@stacksjs/ts-cloud 0.16.45 → 0.16.47

package/dist/index.js

@@ -1,4 +1,4 @@
-import{dI,lI,Od,qp,_d,Ld,Jr,L,d,$d,jp,Q,Md,g,NA,Mi,Fd,Ud,fe,Qd,kA,r,t,uI,gI,p,pI,mI,fI,hI,yI,Xt,Hd,Fi,BA,SI,II,De,je,Gd,zp,Kp,bI,Wp,Jp,Xp,Eo,Vd,re,Xr,yt,vo,St,he,xA,qd,To,Yp,Zp,em,tm,jd,CI,H,b,OA,_A,rm,a,y,ze,m,nm,Ke,G,It,EI,im,V,zd,Pe,Yt,wo,ne,Kd,ie,LA,Ro,q,j,k,Ui,T,Zt,bt,z,e,Yr,vI,sm,Wd,TI,wI,RI,DI,Jd,PI,NI,kI,BI,xI,OI,_I,LI,$I,MI,FI,UI,$A,MA,FA,UA,QA,HA,GA,er,om,am,Zr,Qi,QI,cm,HI,GI,en,VI,qI,jI,zI,KI,WI,VA,qA,jA,zA,KA,Hi,JI,Do,WA,dm,F,JA,We,Po,Ct,XA,lm,YA,ZA,ey,um,U,XI,YI,ZI,eb,ty,tb,K,rb,nb,ib,Xd,Yd,ry,gm,pm,sb,ob,ab,cb,db,ny,Zd,lb,ub,gb,pb,mb,iy,sy,fb,hb,Ab,yb,Sb,Ib,bb,oy,Cb,mm,el,Eb,vb,Tb,wb,fm,hm,Am,Rb,tl,ay,cy,dy,ly,rl,uy,Db,Pb,Nb,kb,Bb,xb,Ob,gy,py,my,fy,ym,_b,Lb,$b,Mb,Fb,Ub,Qb,Hb,Gb,hy,Ay,yy,Sy,Vb,qb,Sm,jb,Im,bm,Cm,Em,zb,Kb,Wb,Jb,Ne,Gi,Xb,Yb,Zb,eC,tC,rC,nC,iC,Iy,sC,oC,vm,Tm,aC,cC,by,dC,lC,uC,gC,pC,mC,fC,hC,AC,yC,SC,IC,bC,CC,EC,vC,TC,wC,RC,DC,PC,nl,Cy,il,Ey,sl,vy,ol,Ty,al,wy,tr,Ry,cl,Dy,Vi,Py,dl,Ny,ll,ky,wm,NC,Rm,kC,ul,By,rr,xy,Dm,BC,gl,Oy,Pm,xC,Nm,OC,km,_C,pl,_y,Bm,LC,xm,$C,Om,MC,_m,FC,ml,Ly,fl,$y,Lm,UC,$m,QC,Mm,HC,Fm,GC,Um,VC,Qm,qC,hl,My,Hm,jC,Gm,zC,Vm,KC,qm,WC,jm,JC,zm,XC,Km,Wm,Jm,Xm,Ym,YC,Zm,ZC,ef,eE,tf,tE,Je,rf,Fy,No,Al,tn,Uy,qi,nr,yl,Sl,Qy,Hy,Il,nf,bl,sf,rE,nE,ko,Bo,xo,Cl,rn,El,vl,ji,Oo,_o,of,Gy,Vy,qy,iE,af,cf,sE,jy,df,zy,Ky,Wy,oE,lf,nn,Tl,uf,aE,Jy,Lo,$o,wl,gf,cE,Rl,Xy,pf,dE,mf,lE,ff,uE}from"./chunk-c5jyzyqw.js";import{Dl,R,Pl,Mo,Yy,hf,Zy,eS,tS,rS,nS,iS,sS,oS}from"./chunk-x2pxtfk0.js";import{Vo,Af,Ll,lS,Ji,$l,qo,yf,Sf,on,jo,Ml,Ye,Fl,Ul,Ql,Xi,an,If,Ze,Hl,zo,Ko,Wo,Gl,Vl,ql,Yi,Jo,jl,cn,Zi,Xo,Et,bf,zl,Kl,Cf,Wl,Yo,ir,Jl,Xl,Yl,Zl,et,Ef,eu,sr,Zo,ea,ta,es,ts,dn,tu,rs,ra,na,ln,ru,un,vf,Tf,vt,gn,ia,wf,nu,iu,sa,su,ou,au,uS,se,cu,gS,pS,ns,is,mS,Ae,Rf,Tt,ke,Be,wt,du,lu,uu,gu,Df,Pf,oa,Nf,kf,aa,pu,mu,Bf,oe,xf,fu,ye,ca,tt,Rt,Dt,pn,ss,hu,fS,da,Of,_f,Lf,$f,la,ua,Au,mn,ga,yu,os,Su,pa,ma,fa,ha,Aa,ya,Sa,Ia,Iu,or,ba,bu,fn,Cu,Ca,Ea,Eu,ar,va,Ta,Mf,hS,as,AS,yS,SS,wa,Ra,vu,Ff,Da,hn,Tu,cs,wu,Ru,Du,Pa,Uf,Na,Pu,Qf,ka,Hf,An,yn,Nu,ds,Lu,Uu,Qu,Hu,Gu,Vu,us,cr,xa,Sn,In,dr,rt,Jf,_a,Xf,Yf,zu,La,ps,Ku,$a,Nt,Oe,Wu,Ma,Fa,Ju,Ua,Qa,Ha,Ga,Xu,Yu,Cn,Va,qa,ja,za,Zu,ms,En,fs,Ka}from"./chunk-294kdscm.js";import{_,Lr,Wc,Xs,u,Sp,Ip}from"./chunk-hm6pwhne.js";import{pt,Kc,bi,Ci,Ei,yp}from"./chunk-1w9v8g26.js";import{Nh,kh,Bh,Zg,ep,tp,xh,rp,np,Oh,_h,ip,Lh,$h,jc,sp,Mh,Fh,op,Uh,Qh,Hh,Gh,Vh,qh,jh,Ii,zc,ap,cp,dp,lp,up,gp,pp,mp,fp,hp,Ap,zh,Kh,Wh,Jh,Xh,Yh,Zh}from"./chunk-vkrgf3sv.js";import{Ge,Jc,me,Vt,Xc,P,qt,mt,Yc,Ys,rA,bp,Zc,s,vi,Zs,$r,ed,td,Mr,nA,rd,sI,oI,eo,aI,cI,nd,id,Ti,to,te,c,ro,Ve,Fr,iA,sA,sd,jt,oA,no,aA,cA,io,od,Ur,so,dA,ad,Cp,zt,Qr,lA,oo,uA,N,gA,cd,Ep,ao,pA,mA,fA,dd,wi,co,ld,Kt,ft,hA,Hr,AA,ud,vp,Tp,lo,gd,pd,ht,wp,Ri,md,uo,Gr,Rp,Di,fd,hd,Pi,Dp,Ad,yd,Sd,Id,go,Pp,Np,yA,kp,bd,Ni,Bp,xp,po,Vr,mo,fo,ho,Cd,Op,Ed,Ao,SA,Wt,IA,vd,qr,Td,bA,wd,_p,ki,jr,yo,Bi,qe,CA,Lp,$p,Jt,Rd,Dd,Pd,xi,Oi,_i,EA,vA,At,So,TA,zr,Mp,Io,wA,Fp,Up,Qp,RA,Hp,Gp,DA,i,PA,Li,bo,Co}from"./chunk-v3w791ze.js";import{n}from"./chunk-cgcthvq9.js";import{be,ot,On}from"./chunk-w78e5n94.js";import{o}from"./chunk-bwtxb2hf.js";import{Se,Cs,Es,rg,Za,ec,vs,tc,nt,W,it,ae,E,Ie,Rn,rc,_e,nc,Dn,Pn,Nn,kt,Bt,xt,kn,ur,ic,gr,pr,st,Bn,oc,Ot,mr,xn,cc,ag,cg,dc,fr}from"./chunk-8jsf214f.js";import{at,le,Me,dg,_t,uc,gc,Lt,M,_n,$t,Mt,Ln,Ds,Ps,hr,Ar,$n,yr,Ns,ks,Bs,xs,X,Os,_s,Ls,$s,ue,Ms,Fs,Us,D,pc,Mn,mc,ge,Sr}from"./chunk-gp9tkznp.js";import{J}from"./chunk-ct72f70x.js";import{lg,fc,Ce,hc,Un,ug,Ac,gg,pg,uh,Hn,Hs,Gn,Vn,qn,Y,Fe,x,vr,zn,Tr,pe,Ic,Kn,bc,Rr,Jn,Gs,Xn,Yn,Zn,ei,Dr,wc,Ue,Z,Qe,He,dt,Te,Pr,we,ni,ii,si,oi,ai,ci,di,Nr,O,js,Fg,xc,ui,gi,pi,mi,Uc,zs,Qc,Gt,fi,Ks,Ws,Hc,hi,Gc}from"./chunk-vv5fmmhr.js";import{Nl,Fo,zi,Ki,Uo,kl,Bl,Wi,Qo,Ho,Ol,_l,Go}from"./chunk-d02jxsxv.js";import{Wa,vn,Tn,hs,As,ys,Ss,Ja,Xa}from"./chunk-j5x0qn7z.js";import{Ya}from"./chunk-96vc5w8w.js";import{lc,Le,S}from"./chunk-3s8dtcz8.js";import{$e}from"./chunk-varjr6np.js";import{I}from"./chunk-97gre81w.js";import{ee,Ai,Js,Vc,yi,Jg}from"./chunk-e4pxs9g6.js";import{Br,Re}from"./chunk-fwcf0n8f.js";import{h}from"./chunk-9e4afej1.js";import{Nd,Kr,kd,Bd,xd,$i,Vp,Wr}from"./chunk-0evxayn1.js";import{aS,Xe}from"./chunk-9mv07nz0.js";var $S="https://api.machines.dev/v1";class sc extends Error{status;path;constructor(l,f,C){super(l);this.status=f;this.path=C;this.name="FlyApiError"}}function Ou(l){let f=l.ip.includes(":");if(f&&l.ip.startsWith("fdaa:"))return"private_v6";if(l.shared)return"shared_v4";return f?"v6":"v4"}class Dg{token;fetch;constructor(l){if(!l.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=l.token,this.fetch=l.fetch??fetch}async rest(l,f,C={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[ce,de]of Object.entries(C.query??{}))A.searchParams.set(ce,de);let w=await this.fetch(A,{method:l,headers:{Authorization:`Bearer ${this.token}`,...C.body!==void 0?{"Content-Type":"application/json"}:{},...C.headers},body:C.body===void 0?void 0:JSON.stringify(C.body)});if(w.status===404&&C.notFound==="null")return null;let B=await w.text(),v=B?kg(B):void 0;if(!w.ok){let ce=typeof v==="object"&&v&&"error"in v?String(v.error):B||w.statusText;throw new sc(`Fly.io ${l} ${f} failed (${w.status}): ${ce}`,w.status,f)}return v}getApp(l){return this.rest("GET",`/apps/${encodeURIComponent(l)}`,{notFound:"null"})}createApp(l,f){return this.rest("POST","/apps",{body:{app_name:l,org_slug:f}})}async listMachines(l){return await this.rest("GET",`/apps/${encodeURIComponent(l)}/machines`)??[]}createMachine(l,f){return this.rest("POST",`/apps/${encodeURIComponent(l)}/machines`,{body:f})}updateMachine(l,f,C,A){return this.rest("POST",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}`,{body:C,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(l,f,C=120){let w=(await this.rest("POST",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:C}})).data?.nonce;if(!w)throw new sc(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return w}async releaseLease(l,f,C){await this.rest("DELETE",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":C}})}async waitForState(l,f,C,A={}){await this.rest("GET",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:C,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(l){return await this.rest("GET",`/apps/${encodeURIComponent(l)}/volumes`)??[]}createVolume(l,f){return this.rest("POST",`/apps/${encodeURIComponent(l)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(l,f){return(await this.rest("POST",`/apps/${encodeURIComponent(l)}/secrets`,{body:{values:f}})).version}async listIpAssignments(l){return(await this.rest("GET",`/apps/${encodeURIComponent(l)}/ip_assignments`)).ips??[]}async assignIp(l,f){let C=await this.rest("POST",`/apps/${encodeURIComponent(l)}/ip_assignments`,{body:{type:f}});if(!C.ip)throw new sc(`Fly.io assigned no ${f} address to ${l}`,200,`/apps/${l}/ip_assignments`);return{ip:C.ip,shared:C.shared??f==="shared_v4",region:C.region}}async requestCertificate(l,f){return this.rest("POST",`/apps/${encodeURIComponent(l)}/certificates/acme`,{body:{hostname:f}})}}function kg(l){try{return JSON.parse(l)}catch{return}}var Ec="ts-cloud-role";function DS(l,f){let C=l.fly??{},A=C.app??`${l.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let w=C.internalPort??3000,B=C.count??1;if(!Number.isInteger(B)||B<1)throw Error(`fly.count must be a whole number of at least 1, got ${B}.`);return{app:A,org:C.org??"personal",image:f.image,regions:C.regions?.length?C.regions:["iad"],count:B,internalPort:w,healthPath:C.healthPath??"/",vm:{cpuKind:C.vm?.cpuKind??"shared",cpus:C.vm?.cpus??1,memoryMb:C.vm?.memoryMb??512},...C.volume?{volume:{name:C.volume.name??"data",sizeGb:C.volume.sizeGb,path:C.volume.path}}:{},autoStop:C.autoStop??!1,env:{...f.env,PORT:String(w)},secrets:f.secrets??{},hostnames:C.hostnames??[],release:f.release}}function vg(l){return{image:l.image,env:l.env,guest:{cpu_kind:l.vm.cpuKind,cpus:l.vm.cpus,memory_mb:l.vm.memoryMb},services:[{protocol:"tcp",internal_port:l.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:l.autoStop?"stop":"off",autostart:!0,...l.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:l.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Ec]:"app","ts-cloud-release":l.release}}}async function kS(l,f,C=()=>{}){let A=!1;if(!await l.getApp(f.app))C(`Creating Fly app ${f.app} in ${f.org}`),await l.createApp(f.app,f.org),A=!0;let w;if(Object.keys(f.secrets).length>0)w=await l.setSecrets(f.app,f.secrets),C(`Set ${Object.keys(f.secrets).length} secret(s) (version ${w})`);let B=await l.listIpAssignments(f.app),v=new Set(B.map(Ou));if(!v.has("v6"))B.push(await l.assignIp(f.app,"v6")),C("Assigned a dedicated IPv6");if(!v.has("v4")&&!v.has("shared_v4"))B.push(await l.assignIp(f.app,"shared_v4")),C("Assigned a shared IPv4");let ce=vg(f),de=(await l.listMachines(f.app)).filter((lt)=>{let ut=lt.config?.metadata??{};if(ut[Ec])return ut[Ec]==="app";return!ut.fly_process_group||ut.fly_process_group==="app"}),ct=f.volume?await l.listVolumes(f.app):[],xe=[],Ut=[],Qt=new Set;for(let lt of f.regions){let ut=de.filter((Ee)=>Ee.region===lt).sort((Ee,Ft)=>Ee.id.localeCompare(Ft.id));for(let Ee=0;Ee<f.count;Ee++){let Ft=ut[Ee];if(Ft){Qt.add(Ft.id),await Eg(l,f.app,Ft,ce,w),Ut.push(Ft.id),C(`Updated ${Ft.id} (${lt}) to ${f.image}`);continue}let ve=f.volume?[{volume:(await Og(l,f,lt,ct)).id,path:f.volume.path}]:void 0,Pt=await l.createMachine(f.app,{region:lt,name:`${f.app}-${lt}-${Ee+1}`,config:{...ce,...ve?{mounts:ve}:{}},...w!==void 0?{min_secrets_version:w}:{}});await l.waitForState(f.app,Pt.id,"started",{instanceId:Pt.instance_id}),xe.push(Pt.id),C(`Created ${Pt.id} in ${lt}`)}}let gt=[];for(let lt of f.hostnames)gt.push(await l.requestCertificate(f.app,lt));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:xe,updated:Ut,untouched:de.filter((lt)=>!Qt.has(lt.id)).map((lt)=>lt.id),ips:B,certificates:gt}}async function Eg(l,f,C,A,w){let B=await l.acquireLease(f,C.id);try{let v=await l.updateMachine(f,C.id,{config:{...A,...C.config?.mounts?.length?{mounts:C.config.mounts}:{}},...w!==void 0?{min_secrets_version:w}:{}},B);await l.waitForState(f,C.id,"started",{instanceId:v.instance_id})}finally{await l.releaseLease(f,C.id,B)}}async function Og(l,f,C,A){let w=A.find((v)=>v.region===C&&v.name===f.volume.name&&!v.attached_machine_id);if(w)return w.attached_machine_id="pending",w;let B=await l.createVolume(f.app,{name:f.volume.name,region:C,size_gb:f.volume.sizeGb});return A.push({...B,attached_machine_id:"pending"}),B}import{createHmac as xu,createSign as Ng,timingSafeEqual as xg}from"node:crypto";function bs(l){let f=l instanceof Date?l.getTime():l;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Fu(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Lg(l){return Buffer.from(l).toString("base64url")}function _u(l,f=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let C=f?l.replaceAll("*","wildcard"):l,A=new URL(C);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Mu(l,f){let C=Ng("RSA-SHA1");return C.update(l),C.end(),Fu(C.sign(f))}function Bu(l){_u(l.resource,!0);let C={DateLessThan:{"AWS:EpochTime":bs(l.expiresAt)}};if(l.activeAt!==void 0)C.DateGreaterThan={"AWS:EpochTime":bs(l.activeAt)};if(l.ipAddress)C.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:C}]})}function LS(l,f,C){_u(l);let A=bs(f),w=l.includes("?")?"&":"?",B=Bu({resource:l,expiresAt:f}),v=Mu(B,C.privateKey);return`${l}${w}Expires=${A}&Signature=${encodeURIComponent(v)}&Key-Pair-Id=${encodeURIComponent(C.keyPairId)}`}function FS(l,f){let C=Bu(l);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Fu(Buffer.from(C)),"CloudFront-Signature":Mu(C,f.privateKey)}}function _S(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let f=Lg(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:bs(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),C=xu("sha256",l.secret).update(f).digest("base64url");return`${f}.${C}`}function MS(l,f){let[C,A,w]=l.split(".");if(!C||!A||w)return null;let B=xu("sha256",f.secret).update(C).digest(),v;try{v=Buffer.from(A,"base64url")}catch{return null}if(B.length!==v.length||!xg(B,v))return null;try{let ce=JSON.parse(Buffer.from(C,"base64url").toString("utf8")),de=bs(f.now??Date.now());if(!ce.resource||!Number.isSafeInteger(ce.expiresAt)||ce.expiresAt<=de)return null;if(f.resource&&ce.resource!==f.resource)return null;if(f.audience&&ce.audience!==f.audience)return null;return ce}catch{return null}}function BS(l,f=!1){let C=new URL(l,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(C),w=/\.(?:key|license)$/.test(C)||C.includes("/keys/")||C.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||w)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function WS(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let f=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",C=l.protected??!1,A="public, max-age=31536000, immutable",w=C?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:f,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.mpd",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.vtt",cacheControl:w,compress:!0,signed:C},{pathPattern:"*",cacheControl:A,compress:!1,signed:C}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class _g{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Qd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let f=this.config.features||{};if(!l.requiresFeatures.every((A)=>f[A]===!0))return!1}if(l.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(f))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(l||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,f){return l==="public"||f.routeCompute===!0}storageBucketName(l,f,C){return this.mergedConfig.infrastructure?.storage?.[C]?.bucket??`${l}-${f}-${C}`}fileSystemLogicalId(l,f,C){return t(r({slug:`${l}-${C}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(l,f,C){let A=l.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,C,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,C,A.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,f){return{PathPattern:l,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,f,C,A,w,B){let v=this.serverEipLogicalIds.get("app"),ce=this.serverEipLogicalIds.get("appInstance");if(!v)return;let de=`EC2-${A}-${w}-api`,ct=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",xe=ct==="us-east-1"?".compute-1.amazonaws.com":`.${ct}.compute.amazonaws.com`,Ut={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:v}]}]},xe]]},Qt=this.resolveApiOriginPort();if(l.push({Id:de,DomainName:Ut,CustomOriginConfig:{HTTPPort:Qt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),C.push(v),ce)C.push(ce);for(let gt of B)f.push(this.createComputeCacheBehavior(gt,de))}buildCaddyfile(l){let f=l.filter(([,w])=>typeof w.domain==="string"&&w.domain&&typeof w.port==="number");if(f.length===0)return;let C=new Map;for(let[,w]of f){let B=C.get(w.domain)??[];B.push({port:w.port,path:w.path}),C.set(w.domain,B)}let A=[];for(let[w,B]of C){let ce=[...B].sort((de,ct)=>{let xe=!de.path||de.path==="/",Ut=!ct.path||ct.path==="/";if(xe&&!Ut)return 1;if(!xe&&Ut)return-1;return(ct.path?.length??0)-(de.path?.length??0)}).map((de)=>{let ct=!de.path||de.path==="/",xe=`reverse_proxy localhost:${de.port}`;return ct?`  handle {
