ve.path)),de}function Og(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function Hs(l,f,C,A){let w={Authorization:C},de;if(A instanceof FormData)de=A;else if(A!==void 0)w["Content-Type"]="application/json",de=JSON.stringify(A);let v=await fetch(`https://api.cloudflare.com/client/v4${f}`,{method:l,headers:w,body:de}),B=await v.text(),ve;try{ve=JSON.parse(B)}catch{throw Error(`Cloudflare Pages API returned ${v.status} with a non-JSON body: ${B.slice(0,200)}`)}if(!ve.success){let ct=(ve.errors??[]).map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw Error(`Cloudflare Pages API error (${v.status}): ${ct||B.slice(0,200)}`)}return ve.result}import{createHash as Eg}from"node:crypto";var xu="https://api.cloudflare.com/client/v4",Fu=10042,kg=10006,Ng=10059;class Qn extends Error{status;errors;constructor(l,f,C=[]){super(l);this.name="R2ApiError",this.status=f,this.errors=C}hasCode(l){return this.errors.some((f)=>f.code===l)}}class jn extends Qn{accountId;constructor(l,f,C=[]){super(`R2 is not enabled on Cloudflare account ${l}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,f,C);this.name="R2NotEnabledError",this.accountId=l}}class Gs{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(l){if(!l.apiToken)throw Error("Cloudflare R2 needs an API token");if(!l.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId,this.fetchImpl=l.fetch??((f,C)=>fetch(f,C))}async requestEnvelope(l,f,C,A={}){let w={Authorization:`Bearer ${this.apiToken}`};if(C!==void 0)w["Content-Type"]="application/json";if(A.jurisdiction&&A.jurisdiction!=="default")w["cf-r2-jurisdiction"]=A.jurisdiction;let de=await this.fetchImpl(`${xu}/accounts/${this.accountId}/r2${f}`,{method:l,headers:w,body:C===void 0?void 0:JSON.stringify(C)}),v=await de.text(),B;try{B=JSON.parse(v)}catch{throw new Qn(`Cloudflare R2 API returned ${de.status} with a non-JSON body: ${v.slice(0,200)}`,de.status)}if(!B.success){let ve=B.errors??[];if(ve.some((xe)=>xe.code===Fu))throw new jn(this.accountId,de.status,ve);let ct=ve.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw new Qn(`Cloudflare R2 API error (${de.status}) on ${l} ${f}: ${ct||v.slice(0,200)}`,de.status,ve)}return B}async request(l,f,C,A){return(await this.requestEnvelope(l,f,C,A)).result}bucketPath(l){return`/buckets/${encodeURIComponent(l)}`}async listBuckets(l={}){let f=[],C;do{let A=new URLSearchParams({per_page:"1000"});if(C)A.set("cursor",C);let w=await this.requestEnvelope("GET",`/buckets?${A}`,void 0,l),de=w.result?.buckets??[];f.push(...de),C=de.length>0?w.result_info?.cursor||void 0:void 0}while(C);return f}async getBucket(l,f={}){try{return await this.request("GET",this.bucketPath(l),void 0,f)}catch(C){if(C instanceof jn)throw C;if(C instanceof Qn&&(C.hasCode(kg)||C.status===404))return null;throw C}}async ensureBucket(l,f={}){let C={jurisdiction:f.jurisdiction},A=await this.getBucket(l,C);if(A)return{bucket:A,created:!1};let w={name:l};if(f.locationHint)w.locationHint=f.locationHint;let de=await this.request("POST","/buckets",w,C);return{bucket:{...de,name:de?.name||l},created:!0}}async getCors(l,f={}){try{return(await this.request("GET",`${this.bucketPath(l)}/cors`,void 0,f))?.rules??[]}catch(C){if(C instanceof Qn&&!(C instanceof jn)&&(C.hasCode(Ng)||C.status===404))return[];throw C}}async putCors(l,f,C={}){if(f.length===0){await this.request("DELETE",`${this.bucketPath(l)}/cors`,void 0,C);return}await this.request("PUT",`${this.bucketPath(l)}/cors`,{rules:f},C)}async ensureCors(l,f,C={}){let A=await this.getCors(l,C);if(Na(A,f))return!1;return await this.putCors(l,f,C),!0}async getLifecycle(l,f={}){return(await this.request("GET",`${this.bucketPath(l)}/lifecycle`,void 0,f))?.rules??[]}async putLifecycle(l,f,C={}){await this.request("PUT",`${this.bucketPath(l)}/lifecycle`,{rules:f},C)}async ensureLifecycle(l,f,C={}){let A=await this.getLifecycle(l,C);if(Ba(A,f))return!1;return await this.putLifecycle(l,f,C),!0}async listCustomDomains(l,f={}){return(await this.request("GET",`${this.bucketPath(l)}/domains/custom`,void 0,f))?.domains??[]}async attachCustomDomain(l,f,C={}){return this.request("POST",`${this.bucketPath(l)}/domains/custom`,{domain:f.domain,zoneId:f.zoneId,enabled:f.enabled??!0,minTLS:f.minTLS??"1.2"},C)}async updateCustomDomain(l,f,C,A={}){return this.request("PUT",`${this.bucketPath(l)}/domains/custom/${encodeURIComponent(f)}`,C,A)}async ensureCustomDomain(l,f,C={},A){let w=f.minTLS??"1.2",v=(A??await this.listCustomDomains(l,C)).find((ct)=>ct.domain.toLowerCase()===f.domain.toLowerCase());if(!v){let ct=await this.attachCustomDomain(l,{...f,minTLS:w,enabled:!0},C);return{action:"attached",domain:{...ct,domain:ct?.domain||f.domain}}}let B=v.minTLS??"1.0";if(v.enabled&&B===w)return{action:"unchanged",domain:v};let ve=await this.updateCustomDomain(l,v.domain,{enabled:!0,minTLS:w},C);return{action:"updated",domain:{...v,...ve}}}async getManagedDomain(l,f={}){return this.request("GET",`${this.bucketPath(l)}/domains/managed`,void 0,f)}async setManagedDomain(l,f,C={}){let A=await this.getManagedDomain(l,C);if(A?.enabled===f)return{changed:!1,domain:A};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(l)}/domains/managed`,{enabled:f},C)}}}function Bu(l){return`https://${l}.r2.cloudflarestorage.com`}async function xg(l){let{apiToken:f,accountId:C}=l;if(!f)throw Error("r2S3Credentials needs an API token");if(!C)throw Error("r2S3Credentials needs an account id");let A=l.fetch??