+import{lI,uI,Od,jp,_d,Ld,Jr,L,d,$d,zp,Q,Md,g,kA,Mi,Fd,Ud,fe,Qd,BA,r,t,gI,pI,p,mI,fI,hI,yI,SI,Xt,Hd,Fi,xA,II,bI,De,je,Gd,Kp,Wp,CI,Jp,Xp,Yp,Eo,Vd,re,Xr,yt,vo,St,he,OA,qd,To,Zp,em,tm,rm,jd,EI,H,b,_A,LA,nm,a,y,ze,m,im,Ke,G,It,vI,sm,V,zd,Pe,Yt,wo,ne,Kd,ie,$A,Ro,q,j,k,Ui,T,Zt,bt,z,e,Yr,TI,om,Wd,wI,RI,DI,PI,Jd,NI,kI,BI,xI,OI,_I,LI,$I,MI,FI,UI,QI,MA,FA,UA,QA,HA,GA,VA,er,am,cm,Zr,Qi,HI,dm,GI,VI,en,qI,jI,zI,KI,WI,JI,qA,jA,zA,KA,WA,Hi,XI,Do,JA,lm,F,XA,We,Po,Ct,YA,um,ZA,ey,ty,gm,U,YI,ZI,eb,tb,ry,rb,K,nb,ib,sb,Xd,Yd,ny,pm,mm,ob,ab,cb,db,lb,iy,Zd,ub,gb,pb,mb,fb,sy,oy,hb,Ab,yb,Sb,Ib,bb,Cb,ay,Eb,fm,el,vb,Tb,wb,Rb,hm,Am,ym,Db,tl,cy,dy,ly,uy,rl,gy,Pb,Nb,kb,Bb,xb,Ob,_b,py,my,fy,hy,Sm,Lb,$b,Mb,Fb,Ub,Qb,Hb,Gb,Vb,Ay,yy,Sy,Iy,qb,jb,Im,zb,bm,Cm,Em,vm,Kb,Wb,Jb,Xb,Ne,Gi,Yb,Zb,eC,tC,rC,nC,iC,sC,by,oC,aC,Tm,wm,cC,dC,Cy,lC,uC,gC,pC,mC,fC,hC,AC,yC,SC,IC,bC,CC,EC,vC,TC,wC,RC,DC,PC,NC,nl,Ey,il,vy,sl,Ty,ol,wy,al,Ry,tr,Dy,cl,Py,Vi,Ny,dl,ky,ll,By,Rm,kC,Dm,BC,ul,xy,rr,Oy,Pm,xC,gl,_y,Nm,OC,km,_C,Bm,LC,pl,Ly,xm,$C,Om,MC,_m,FC,Lm,UC,ml,$y,fl,My,$m,QC,Mm,HC,Fm,GC,Um,VC,Qm,qC,Hm,jC,hl,Fy,Gm,zC,Vm,KC,qm,WC,jm,JC,zm,XC,Km,YC,Wm,Jm,Xm,Ym,Zm,ZC,ef,eE,tf,tE,rf,rE,Je,nf,Uy,No,Al,tn,Qy,qi,nr,yl,Sl,Hy,Gy,Il,sf,bl,of,nE,iE,ko,Bo,xo,Cl,rn,El,vl,ji,Oo,_o,af,Vy,qy,jy,sE,cf,df,oE,zy,lf,Ky,Wy,Jy,aE,uf,nn,Tl,gf,cE,Xy,Lo,$o,wl,pf,dE,Rl,Yy,mf,lE,ff,uE,hf,gE}from"./chunk-j73ntebp.js";import{Dl,R,Pl,Mo,Zy,Af,eS,tS,rS,nS,iS,sS,oS,aS}from"./chunk-astzz50p.js";import{Vo,yf,Ll,uS,Ji,$l,qo,Sf,If,on,jo,Ml,Ye,Fl,Ul,Ql,Xi,an,bf,Ze,Hl,zo,Ko,Wo,Gl,Vl,ql,Yi,Jo,jl,cn,Zi,Xo,Et,Cf,zl,Kl,Ef,Wl,Yo,ir,Jl,Xl,Yl,Zl,et,vf,eu,sr,Zo,ea,ta,es,ts,dn,tu,rs,ra,na,ln,ru,un,Tf,wf,vt,gn,ia,Rf,nu,iu,sa,su,ou,au,gS,se,cu,pS,mS,ns,is,fS,Ae,Df,Tt,ke,Be,wt,du,lu,uu,gu,Pf,Nf,oa,kf,Bf,aa,pu,mu,xf,oe,Of,fu,ye,ca,tt,Rt,Dt,pn,ss,hu,hS,da,_f,Lf,$f,Mf,la,ua,Au,mn,ga,yu,os,Su,pa,ma,fa,ha,Aa,ya,Sa,Ia,Iu,or,ba,bu,fn,Cu,Ca,Ea,Eu,ar,va,Ta,Ff,AS,as,yS,SS,IS,wa,Ra,vu,Uf,Da,hn,Tu,cs,wu,Ru,Du,Pa,Qf,Na,Pu,Hf,ka,Gf,An,yn,Nu,ds,Lu,Uu,Qu,Hu,Gu,Vu,us,cr,xa,Sn,In,dr,rt,Xf,_a,Yf,Zf,zu,La,ps,Ku,$a,Nt,Oe,Wu,Ma,Fa,Ju,Ua,Qa,Ha,Ga,Xu,Yu,Cn,Va,qa,ja,za,Zu,ms,En,fs,Ka}from"./chunk-j2jex596.js";import{_,Lr,Wc,Xs,u,Ip,bp}from"./chunk-tj852ns1.js";import{pt,Kc,bi,Ci,Ei,Sp}from"./chunk-zwkm3pkb.js";import{kh,Bh,xh,ep,tp,rp,Oh,np,ip,_h,Lh,sp,$h,Mh,jc,op,Fh,Uh,ap,Qh,Hh,Gh,Vh,qh,jh,zh,Ii,zc,cp,dp,lp,up,gp,pp,mp,fp,hp,Ap,yp,Kh,Wh,Jh,Xh,Yh,Zh,eA}from"./chunk-wb7h8ag4.js";import{Ge,Jc,me,Vt,Xc,P,qt,mt,Yc,Ys,nA,Cp,Zc,s,vi,Zs,$r,ed,td,Mr,iA,rd,oI,aI,eo,cI,dI,nd,id,Ti,to,te,c,ro,Ve,Fr,sA,oA,sd,jt,aA,no,cA,dA,io,od,Ur,so,lA,ad,Ep,zt,Qr,uA,oo,gA,N,pA,cd,vp,ao,mA,fA,hA,dd,wi,co,ld,Kt,ft,AA,Hr,yA,ud,Tp,wp,lo,gd,pd,ht,Rp,Ri,md,uo,Gr,Dp,Di,fd,hd,Pi,Pp,Ad,yd,Sd,Id,go,Np,kp,SA,Bp,bd,Ni,xp,Op,po,Vr,mo,fo,ho,Cd,_p,Ed,Ao,IA,Wt,bA,vd,qr,Td,CA,wd,Lp,ki,jr,yo,Bi,qe,EA,$p,Mp,Jt,Rd,Dd,Pd,xi,Oi,_i,vA,TA,At,So,wA,zr,Fp,Io,RA,Up,Qp,Hp,DA,Gp,Vp,PA,i,NA,Li,bo,Co}from"./chunk-jzpwfgg1.js";import{n}from"./chunk-2sc0s7pc.js";import{be,ot,On}from"./chunk-nryh43p1.js";import{o}from"./chunk-jpdpr7k6.js";import{Se,Cs,Es,rg,Za,ec,vs,tc,nt,W,it,ae,E,Ie,Rn,rc,_e,nc,Dn,Pn,Nn,kt,Bt,xt,kn,ur,ic,gr,pr,st,Bn,oc,Ot,mr,xn,cc,ag,cg,dc,fr}from"./chunk-1dbe68z7.js";import{at,le,Me,dg,_t,uc,gc,Lt,M,_n,$t,Mt,Ln,Ds,Ps,hr,Ar,$n,yr,Ns,ks,Bs,xs,X,Os,_s,Ls,$s,ue,Ms,Fs,Us,D,pc,Mn,mc,ge,Sr}from"./chunk-v1bzy3tp.js";import{J}from"./chunk-fh7apa5n.js";import{lg,fc,ug,Ce,hc,Un,gg,Ac,pg,mg,gh,Hn,Hs,Gn,Vn,qn,Y,Fe,x,vr,zn,Tr,pe,Ic,Kn,bc,Rr,Jn,Gs,Xn,Yn,Zn,ei,Dr,wc,Ue,Z,Qe,He,dt,Te,Pr,we,ni,ii,si,oi,ai,ci,di,Nr,O,js,Ug,xc,ui,gi,pi,mi,Uc,zs,Qc,Gt,fi,Ks,Ws,Hc,hi,Gc}from"./chunk-46bazfbh.js";import{Nl,Fo,zi,Ki,Uo,kl,Bl,Wi,Qo,Ho,Ol,_l,Go}from"./chunk-6ea5d30w.js";import{Wa,vn,Tn,hs,As,ys,Ss,Ja,Xa}from"./chunk-wmxw3pe4.js";import{Ya}from"./chunk-yxzdwe7j.js";import{lc,Le,S}from"./chunk-r86dh7h7.js";import{$e}from"./chunk-xzcpzxtj.js";import{I}from"./chunk-vb4t2r4r.js";import{ee,Ai,Js,Vc,yi,Xg}from"./chunk-79snvzcx.js";import{Br,Re}from"./chunk-xxq1ygp9.js";import{h}from"./chunk-vjph4eh0.js";import{Nd,Kr,kd,Bd,xd,$i,qp,Wr}from"./chunk-6rcj3km0.js";import{cS,Xe}from"./chunk-ynprwawa.js";var $S="https://api.machines.dev/v1";class sc extends Error{status;path;constructor(l,f,C){super(l);this.status=f;this.path=C;this.name="FlyApiError"}}function Ou(l){let f=l.ip.includes(":");if(f&&l.ip.startsWith("fdaa:"))return"private_v6";if(l.shared)return"shared_v4";return f?"v6":"v4"}class kg{token;fetch;constructor(l){if(!l.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=l.token,this.fetch=l.fetch??fetch}async rest(l,f,C={}){let A=new URL(`https://api.machines.dev/v1${f}`);for(let[ce,de]of Object.entries(C.query??{}))A.searchParams.set(ce,de);let w=await this.fetch(A,{method:l,headers:{Authorization:`Bearer ${this.token}`,...C.body!==void 0?{"Content-Type":"application/json"}:{},...C.headers},body:C.body===void 0?void 0:JSON.stringify(C.body)});if(w.status===404&&C.notFound==="null")return null;let B=await w.text(),v=B?vg(B):void 0;if(!w.ok){let ce=typeof v==="object"&&v&&"error"in v?String(v.error):B||w.statusText;throw new sc(`Fly.io ${l} ${f} failed (${w.status}): ${ce}`,w.status,f)}return v}getApp(l){return this.rest("GET",`/apps/${encodeURIComponent(l)}`,{notFound:"null"})}createApp(l,f){return this.rest("POST","/apps",{body:{app_name:l,org_slug:f}})}async listMachines(l){return await this.rest("GET",`/apps/${encodeURIComponent(l)}/machines`)??[]}createMachine(l,f){return this.rest("POST",`/apps/${encodeURIComponent(l)}/machines`,{body:f})}updateMachine(l,f,C,A){return this.rest("POST",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}`,{body:C,headers:{"fly-machine-lease-nonce":A}})}async acquireLease(l,f,C=120){let w=(await this.rest("POST",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}/lease`,{body:{ttl:C}})).data?.nonce;if(!w)throw new sc(`Fly.io gave no lease nonce for Machine ${f}`,200,`/machines/${f}/lease`);return w}async releaseLease(l,f,C){await this.rest("DELETE",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}/lease`,{headers:{"fly-machine-lease-nonce":C}})}async waitForState(l,f,C,A={}){await this.rest("GET",`/apps/${encodeURIComponent(l)}/machines/${encodeURIComponent(f)}/wait`,{query:{state:C,timeout:String(A.timeoutSeconds??60),...A.instanceId?{instance_id:A.instanceId}:{}}})}async listVolumes(l){return await this.rest("GET",`/apps/${encodeURIComponent(l)}/volumes`)??[]}createVolume(l,f){return this.rest("POST",`/apps/${encodeURIComponent(l)}/volumes`,{body:{...f,encrypted:!0}})}async setSecrets(l,f){return(await this.rest("POST",`/apps/${encodeURIComponent(l)}/secrets`,{body:{values:f}})).version}async listIpAssignments(l){return(await this.rest("GET",`/apps/${encodeURIComponent(l)}/ip_assignments`)).ips??[]}async assignIp(l,f){let C=await this.rest("POST",`/apps/${encodeURIComponent(l)}/ip_assignments`,{body:{type:f}});if(!C.ip)throw new sc(`Fly.io assigned no ${f} address to ${l}`,200,`/apps/${l}/ip_assignments`);return{ip:C.ip,shared:C.shared??f==="shared_v4",region:C.region}}async requestCertificate(l,f){return this.rest("POST",`/apps/${encodeURIComponent(l)}/certificates/acme`,{body:{hostname:f}})}}function vg(l){try{return JSON.parse(l)}catch{return}}var Ec="ts-cloud-role";function kS(l,f){let C=l.fly??{},A=C.app??`${l.project.slug}-${f.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(A))throw Error(`"${A}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let w=C.internalPort??3000,B=C.count??1;if(!Number.isInteger(B)||B<1)throw Error(`fly.count must be a whole number of at least 1, got ${B}.`);return{app:A,org:C.org??"personal",image:f.image,regions:C.regions?.length?C.regions:["iad"],count:B,internalPort:w,healthPath:C.healthPath??"/",vm:{cpuKind:C.vm?.cpuKind??"shared",cpus:C.vm?.cpus??1,memoryMb:C.vm?.memoryMb??512},...C.volume?{volume:{name:C.volume.name??"data",sizeGb:C.volume.sizeGb,path:C.volume.path}}:{},autoStop:C.autoStop??!1,env:{...f.env,PORT:String(w)},secrets:f.secrets??{},hostnames:C.hostnames??[],release:f.release}}function Eg(l){return{image:l.image,env:l.env,guest:{cpu_kind:l.vm.cpuKind,cpus:l.vm.cpus,memory_mb:l.vm.memoryMb},services:[{protocol:"tcp",internal_port:l.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:l.autoStop?"stop":"off",autostart:!0,...l.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:l.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Ec]:"app","ts-cloud-release":l.release}}}async function vS(l,f,C=()=>{}){let A=!1;if(!await l.getApp(f.app))C(`Creating Fly app ${f.app} in ${f.org}`),await l.createApp(f.app,f.org),A=!0;let w;if(Object.keys(f.secrets).length>0)w=await l.setSecrets(f.app,f.secrets),C(`Set ${Object.keys(f.secrets).length} secret(s) (version ${w})`);let B=await l.listIpAssignments(f.app),v=new Set(B.map(Ou));if(!v.has("v6"))B.push(await l.assignIp(f.app,"v6")),C("Assigned a dedicated IPv6");if(!v.has("v4")&&!v.has("shared_v4"))B.push(await l.assignIp(f.app,"shared_v4")),C("Assigned a shared IPv4");let ce=Eg(f),de=(await l.listMachines(f.app)).filter((lt)=>{let ut=lt.config?.metadata??{};if(ut[Ec])return ut[Ec]==="app";return!ut.fly_process_group||ut.fly_process_group==="app"}),ct=f.volume?await l.listVolumes(f.app):[],xe=[],Ut=[],Qt=new Set;for(let lt of f.regions){let ut=de.filter((Ee)=>Ee.region===lt).sort((Ee,Ft)=>Ee.id.localeCompare(Ft.id));for(let Ee=0;Ee<f.count;Ee++){let Ft=ut[Ee];if(Ft){Qt.add(Ft.id),await Og(l,f.app,Ft,ce,w),Ut.push(Ft.id),C(`Updated ${Ft.id} (${lt}) to ${f.image}`);continue}let ve=f.volume?[{volume:(await Ng(l,f,lt,ct)).id,path:f.volume.path}]:void 0,Pt=await l.createMachine(f.app,{region:lt,name:`${f.app}-${lt}-${Ee+1}`,config:{...ce,...ve?{mounts:ve}:{}},...w!==void 0?{min_secrets_version:w}:{}});await l.waitForState(f.app,Pt.id,"started",{instanceId:Pt.instance_id}),xe.push(Pt.id),C(`Created ${Pt.id} in ${lt}`)}}let gt=[];for(let lt of f.hostnames)gt.push(await l.requestCertificate(f.app,lt));return{app:f.app,url:`https://${f.app}.fly.dev`,createdApp:A,created:xe,updated:Ut,untouched:de.filter((lt)=>!Qt.has(lt.id)).map((lt)=>lt.id),ips:B,certificates:gt}}async function Og(l,f,C,A,w){let B=await l.acquireLease(f,C.id);try{let v=await l.updateMachine(f,C.id,{config:{...A,...C.config?.mounts?.length?{mounts:C.config.mounts}:{}},...w!==void 0?{min_secrets_version:w}:{}},B);await l.waitForState(f,C.id,"started",{instanceId:v.instance_id})}finally{await l.releaseLease(f,C.id,B)}}async function Ng(l,f,C,A){let w=A.find((v)=>v.region===C&&v.name===f.volume.name&&!v.attached_machine_id);if(w)return w.attached_machine_id="pending",w;let B=await l.createVolume(f.app,{name:f.volume.name,region:C,size_gb:f.volume.sizeGb});return A.push({...B,attached_machine_id:"pending"}),B}import{createHmac as xu,createSign as xg,timingSafeEqual as Lg}from"node:crypto";function bs(l){let f=l instanceof Date?l.getTime():l;if(!Number.isFinite(f))throw TypeError("Media access timestamp must be finite");return Math.floor(f/1000)}function Fu(l){return Buffer.from(l).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Fg(l){return Buffer.from(l).toString("base64url")}function _u(l,f=!1){if(!l||/[\r\n]/.test(l))throw TypeError("Media resource is invalid");let C=f?l.replaceAll("*","wildcard"):l,A=new URL(C);if(!["http:","https:"].includes(A.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!f&&l.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Mu(l,f){let C=xg("RSA-SHA1");return C.update(l),C.end(),Fu(C.sign(f))}function Bu(l){_u(l.resource,!0);let C={DateLessThan:{"AWS:EpochTime":bs(l.expiresAt)}};if(l.activeAt!==void 0)C.DateGreaterThan={"AWS:EpochTime":bs(l.activeAt)};if(l.ipAddress)C.IpAddress={"AWS:SourceIp":l.ipAddress};return JSON.stringify({Statement:[{Resource:l.resource,Condition:C}]})}function FS(l,f,C){_u(l);let A=bs(f),w=l.includes("?")?"&":"?",B=Bu({resource:l,expiresAt:f}),v=Mu(B,C.privateKey);return`${l}${w}Expires=${A}&Signature=${encodeURIComponent(v)}&Key-Pair-Id=${encodeURIComponent(C.keyPairId)}`}function _S(l,f){let C=Bu(l);return{"CloudFront-Key-Pair-Id":f.keyPairId,"CloudFront-Policy":Fu(Buffer.from(C)),"CloudFront-Signature":Mu(C,f.privateKey)}}function MS(l){if(!l.resource||/[\r\n]/.test(l.resource))throw TypeError("Media resource is invalid");let f=Fg(Buffer.from(JSON.stringify({resource:l.resource,expiresAt:bs(l.expiresAt),...l.keyId?{keyId:l.keyId}:{},...l.audience?{audience:l.audience}:{}}))),C=xu("sha256",l.secret).update(f).digest("base64url");return`${f}.${C}`}function BS(l,f){let[C,A,w]=l.split(".");if(!C||!A||w)return null;let B=xu("sha256",f.secret).update(C).digest(),v;try{v=Buffer.from(A,"base64url")}catch{return null}if(B.length!==v.length||!Lg(B,v))return null;try{let ce=JSON.parse(Buffer.from(C,"base64url").toString("utf8")),de=bs(f.now??Date.now());if(!ce.resource||!Number.isSafeInteger(ce.expiresAt)||ce.expiresAt<=de)return null;if(f.resource&&ce.resource!==f.resource)return null;if(f.audience&&ce.audience!==f.audience)return null;return ce}catch{return null}}function WS(l,f=!1){let C=new URL(l,"https://media.invalid").pathname.toLowerCase(),A=/\.(?:m3u8|mpd|vtt|json)$/.test(C),w=/\.(?:key|license)$/.test(C)||C.includes("/keys/")||C.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":f&&(A||w)?"private, no-store":A?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function VS(l){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(l.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(l.region))throw TypeError("Media bucket region is invalid");let f=l.prefix?`/${l.prefix.replace(/^\/+|\/+$/g,"")}`:"",C=l.protected??!1,A="public, max-age=31536000, immutable",w=C?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${l.bucket}.s3.${l.region}.amazonaws.com`,originPath:f,domain:l.domain,trustedKeyGroupIds:[...new Set(l.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.mpd",cacheControl:w,compress:!0,signed:C},{pathPattern:"*.vtt",cacheControl:w,compress:!0,signed:C},{pathPattern:"*",cacheControl:A,compress:!1,signed:C}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class _g{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(l){this.config=l.config,this.environment=l.environment,this.builder=new Qd(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let f=this.config.environments[this.environment]?.infrastructure;if(!f)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...f,compute:{...this.config.infrastructure?.compute,...f.compute},storage:{...this.config.infrastructure?.storage,...f.storage},functions:{...this.config.infrastructure?.functions,...f.functions},servers:{...this.config.infrastructure?.servers,...f.servers},databases:{...this.config.infrastructure?.databases,...f.databases},cdn:{...this.config.infrastructure?.cdn,...f.cdn},sftp:f.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...f.queues},redirects:{...this.config.infrastructure?.redirects,...f.redirects},realtime:{...this.config.infrastructure?.realtime,...f.realtime},cache:{...this.config.infrastructure?.cache,...f.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...f.fileSystem},email:{...this.config.infrastructure?.email,...f.email},search:{...this.config.infrastructure?.search,...f.search},ai:{...this.config.infrastructure?.ai,...f.ai}}}}shouldDeploy(l){if(l.environments&&!l.environments.includes(this.environment))return!1;if(l.requiresFeatures){let f=this.config.features||{};if(!l.requiresFeatures.every((A)=>f[A]===!0))return!1}if(l.regions){let f=this.config.environments[this.environment]?.region||this.config.project.region;if(!l.regions.includes(f))return!1}if(l.condition&&typeof l.condition==="function")return l.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let l=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,f=Number(l||3008);return Number.isFinite(f)&&f>0?f:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(l,f){return l==="public"||f.routeCompute===!0}storageBucketName(l,f,C){return this.mergedConfig.infrastructure?.storage?.[C]?.bucket??`${l}-${f}-${C}`}fileSystemLogicalId(l,f,C){return t(r({slug:`${l}-${C}`,environment:f,resourceType:"efs"}))}resolveSftpStorage(l,f,C){let A=l.storage;if(A?.type==="efs"&&A.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[A.fileSystem])throw Error(`sftp: storage.fileSystem "${A.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(f,C,A.fileSystem)},posixProfile:A.posixProfile}}if(A?.type==="s3"&&A.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[A.storageBucket])throw Error(`sftp: storage.storageBucket "${A.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(f,C,A.storageBucket)}}return}resolveComputeCachePathPatterns(l){if(l&&l.length>0)return l;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(l,f){return{PathPattern:l,TargetOriginId:f,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(l,f,C,A,w,B){let v=this.serverEipLogicalIds.get("app"),ce=this.serverEipLogicalIds.get("appInstance");if(!v)return;let de=`EC2-${A}-${w}-api`,ct=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",xe=ct==="us-east-1"?".compute-1.amazonaws.com":`.${ct}.compute.amazonaws.com`,Ut={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:v}]}]},xe]]},Qt=this.resolveApiOriginPort();if(l.push({Id:de,DomainName:Ut,CustomOriginConfig:{HTTPPort:Qt,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),C.push(v),ce)C.push(ce);for(let gt of B)f.push(this.createComputeCacheBehavior(gt,de))}buildCaddyfile(l){let f=l.filter(([,w])=>typeof w.domain==="string"&&w.domain&&typeof w.port==="number");if(f.length===0)return;let C=new Map;for(let[,w]of f){let B=C.get(w.domain)??[];B.push({port:w.port,path:w.path}),C.set(w.domain,B)}let A=[];for(let[w,B]of C){let ce=[...B].sort((de,ct)=>{let xe=!de.path||de.path==="/",Ut=!ct.path||ct.path==="/";if(xe&&!Ut)return 1;if(!xe&&Ut)return-1;return(ct.path?.length??0)-(de.path?.length??0)}).map((de)=>{let ct=!de.path||de.path==="/",xe=`reverse_proxy localhost:${de.port}`;return ct?`  handle {
     ${xe}
   }`:`  handle ${de.path} {
     ${xe}
@@ -10,8 +10,8 @@ ${ce.join(`
 `)}normalizeMountPath(l){let f=l?.mountPath||l?.path;if(!f||f==="/")return;let C=`/${f}`.replace(/\/+/g,"/").replace(/\/$/,"");return C==="/"?void 0:C}storageBucketLogicalId(l,f,C){return`${l}-${f}-s3-${C}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((A)=>A.charAt(0).toUpperCase()+A.slice(1)).join("")}pathMountRewriteFunctionCode(l,f="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(l)}; var rewriteStyle = ${JSON.stringify(f)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let l=this.mergedConfig.project.slug,f=this.environment,C=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),A=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),w=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(l,f),this.generateContainerInfrastructure(l,f);if(C)this.generateServerless(l,f);if(A)this.generateServer(l,f);if(w)this.generateComputeApp(l,f);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(l,f);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(l,f),this.storageFailoverReplicas.length>0)this.builder.addMetadata(qd,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(l){}generateNetworkInfrastructure(l,f){if(this.builder.hasResource("VPC"))return;let A=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:w,logicalId:B}=y.createVpc({slug:l,environment:f,cidr:A,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",w);let v=`${l}${f}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(v,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${l}-${f}-igw`},{Key:"Environment",Value:f}]}});let ce=`${l}${f}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(ce,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:v}}});let de=`${l}${f}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(de,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${l}-${f}-public-rt`},{Key:"Environment",Value:f}]}}),this.builder.addResource(`${l}${f}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:de},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:v}},DependsOn:ce});let ct=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",xe=["a","b"];for(let Ut=0;Ut<2;Ut++){let Qt=`PublicSubnet${Ut+1}`;this.builder.addResource(Qt,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${Ut}.0/24`,AvailabilityZone:`${ct}${xe[Ut]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${l}-${f}-public-${xe[Ut]}`},{Key:"Environment",Value:f}]}}),this.builder.addResource(`${Qt}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:Qt},RouteTableId:{Ref:de}}})}}generateContainerInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.containers;if(!C)return;let A=this.mergedConfig.infrastructure?.loadBalancer,w=this.mergedConfig.infrastructure?.ssl,B=this.mergedConfig.infrastructure?.dns,v;if(w?.enabled&&w.domains?.length)if(w.certificateArn);else{let xe=w.domains[0],Ut=w.domains.slice(1).map((lt)=>{if(lt.includes(".")&&lt.endsWith(xe))return lt.replace(`.${xe}`,"");return lt}),{certificate:Qt,logicalId:gt}=b.createCertificate({domain:xe,subdomains:Ut,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:B?.hostedZoneId});v=gt,this.builder.addResource(gt,Qt)}let ce="ECSCluster";this.builder.addResource(ce,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${l}-${f}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${l}-${f}`},{Key:"Environment",Value:f}]}});let de=`${l}${f}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(de,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${l}-${f}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-alb-sg`},{Key:"Environment",Value:f}]}});let ct=`${l}${f}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[xe,Ut]of Object.entries(C)){let Qt=Ut.port||3000;this.builder.addResource(ct,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${l}-${f}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:Qt,ToPort:Qt,SourceSecurityGroupId:{Ref:de},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${l}-${f}-ecs-sg`},{Key:"Environment",Value:f}]}});let gt=`${l}${f}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(gt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let lt=`${l}${f}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(lt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let ut=`${l}${f}${xe}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),Ee=`/ecs/${l}-${f}-${xe}`;this.builder.addResource(ut,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:Ee,RetentionInDays:30}});let Ft=`${l}${f}${xe}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),ve=String(Ut.cpu||512),Pt=String(Ut.memory||1024);this.builder.addResource(Ft,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${l}-${f}-${xe}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:ve,Memory:Pt,ExecutionRoleArn:{"Fn::GetAtt":[gt,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[lt,"Arn"]},ContainerDefinitions:[{Name:xe,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${l}:latest`},Essential:!0,PortMappings:[{ContainerPort:Qt,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":Ee,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":xe}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${Qt}${Ut.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[gt,lt,ut]});let Ht=`${l}${f}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(A?.enabled!==!1){this.builder.addResource(Ht,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${l}-${f}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:de}],Tags:[{Key:"Name",Value:`${l}-${f}-alb`},{Key:"Environment",Value:f}]}});let lr=`${l}${f}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),Cr=A?.healthCheck?.path||Ut.healthCheck||"/health";this.builder.addResource(lr,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${l}-${f}-tg`,Port:Qt,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:Cr,HealthCheckIntervalSeconds:A?.healthCheck?.interval||30,HealthyThresholdCount:A?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:A?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${l}-${f}-tg`},{Key:"Environment",Value:f}]}});let br=`${l}${f}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(w?.enabled&&w?.redirectHttp)this.builder.addResource(br,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ht},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(br,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ht},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:lr}}]}});if(w?.enabled){let Ir=w.certificateArn||(v?{Ref:v}:void 0);if(Ir){let Er=`${l}${f}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Er,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ht},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:Ir}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:lr}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let wr=`${l}${f}${xe}Service`.replace(/[^a-zA-Z0-9]/g,""),kr=Ut.desiredCount||1;this.builder.addResource(wr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-${xe}`,Cluster:{Ref:ce},TaskDefinition:{Ref:Ft},DesiredCount:kr,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ct}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:xe,ContainerPort:Qt,TargetGroupArn:{Ref:lr}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[Ft,br,lr]});let xr=Ut.autoScaling;if(xr){let Ir=`${l}${f}${xe}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Ir,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:xr.max||10,MinCapacity:xr.min||1,ResourceId:{"Fn::Sub":`service/\${${ce}}/${l}-${f}-${xe}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:wr}),xr.targetCpuUtilization)this.builder.addResource(`${l}${f}${xe}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-${xe}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Ir},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:xr.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(xr.targetMemoryUtilization)this.builder.addResource(`${l}${f}${xe}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${l}-${f}-${xe}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Ir},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:xr.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(B?.domain&&B?.hostedZoneId)this.builder.addResource(`${l}${f}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:B.hostedZoneId,Name:`api.${B.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ht,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Ht,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[ce,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${l}-${f}-${xe}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Ht,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let lr=`${l}${f}${xe}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(lr,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${l}-${f}-${xe}`,Cluster:{Ref:ce},TaskDefinition:{Ref:Ft},DesiredCount:Ut.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:ct}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${l}-${f}-${xe}`},{Key:"Environment",Value:f}]},DependsOn:[Ft]})}break}}generateServerless(l,f){if(this.mergedConfig.infrastructure?.functions)for(let[C,A]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(A))continue;let{role:w,logicalId:B}=ne.createRole({slug:l,environment:f,roleName:`${l}-${f}-${C}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(B,w);let{lambdaFunction:v,logicalId:ce}=a.createLambdaFunction({slug:l,environment:f,functionName:`${l}-${f}-${C}`,handler:A.handler||"index.handler",runtime:A.runtime||"nodejs20.x",code:{zipFile:A.code||"export const handler = async () => ({ statusCode: 200 });"},role:B,timeout:A.timeout,memorySize:A.memorySize});this.builder.addResource(ce,v)}if(this.mergedConfig.infrastructure?.api){let{restApi:C,logicalId:A}=Kd.createRestApi({slug:l,environment:f,apiName:`${l}-${f}-api`});this.builder.addResource(A,C)}}generateServer(l,f){if(!this.mergedConfig.infrastructure?.servers)return;let C=this.mergedConfig.infrastructure.servers,A=this.mergedConfig.infrastructure?.compute,w=this.mergedConfig.infrastructure?.ssl;if(Object.values(C).some((v)=>!v.privateNetwork||v.privateNetwork==="create"))this.generateNetworkInfrastructure(l,f);for(let[v,ce]of Object.entries(C)){let de=ce.instanceType||ce.size||A?.size,xe=(de?a.InstanceSize.specs[de]:void 0)?.instanceType||de||"t3.micro",Ut=ce.type||"app",Qt=ce.userData||ce.startupScript;if(!Qt)Qt=a.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:ce.bunVersion||"latest",webServer:"none",domain:ce.domain,enableSsl:!!w?.enabled,sslEmail:w?.letsEncrypt?.email,installRedis:Ut==="cache",installDatabaseClients:!!ce.database});let gt=ce.privateNetwork&&ce.privateNetwork!=="create"?ce.privateNetwork:{Ref:"VPC"},lt=ce.subnet||{Ref:"PublicSubnet1"},Ee=!!this.mergedConfig.infrastructure?.email?.server?.enabled,Ft=[22,80,443,this.resolveApiOriginPort()];if(Ee)Ft.push(25,465,587,143,993);let ve=a.createServerModeStack({slug:`${l}-${v}`,environment:f,vpcId:gt,subnetId:lt,instanceType:xe,keyName:ce.keyName||`${l}-${f}`,domain:ce.domain,userData:Qt,volumeSize:ce.diskSize||20,imageId:ce.image,allowedPorts:Ft});for(let[Pt,Ht]of Object.entries(ve.resources))this.builder.addResource(Pt,Ht);this.serverEipLogicalIds.set(v,ve.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${v}Instance`,ve.outputs.instanceLogicalId),this.builder.addOutput(`${v}InstanceId`,{Value:{Ref:ve.outputs.instanceLogicalId},Description:`Instance ID for ${v} server`}),this.builder.addOutput(`${v}PublicIp`,{Value:{Ref:ve.outputs.eipLogicalId},Description:`Public IP for ${v} server`})}}generateComputeApp(l,f){let C=this.mergedConfig.infrastructure?.compute;if(!C)return;let A=this.mergedConfig.sites||{},w=Object.entries(A),v=this.mergedConfig.infrastructure?.dns?.domain,ce=this.mergedConfig.infrastructure?.database,de=C.size,xe=(de?a.InstanceSize.specs[de]:void 0)?.instanceType||de||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(l,f);let Ut=this.buildCaddyfile(w),Qt=a.UserData.generateBunAppScript({runtime:C.runtime||"bun",runtimeVersion:C.runtimeVersion||"latest",systemPackages:C.systemPackages,database:ce,caddyfile:Ut}),gt=Hs(C.appUpdates),lt=gt.length>0?`${Qt}