((v,B)=>fetch(v,B)),w=[],de;for(let v of[`/accounts/${C}/tokens/verify`,"/user/tokens/verify"]){let B=await A(`${xu}${v}`,{method:"GET",headers:{Authorization:`Bearer ${f}`}}),ve=await B.json().catch(()=>null);if(B.ok&&ve?.success&&ve.result?.id){de=ve.result.id;break}let ct=ve?.errors?.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");w.push(`${v} -> ${B.status}${ct?` (${ct})`:""}`)}if(!de)throw Error(`Could not verify the Cloudflare API token to derive R2 credentials: ${w.join("; ")}`);return{accessKeyId:de,secretAccessKey:Eg("sha256").update(f).digest("hex"),endpoint:Bu(C),region:"auto"}}function gs(l){if(Array.isArray(l))return`[${l.map(gs).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${gs(A)}`).join(",")}}`;return JSON.stringify(l)}function ku(l,f){let C=(A)=>A&&A.length>0?[...A].map(String).sort():void 0;return{id:f?l.id:void 0,allowed:{origins:C(l.allowed?.origins),methods:C(l.allowed?.methods?.map((A)=>A.toUpperCase())),headers:C(l.allowed?.headers?.map((A)=>A.toLowerCase()))},exposeHeaders:C(l.exposeHeaders?.map((A)=>A.toLowerCase())),maxAgeSeconds:l.maxAgeSeconds}}function Na(l,f){if(l.length!==f.length)return!1;return f.every((C,A)=>{let w=C.id!==void 0;return gs(ku(l[A],w))===gs(ku(C,w))})}function Ba(l,f){if(l.length!==f.length)return!1;let C=(A)=>gs([...A].map((w)=>({...w,storageClassTransitions:w.storageClassTransitions?.length?w.storageClassTransitions:void 0})).sort((w,de)=>w.id.localeCompare(de.id)));return C(l)===C(f)}var Lg="r2 cache",Bg=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function Mg(l,f={}){let C=f.log??(()=>{}),A={buckets:[],warnings:[]},w=l.infrastructure?.r2??l.r2,de=Object.entries(w?.buckets??{});if(de.length===0)return C("R2: no buckets declared, skipping."),A;if(!f.apiToken||!f.accountId){let xe=[!f.apiToken&&"CLOUDFLARE_API_TOKEN",!f.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),Qt=`R2: ${de.length} bucket(s) declared but ${xe} is not set, skipping.`;return C(Qt),A.warnings.push(Qt),A}let v=f.dryRun===!0,B=new Gs({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),ve=new J(f.apiToken,{zoneId:f.zoneId,accountId:f.accountId}),ct=new Map;for(let[xe,Qt]of de){let Ut=Qt?.name;if(!Ut||!Bg.test(Ut)){A.warnings.push(`R2: bucket '${xe}' has an invalid name '${Ut??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}C(`R2: ${v?"checking":"reconciling"} bucket ${Ut}...`);let Pt={name:Ut,changes:[],domains:[]};if(A.buckets.push(Pt),await _g(Qt,{r2:B,cloudflare:ve,dryRun:v,summary:Pt,warnings:A.warnings,claimed:ct,log:C}),Pt.changes.length===0)C(`R2: ${Ut} is in sync.`);else for(let ut of Pt.changes)C(`R2: ${Ut}: ${ut}`)}return A}async function _g(l,f){let{r2:C,dryRun:A,summary:w,warnings:de}=f,v=l.name,B={jurisdiction:l.jurisdiction},ve=(Pt,ut)=>{let lt=A?ut&&`would ${ut}`:Pt;if(lt)w.changes.push(lt)},ct;if(A)ct=await C.getBucket(v,B)!==null;else{let{created:Pt}=await C.ensureBucket(v,{locationHint:l.locationHint,jurisdiction:l.jurisdiction});if(ct=!0,Pt)ve("created","")}if(!ct)ve("","create bucket");let xe=Hg(l.customDomains);await bs(f,`cors on ${v}`,async()=>{if(!l.cors)return;if(!ct){ve("cors updated","set cors");return}let Pt=await C.getCors(v,B);if(Na(Pt,l.cors))return;if(!A)await C.putCors(v,l.cors,B);ve(l.cors.length===0?"cors removed":"cors updated",l.cors.length===0?"remove cors":"update cors")}),await bs(f,`lifecycle on ${v}`,async()=>{if(!l.lifecycle)return;let Pt=l.lifecycle.map(ju);if(ct){let ut=await C.getLifecycle(v,B);if(Ba(ut,Pt))return}if(!A)await C.putLifecycle(v,Pt,B);ve("lifecycle updated","update lifecycle")}),await bs(f,`r2.dev URL on ${v}`,async()=>{let Pt=l.publicDevUrl===!0;if(!ct){if(Pt)ve("r2.dev URL enabled","enable r2.dev URL");return}if((await C.getManagedDomain(v,B))?.enabled===Pt)return;if(!A)await C.setManagedDomain(v,Pt,B);ve(Pt?"r2.dev URL enabled":"r2.dev URL disabled",Pt?"enable r2.dev URL":"disable r2.dev URL")});let Qt=[];if(xe.length>0&&ct)try{Qt=await C.listCustomDomains(v,B)}catch(Pt){if(Pt instanceof jn)throw Pt;de.push(`R2: could not list custom domains on ${v}: ${Dc(Pt)}`)}let Ut=new Map;for(let{domain:Pt,minTLS:ut}of xe){let lt=f.claimed.get(Pt);if(lt&&lt!==v){de.push(`R2: ${Pt} is declared on both ${lt} and ${v}; leaving it on ${lt}.`);continue}f.claimed.set(Pt,v);let Ee=Qt.find((ce)=>ce.domain.toLowerCase()===Pt),Ht=ut??"1.2";if(Ee&&Ee.enabled&&(Ee.minTLS??"1.0")===Ht){if(w.domains.push({domain:Pt,status:$c(Ee)}),Ee.zoneId)Ut.set(Pt,Ee.zoneId);continue}await bs(f,`custom domain ${Pt} on ${v}`,async()=>{if(Ee){if(!A)await C.updateCustomDomain(v,Ee.domain,{enabled:!0,minTLS:Ht},B);if(ve(`custom domain ${Pt} updated`,`update custom domain ${Pt}`),w.domains.push({domain:Pt,status:$c({...Ee,enabled:!0})}),Ee.zoneId)Ut.set(Pt,Ee.zoneId);return}let ce=await f.cloudflare.zoneIdFor(Pt);if(Ut.set(Pt,ce),!A)await C.ensureCustomDomain(v,{domain:Pt,zoneId:ce,minTLS:Ht},B,Qt);ve(`custom domain ${Pt} attached`,`attach custom domain ${Pt}`),w.domains.push({domain:Pt,status:A?"not attached":"pending"})},()=>w.domains.push({domain:Pt,status:"error"}))}if(l.cache&&xe.length>0)await Vg(l,xe.map((Pt)=>Pt.domain).filter((Pt)=>f.claimed.get(Pt)===v),Ut,f,ve)}async function Vg(l,f,C,A,w){let de=Mu(l.cache);if(!de||f.length===0)return;let v=new Map;for(let B of f){let ve=C.get(B);if(!ve)try{ve=await A.cloudflare.zoneIdFor(B)}catch(ct){A.warnings.push(`R2: could not resolve the zone for ${B}, cache rule skipped: ${Dc(ct)}`);continue}v.set(ve,[...v.get(ve)??