 ${gt.join(`
 `)}
-`:Qt,ut=w.map(([,Cr])=>Cr.port).filter((Cr)=>typeof Cr==="number"&&![80,443].includes(Cr)),Ee=this.resolveApiOriginPort(),Ft=`${l}${f}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),ve=`${l}-${f}-deploy`;this.builder.addResource(Ft,{Type:"AWS::S3::Bucket",Properties:{BucketName:ve,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"ManagedBy",Value:"ts-cloud"}]}});let Pt=a.createServerModeStack({slug:`${l}-app`,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:xe,keyName:C.allowSsh?`${l}-${f}`:void 0,domain:v,userData:lt,volumeSize:C.disk?.size||20,imageId:C.image,allowedPorts:[...C.allowSsh?[22]:[],80,443,Ee,...ut]}),Ht=Pt.resources[Pt.outputs.instanceLogicalId];if(Ht?.Properties){let Cr=Ht.Properties.Tags||[];Ht.Properties.Tags=[...Cr,{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let lr=Pt.resources[Pt.outputs.roleLogicalId];if(lr?.Properties)lr.Properties.Policies=lr.Properties.Policies||[],lr.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${ve}`,`arn:aws:s3:::${ve}/*`]}]}});for(let[Cr,br]of Object.entries(Pt.resources))this.builder.addResource(Cr,br);this.builder.addOutput("deployBucketName",{Value:{Ref:Ft},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:Pt.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:Pt.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",Pt.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",Pt.outputs.instanceLogicalId)}jumpBoxFileSystemId(l,f,C){let A=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof C==="string")return A.includes(C)?{Ref:this.fileSystemLogicalId(l,f,C)}:C;if(A.length===1)return{Ref:this.fileSystemLogicalId(l,f,A[0])};throw Error(A.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${A.length} (${A.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(l,f){let C=this.mergedConfig.infrastructure?.jumpBox;if(!C)return;let A=C===!0?{}:C;if(A.enabled===!1)return;this.generateNetworkInfrastructure(l,f);let w=A.size||"micro",v=a.InstanceSize.specs[w]?.instanceType||w||"t3.micro",ce=a.createJumpBox({slug:l,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:A.keyName,instanceType:v,allowedCidrs:A.allowedCidrs,mountEfs:A.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(l,f,A.mountEfs),mountPath:A.mountPath||"/mnt/efs"}:void 0,databaseTools:A.databaseTools});for(let[de,ct]of Object.entries(ce.resources))this.builder.addResource(de,ct);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:ce.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.ssl,A=this.mergedConfig.infrastructure?.dns,w=A?.domain,B=A?.hostedZoneId,v=[],ce,de;if(C?.certificateArn)de=C.certificateArn;else if(C?.enabled&&w&&B){let ut=C.domains||[w],Ee=ut[0],Ft=ut.slice(1).map((Ht)=>{if(Ht.includes(".")&&Ht.endsWith(Ee))return Ht.replace(`.${Ee}`,"");return Ht}),{certificate:ve,logicalId:Pt}=b.createCertificate({domain:Ee,subdomains:Ft,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:B});ce=Pt,this.builder.addResource(Pt,ve)}if(this.mergedConfig.infrastructure?.storage){let ut=Object.entries(this.mergedConfig.infrastructure.storage).some(([,ve])=>ve.website),Ee;if(ut&&(ce||de))Ee=`${l}${f}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Ee,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${l}-${f}-s3-oac`,Description:`OAC for ${l} ${f} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let Ft=Object.entries(this.mergedConfig.infrastructure.storage).map(([ve,Pt])=>({name:ve,config:Pt,mountPath:this.normalizeMountPath(Pt),rewriteStyle:Pt.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(l,f,ve)})).filter((ve)=>ve.name!=="public"&&ve.config.website&&ve.mountPath);for(let[ve,Pt]of Object.entries(this.mergedConfig.infrastructure.storage)){let Ht=!!(Pt.website&&Ee),lr=this.storageBucketName(l,f,ve),{bucket:Cr,logicalId:br}=De.createBucket({slug:l,name:ve,environment:f,bucketName:lr,versioning:Pt.versioning,encryption:Pt.encryption,public:Ht?!1:Pt.public}),wr=this.normalizeMountPath(Pt),kr;if(Pt.failover){let Ir=`infrastructure.storage.${ve}`;if(!Ht||!w||wr&&ve!=="public")throw Error(`${Ir}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(kr=Yp({failover:Pt.failover,primaryBucket:lr,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:Ir}),kr.replicate&&Cr.Properties){let Er=`${br}FailoverReplicationRole`;this.builder.addResource(Er,em({primaryBucket:lr,replicaBucket:kr.replicaBucket}));let sn=Cr.Properties;sn.VersioningConfiguration={Status:"Enabled"},sn.ReplicationConfiguration=tm({replicaBucket:kr.replicaBucket,roleArn:{"Fn::GetAtt":[Er,"Arn"]}})}}if(Ht&&Cr.Properties)Cr.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(br,Cr),Pt.website){let Ir=typeof Pt.website==="object"?Pt.website:{},Er=De.enableWebsiteHosting(Cr,Ir.indexDocument||"index.html",Ir.errorDocument);this.builder.addResource(br,Er)}let xr=this.normalizeMountPath(Pt);if(Ht&&Ee&&w&&!(xr&&ve!=="public")){let Ir=`${l}${f}${ve}CDN`.replace(/[^a-zA-Z0-9]/g,""),Er=[];if(Pt.aliases&&Pt.aliases.length>0)Er.push(...Pt.aliases);else if(ve==="public"){if(Er.push(w),C?.domains?.includes(`www.${w}`))Er.push(`www.${w}`)}else if(ve==="docs")Er.push(`docs.${w}`);else if(ve==="blog")Er.push(`blog.${w}`);let sn=typeof Pt.website==="object"?Pt.website:{},Fn=Pt.spa===!0,bn=sn.errorDocument||(Fn?"index.html":"404.html"),_r=[];if(Fn)_r.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else _r.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${bn}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${bn}`,ErrorCachingMinTTL:300});let Wn=de&&Er.length>0?{AcmCertificateArn:de,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:ce&&Er.length>0?{AcmCertificateArn:{Ref:ce},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},ri=`S3-${l}-${f}-${ve}`,$c=this.mergedConfig.project.region||"us-east-1",li;if(!Fn)li=`${l}${f}${ve}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(li,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${ve}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${l} ${f} ${ve} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
-else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let Rs=[{Id:ri,DomainName:{"Fn::Sub":`\${${br}}.s3.${$c}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}],Qs=[],Dc=[];if(this.shouldRouteStorageBucketToCompute(ve,Pt)){this.appendComputeAppOrigin(Rs,Qs,Dc,l,f,this.resolveComputeCachePathPatterns(Pt.computeRoutes));for(let Or of Ft){let Ba=`S3-${l}-${f}-${Or.name}`,vc=`${l}${f}${Or.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(vc,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${Or.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${l} ${f} ${Or.name} at ${Or.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(Or.mountPath,Or.rewriteStyle)}}),Rs.push({Id:Ba,DomainName:{"Fn::Sub":`\${${Or.logicalId}}.s3.${$c}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}),Dc.push(Or.logicalId,vc);for(let Ig of[Or.mountPath,`${Or.mountPath}/*`])Qs.push({PathPattern:Ig,TargetOriginId:Ba,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[vc,"FunctionARN"]}}]})}}let Oa,ku=ri;if(kr){let Or=`${ri}-failover`;Object.assign(Rs[0],kr.primaryConnection),Rs.push({Id:Or,DomainName:Zp(kr.replicaBucket,kr.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}),Oa=Xr({primaryOriginId:ri,secondaryOriginId:Or,statusCodes:kr.statusCodes}),ku=Oa.Items[0].Id}let kc={Type:"AWS::CloudFront::Distribution",DependsOn:[br,Ee,...li?[li]:[],...Dc],Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${ve} site`,DefaultRootObject:"index.html",Origins:Rs,...Oa?{OriginGroups:Oa}:{},DefaultCacheBehavior:{TargetOriginId:ku,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...li?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[li,"FunctionARN"]}}]}:{}},...Qs.length>0?{CacheBehaviors:Qs}:{},...Er.length>0?{Aliases:Er}:{},ViewerCertificate:Wn,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:_r}}};if(ce)kc.DependsOn.push(ce);if(kr)St(kc.Properties.DistributionConfig,`infrastructure.storage.${ve}`),this.storageFailoverReplicas.push({name:ve,primaryBucket:lr,primaryRegion:$c,replicaBucket:kr.replicaBucket,replicaRegion:kr.replicaRegion,replicate:kr.replicate,distributionArnOutput:`${ve}CloudFrontDistributionArn`}),this.builder.addOutput(`${ve}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${Ir}}`},Description:`CloudFront distribution ARN for ${ve} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${ve}FailoverBucketName`,{Value:kr.replicaBucket,Description:`Failover replica bucket for ${ve} (${kr.replicaRegion}), outside this stack`});this.builder.addResource(Ir,kc);let wg=`${br}CloudFrontPolicy`;if(this.builder.addResource(wg,{Type:"AWS::S3::BucketPolicy",DependsOn:[br,Ir],Properties:{Bucket:{Ref:br},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${br}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Ir}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(ve,Pt))for(let Or of Ft){let Ba=`${Or.logicalId}CloudFrontPolicy`;this.builder.addResource(Ba,{Type:"AWS::S3::BucketPolicy",DependsOn:[Or.logicalId,Ir],Properties:{Bucket:{Ref:Or.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Or.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Ir}}`}}}}]}}})}if(Er.length>0)v.push({name:ve,bucketLogicalId:br,distLogicalId:Ir,oacLogicalId:Ee,aliases:Er});this.builder.addOutput(`${ve}CloudFrontDomain`,{Value:{"Fn::GetAtt":[Ir,"DomainName"]},Description:`CloudFront domain for ${ve}`}),this.builder.addOutput(`${ve}CloudFrontDistributionId`,{Value:{Ref:Ir},Description:`CloudFront distribution ID for ${ve}`})}if(this.builder.addOutput(`${ve}BucketName`,{Value:{Ref:br},Description:`S3 bucket name for ${ve}`}),ve==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:br},Description:"Frontend S3 bucket name"});if(ve==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:br},Description:"Documentation S3 bucket name"});if(ve==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:br},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let ut=this.mergedConfig.infrastructure.sftp,Ee=zd.create({...ut,storage:this.resolveSftpStorage(ut,l,f)??ut.storage,slug:l,environment:f});for(let[Ft,ve]of Object.entries(Ee.resources))this.builder.addResource(Ft,ve);this.builder.addOutput("SftpServerId",{Value:{Ref:Ee.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${Ee.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:Ee.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(B&&v.length>0)for(let{name:ut,distLogicalId:Ee,aliases:Ft}of v)for(let ve of Ft){let Pt=ve.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Pt}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ee],Properties:{HostedZoneId:B,Name:ve,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ee,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${Pt}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ee],Properties:{HostedZoneId:B,Name:ve,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[Ee,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.databases))if(Ee.engine==="dynamodb"){let{table:Ft,logicalId:ve}=Yt.createTable({slug:l,environment:f,tableName:`${l}-${f}-${ut}`,partitionKey:Ee.partitionKey||{name:"id",type:"S"},sortKey:Ee.sortKey});this.builder.addResource(ve,Ft)}else if(Ee.engine==="postgres"){let{dbInstance:Ft,logicalId:ve}=Yt.createPostgres({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${ut}`,masterUsername:Ee.username||"admin",masterUserPassword:Ee.password||"changeme123",allocatedStorage:Ee.storage||20,dbInstanceClass:Ee.instanceClass||"db.t3.micro"});this.builder.addResource(ve,Ft)}else if(Ee.engine==="mysql"){let{dbInstance:Ft,logicalId:ve}=Yt.createMysql({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${ut}`,masterUsername:Ee.username||"admin",masterUserPassword:Ee.password||"changeme123",allocatedStorage:Ee.storage||20,dbInstanceClass:Ee.instanceClass||"db.t3.micro"});this.builder.addResource(ve,Ft)}}if(this.mergedConfig.infrastructure?.cdn)for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!Ee.origin)continue;let Ft=typeof Ee.customDomain==="string"?Ee.customDomain:Ee.customDomain?.domain||Ee.domain,ve=typeof Ee.customDomain==="object"?Ee.customDomain?.certificateArn:Ee.certificateArn,Pt=ve||de,Ht=`${l}${f}${ut}CDN`.replace(/[^a-zA-Z0-9]/g,""),lr=`S3-${l}-${f}-${ut}-cdn`,Cr=[{Id:lr,DomainName:Ee.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:Ee.originShield?{Enabled:!0,OriginShieldRegion:Ee.originShieldRegion||this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...re(Ee,`infrastructure.cdn.${ut}`)}],br=[],wr=[],kr=["GET","HEAD","OPTIONS"],xr=lr,Ir;if(Ee.failoverOrigin){yt(kr,`the default cache behavior of infrastructure.cdn.${ut}`);let bn=`${lr}-failover`,_r=typeof Ee.failoverOrigin==="string"?{domain:Ee.failoverOrigin}:Ee.failoverOrigin;if(!_r.domain)throw Error(`infrastructure.cdn.${ut}.failoverOrigin.domain is required`);if(_r.domain===Ee.origin)throw Error(`infrastructure.cdn.${ut}: failoverOrigin must differ from origin (both are ${Ee.origin})`);Cr.push({Id:bn,DomainName:_r.domain,OriginPath:_r.originPath||"",...vo(_r.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...re(_r,`infrastructure.cdn.${ut}.failoverOrigin`)}),Ir=Xr({primaryOriginId:lr,secondaryOriginId:bn,statusCodes:Ee.failoverStatusCodes}),xr=Ir.Items[0].Id}else if(Ee.failoverStatusCodes)throw Error(`infrastructure.cdn.${ut}: failoverStatusCodes needs failoverOrigin to fail over to`);if(Ee.routeCompute)this.appendComputeAppOrigin(Cr,br,wr,l,f,this.resolveComputeCachePathPatterns(Ee.computeRoutes));let Er=Pt&&Ft?{AcmCertificateArn:ce&&!ve?{Ref:ce}:Pt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},sn=[...wr];if(ce&&!ve&&Ft)sn.push(ce);let Fn={Type:"AWS::CloudFront::Distribution",...sn.length>0?{DependsOn:sn}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${ut} CDN`,DefaultRootObject:"index.html",Origins:Cr,...Ir?{OriginGroups:Ir}:{},DefaultCacheBehavior:{TargetOriginId:xr,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:kr,CachedMethods:["GET","HEAD","OPTIONS"],Compress:Ee.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...br.length>0?{CacheBehaviors:br}:{},...Ft&&Pt?{Aliases:[Ft]}:{},ViewerCertificate:Er,PriceClass:"PriceClass_100",HttpVersion:Ee.http3?"http2and3":"http2"}}};if(St(Fn.Properties.DistributionConfig,`infrastructure.cdn.${ut}`),this.builder.addResource(Ht,Fn),B&&Ft&&Pt){let bn=Ft.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${bn}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ht,...ce&&!ve?[ce]:[]],Properties:{HostedZoneId:B,Name:Ft,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Ht,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(Ee))continue;let{queue:Ft,logicalId:ve}=G.createQueue({slug:l,environment:f,name:`${l}-${f}-${ut}`,fifo:Ee.fifo,visibilityTimeout:Ee.visibilityTimeout,messageRetentionPeriod:Ee.messageRetentionPeriod,delaySeconds:Ee.delaySeconds,maxMessageSize:Ee.maxMessageSize,receiveMessageWaitTime:Ee.receiveMessageWaitTime,contentBasedDeduplication:Ee.contentBasedDeduplication,encrypted:Ee.encrypted,kmsKeyId:Ee.kmsKeyId});this.builder.addResource(ve,Ft);let Pt;if(Ee.deadLetterQueue){let{deadLetterQueue:Ht,updatedSourceQueue:lr,deadLetterLogicalId:Cr}=G.createDeadLetterQueue(ve,{slug:l,environment:f,maxReceiveCount:Ee.maxReceiveCount});Pt=Cr,this.builder.addResource(Cr,Ht);let wr=this.builder.getResources()[ve];if(wr?.Properties)wr.Properties.RedrivePolicy=lr.Properties?.RedrivePolicy}if(Ee.trigger){let Ht=Ee.trigger,lr=`${l}${f}${Ht.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Cr={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[ve,"Arn"]},FunctionName:{Ref:lr},BatchSize:Ht.batchSize||10,MaximumBatchingWindowInSeconds:Ht.batchWindow||0,Enabled:!0,...Ht.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Ht.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Ht.maxConcurrency}},...Ht.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Ht.filterPattern)}]}}},DependsOn:[ve,lr]};this.builder.addResource(`${ve}Trigger`,Cr)}if(Ee.alarms?.enabled){let Ht=Ee.alarms,lr=Ht.notificationTopicArn;if(!lr&&Ht.notificationEmails?.length){let wr=`${ve}AlarmTopic`;this.builder.addResource(wr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-${ut}-alarms`,DisplayName:`${ut} Queue Alarms`}}),Ht.notificationEmails.forEach((kr,xr)=>{this.builder.addResource(`${wr}Sub${xr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:wr},Protocol:"email",Endpoint:kr}})}),lr={Ref:wr}}let Cr=Ht.queueDepthThreshold||1000;this.builder.addResource(`${ve}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ut}-queue-depth`,AlarmDescription:`Queue ${ut} depth exceeds ${Cr} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Cr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ve,"QueueName"]}}],...lr&&{AlarmActions:[lr],OKActions:[lr]}}});let br=Ht.messageAgeThreshold||3600;if(this.builder.addResource(`${ve}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ut}-message-age`,AlarmDescription:`Queue ${ut} oldest message exceeds ${br} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:br,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ve,"QueueName"]}}],...lr&&{AlarmActions:[lr],OKActions:[lr]}}}),Pt&&Ht.dlqAlarm!==!1)this.builder.addResource(`${Pt}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ut}-dlq-messages`,AlarmDescription:`Dead letter queue for ${ut} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Pt,"QueueName"]}}],...lr&&{AlarmActions:[lr]}}})}if(Ee.subscribe){let Ht=Ee.subscribe,lr=Ht.topicArn;if(!lr&&Ht.topicName)lr={Ref:Ht.topicName};if(lr){this.builder.addResource(`${ve}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:ve}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[ve,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":lr}}}]}}});let Cr={TopicArn:lr,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[ve,"Arn"]},RawMessageDelivery:Ht.rawMessageDelivery||!1};if(Ht.filterPolicy)Cr.FilterPolicy=Ht.filterPolicy,Cr.FilterPolicyScope=Ht.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${ve}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Cr,DependsOn:`${ve}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(l,f);else this.generateRealtimeResources(l,f);let ct=this.mergedConfig.infrastructure?.redirects;if(ct){let ut=ct.target||this.mergedConfig.infrastructure?.dns?.domain||"",Ee=ct.protocol||"https";if(ct.domains?.length&&ut)for(let Ft of ct.domains){let{bucket:ve,bucketPolicy:Pt,logicalId:Ht,policyLogicalId:lr}=bt.createDomainRedirectBucket({slug:l,environment:f,sourceDomain:Ft,targetDomain:ut,protocol:Ee});this.builder.addResource(Ht,ve),this.builder.addResource(lr,Pt)}if(ct.paths&&Object.keys(ct.paths).length>0){let Ft=bt.fromMapping(ct.paths,{statusCode:ct.statusCode||301}),{function:ve,logicalId:Pt}=bt.createPathRedirectFunction({slug:l,environment:f,rules:Ft});this.builder.addResource(Pt,ve)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:Ft,logicalId:ve}=Ro.createAlarm({slug:l,environment:f,alarmName:`${l}-${f}-${ut}`,metricName:Ee.metricName||"Errors",namespace:Ee.namespace||"AWS/Lambda",threshold:Ee.threshold||1,comparisonOperator:Ee.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(ve,Ft)}let xe=this.mergedConfig.infrastructure?.cache;if(xe){let ut=xe.type||"redis";if(ut==="redis"){this.generateNetworkInfrastructure(l,f);let Ee=xe.redis||{},{replicationGroup:Ft,subnetGroup:ve,logicalId:Pt,subnetGroupId:Ht}=wo.createRedis({slug:l,environment:f,nodeType:Ee.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:Ee.engineVersion||"7.1",port:Ee.port||6379,numCacheClusters:Ee.numCacheNodes||2,automaticFailover:Ee.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:Ee.snapshotRetentionLimit||7,snapshotWindow:Ee.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Pt,Ft),ve&&Ht)this.builder.addResource(Ht,ve);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Pt,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[Pt,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(ut==="memcached"){this.generateNetworkInfrastructure(l,f);let Ee=xe.elasticache||{},{cluster:Ft,subnetGroup:ve,logicalId:Pt,subnetGroupId:Ht}=wo.createMemcached({slug:l,environment:f,nodeType:Ee.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:Ee.engineVersion||"1.6.22",numCacheNodes:Ee.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Pt,Ft),ve&&Ht)this.builder.addResource(Ht,ve);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Pt,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let Ut=this.mergedConfig.infrastructure?.email;if(Ut){let ut=Ut.domain||this.mergedConfig.infrastructure?.dns?.domain;if(ut){let{emailIdentity:Ee,logicalId:Ft}=m.verifyDomain({domain:ut,slug:l,environment:f,enableDkim:Ut.enableDkim!==!1,dkimKeyLength:Ut.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(Ft,Ee),Ut.configurationSet!==!1){let{configurationSet:Ht,logicalId:lr}=m.createConfigurationSet({slug:l,environment:f});this.builder.addResource(lr,Ht)}let ve=Ut.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(ve){if(Ut.enableDkim!==!1)for(let wr=1;wr<=3;wr++){let kr=`DkimRecord${wr}${ut.replace(/\./g,"")}`;this.builder.addResource(kr,{Type:"AWS::Route53::RecordSet",DependsOn:[Ft],Properties:{HostedZoneId:ve,Name:{"Fn::GetAtt":[Ft,`DkimDNSTokenName${wr}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[Ft,`DkimDNSTokenValue${wr}`]}]}})}let{record:Ht,logicalId:lr}=m.createSpfRecord(ut,ve);this.builder.addResource(lr,Ht);let{record:Cr,logicalId:br}=m.createDmarcRecord(ut,ve,{policy:"none",reportingEmail:Ut.dmarcReportingEmail||`dmarc-reports@${ut}`});this.builder.addResource(br,Cr)}this.builder.addOutput("EmailDomain",{Value:ut,Description:"SES verified email domain"});let Pt=Ut.server;if(Pt?.enabled&&ve){let Ht=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",lr=`${l}-${f}-email`,{role:Cr,policy:br,roleLogicalId:wr,policyLogicalId:kr}=m.createEmailLambdaRole({slug:l,environment:f,s3BucketArn:`arn:aws:s3:::${lr}`,sesIdentityArn:`arn:aws:ses:${Ht}:*:identity/${ut}`});this.builder.addResource(wr,Cr),this.builder.addResource(kr,br);let{function:xr,permission:Ir,logicalId:Er,permissionLogicalId:sn}=m.createInboundEmailLambda({slug:l,environment:f,roleArn:{"Fn::GetAtt":[wr,"Arn"]},s3BucketName:lr,organizedPrefix:"mailboxes/"});this.builder.addResource(Er,xr),this.builder.addResource(sn,Ir);let Fn=m.createInboundEmailSetup({slug:l,environment:f,domain:ut,s3BucketName:lr,s3KeyPrefix:"inbox/",region:Ht,hostedZoneId:ve,lambdaFunctionArn:{"Fn::GetAtt":[Er,"Arn"]}});for(let[_r,Wn]of Object.entries(Fn.resources)){if(Wn.Type==="AWS::SES::ReceiptRule")Wn.DependsOn=[sn,Er];this.builder.addResource(_r,Wn)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:Er},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:lr,Description:"S3 bucket for email storage"});let bn=this.serverEipLogicalIds.get("app");if(bn&&ve){let Wn=`${Pt?.subdomain||"mail"}.${ut}`,ri=Wn.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${ri}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ve,Name:Wn,Type:"A",TTL:"300",ResourceRecords:[{Ref:bn}]}})}this.builder.addOutput("MailHost",{Value:`mail.${ut}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let Qt=this.mergedConfig.infrastructure?.search;if(Qt){let ut=Qt.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(ut)this.generateNetworkInfrastructure(l,f);let{domain:Ee,logicalId:Ft}=Zt.createDomain({slug:l,environment:f,engineVersion:Qt.engineVersion||"OpenSearch_2.11",instanceType:Qt.instanceType||"t3.small.search",instanceCount:Qt.instanceCount||1,volumeSize:Qt.volumeSize||10,volumeType:Qt.volumeType||"gp3",dedicatedMaster:Qt.dedicatedMaster||!1,dedicatedMasterType:Qt.dedicatedMasterType,dedicatedMasterCount:Qt.dedicatedMasterCount||3,multiAz:Qt.multiAz||!1,encryption:Qt.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:Qt.advancedSecurity,autoTune:Qt.autoTune!==!1,vpc:ut});this.builder.addResource(Ft,Ee),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[Ft,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[Ft,"Arn"]},Description:"OpenSearch domain ARN"})}let gt=this.mergedConfig.infrastructure?.fileSystem;if(gt&&Object.keys(gt).length>0){this.generateNetworkInfrastructure(l,f);for(let[ut,Ee]of Object.entries(gt)){let{fileSystem:Ft,logicalId:ve}=ze.createFileSystem({slug:`${l}-${ut}`,environment:f,encrypted:Ee.encrypted!==!1,performanceMode:Ee.performanceMode||"generalPurpose",throughputMode:Ee.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(ve,Ft);let{securityGroup:Pt,logicalId:Ht}=ze.createEfsSecurityGroup({slug:`${l}-${ut}`,environment:f,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Ht,Pt);let{mountTargets:lr,logicalIds:Cr}=ze.createMultiAzMountTargets(ve,{slug:`${l}-${ut}`,environment:f,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Ht}});for(let br=0;br<lr.length;br++)this.builder.addResource(Cr[br],lr[br]);this.builder.addOutput(`${ut}FileSystemId`,{Value:{Ref:ve},Description:`EFS file system ID for ${ut}`})}}let lt=this.mergedConfig.infrastructure?.ai;if(lt){let ut=lt.service||"ecs",Ee=lt.models||["*"],Ft=lt.allowStreaming!==!1,ve;if(ut==="ecs")ve=Pe.enableBedrockForEcs({slug:l,environment:f,models:Ee,allowStreaming:Ft});else if(ut==="ec2")ve=Pe.enableBedrockForEc2({slug:l,environment:f,models:Ee,allowStreaming:Ft});else if(ut==="lambda")ve=Pe.enableBedrockForLambda({slug:l,environment:f,models:Ee,allowStreaming:Ft});else ve=Pe.createBedrockRole(ut,{slug:l,environment:f,models:Ee,allowStreaming:Ft});if(this.builder.addResource(ve.logicalId,ve.role),lt.allowAsync){let{policy:Pt,logicalId:Ht}=Pe.createBedrockPolicy({slug:l,environment:f,models:Ee,allowStreaming:Ft,allowAsync:!0});this.builder.addResource(Ht,Pt)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[ve.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(l,f){let C=this.mergedConfig.infrastructure?.realtime;if(!C)return;let A=C.name||`${l}-${f}-realtime`,w=C.scaling||{},B=C.storage||{type:"dynamodb"},v=w.handlerMemory||256,ce=w.handlerTimeout||30,de=`${l}${f}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),ct=`${l}${f}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(B.type==="dynamodb"){let Cr=B.dynamodb||{},br=Cr.billingMode||"PAY_PER_REQUEST";this.builder.addResource(de,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-connections`,BillingMode:br,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}},...Cr.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-connections`},{Key:"Environment",Value:f}]}}),this.builder.addResource(ct,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-channels`,BillingMode:br,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-channels`},{Key:"Environment",Value:f}]}})}let xe=`${l}${f}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(xe,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[de,"Arn"]},{"Fn::Sub":`\${${de}.Arn}/index/*`},{"Fn::GetAtt":[ct,"Arn"]},{"Fn::Sub":`\${${ct}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let Ut=`${l}${f}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),Qt=`${l}${f}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),gt=`${l}${f}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ut,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:de},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[xe,de]}),this.builder.addResource(Qt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:de},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[xe,de,ct]}),this.builder.addResource(gt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:de},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[xe,de,ct]});let lt=`${l}${f}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(lt,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:A,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:A,Environment:f}}});let ut=`${Ut}Permission`,Ee=`${Qt}Permission`,Ft=`${gt}Permission`;this.builder.addResource(ut,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Ut},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${lt}}/*/$connect`}}}),this.builder.addResource(Ee,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Qt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${lt}}/*/$disconnect`}}}),this.builder.addResource(Ft,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:gt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${lt}}/*/$default`}}});let ve=`${lt}ConnectInteg`,Pt=`${lt}DisconnectInteg`,Ht=`${lt}MessageInteg`;this.builder.addResource(ve,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:lt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Ut}.Arn}/invocations`}}}),this.builder.addResource(Pt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:lt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Qt}.Arn}/invocations`}}}),this.builder.addResource(Ht,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:lt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${gt}.Arn}/invocations`}}}),this.builder.addResource(`${lt}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:lt},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${ve}}`}}}),this.builder.addResource(`${lt}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:lt},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${Pt}}`}}}),this.builder.addResource(`${lt}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:lt},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Ht}}`}}});let lr=`${lt}Stage`;if(this.builder.addResource(lr,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:lt},StageName:f,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:w.messagesPerSecond||1000,ThrottlingRateLimit:w.messagesPerSecond||1000}}}),C.monitoring?.enabled){let Cr=C.monitoring,br=Cr.notificationTopicArn;if(!br&&Cr.notificationEmails?.length){let wr=`${lt}AlarmTopic`;this.builder.addResource(wr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Cr.notificationEmails.forEach((kr,xr)=>{this.builder.addResource(`${wr}Sub${xr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:wr},Protocol:"email",Endpoint:kr}})}),br={Ref:wr}}if(Cr.connectionThreshold)this.builder.addResource(`${lt}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Cr.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Cr.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:lt}}],...br&&{AlarmActions:[br]}}});if(Cr.errorThreshold)this.builder.addResource(`${lt}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Cr.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Cr.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:lt}}],...br&&{AlarmActions:[br]}}})}this.builder.addOutput(`${lt}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${lt}}.execute-api.\${AWS::Region}.amazonaws.com/${f}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${lt}Id`,{Description:"WebSocket API ID",Value:{Ref:lt},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