[],B])}for(let B of v.values()){let ve={action:"set_cache_settings",description:`${Lt} ${Lg}`,expression:`(${_t(B)})`,enabled:!0,action_parameters:de};await bs(A,`cache rule for ${B.join(", ")}`,async()=>{let ct=await A.cloudflare.getPhaseRules(B[0],"http_request_cache_settings");if(_u(ct,ve))return;if(!A.dryRun){let xe=await A.cloudflare.putManagedPhaseRules(B[0],"http_request_cache_settings",[ve]);if(!xe.success)throw Error(xe.message||"cache rule write failed")}w(`cache rule updated for ${B.join(", ")}`,`update cache rule for ${B.join(", ")}`)})}}function Mu(l){if(l.edgeTtl===void 0&&l.browserTtl===void 0)return null;let f={cache:!0};if(l.edgeTtl!==void 0)f.edge_ttl={mode:"override_origin",default:l.edgeTtl};if(l.browserTtl!==void 0)f.browser_ttl={mode:"override_origin",default:l.browserTtl};return f}function _u(l,f){let C=$t(f.expression),A=_n(f.expression),w=(B)=>(B.description||"").startsWith(Lt),de=(B)=>B.action===f.action&&B.description===f.description&&(B.enabled??!0)===(f.enabled??!0)&&_n(B.expression)===A&&rc(B.action_parameters)===rc(f.action_parameters),v=!1;for(let B of l){if(!w(B))continue;let ve=$t(B.expression);if(!C.some((xe)=>ve.includes(xe)))continue;if(de(B)&&C.every((xe)=>ve.includes(xe))&&!v){v=!0;continue}return!1}return v}function ju(l){let f={id:l.id,enabled:l.enabled??!0,conditions:{prefix:l.prefix??""}};if(l.expireAfterDays!==void 0)f.deleteObjectsTransition={condition:{type:"Age",maxAge:Tc(l.expireAfterDays)}};else if(l.expireOn!==void 0)f.deleteObjectsTransition={condition:{type:"Date",date:l.expireOn}};if(l.abortMultipartUploadsAfterDays!==void 0)f.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:Tc(l.abortMultipartUploadsAfterDays)}};if(l.infrequentAccessAfterDays!==void 0)f.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:Tc(l.infrequentAccessAfterDays)}}];return f}function Tc(l){return Math.round(l*86400)}function Hg(l){let f=new Set,C=[];for(let A of l??[]){let w=typeof A==="string"?{domain:A}:A,de=w.domain?.trim().replace(/\.$/,"").toLowerCase();if(!de||f.has(de))continue;f.add(de),C.push({domain:de,minTLS:w.minTLS})}return C}function $c(l){if(!l.enabled)return"disabled";let f=l.status?.ownership,C=l.status?.ssl;if(f==="active"&&C==="active")return"active";for(let A of[f,C])if(A==="error"||A==="blocked"||A==="deactivated")return A;return"pending"}async function bs(l,f,C,A){try{await C()}catch(w){if(w instanceof jn)throw w;l.warnings.push(`R2: ${f} failed: ${Dc(w)}`),A?.()}}function Dc(l){return l instanceof Error?l.message:String(l)}function rc(l){if(Array.isArray(l))return`[${l.map(rc).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${rc(A)}`).join(",")}}`;return JSON.stringify(l)}export{dl as ABTestManager,ge as ACMClient,Sr as ACMDnsValidator,_c as ACME_DIRECTORIES,Pe as AI,ql as API_IDEMPOTENCY_TTL_MS,Gl as API_TOKEN_DEFAULT_TTL_MS,Vl as API_TOKEN_MAX_TTL_MS,rs as API_VERSION,me as AUTHORIZATION_CAPABILITIES,Fl as AUTH_ACTION_TOKEN_TTL_MS,Ul as AUTH_MFA_CHALLENGE_TTL_MS,Ql as AUTH_OIDC_TRANSACTION_TTL_MS,Ye as AUTH_SESSION_ABSOLUTE_TTL_MS,Ml as AUTH_SESSION_IDLE_TTL_MS,YA as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,S as AWSCloudFrontClient,sl as AWSConfigManager,vI as AWS_PSEUDO_PARAMETERS,Ne as AWS_REGIONS,bg as AcmeClient,jr as AlertEvaluator,ki as AlertStore,uo as AnomalyConfigStore,Kd as ApiGateway,i as ApiServiceError,oc as ApplicationAutoScalingClient,Yr as Arn,k as AssetHasher,V as Auth,Xi as AuthenticationStore,Li as AutomationApiService,Yi as AutomationIdentityStore,ga as AwsAuroraDataAdapter,Aa as AwsAuroraTransport,_a as AwsDatabaseBackupSource,vr as AwsDriver,pa as AwsElastiCacheDataAdapter,ya as AwsElastiCacheTransport,wf as AwsIamCapabilityScanner,Ua as AwsInfrastructureBackupSource,ua as AwsRdsDataAdapter,ha as AwsRdsTransport,Ff as AwsRegionalDriver,Ha as AwsSecretsManagerConfigurationBackend,Hp as AwsSpendTransport,Ga as AwsSsmConfigurationBackend,ps as BackupCoordinator,nl as BackupManager,xa as BackupStore,ef as BatchProcessingManager,Nn as BedrockClient,Pn as BedrockRuntimeClient,Yl as BitbucketSourceAdapter,cl as BlueGreenManager,Vm as BounceComplaintHandler,_m as BuildOptimizationManager,Iu as BunDockerRuntime,Ju as BunDockerVolumeRuntime,Wu as BunFilesystemArchiveRuntime,he as CDN,No as CHAIN_HEADER,Lt as CLOUDFLARE_MANAGED_RULE_PREFIX,Gd as CLOUDFRONT_FAILOVER_STATUS_CODES,lC as COMMON_CROSS_ACCOUNT_ROLES,Ge as CONTROL_PLANE_SCHEMA_VERSION,vo as Cache,Vi as CanaryManager,Bm as CertificateManager,dA as CloudBlockVolumeDriver,Vs as CloudDriverFactory,We as CloudError,sm as CloudFormationBuilder,h as CloudFormationClient,S as CloudFrontClient,ol as CloudTrailManager,Ie as CloudWatchLogsClient,xl as CloudflarePagesProvider,J as CloudflareProvider,Sy as CommandHistory,j as Communication,Qr as ComposeApplicationService,zt as ComposeApplicationStore,kt as ComprehendClient,a as Compute,Gp as