+`:Qt,ut=w.map(([,Cr])=>Cr.port).filter((Cr)=>typeof Cr==="number"&&![80,443].includes(Cr)),Ee=this.resolveApiOriginPort(),Ft=`${l}${f}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),ve=`${l}-${f}-deploy`;this.builder.addResource(Ft,{Type:"AWS::S3::Bucket",Properties:{BucketName:ve,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"ManagedBy",Value:"ts-cloud"}]}});let Pt=a.createServerModeStack({slug:`${l}-app`,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:xe,keyName:C.allowSsh?`${l}-${f}`:void 0,domain:v,userData:lt,volumeSize:C.disk?.size||20,imageId:C.image,allowedPorts:[...C.allowSsh?[22]:[],80,443,Ee,...ut]}),Ht=Pt.resources[Pt.outputs.instanceLogicalId];if(Ht?.Properties){let Cr=Ht.Properties.Tags||[];Ht.Properties.Tags=[...Cr,{Key:"Project",Value:l},{Key:"Environment",Value:f},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let lr=Pt.resources[Pt.outputs.roleLogicalId];if(lr?.Properties)lr.Properties.Policies=lr.Properties.Policies||[],lr.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${ve}`,`arn:aws:s3:::${ve}/*`]}]}});for(let[Cr,br]of Object.entries(Pt.resources))this.builder.addResource(Cr,br);this.builder.addOutput("deployBucketName",{Value:{Ref:Ft},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:Pt.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:Pt.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",Pt.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",Pt.outputs.instanceLogicalId)}jumpBoxFileSystemId(l,f,C){let A=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof C==="string")return A.includes(C)?{Ref:this.fileSystemLogicalId(l,f,C)}:C;if(A.length===1)return{Ref:this.fileSystemLogicalId(l,f,A[0])};throw Error(A.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${A.length} (${A.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(l,f){let C=this.mergedConfig.infrastructure?.jumpBox;if(!C)return;let A=C===!0?{}:C;if(A.enabled===!1)return;this.generateNetworkInfrastructure(l,f);let w=A.size||"micro",v=a.InstanceSize.specs[w]?.instanceType||w||"t3.micro",ce=a.createJumpBox({slug:l,environment:f,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:A.keyName,instanceType:v,allowedCidrs:A.allowedCidrs,mountEfs:A.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(l,f,A.mountEfs),mountPath:A.mountPath||"/mnt/efs"}:void 0,databaseTools:A.databaseTools});for(let[de,ct]of Object.entries(ce.resources))this.builder.addResource(de,ct);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:ce.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(l,f){let C=this.mergedConfig.infrastructure?.ssl,A=this.mergedConfig.infrastructure?.dns,w=A?.domain,B=A?.hostedZoneId,v=[],ce,de;if(C?.certificateArn)de=C.certificateArn;else if(C?.enabled&&w&&B){let ut=C.domains||[w],Ee=ut[0],Ft=ut.slice(1).map((Ht)=>{if(Ht.includes(".")&&Ht.endsWith(Ee))return Ht.replace(`.${Ee}`,"");return Ht}),{certificate:ve,logicalId:Pt}=b.createCertificate({domain:Ee,subdomains:Ft,slug:l,environment:f,validationMethod:"DNS",hostedZoneId:B});ce=Pt,this.builder.addResource(Pt,ve)}if(this.mergedConfig.infrastructure?.storage){let ut=Object.entries(this.mergedConfig.infrastructure.storage).some(([,ve])=>ve.website),Ee;if(ut&&(ce||de))Ee=`${l}${f}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Ee,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${l}-${f}-s3-oac`,Description:`OAC for ${l} ${f} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let Ft=Object.entries(this.mergedConfig.infrastructure.storage).map(([ve,Pt])=>({name:ve,config:Pt,mountPath:this.normalizeMountPath(Pt),rewriteStyle:Pt.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(l,f,ve)})).filter((ve)=>ve.name!=="public"&&ve.config.website&&ve.mountPath);for(let[ve,Pt]of Object.entries(this.mergedConfig.infrastructure.storage)){let Ht=!!(Pt.website&&Ee),lr=this.storageBucketName(l,f,ve),{bucket:Cr,logicalId:br}=De.createBucket({slug:l,name:ve,environment:f,bucketName:lr,versioning:Pt.versioning,encryption:Pt.encryption,public:Ht?!1:Pt.public}),wr=this.normalizeMountPath(Pt),kr;if(Pt.failover){let Ir=`infrastructure.storage.${ve}`;if(!Ht||!w||wr&&ve!=="public")throw Error(`${Ir}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(kr=Zp({failover:Pt.failover,primaryBucket:lr,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:Ir}),kr.replicate&&Cr.Properties){let Er=`${br}FailoverReplicationRole`;this.builder.addResource(Er,tm({primaryBucket:lr,replicaBucket:kr.replicaBucket}));let sn=Cr.Properties;sn.VersioningConfiguration={Status:"Enabled"},sn.ReplicationConfiguration=rm({replicaBucket:kr.replicaBucket,roleArn:{"Fn::GetAtt":[Er,"Arn"]}})}}if(Ht&&Cr.Properties)Cr.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(br,Cr),Pt.website){let Ir=typeof Pt.website==="object"?Pt.website:{},Er=De.enableWebsiteHosting(Cr,Ir.indexDocument||"index.html",Ir.errorDocument);this.builder.addResource(br,Er)}let xr=this.normalizeMountPath(Pt);if(Ht&&Ee&&w&&!(xr&&ve!=="public")){let Ir=`${l}${f}${ve}CDN`.replace(/[^a-zA-Z0-9]/g,""),Er=[];if(Pt.aliases&&Pt.aliases.length>0)Er.push(...Pt.aliases);else if(ve==="public"){if(Er.push(w),C?.domains?.includes(`www.${w}`))Er.push(`www.${w}`)}else if(ve==="docs")Er.push(`docs.${w}`);else if(ve==="blog")Er.push(`blog.${w}`);let sn=typeof Pt.website==="object"?Pt.website:{},Fn=Pt.spa===!0,bn=sn.errorDocument||(Fn?"index.html":"404.html"),_r=[];if(Fn)_r.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else _r.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${bn}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${bn}`,ErrorCachingMinTTL:300});let Wn=de&&Er.length>0?{AcmCertificateArn:de,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:ce&&Er.length>0?{AcmCertificateArn:{Ref:ce},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},ri=`S3-${l}-${f}-${ve}`,$c=this.mergedConfig.project.region||"us-east-1",li;if(!Fn)li=`${l}${f}${ve}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(li,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${ve}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${l} ${f} ${ve} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
+else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let Rs=[{Id:ri,DomainName:{"Fn::Sub":`\${${br}}.s3.${$c}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}],Qs=[],Dc=[];if(this.shouldRouteStorageBucketToCompute(ve,Pt)){this.appendComputeAppOrigin(Rs,Qs,Dc,l,f,this.resolveComputeCachePathPatterns(Pt.computeRoutes));for(let Or of Ft){let Ba=`S3-${l}-${f}-${Or.name}`,vc=`${l}${f}${Or.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(vc,{Type:"AWS::CloudFront::Function",Properties:{Name:`${l}-${f}-${Or.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${l} ${f} ${Or.name} at ${Or.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode(Or.mountPath,Or.rewriteStyle)}}),Rs.push({Id:Ba,DomainName:{"Fn::Sub":`\${${Or.logicalId}}.s3.${$c}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}),Dc.push(Or.logicalId,vc);for(let Dg of[Or.mountPath,`${Or.mountPath}/*`])Qs.push({PathPattern:Dg,TargetOriginId:Ba,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[vc,"FunctionARN"]}}]})}}let Oa,ku=ri;if(kr){let Or=`${ri}-failover`;Object.assign(Rs[0],kr.primaryConnection),Rs.push({Id:Or,DomainName:em(kr.replicaBucket,kr.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:Ee}}),Oa=Xr({primaryOriginId:ri,secondaryOriginId:Or,statusCodes:kr.statusCodes}),ku=Oa.Items[0].Id}let kc={Type:"AWS::CloudFront::Distribution",DependsOn:[br,Ee,...li?[li]:[],...Dc],Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${ve} site`,DefaultRootObject:"index.html",Origins:Rs,...Oa?{OriginGroups:Oa}:{},DefaultCacheBehavior:{TargetOriginId:ku,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...li?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[li,"FunctionARN"]}}]}:{}},...Qs.length>0?{CacheBehaviors:Qs}:{},...Er.length>0?{Aliases:Er}:{},ViewerCertificate:Wn,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:_r}}};if(ce)kc.DependsOn.push(ce);if(kr)St(kc.Properties.DistributionConfig,`infrastructure.storage.${ve}`),this.storageFailoverReplicas.push({name:ve,primaryBucket:lr,primaryRegion:$c,replicaBucket:kr.replicaBucket,replicaRegion:kr.replicaRegion,replicate:kr.replicate,distributionArnOutput:`${ve}CloudFrontDistributionArn`}),this.builder.addOutput(`${ve}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${Ir}}`},Description:`CloudFront distribution ARN for ${ve} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${ve}FailoverBucketName`,{Value:kr.replicaBucket,Description:`Failover replica bucket for ${ve} (${kr.replicaRegion}), outside this stack`});this.builder.addResource(Ir,kc);let Ig=`${br}CloudFrontPolicy`;if(this.builder.addResource(Ig,{Type:"AWS::S3::BucketPolicy",DependsOn:[br,Ir],Properties:{Bucket:{Ref:br},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${br}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Ir}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(ve,Pt))for(let Or of Ft){let Ba=`${Or.logicalId}CloudFrontPolicy`;this.builder.addResource(Ba,{Type:"AWS::S3::BucketPolicy",DependsOn:[Or.logicalId,Ir],Properties:{Bucket:{Ref:Or.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Or.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Ir}}`}}}}]}}})}if(Er.length>0)v.push({name:ve,bucketLogicalId:br,distLogicalId:Ir,oacLogicalId:Ee,aliases:Er});this.builder.addOutput(`${ve}CloudFrontDomain`,{Value:{"Fn::GetAtt":[Ir,"DomainName"]},Description:`CloudFront domain for ${ve}`}),this.builder.addOutput(`${ve}CloudFrontDistributionId`,{Value:{Ref:Ir},Description:`CloudFront distribution ID for ${ve}`})}if(this.builder.addOutput(`${ve}BucketName`,{Value:{Ref:br},Description:`S3 bucket name for ${ve}`}),ve==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:br},Description:"Frontend S3 bucket name"});if(ve==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:br},Description:"Documentation S3 bucket name"});if(ve==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:br},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let ut=this.mergedConfig.infrastructure.sftp,Ee=zd.create({...ut,storage:this.resolveSftpStorage(ut,l,f)??ut.storage,slug:l,environment:f});for(let[Ft,ve]of Object.entries(Ee.resources))this.builder.addResource(Ft,ve);this.builder.addOutput("SftpServerId",{Value:{Ref:Ee.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${Ee.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:Ee.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(B&&v.length>0)for(let{name:ut,distLogicalId:Ee,aliases:Ft}of v)for(let ve of Ft){let Pt=ve.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Pt}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ee],Properties:{HostedZoneId:B,Name:ve,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ee,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${Pt}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ee],Properties:{HostedZoneId:B,Name:ve,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[Ee,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.databases))if(Ee.engine==="dynamodb"){let{table:Ft,logicalId:ve}=Yt.createTable({slug:l,environment:f,tableName:`${l}-${f}-${ut}`,partitionKey:Ee.partitionKey||{name:"id",type:"S"},sortKey:Ee.sortKey});this.builder.addResource(ve,Ft)}else if(Ee.engine==="postgres"){let{dbInstance:Ft,logicalId:ve}=Yt.createPostgres({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${ut}`,masterUsername:Ee.username||"admin",masterUserPassword:Ee.password||"changeme123",allocatedStorage:Ee.storage||20,dbInstanceClass:Ee.instanceClass||"db.t3.micro"});this.builder.addResource(ve,Ft)}else if(Ee.engine==="mysql"){let{dbInstance:Ft,logicalId:ve}=Yt.createMysql({slug:l,environment:f,dbInstanceIdentifier:`${l}-${f}-${ut}`,masterUsername:Ee.username||"admin",masterUserPassword:Ee.password||"changeme123",allocatedStorage:Ee.storage||20,dbInstanceClass:Ee.instanceClass||"db.t3.micro"});this.builder.addResource(ve,Ft)}}if(this.mergedConfig.infrastructure?.cdn)for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!Ee.origin)continue;let Ft=typeof Ee.customDomain==="string"?Ee.customDomain:Ee.customDomain?.domain||Ee.domain,ve=typeof Ee.customDomain==="object"?Ee.customDomain?.certificateArn:Ee.certificateArn,Pt=ve||de,Ht=`${l}${f}${ut}CDN`.replace(/[^a-zA-Z0-9]/g,""),lr=`S3-${l}-${f}-${ut}-cdn`,Cr=[{Id:lr,DomainName:Ee.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:Ee.originShield?{Enabled:!0,OriginShieldRegion:Ee.originShieldRegion||this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...re(Ee,`infrastructure.cdn.