ComputeSpendTransport,Ro as ConfigurationError,qa as ConfigurationService,Qa as ConfigurationStore,Rn as ConnectClient,fa as ContainerDataAdapter,ml as ContainerRegistryManager,Fa as ControlPlaneBackupSource,Pa as ControlPlaneCleanupDriver,vi as ControlPlaneStore,ao as CounterTracker,Ct as CredentialError,Im as CrossRegionReferenceManager,MA as DASHBOARD_ENTRY,FA as DASHBOARD_PORT_BASE,UA as DASHBOARD_PORT_SPAN,$A as DASHBOARD_STATE_DIR,Fo as DEFAULT_ATTACK_MODE_HOURS,Nd as DEFAULT_DDOS_THRESHOLDS,zp as DEFAULT_FAILOVER_STATUS_CODES,ud as DEFAULT_METER_MAPPINGS,dd as DEFAULT_PRICE_BOOK,rn as DEFAULT_RECURSION_LIMITS,Gn as DEFAULT_RPX_CERTS_DIR,z as DEFAULT_SERVICE_LIMITS,Od as DEFAULT_STATE_DIR,dg as DEFAULT_STATIC_ASSET_EXTENSIONS,xA as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,CA as DEFAULT_TELEMETRY_POLICY,wp as DEFAULT_THRESHOLDS,iA as DEPLOYMENT_QUEUE_KINDS,Po as DEPTH_HEADER,Vr as DETECTABLE_SIGNALS,fu as DIAGNOSTIC_PRESETS,Zm as DLQMonitoringManager,Q as DNS,Hm as DNSSECManager,os as DataServiceLifecycle,la as DataServiceStore,Yt as Database,Nm as DatabaseUserManager,F as DebugLogger,BA as DependencyGraph,q as Deployment,XA as DeploymentError,il as DisasterRecoveryManager,Mn as DnsProviderFactory,or as DockerDataTransport,ia as DockerDiscoveryAdapter,Ur as DockerNamedVolumeDriver,Ma as DockerVolumeBackupSource,c as DurableOperationQueue,eo as DurableQueueWorker,_e as DynamoDBClient,Br as EC2Client,$e as ECRClient,nt as ECSClient,fr as EFSClient,ec as ELBv2Client,uA as ENFORCEMENT_ACTIONS,Pi as ENFORCEMENT_DESCRIPTIONS,N as ENFORCEMENT_SEVERITY,ep as ENVIRONMENT_LABEL,pu as EcsRuntimeAdapter,Mo as EdgeRateLimiter,st as ElastiCacheClient,m as Email,Km as EmailAdvanced,qm as EmailAnalyticsManager,On as EmailClient,Wm as EmailHandlers,zm as EmailTemplateManager,Sa as EncryptedDataSecretStore,ZA as ErrorCodes,pr as EventBridgeClient,Lf as EventBridgeJobAdapter,Va as ExternalConfigurationBackend,Eo as FAILOVER_REPLICA_POLICY_SID,Ym as FIFOQueueManager,Op as FOCUS_VERSION,Xd as FileCache,ze as FileSystem,La as FilesystemBackupSource,ba as FleetService,Ia as FleetStore,e as Fn,Zl as GiteaSourceAdapter,Jl as GithubSourceAdapter,Xl as GitlabSourceAdapter,bm as GlobalResourceManager,Me as GoDaddyProvider,al as GuardDutyManager,pt as HOST_SITES_DIR,ny as HashCache,pf as HealthCheckManager,qe as HealthCheckRunner,Dr as HetznerClient,Te as HetznerDriver,be as IAMClient,hc as IPV6_EXCLUDED_HOST_LABELS,Om as ImageScanningManager,jf as InfrastructureGenerator,Yc as InvalidOperationTransitionError,It as JobLoader,$f as JobProviderReconciler,da as JobService,aa as JobStore,gr as KendraClient,uf as LARAVEL_SERVERLESS_BUILD_STEPS,E as LambdaClient,Mm as LambdaConcurrencyManager,Qm as LambdaDLQManager,Fm as LambdaDestinationsManager,Lm as LambdaLayersManager,mu as LambdaRuntimeAdapter,Um as LambdaVPCManager,$m as LambdaVersionsManager,Cn as LocalEncryptedConfigurationBackend,$a as LogicalDatabaseBackupSource,ul as LogsManager,Uy as MANAGED_NODE_VERSIONS,Uc as MANAGEMENT_DASHBOARD_SITE,om as MANAGEMENT_DASHBOARD_SITE_PREFIX,Wi as MAX_CONTROL_HOURS,Zc as MAX_CONTROL_PLANE_ERROR_BYTES,bp as MAX_CONTROL_PLANE_JSON_BYTES,io as METERS,lA as METER_KEYS,gA as MICRO_CENTS,Rp as MIN_PROJECTION_CONFIDENCE,pg as MTA_STS_PORT,Da as MaintenanceService,Ra as MaintenanceStore,ie as Messaging,Rm as MetricsManager,Dm as MigrationManager,fm as MockCloudFormation,Am as MockDynamoDB,hm as MockS3,To as Monitoring,vm as MultiAccountManager,Sm as MultiRegionManager,py as MultiStepProgress,y as Network,mf as NetworkSecurityManager,Bi as NotificationRouter,Jp as ORIGIN_CONNECTION_ATTEMPTS,Xp as ORIGIN_CONNECTION_TIMEOUT,Kp as ORIGIN_GROUP_ALLOWED_METHODS,bI as ORIGIN_GROUP_ID_SUFFIX,Wp as ORIGIN_GROUP_SELECTION_CRITERIA,tc as OpenSearchClient,mt as OptimisticConcurrencyError,Tm as OrganizationManager,Ig as PAGES_MAX_FILE_BYTES,Jy as PHP_DEFAULT_EXCLUDES,Qy as PHP_LAYER_EXTENSIONS,Zg as PROJECT_LABEL,at as PROXIABLE_RECORD_TYPES,T as ParameterStore,Pm as PerformanceManager,ne as Permissions,ic as PersonalizeClient,Ke as Phone,Jm as PhoneAdvanced,nm as PhoneHandlers,Ea as PlacementService,Ca as PlacementStore,kn as PollyClient,le as PorkbunProvider,un as PreDeployScanner,tl as PreviewEnvironmentManager,Fr as PreviewEnvironmentService,Ve as PreviewEnvironmentStore,rl as PreviewNotificationService,gy as ProgressBar,ll as ProgressiveDeploymentManager,Uo as ProtectionControlStore,kA as Pseudo,H as Queue,Ti as QueueCancellationError,tf as QueueManagementManager,dI as QueuePresets,Zs as QueueTimeoutError,Qn as R2ApiError,jn as R2NotEnabledError,Gs as R2Provider,Fu as R2_NOT_ENABLED_ERROR_CODE,Nl as RATE_LIMIT_KEY_SEPARATOR,W as RDSClient,by as RECOMMENDED_ACCOUNT_STRUCTURES,dC as RECOMMENDED_SCPS,Cf as RELEASE_QUEUE_KINDS,hy as REPL,yy as REPLCommandBuilder,Ay as REPLContext,tp as ROLE_LABEL,iy as RateLimiter,lI as RealtimePresets,_p as RecordingSpendTransport,ji as RecursionGuard,bt as Redirects,Cm as RegionPairManager,Ta as RegionService,va as RegionStore,je as Registry,Bt as RekognitionClient,Et as ReleaseService,Wo as ReleaseStore,Mf as RemoteBuildService,gl as ReplicaManager,ff as ResourceManagementManager,te as RetryableOperationError,I as Route53Client,Za as Route53DomainsClient,X as Route53Provider,Gm as Route53ResolverManager,hl as Route53RoutingManager,ye as RuntimeOperationService,oa as RuntimeStreamRegistry,Oa as S3BackupDestinationAdapter,o as S3Client,M as S3Error,ru as SECRET_PATTERNS,Bp as SENSITIVITY_THRESHOLDS,ot as SESClient,G as SMS,it as SNSClient,Qp as SPEND_CYCLE_SECONDS,vd as SPEND_GATE_SETTING,wA as SPEND_LEASE_SETTING,ae as SQSClient,we as SSH_BOOTSTRAP_VERSION,si as SSH_PREFLIGHT_SCRIPT,Re as SSMClient,qp as STATE_DIR_ENV_VAR,ls as STATIC_SITE_ZONE_SETTINGS,qd as STORAGE_FAILOVER_METADATA_KEY,Se as STSClient,Bn as SchedulerClient,Zt as Search,gn as SecretFindingScanner,Ui as Secrets,pl as SecretsManager,K as SecretsManagerClient,km as SecretsRotationManager,b as Security,tr as SecurityHubManager,ln as SecurityPostureStore,vt as SecurityScannerRunner,xm as SecurityScanningManager,jm as SenderReputationManager,_f as ServerCronJobAdapter,ma as ServerDataAdapter,no as ServerPathVolumeDriver,fl as ServiceMeshManager,zd as Sftp,po as SignalSource,Xm as SmsAdvanced,Ot as SmsClient,im as SmsHandlers,dc as SmsVoiceClient,Jo as SourceConnectionStore,ir as SourceProviderError,Td as SpendCapError,qr as SpendGate,Fp as SpendLoopLease,yo as SpendNotificationRouter,Up as SpendRunner,Wt as SpendService,Ri as SpendStore,my as Spinner,Nr as SshDriver,fn as SshFleetDriver,Em as StackDependencyManager,EI as StacksIntegration,gf as StaticSiteManager,De as Storage,Rl as StorageAdvancedManager,xn as SupportClient,rr as SyntheticsManager,bu as SystemFleetSshTransport,Pr as SystemSshTransport,sa as SystemdDiscoveryAdapter,ko as TRACE_HEADER,fy as TaskList,At as TelemetryStore,Qd as TemplateBuilder,Yd as TemplateCache,xt as TextractClient,Dn as TranscribeClient,ur as TranslateClient,Hf as TransportDisasterRecoveryDriver,Qf as TransportPlatformMaintenanceDriver,as as TransportRemoteBuildDriver,ra as TrivyImageScanner,Ko as TsCloudApiError,jl as TsCloudClient,TA as URGENT_SPEND_EVENTS,Dp as USER_VISIBLE_ACTIONS,wa as UnavailableRegionalDriver,ue as UnifiedDnsValidator,Js as UnsupportedSchemaVersionError,lm as ValidationError,mr as VoiceClient,ro as VolumeService,jt as VolumeStore,LA as Workflow,wm as XRayManager,Ny as abTestManager,zl as activateImmutableRelease,yg as addDns01ChallengeRecord,An as addSiteToCloudConfig,wt as ageSeconds,pd as aggregateDeltas,yp as allocateSitePorts,rm as amazonLinuxImageId,_A as amazonLinuxImageParameter,SI as analyzeStackDiff,Ni as anomalyOptionsForSignal,Qo as applyControlsToDdos,_l as applyControlsToRateLimits,Ns as applyDeclaredZoneSettings,Wr as applyMitigationFactor,Fh as applyPlan,Os as applyZoneMigration,Al as artifactKey,yt as assertOriginGroupMethods,Zi as assertReleaseStrategy,bA as assertSpendAllows,Vh as attachConflicts,qh as attachIsViable,Gh as attachPreconditions,au as attachProvenanceToRelease,na as attachSbomToRelease,su as attachVulnerabilitySummary,If as authEncryptionKeyFile,P as authorizeOrganization,xf as authorizeRuntimePath,Fb as autocomplete,vy as awsConfigManager,zu as backupCredentialStatus,Cy as backupManager,lb as batch,eE as batchProcessingManager,jo as beginOidcAuthorization,Dy as blueGreenManager,KC as bounceComplaintHandler,ft as budgetWindow,Ja as buildAndPushServerlessImage,nE as buildBunRuntimeLayerZip,Xh as buildCertificatePackScript,Kh as buildCertificateStateScript,Yh as buildCertificateUnpackScript,Wd as buildCloudFormationTemplate,xc as buildCloudInitFirstBoot,nd as buildComposeLogsCommand,aI as buildComposeRuntimeCommand,cI as buildComposeScaleCommand,id as buildComposeShellCommand,fp as buildDrainSourceScript,Nh as buildDrainedSiteScanScript,jd as buildFailoverReplicaPolicyStatement,cr as buildFunctionEnv,mp as buildHealthGateScript,Xn as buildHostCleanupDeployScript,Qs as buildHostCleanupInstallScript,Jn as buildHostCleanupScript,Ci as buildHostSitePortsScript,Ud as buildMailEnv,js as buildManagementDashboardArtifact,qg as buildMediaCdnPlan,gg as buildMtaStsPolicy,uh as buildMtaStsServer,rE as buildNodeRuntimeLayerZip,FC as buildOptimizationManager,Vd as buildOriginGroup,Xr as buildOriginGroups,gc as buildOriginGuardRule,ap as buildPauseWorkersScript,aE as buildPhpRuntimeLayerZip,tm as buildReplicationConfiguration,em as buildReplicationRole,up as buildRestoreScript,Y as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Qh as buildSetHostnameScript,Zn as buildSiteDeployScript,lp as buildSnapshotScript,hp as buildSourceStateScript,zn as buildSshArgs,ni as buildSshBootstrapScript,uc as buildStaticSiteCacheRules,ei as buildStaticSiteDeployScript,gp as buildTargetStateScript,cp as buildWorkersStateScript,du as bytes,Mu as cacheRuleParameters,Py as canaryManager,hn as canonicalJson,Tt as capabilities,ar as capacity,Sb as categorizeChanges,LC as certificateManager,Jh as certificatesMatch,eb as checkIAMPermissions,af as checkInvocation,rb as checkServiceQuotas,sy as chunk,fh as cleanupDns01Challenge,nS as clearSigningKeyCache,Yo as cloneSourceBinding,oy as cloudConfigSchema,Fg as cloudDrivers,Ty as cloudTrailManager,Ou as collectAssets,_o as collectPhpAppEntries,lg as collectServerDnsDomains,Cp as completeComposeVolumeDeletion,zo as completeOidcAuthorization,HI as composePresets,Ys as composeProjectName,Sl as composeServerlessAppTemplate,DA as