${ut}`)}],br=[],wr=[],kr=["GET","HEAD","OPTIONS"],xr=lr,Ir;if(Ee.failoverOrigin){yt(kr,`the default cache behavior of infrastructure.cdn.${ut}`);let bn=`${lr}-failover`,_r=typeof Ee.failoverOrigin==="string"?{domain:Ee.failoverOrigin}:Ee.failoverOrigin;if(!_r.domain)throw Error(`infrastructure.cdn.${ut}.failoverOrigin.domain is required`);if(_r.domain===Ee.origin)throw Error(`infrastructure.cdn.${ut}: failoverOrigin must differ from origin (both are ${Ee.origin})`);Cr.push({Id:bn,DomainName:_r.domain,OriginPath:_r.originPath||"",...vo(_r.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...re(_r,`infrastructure.cdn.${ut}.failoverOrigin`)}),Ir=Xr({primaryOriginId:lr,secondaryOriginId:bn,statusCodes:Ee.failoverStatusCodes}),xr=Ir.Items[0].Id}else if(Ee.failoverStatusCodes)throw Error(`infrastructure.cdn.${ut}: failoverStatusCodes needs failoverOrigin to fail over to`);if(Ee.routeCompute)this.appendComputeAppOrigin(Cr,br,wr,l,f,this.resolveComputeCachePathPatterns(Ee.computeRoutes));let Er=Pt&&Ft?{AcmCertificateArn:ce&&!ve?{Ref:ce}:Pt,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},sn=[...wr];if(ce&&!ve&&Ft)sn.push(ce);let Fn={Type:"AWS::CloudFront::Distribution",...sn.length>0?{DependsOn:sn}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${l} ${f} ${ut} CDN`,DefaultRootObject:"index.html",Origins:Cr,...Ir?{OriginGroups:Ir}:{},DefaultCacheBehavior:{TargetOriginId:xr,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:kr,CachedMethods:["GET","HEAD","OPTIONS"],Compress:Ee.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...br.length>0?{CacheBehaviors:br}:{},...Ft&&Pt?{Aliases:[Ft]}:{},ViewerCertificate:Er,PriceClass:"PriceClass_100",HttpVersion:Ee.http3?"http2and3":"http2"}}};if(St(Fn.Properties.DistributionConfig,`infrastructure.cdn.${ut}`),this.builder.addResource(Ht,Fn),B&&Ft&&Pt){let bn=Ft.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${bn}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ht,...ce&&!ve?[ce]:[]],Properties:{HostedZoneId:B,Name:Ft,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Ht,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(Ee))continue;let{queue:Ft,logicalId:ve}=G.createQueue({slug:l,environment:f,name:`${l}-${f}-${ut}`,fifo:Ee.fifo,visibilityTimeout:Ee.visibilityTimeout,messageRetentionPeriod:Ee.messageRetentionPeriod,delaySeconds:Ee.delaySeconds,maxMessageSize:Ee.maxMessageSize,receiveMessageWaitTime:Ee.receiveMessageWaitTime,contentBasedDeduplication:Ee.contentBasedDeduplication,encrypted:Ee.encrypted,kmsKeyId:Ee.kmsKeyId});this.builder.addResource(ve,Ft);let Pt;if(Ee.deadLetterQueue){let{deadLetterQueue:Ht,updatedSourceQueue:lr,deadLetterLogicalId:Cr}=G.createDeadLetterQueue(ve,{slug:l,environment:f,maxReceiveCount:Ee.maxReceiveCount});Pt=Cr,this.builder.addResource(Cr,Ht);let wr=this.builder.getResources()[ve];if(wr?.Properties)wr.Properties.RedrivePolicy=lr.Properties?.RedrivePolicy}if(Ee.trigger){let Ht=Ee.trigger,lr=`${l}${f}${Ht.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Cr={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[ve,"Arn"]},FunctionName:{Ref:lr},BatchSize:Ht.batchSize||10,MaximumBatchingWindowInSeconds:Ht.batchWindow||0,Enabled:!0,...Ht.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Ht.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Ht.maxConcurrency}},...Ht.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Ht.filterPattern)}]}}},DependsOn:[ve,lr]};this.builder.addResource(`${ve}Trigger`,Cr)}if(Ee.alarms?.enabled){let Ht=Ee.alarms,lr=Ht.notificationTopicArn;if(!lr&&Ht.notificationEmails?.length){let wr=`${ve}AlarmTopic`;this.builder.addResource(wr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-${ut}-alarms`,DisplayName:`${ut} Queue Alarms`}}),Ht.notificationEmails.forEach((kr,xr)=>{this.builder.addResource(`${wr}Sub${xr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:wr},Protocol:"email",Endpoint:kr}})}),lr={Ref:wr}}let Cr=Ht.queueDepthThreshold||1000;this.builder.addResource(`${ve}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ut}-queue-depth`,AlarmDescription:`Queue ${ut} depth exceeds ${Cr} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Cr,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ve,"QueueName"]}}],...lr&&{AlarmActions:[lr],OKActions:[lr]}}});let br=Ht.messageAgeThreshold||3600;if(this.builder.addResource(`${ve}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ut}-message-age`,AlarmDescription:`Queue ${ut} oldest message exceeds ${br} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:br,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ve,"QueueName"]}}],...lr&&{AlarmActions:[lr],OKActions:[lr]}}}),Pt&&Ht.dlqAlarm!==!1)this.builder.addResource(`${Pt}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-${ut}-dlq-messages`,AlarmDescription:`Dead letter queue for ${ut} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[Pt,"QueueName"]}}],...lr&&{AlarmActions:[lr]}}})}if(Ee.subscribe){let Ht=Ee.subscribe,lr=Ht.topicArn;if(!lr&&Ht.topicName)lr={Ref:Ht.topicName};if(lr){this.builder.addResource(`${ve}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:ve}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[ve,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":lr}}}]}}});let Cr={TopicArn:lr,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[ve,"Arn"]},RawMessageDelivery:Ht.rawMessageDelivery||!1};if(Ht.filterPolicy)Cr.FilterPolicy=Ht.filterPolicy,Cr.FilterPolicyScope=Ht.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${ve}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Cr,DependsOn:`${ve}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(l,f);else this.generateRealtimeResources(l,f);let ct=this.mergedConfig.infrastructure?.redirects;if(ct){let ut=ct.target||this.mergedConfig.infrastructure?.dns?.domain||"",Ee=ct.protocol||"https";if(ct.domains?.length&&ut)for(let Ft of ct.domains){let{bucket:ve,bucketPolicy:Pt,logicalId:Ht,policyLogicalId:lr}=bt.createDomainRedirectBucket({slug:l,environment:f,sourceDomain:Ft,targetDomain:ut,protocol:Ee});this.builder.addResource(Ht,ve),this.builder.addResource(lr,Pt)}if(ct.paths&&Object.keys(ct.paths).length>0){let Ft=bt.fromMapping(ct.paths,{statusCode:ct.statusCode||301}),{function:ve,logicalId:Pt}=bt.createPathRedirectFunction({slug:l,environment:f,rules:Ft});this.builder.addResource(Pt,ve)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[ut,Ee]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:Ft,logicalId:ve}=Ro.createAlarm({slug:l,environment:f,alarmName:`${l}-${f}-${ut}`,metricName:Ee.metricName||"Errors",namespace:Ee.namespace||"AWS/Lambda",threshold:Ee.threshold||1,comparisonOperator:Ee.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(ve,Ft)}let xe=this.mergedConfig.infrastructure?.cache;if(xe){let ut=xe.type||"redis";if(ut==="redis"){this.generateNetworkInfrastructure(l,f);let Ee=xe.redis||{},{replicationGroup:Ft,subnetGroup:ve,logicalId:Pt,subnetGroupId:Ht}=wo.createRedis({slug:l,environment:f,nodeType:Ee.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:Ee.engineVersion||"7.1",port:Ee.port||6379,numCacheClusters:Ee.numCacheNodes||2,automaticFailover:Ee.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:Ee.snapshotRetentionLimit||7,snapshotWindow:Ee.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Pt,Ft),ve&&Ht)this.builder.addResource(Ht,ve);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Pt,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[Pt,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(ut==="memcached"){this.generateNetworkInfrastructure(l,f);let Ee=xe.elasticache||{},{cluster:Ft,subnetGroup:ve,logicalId:Pt,subnetGroupId:Ht}=wo.createMemcached({slug:l,environment:f,nodeType:Ee.nodeType||xe.nodeType||"cache.t3.micro",engineVersion:Ee.engineVersion||"1.6.22",numCacheNodes:Ee.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(Pt,Ft),ve&&Ht)this.builder.addResource(Ht,ve);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[Pt,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let Ut=this.mergedConfig.infrastructure?.email;if(Ut){let ut=Ut.domain||this.mergedConfig.infrastructure?.dns?.domain;if(ut){let{emailIdentity:Ee,logicalId:Ft}=m.verifyDomain({domain:ut,slug:l,environment:f,enableDkim:Ut.enableDkim!==!1,dkimKeyLength:Ut.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(Ft,Ee),Ut.configurationSet!==!1){let{configurationSet:Ht,logicalId:lr}=m.createConfigurationSet({slug:l,environment:f});this.builder.addResource(lr,Ht)}let ve=Ut.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(ve){if(Ut.enableDkim!==!1)for(let wr=1;wr<=3;wr++){let kr=`DkimRecord${wr}${ut.replace(/\./g,"")}`;this.builder.addResource(kr,{Type:"AWS::Route53::RecordSet",DependsOn:[Ft],Properties:{HostedZoneId:ve,Name:{"Fn::GetAtt":[Ft,`DkimDNSTokenName${wr}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[Ft,`DkimDNSTokenValue${wr}`]}]}})}let{record:Ht,logicalId:lr}=m.createSpfRecord(ut,ve);this.builder.addResource(lr,Ht);let{record:Cr,logicalId:br}=m.createDmarcRecord(ut,ve,{policy:"none",reportingEmail:Ut.dmarcReportingEmail||`dmarc-reports@${ut}`});this.builder.addResource(br,Cr)}this.builder.addOutput("EmailDomain",{Value:ut,Description:"SES verified email domain"});let Pt=Ut.server;if(Pt?.enabled&&ve){let Ht=this.mergedConfig.environments[f]?.region||this.mergedConfig.project.region||"us-east-1",lr=`${l}-${f}-email`,{role:Cr,policy:br,roleLogicalId:wr,policyLogicalId:kr}=m.createEmailLambdaRole({slug:l,environment:f,s3BucketArn:`arn:aws:s3:::${lr}`,sesIdentityArn:`arn:aws:ses:${Ht}:*:identity/${ut}`});this.builder.addResource(wr,Cr),this.builder.addResource(kr,br);let{function:xr,permission:Ir,logicalId:Er,permissionLogicalId:sn}=m.createInboundEmailLambda({slug:l,environment:f,roleArn:{"Fn::GetAtt":[wr,"Arn"]},s3BucketName:lr,organizedPrefix:"mailboxes/"});this.builder.addResource(Er,xr),this.builder.addResource(sn,Ir);let Fn=m.createInboundEmailSetup({slug:l,environment:f,domain:ut,s3BucketName:lr,s3KeyPrefix:"inbox/",region:Ht,hostedZoneId:ve,lambdaFunctionArn:{"Fn::GetAtt":[Er,"Arn"]}});for(let[_r,Wn]of Object.entries(Fn.resources)){if(Wn.Type==="AWS::SES::ReceiptRule")Wn.DependsOn=[sn,Er];this.builder.addResource(_r,Wn)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:Er},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:lr,Description:"S3 bucket for email storage"});let bn=this.serverEipLogicalIds.get("app");if(bn&&ve){let Wn=`${Pt?.subdomain||"mail"}.${ut}`,ri=Wn.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${ri}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:ve,Name:Wn,Type:"A",TTL:"300",ResourceRecords:[{Ref:bn}]}})}this.builder.addOutput("MailHost",{Value:`mail.${ut}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let Qt=this.mergedConfig.infrastructure?.search;if(Qt){let ut=Qt.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(ut)this.generateNetworkInfrastructure(l,f);let{domain:Ee,logicalId:Ft}=Zt.createDomain({slug:l,environment:f,engineVersion:Qt.engineVersion||"OpenSearch_2.11",instanceType:Qt.instanceType||"t3.small.search",instanceCount:Qt.instanceCount||1,volumeSize:Qt.volumeSize||10,volumeType:Qt.volumeType||"gp3",dedicatedMaster:Qt.dedicatedMaster||!1,dedicatedMasterType:Qt.dedicatedMasterType,dedicatedMasterCount:Qt.dedicatedMasterCount||3,multiAz:Qt.multiAz||!1,encryption:Qt.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:Qt.advancedSecurity,autoTune:Qt.autoTune!==!1,vpc:ut});this.builder.addResource(Ft,Ee),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[Ft,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[Ft,"Arn"]},Description:"OpenSearch domain ARN"})}let gt=this.mergedConfig.infrastructure?.fileSystem;if(gt&&Object.keys(gt).length>0){this.generateNetworkInfrastructure(l,f);for(let[ut,Ee]of Object.entries(gt)){let{fileSystem:Ft,logicalId:ve}=ze.createFileSystem({slug:`${l}-${ut}`,environment:f,encrypted:Ee.encrypted!==!1,performanceMode:Ee.performanceMode||"generalPurpose",throughputMode:Ee.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(ve,Ft);let{securityGroup:Pt,logicalId:Ht}=ze.createEfsSecurityGroup({slug:`${l}-${ut}`,environment:f,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Ht,Pt);let{mountTargets:lr,logicalIds:Cr}=ze.createMultiAzMountTargets(ve,{slug:`${l}-${ut}`,environment:f,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Ht}});for(let br=0;br<lr.length;br++)this.builder.addResource(Cr[br],lr[br]);this.builder.addOutput(`${ut}FileSystemId`,{Value:{Ref:ve},Description:`EFS file system ID for ${ut}`})}}let lt=this.mergedConfig.infrastructure?.ai;if(lt){let ut=lt.service||"ecs",Ee=lt.models||["*"],Ft=lt.allowStreaming!==!1,ve;if(ut==="ecs")ve=Pe.enableBedrockForEcs({slug:l,environment:f,models:Ee,allowStreaming:Ft});else if(ut==="ec2")ve=Pe.enableBedrockForEc2({slug:l,environment:f,models:Ee,allowStreaming:Ft});else if(ut==="lambda")ve=Pe.enableBedrockForLambda({slug:l,environment:f,models:Ee,allowStreaming:Ft});else ve=Pe.createBedrockRole(ut,{slug:l,environment:f,models:Ee,allowStreaming:Ft});if(this.builder.addResource(ve.logicalId,ve.role),lt.allowAsync){let{policy:Pt,logicalId:Ht}=Pe.createBedrockPolicy({slug:l,environment:f,models:Ee,allowStreaming:Ft,allowAsync:!0});this.builder.addResource(Ht,Pt)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[ve.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(l,f){let C=this.mergedConfig.infrastructure?.realtime;if(!C)return;let A=C.name||`${l}-${f}-realtime`,w=C.scaling||{},B=C.storage||{type:"dynamodb"},v=w.handlerMemory||256,ce=w.handlerTimeout||30,de=`${l}${f}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),ct=`${l}${f}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(B.type==="dynamodb"){let Cr=B.dynamodb||{},br=Cr.billingMode||"PAY_PER_REQUEST";this.builder.addResource(de,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-connections`,BillingMode:br,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}},...Cr.