compositeSpendTransport,Nt as compressBackup,lS as config,lc as configOrigins,yu as connectionGuidance,Ly as containerRegistryManager,rA as controlPlaneDatabaseFile,Jc as controlPlaneMigrations,NI as createApiBackendPreset,ta as createApiV1Handler,SS as createAsgBuildDriver,Ku as createBackupQueueHandlers,Wy as createCliHandler,O as createCloudDriver,Lc as createCloudFrontPolicy,JI as createCredentialProvider,UI as createDashboardSite,_I as createDataPipelinePreset,Su as createDataServiceQueueHandlers,sd as createDeploymentQueueHandlers,D as createDnsProvider,yS as createEcsBuildDriver,wd as createEnforcementHandlers,um as createError,Jd as createExistingStaticFullStackPreset,Cu as createFleetQueueHandlers,PI as createFullStackAppPreset,$s as createGoDaddyValidator,oE as createHandlers,zy as createHttpHandler,BI as createJamstackPreset,Au as createJobQueueHandlers,MI as createLaravelPreset,LI as createMLApiPreset,Pu as createMaintenanceQueueHandlers,Ug as createMediaAccessToken,xI as createMicroservicesPreset,Rb as createMockAWS,wI as createNodeJsServerPreset,RI as createNodeJsServerlessPreset,vs as createObjectStorageClient,Ls as createPorkbunValidator,GI as createPreset,Lo as createPresignedUrl,Yy as createPresignedUrlAsync,Ky as createQueueHandler,OI as createRealtimeAppPreset,vu as createRegionQueueHandlers,ou as createReleaseProvenance,Wl as createReleaseQueueHandlers,hS as createRemoteBuildQueueHandlers,Ms as createRoute53Validator,Bf as createRuntimeAdapters,JA as createS3Client,AS as createServerBuildDriver,FI as createServerlessLaravelPreset,DI as createServerlessNodePreset,cg as createSmsInfrastructure,et as createSourceAdapter,TI as createStaticSitePreset,$I as createTraditionalWebAppPreset,od as createVolumeQueueHandlers,kI as createWordPressPreset,Je as createZip,zb as crossRegionReferenceManager,En as dashboardActions,qs as dashboardCredentialsFile,mn as dataServiceCapabilities,OC as databaseUserManager,$l as decodeBase32,Oe as decompressBackup,Yf as decryptBackup,Ho as defaultConfig,mm as defaultLocalConfig,Bl as defaultRateLimitRules,yr as delegateZone,Ds as delegateZoneFromConfig,Gu as deleteFailoverReplicaBuckets,Ka as deleteStaticSite,Hc as deployAllComputeSites,ka as deployServerlessApp,Vu as deploySite,zs as deploySiteRelease,As as deployStaticSite,Wa as deployStaticSiteFull,vn as deployStaticSiteWithExternalDns,Tn as deployStaticSiteWithExternalDnsFull,Md as deploymentCoexistenceError,QA as deriveManagementDashboardPort,Ps as describeDelegation,Ol as describePosture,ks as describeZoneSettings,Of as desiredJobProviderState,kp as detectAnomalies,jp as detectDeploymentTargets,pc as detectDnsProvider,bd as detectLatestAnomaly,YI as detectMisconfigurations,Dl as detectServiceRegion,td as diffCompose,hb as diffTemplates,Xo as discoverGitRefs,qo as discoverOidcProvider,lu as discoverRuntimeInventory,ZC as dlqMonitoringManager,mc as dnsProviders,jC as dnssecManager,Pf as dockerWorkloads,cs as documentDigest,$c as domainStatus,Ey as drManager,Qe as driverStatePath,uu as ecsWorkloads,qt as effectiveCapabilities,WC as emailAnalyticsManager,XC as emailTemplateManager,Ji as encodeBase32,Xf as encryptBackup,cu as ensureDefaultSecurityPolicies,Uu as ensureFailoverReplicaBuckets,gi as ensureFirewall,fi as ensureManagementDashboard,pi as ensureServer,ui as ensureSshKey,ee as escapeSecLang,fd as evaluateBudget,ai as evaluatePreflight,Ao as evaluateTelemetryAlertRules,hu as eventBridgeScheduleInput,jy as eventToRequest,yA as ewma,ed as exportCompose,Bs as exportRoute53Zone,cm as extendPreset,YC as fifoQueueManager,db as findChangedFiles,vp as findMapping,Ep as findPriceEntry,mC as formatAccountStructure,jh as formatAttachPlan,kb as formatBytes,zr as formatCents,II as formatDiff,Bh as formatDrainedSiteRefusal,Bb as formatDuration,Qb as formatFlagSuggestions,Vb as formatHistory,qb as formatHistoryStats,Lh as formatInventory,Ob as formatKeyValue,xb as formatList,Mh as formatPlan,di as formatPreflightFindings,Nb as formatProgressBar,Iy as formatRegion,sC as formatRegionList,Tf as formatScanResults,_b as formatSuggestion,Db as formatTable,Gr as formatTimeToExhaustion,Pb as formatTree,jA as fromEC2Metadata,zA as fromECSMetadata,VA as fromEnvironment,qA as fromSharedCredentials,KA as fromWebIdentity,Cl as functionFingerprint,qn as gatewayHostnames,bl as generateAppImageDockerfile,DC as generateApprovalConfig,rf as generateBootstrap,dy as generateCleanupWorkflow,ly as generateCostReportWorkflow,gC as generateCrossAccountRoleCF,nu as generateCycloneDxSbom,TC as generateDeploymentConfig,IC as generateDeploymentPipeline,fC as generateDeploymentWorkflow,za as generateExternalDnsStaticSiteTemplate,ph as generateHttpsServerCode,iu as generateImageSbom,dh as generateLetsEncryptUserData,t as generateLogicalId,vC as generateManualPipeline,SC as generateMatrixWorkflow,wC as generateMultiEnvConfig,bC as generateMultiEnvPipeline,hC as generateMultiEnvWorkflow,AC as generatePRPreviewWorkflow,PC as generateParallelConfig,lf as generatePhpFpmConfig,nf as generatePhpLayerDockerfile,CC as generatePreviewPipeline,cy as generatePreviewWorkflow,r as generateResourceName,RC as generateScheduledConfig,EC as generateScheduledPipeline,yC as generateScheduledWorkflow,hs as generateStaticSiteTemplate,x as generateUbuntuAppCloudInit,dm as getAccountId,Xb as getAllRegions,rC as getClosestRegion,Hb as getCommandUsage,nA as getComposeTemplate,Af as getConfig,$b as getContextualHelp,Hi as getCredentials,Ib as getDeploymentStrategy,bb as getDiffStats,Ab as getDiffSummary,ey as getErrorDetails,el as getLocalConfig,Tb as getLocalCredentials,vb as getLocalEndpoint,wb as getLocalEnvVars,nb as getQuotaUsageSummary,uC as getRecommendedStructure,Gi as getRegion,oC as getRegionStats,Zb as getRegionsByCompliance,Yb as getRegionsByLocation,eC as getRegionsByPricingTier,ty as getRequiredPermissions,iS as getSigningKeyCacheSize,ag as getSmsInfrastructureStatus,uI as getTimestamp,$o as globMatches,Ks as globToRegex,Kb as globalResourceManager,Di as governingLimitCents,Qu as grantFailoverReplicaAccess,wy as guardDutyManager,So as handleSpendRequest,Vn as hasAutoWwwVariant,er as hasManagementDashboardSite,Wc as hasProxyUpstream,sb as hashBuffer,ob as hashDirectory,gm as hashFile,ab as hashManifest,pm as hashString,dE as healthCheckManager,Un as hostAcceptsIpv6,_t as hostCondition,Go as hotp,Hr as hourBucket,AA as hourBucketsBetween,MC as imageScanningManager,us as infraEnvFromOutputs,vl as inspectInvocation,Vy as installRecursionFetch,Ss as invalidateCache,of as invocationContext,OA as isArmInstanceType,Lb as isLikelyTypo,Hn as isLocalDatabase,Eb as isLocalDevelopment,Zr as isManagementDashboardSiteName,hr as isNameserverRegistrar,sS as isNodeCryptoAvailable,Id as isOperationAllowed,ho as isQuietHours,Co as isS3RestEndpoint,Ai as isSafePattern,Ld as isStateDirConfigured,$d as isStatePath,Kr as isValidCidr,tC as isValidRegion,wi as isValidTimeZone,oS as isWebCryptoAvailable,Ar as isZoneHost,pn as jobProviderCapability,Es as keyMatchesFilters,HC as lambdaConcurrencyManager,qC as lambdaDLQManager,GC as lambdaDestinationsManager,UC as lambdaLayersManager,VC as lambdaVPCManager,QC as lambdaVersionsManager,gu as lambdaWorkloads,Tl as laravelServerlessEnvDefaults,Mr as listComposeTemplates,ts as listSourceReferences,Ll as loadCloudConfig,Jt as loadTelemetryPolicy,By as logsManager,Cd as lookbackHoursForSignal,NA as mailEnabled,Fd as mailFirewallPorts,Uf as maintenanceWindowOpen,hf as makeAWSRequest,eS as makeAWSRequestAsync,Zy as makeAWSRequestOnce,_u as managedRuleInSync,am as managementDashboardSiteName,Tu as manifestDigest,on as matchTotpCounter,Kg as mediaObjectHeaders,lo as median,Pp as medianAbsoluteDeviation,hd as mergeDecisions,en as mergeInfrastructure,fA as mergePriceBooks,gd as meterTelemetry,kC as metricsManager,rg as migrateObjectStorage,BC as migrationManager,aC as multiAccountManager,jb as multiRegionManager,gh as needsRenewal,lE as networkSecurityManager,Rt as nextScheduleRuns,Ce as normalizePublicIpv6,ke as normalizeRuntimeStatus,tt as normalizeScheduleExpression,Ef as normalizeSourceEvent,Ue as normalizeSshPublicKey,Lp as normalizeTelemetryPolicy,bi as occupiedHostPorts,ea as openApiDocument,mo as optionsForSignal,cC as organizationManager,wl as packagePhpApp,tn as packageServerlessApp,$u as pagesAssetHash,vg as pagesDnsRecord,Zd as parallel,ub as parallelMap,gb as parallelWithRetry,Wh as parseCertificateState,El as parseChain,$r as parseCompose,sI as parseComposeCatalog,Df as parseDockerInspect,Xu as parseDotenv,kh as parseDrainedSites,Ei as parseHostSiteFragments,rS as parseJSONResponse,oi as parsePreflightFacts,Ap as parseSourceDrained,Nf as parseSystemdRecords,pp as parseTargetReady,Kc as parseUpstreamPort,dp as parseWorkersPaused,tS as parseXMLResponse,Oi as pathTemplate,jc as pendingSteps,co as percentOfLimit,xC as performanceManager,Il as phpLayerBuildStage,Hy as phpLayerPackages,nn as phpRuntimeLayerAssets,oI as planComposeTemplateUpgrade,Ad as planEnforcement,sp as planIsDestructive,Vp as planMitigation,Uh as planServerRename,Zh as planSiteMove,xs as planZoneMigration,Mt as policyTag,ci as preflightFailed,ay as previewManager,uy as previewNotifications,Dt as previewSchedule,hA as previousBudgetWindow,so as priceUsage,pA as priceUsageLines,Oh as probeHostRoutes,Pc as probeOriginTls,fb as processInChunks,eu as processSourceWebhook,is as productionChangeReview,ky as progressiveDeploymentManager,md as projectSpend,Bo as propagationHeaders,Xa as providerEndpoint,wu as publicKeyFingerprint,Ln as qualifyName,tE as queueManagementManager,cb as quickHash,Bu as r2Endpoint,xg as r2S3Credentials,kl as rateLimitHeaders,Ki as rateLimitKey,He as readDriverState,_h as reconcile,ug as reconcileAddressRecords,Tg as reconcileCloudflareCdn,Rs as reconcileDeclaredRecords,fS as reconcileJobObservation,Mg as reconcileR2Buckets,dn as reconcileSourceWebhook,ns as recordDashboardHostPosture,gS as recordPreDeploySecretScan,pS as recordSkippedSecretScan,xo as recursionBlockedResponse,Be as redactRuntimeConfig,Pd as redactTelemetryText,xi as redactTelemetryValue,Sn as redeployServerlessApp,Wb as regionPairManager,cn as releaseStrategyCapabilities,bf as releaseTrafficPlan,hi as reloadRpxGateway,Cs as remapKey,Cg as removeDns01ChallengeRecord,yn as removeSiteFromCloudConfig,tu as removeSourceWebhook,fc as removeStaleServerAddressRecords,rd as renderComposeTemplate,$i as renderDdosInstallScript,xd as renderNftablesRuleset,ss as renderServerCron,Bd as renderSysctlFile,Vc as renderWafConfig,yi as renderWafInstallScript,Gc as renewRpxCertificates,Oy as replicaManager,PA as requestHash,yb as requiresReplacement,iE as resetRecursionRuntime,sE as resolveApp,g as resolveAppDatabase,Hh as resolveAttachTarget,Ze as resolveAuthEncryptionKey,fe as resolveCloudProvider,Dg as resolveCloudflareCdnPlan,wo as resolveCredentials,fs as resolveDashboardAction,Qc as resolveDashboardAuth,HA as resolveDashboardDomain,GA as resolveDashboardDomains,ws as resolveDeclaredRecords,yI as resolveDeployBucketName,U as resolveDeploymentMode,Yn as resolveExecStart,bo as resolveFailoverStatusCodes,wc as resolveHetznerApiToken,Rr as resolveHostCleanupConfig,Mi as resolveMailService,QI as resolveManagementDashboardSite,Qi as resolveManagementDashboardSites,Ya as resolveObjectStorage,re as resolveOriginConnection,$h as resolvePlan,p as resolveProjectStackName,Lr as resolveProxyUpstreams,yl as resolveQueueNames,sA as resolveQueuedDeploymentCommand,nr as resolveQueues,Gy as resolveRecursionConfig,WA as resolveRegion,oe as resolveRuntimeInventory,Xt as resolveServerlessAppStackName,Hd as resolveServerlessArtifactBucketName,Fi as resolveServerlessAssetBucketName,qi as resolveServerlessRuntime,fI as resolveSiteBucketName,Ws as resolveSiteDeployTarget,u as resolveSiteKind,mI as resolveSiteResourceName,pI as resolveSiteStackName,ii as resolveSshSettings,d as resolveStatePath,hI as resolveStorageBucketName,Yp as resolveStorageFailover,Gt as resolveUiSource,qc as resolveZoneApex,uE as resourceManagementManager,df as responseToResult,Np as robustZScore,Vt as roleCapabilities,Kl as rollbackImmutableRelease,In as rollbackServerlessApp,mA as roundCents,zC as route53ResolverManager,My as route53RoutingManager,xp as routeMatches,rp as routesFromFragments,zi as ruleMatches,Fy as runBuildHooks,yd as runEnforcement,Oo as runPhpBuildHooks,rt as runRemoteCommand,Ae as runtimeId,Le as s3OriginBucket,Zp as s3RegionalDomain,Na as sameCorsRules,Ba as sameLifecycleRules,$n as sameNameservers,ms as sanitizeCloudConfig,s as sanitizeControlPlaneValue,gI as sanitizeName,Hl as sanitizeOidcReturnPath,Rd as saveTelemetryPolicy,vf as scanForSecrets,Xc as scopeContains,ht as scopeKey,Ic as scpUpload,Mb as searchCommands,Xs as searchControlPlane,_y as secretsManager,_C as secretsRotationManager,mS as secureContainerRelease,Ry as securityHubManager,$C as securityScanningManager,se as securityScope,Hu as seedFailoverReplicas,an as sendAuthenticationEmail,JC as senderReputationManager,pb as sequence,Yu as serializeDotenv,mi as serverPublicIpv4,$y as serviceMeshManager,Lu as setAttachToInCloudConfig,dr as setMaintenance,ds as setSitePropertyInCloudConfig,_d as setStateDir,mh as setupDns01Challenge,cc as setupSmsInfrastructure,Do as sha256,qy as sharedRecursionGuard,sf as sharedRuntimeLoop,Ip as shipsARelease,Gg as signCloudFrontCookies,Wg as signCloudFrontUrl,R as signRequest,Pl as signRequestAsync,go as signalDefinition,_ as siteInstallBase,Ii as siteMoveArchivePath,zh as siteMoveCertArchivePath,zc as siteUnitGlob,Mp as spendNotificationText,Io as spendOpenApiPaths,Tr as sshExec,pe as sshExecOrThrow,Jb as stackDependencyManager,ja as startLocalDashboardServer,RA as startSpendLoop,Jr as stateDir,L as statePath,cE as staticSiteManager,Xy as storageAdvancedManager,CI as storageFailoverReplicasFromTemplate,SA as streamFocusJsonl,Sd as strongestActiveAction,ym as suggestCommand,Ub as suggestFlags,tb as suggestIAMPolicy,ib as suggestQuotaIncrease,iC as suggestRegionPairs,nC as suggestRegions,es as syncSourceRepositories,ad as synchronizeComposeVolumes,Zu as synchronizeConfiguredConfiguration,ca as synchronizeConfiguredJobs,xy as syntheticsManager,kd as sysctlHardening,kf as systemdWorkloads,vA as telemetryBucketLabel,_i as telemetryCursor,Dd as telemetryEstimatedMonthlyCost,EA as telemetryPercentile,$p as telemetryPolicyKey,ry as templateCache,np as tenantsOf,Zo as testSourceConnection,cd as tieredMicroCents,ju as toApiLifecycleRule,Rc as toCloudflareZoneSettings,fo as toFocusJsonl,Ed as toFocusRecords,xh as toInventoryServer,yf as totp,Vo as totpUri,ip as unaccountedSites,Rf as unsupportedCapabilities,oA as unsupportedVolumeCapabilities,Du as updateCompatibility,Nu as updateSiteInCloudConfig,ys as uploadStaticFiles,Tp as usageDeltaKey,Kt as utcInstantOfLocal,pC as validateAccountStructure,Cb as validateAgainstSchema,cA as validateAttachment,Jf as validateBackupDestination,Gb as validateCommand,XI as validateConfiguration,ZI as validateCredentials,Sp as validateDeploymentConfig,aA as validateMountPath,St as validateOriginGroups,ig as validateResourceLimits,op as validateServerName,Kf as validateTemplate,ng as validateTemplateSize,Ac as verifyAddressRecord,uS as verifyArtifactSignature,jg as verifyMediaAccessToken,Sf as verifyTotp,Ru as verifyUpdateSignature,_s as verifyZoneParity,to as volumeCapabilities,Jg as wafEventTelemetry,bc as waitForCloudInit,Kn as waitForSsh,sr as webhookEndpoint,KI as withCDN,zI as withCache,jI as withDatabase,cf as withInvocation,VI as withMonitoring,WI as withQueue,qI as withSecurity,mb as withTimeout,Z as wrapCloudInitUserData,dt as writeDriverState,NC as xrayManager,Eu as zeroCapacity,IA as zeroFill,ld as zoneOffsetMs,oo as zonedParts};