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-connections`},{Key:"Environment",Value:f}]}}),this.builder.addResource(ct,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${l}-${f}-realtime-channels`,BillingMode:br,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...br==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Cr.readCapacity||5,WriteCapacityUnits:Cr.writeCapacity||5}},Tags:[{Key:"Name",Value:`${l}-${f}-realtime-channels`},{Key:"Environment",Value:f}]}})}let xe=`${l}${f}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(xe,{Type:"AWS::IAM::Role",Properties:{RoleName:`${l}-${f}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[de,"Arn"]},{"Fn::Sub":`\${${de}.Arn}/index/*`},{"Fn::GetAtt":[ct,"Arn"]},{"Fn::Sub":`\${${ct}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let Ut=`${l}${f}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),Qt=`${l}${f}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),gt=`${l}${f}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ut,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:de},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[xe,de]}),this.builder.addResource(Qt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:de},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[xe,de,ct]}),this.builder.addResource(gt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${l}-${f}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[xe,"Arn"]},MemorySize:v,Timeout:ce,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:de},CHANNELS_TABLE:{Ref:ct},ENVIRONMENT:f}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[xe,de,ct]});let lt=`${l}${f}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(lt,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:A,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:A,Environment:f}}});let ut=`${Ut}Permission`,Ee=`${Qt}Permission`,Ft=`${gt}Permission`;this.builder.addResource(ut,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Ut},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${lt}}/*/$connect`}}}),this.builder.addResource(Ee,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:Qt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${lt}}/*/$disconnect`}}}),this.builder.addResource(Ft,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:gt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${lt}}/*/$default`}}});let ve=`${lt}ConnectInteg`,Pt=`${lt}DisconnectInteg`,Ht=`${lt}MessageInteg`;this.builder.addResource(ve,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:lt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Ut}.Arn}/invocations`}}}),this.builder.addResource(Pt,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:lt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${Qt}.Arn}/invocations`}}}),this.builder.addResource(Ht,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:lt},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${gt}.Arn}/invocations`}}}),this.builder.addResource(`${lt}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:lt},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${ve}}`}}}),this.builder.addResource(`${lt}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:lt},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${Pt}}`}}}),this.builder.addResource(`${lt}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:lt},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Ht}}`}}});let lr=`${lt}Stage`;if(this.builder.addResource(lr,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:lt},StageName:f,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:w.messagesPerSecond||1000,ThrottlingRateLimit:w.messagesPerSecond||1000}}}),C.monitoring?.enabled){let Cr=C.monitoring,br=Cr.notificationTopicArn;if(!br&&Cr.notificationEmails?.length){let wr=`${lt}AlarmTopic`;this.builder.addResource(wr,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${l}-${f}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Cr.notificationEmails.forEach((kr,xr)=>{this.builder.addResource(`${wr}Sub${xr}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:wr},Protocol:"email",Endpoint:kr}})}),br={Ref:wr}}if(Cr.connectionThreshold)this.builder.addResource(`${lt}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Cr.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Cr.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:lt}}],...br&&{AlarmActions:[br]}}});if(Cr.errorThreshold)this.builder.addResource(`${lt}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${l}-${f}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Cr.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Cr.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:lt}}],...br&&{AlarmActions:[br]}}})}this.builder.addOutput(`${lt}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${lt}}.execute-api.\${AWS::Region}.amazonaws.com/${f}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${lt}Id`,{Description:"WebSocket API ID",Value:{Ref:lt},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
 const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
 const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
 
@@ -219,7 +219,7 @@ ${f.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Mg(l){let f=[],C=[];if(!l.AWSTemplateFormatVersion)f.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(l.AWSTemplateFormatVersion!=="2010-09-09")C.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!l.Resources||Object.keys(l.Resources).length===0)f.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[A,w]of Object.entries(l.Resources))Bg(A,w,f,C);if(l.Resources){let A=zg(l.Resources);if(A.length>0)f.push({path:"Resources",message:`Circular dependencies detected: ${A.join(" -> ")}`,severity:"error"})}if(l.Parameters)for(let[A,w]of Object.entries(l.Parameters))Wg(A,w,f,C);if(l.Outputs)for(let[A,w]of Object.entries(l.Outputs))Vg(A,w,f,C);return{valid:f.length===0,errors:f,warnings:C}}function Bg(l,f,C,A){if(!f.Type)C.push({path:`Resources.${l}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(l))A.push({path:`Resources.${l}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(f.Type&&!f.Type.startsWith("AWS::")&&!f.Type.startsWith("Custom::"))C.push({path:`Resources.${l}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(f.Properties){for(let[w,B]of Object.entries(f.Properties))if(B===void 0||B===null)A.push({path:`Resources.${l}.Properties.${w}`,message:"Property has undefined or null value",severity:"warning"})}if(f.DependsOn){if(typeof f.DependsOn==="string"){if(f.DependsOn===l)C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(f.DependsOn)){if(f.DependsOn.includes(l))C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Wg(l,f,C,A){if(!f.Type)C.push({path:`Parameters.${l}.Type`,message:"Parameter Type is required",severity:"error"});let w=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(f.Type&&!w.includes(f.Type)&&!f.Type.startsWith("AWS::"))A.push({path:`Parameters.${l}.Type`,message:`Uncommon parameter type: ${f.Type}`,severity:"warning"});if(f.NoEcho&&f.Default)A.push({path:`Parameters.${l}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Vg(l,f,C,A){if(!f.Value)C.push({path:`Outputs.${l}.Value`,message:"Output Value is required",severity:"error"})}function zg(l){let f={};for(let[v,ce]of Object.entries(l)){if(f[v]=[],ce.DependsOn){if(typeof ce.DependsOn==="string")f[v].push(ce.DependsOn);else if(Array.isArray(ce.DependsOn))f[v].push(...ce.DependsOn)}let de=Oc(ce);f[v].push(...de)}let C=new Set,A=new Set,w=[];function B(v,ce){C.add(v),A.add(v),ce.push(v);let de=f[v]||[];for(let ct of de)if(!C.has(ct)){if(B(ct,ce))return!0}else if(A.has(ct)){let xe=ce.indexOf(ct);return w.push(...ce.slice(xe),ct),!0}return ce.pop(),A.delete(v),!1}for(let v of Object.keys(f))if(!C.has(v)){if(B(v,[]))return w}return[]}function Oc(l,f=[]){if(typeof l!=="object"||l===null)return f;if(Array.isArray(l)){for(let C of l)Oc(C,f);return f}if(l.Ref&&typeof l.Ref==="string"&&!l.Ref.startsWith("AWS::"))f.push(l.Ref);if(l["Fn::GetAtt"]){let C=l["Fn::GetAtt"];if(Array.isArray(C)&&C.length>0)f.push(C[0])}for(let C of Object.values(l))Oc(C,f);return f}function Hg(l){let f=[],C=[],A=new TextEncoder().encode(l).length,w=51200,B=460800;if(A>51200)if(A>460800)f.push({path:"template",message:`Template size (${A} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else C.push({path:"template",message:`Template size (${A} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:f.length===0,errors:f,warnings:C}}function Ug(l){let f=[],C=[],A=l.Resources?Object.keys(l.Resources).length:0,w=l.Parameters?Object.keys(l.Parameters).length:0,B=l.Outputs?Object.keys(l.Outputs).length:0;if(A>500)f.push({path:"Resources",message:`Template has ${A} resources, exceeding the limit of 500`,severity:"error"});else if(A>200)C.push({path:"Resources",message:`Template has ${A} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(w>200)f.push({path:"Parameters",message:`Template has ${w} parameters, exceeding the limit of 200`,severity:"error"});if(B>200)f.push({path:"Outputs",message:`Template has ${B} outputs, exceeding the limit of 200`,severity:"error"});return{valid:f.length===0,errors:f,warnings:C}}function eR(l){let{domains:f,email:C,staging:A=!1,challengeType:w="http-01",certPath:B="/etc/letsencrypt/live",autoRenew:v=!0}=l,ce=f[0],de=f.map((xe)=>`-d ${xe}`).join(" "),ct=A?"--staging":"";if(w==="http-01")return Gg({domains:f,email:C,staging:A,certPath:B,autoRenew:v,domainFlags:de,stagingFlag:ct,primaryDomain:ce});else{let xe=l.dnsProvider?.provider||(l.hostedZoneId?"route53":void 0);return jg({domains:f,email:C,staging:A,certPath:B,autoRenew:v,domainFlags:de,stagingFlag:ct,primaryDomain:ce,hostedZoneId:l.hostedZoneId,dnsProvider:l.dnsProvider,dnsProviderType:xe})}}function Gg(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:B,primaryDomain:v}=l;return`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Mg(l){let f=[],C=[];if(!l.AWSTemplateFormatVersion)f.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(l.AWSTemplateFormatVersion!=="2010-09-09")C.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!l.Resources||Object.keys(l.Resources).length===0)f.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[A,w]of Object.entries(l.Resources))Bg(A,w,f,C);if(l.Resources){let A=zg(l.Resources);if(A.length>0)f.push({path:"Resources",message:`Circular dependencies detected: ${A.join(" -> ")}`,severity:"error"})}if(l.Parameters)for(let[A,w]of Object.entries(l.Parameters))Wg(A,w,f,C);if(l.Outputs)for(let[A,w]of Object.entries(l.Outputs))Vg(A,w,f,C);return{valid:f.length===0,errors:f,warnings:C}}function Bg(l,f,C,A){if(!f.Type)C.push({path:`Resources.${l}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(l))A.push({path:`Resources.${l}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(f.Type&&!f.Type.startsWith("AWS::")&&!f.Type.startsWith("Custom::"))C.push({path:`Resources.${l}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(f.Properties){for(let[w,B]of Object.entries(f.Properties))if(B===void 0||B===null)A.push({path:`Resources.${l}.Properties.${w}`,message:"Property has undefined or null value",severity:"warning"})}if(f.DependsOn){if(typeof f.DependsOn==="string"){if(f.DependsOn===l)C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(f.DependsOn)){if(f.DependsOn.includes(l))C.push({path:`Resources.${l}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function Wg(l,f,C,A){if(!f.Type)C.push({path:`Parameters.${l}.Type`,message:"Parameter Type is required",severity:"error"});let w=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(f.Type&&!w.includes(f.Type)&&!f.Type.startsWith("AWS::"))A.push({path:`Parameters.${l}.Type`,message:`Uncommon parameter type: ${f.Type}`,severity:"warning"});if(f.NoEcho&&f.Default)A.push({path:`Parameters.${l}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function Vg(l,f,C,A){if(!f.Value)C.push({path:`Outputs.${l}.Value`,message:"Output Value is required",severity:"error"})}function zg(l){let f={};for(let[v,ce]of Object.entries(l)){if(f[v]=[],ce.DependsOn){if(typeof ce.DependsOn==="string")f[v].push(ce.DependsOn);else if(Array.isArray(ce.DependsOn))f[v].push(...ce.DependsOn)}let de=Oc(ce);f[v].push(...de)}let C=new Set,A=new Set,w=[];function B(v,ce){C.add(v),A.add(v),ce.push(v);let de=f[v]||[];for(let ct of de)if(!C.has(ct)){if(B(ct,ce))return!0}else if(A.has(ct)){let xe=ce.indexOf(ct);return w.push(...ce.slice(xe),ct),!0}return ce.pop(),A.delete(v),!1}for(let v of Object.keys(f))if(!C.has(v)){if(B(v,[]))return w}return[]}function Oc(l,f=[]){if(typeof l!=="object"||l===null)return f;if(Array.isArray(l)){for(let C of l)Oc(C,f);return f}if(l.Ref&&typeof l.Ref==="string"&&!l.Ref.startsWith("AWS::"))f.push(l.Ref);if(l["Fn::GetAtt"]){let C=l["Fn::GetAtt"];if(Array.isArray(C)&&C.length>0)f.push(C[0])}for(let C of Object.values(l))Oc(C,f);return f}function Hg(l){let f=[],C=[],A=new TextEncoder().encode(l).length,w=51200,B=460800;if(A>51200)if(A>460800)f.push({path:"template",message:`Template size (${A} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else C.push({path:"template",message:`Template size (${A} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:f.length===0,errors:f,warnings:C}}function Gg(l){let f=[],C=[],A=l.Resources?Object.keys(l.Resources).length:0,w=l.Parameters?Object.keys(l.Parameters).length:0,B=l.Outputs?Object.keys(l.Outputs).length:0;if(A>500)f.push({path:"Resources",message:`Template has ${A} resources, exceeding the limit of 500`,severity:"error"});else if(A>200)C.push({path:"Resources",message:`Template has ${A} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(w>200)f.push({path:"Parameters",message:`Template has ${w} parameters, exceeding the limit of 200`,severity:"error"});if(B>200)f.push({path:"Outputs",message:`Template has ${B} outputs, exceeding the limit of 200`,severity:"error"});return{valid:f.length===0,errors:f,warnings:C}}function tR(l){let{domains:f,email:C,staging:A=!1,challengeType:w="http-01",certPath:B="/etc/letsencrypt/live",autoRenew:v=!0}=l,ce=f[0],de=f.map((xe)=>`-d ${xe}`).join(" "),ct=A?"--staging":"";if(w==="http-01")return jg({domains:f,email:C,staging:A,certPath:B,autoRenew:v,domainFlags:de,stagingFlag:ct,primaryDomain:ce});else{let xe=l.dnsProvider?.provider||(l.hostedZoneId?"route53":void 0);return Kg({domains:f,email:C,staging:A,certPath:B,autoRenew:v,domainFlags:de,stagingFlag:ct,primaryDomain:ce,hostedZoneId:l.hostedZoneId,dnsProvider:l.dnsProvider,dnsProviderType:xe})}}function jg(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:B,primaryDomain:v}=l;return`
 # ==========================================
 # Let's Encrypt Certificate Setup (HTTP-01)
 # ==========================================
@@ -257,7 +257,7 @@ ${A?Nc(v):"# Auto-renewal disabled"}
 
 # Restart the application
 systemctl start stacks
-`}function jg(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:B,primaryDomain:v,hostedZoneId:ce,dnsProvider:de,dnsProviderType:ct}=l;if(ct==="route53"||ce){if(!ce)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
+`}function Kg(l){let{email:f,certPath:C,autoRenew:A,domainFlags:w,stagingFlag:B,primaryDomain:v,hostedZoneId:ce,dnsProvider:de,dnsProviderType:ct}=l;if(ct==="route53"||ce){if(!ce)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via Route53)
 # ==========================================
@@ -289,7 +289,7 @@ else
 fi
 
 ${A?Nc(v):"# Auto-renewal disabled"}
-`}if(!de)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let xe=de.provider.toUpperCase(),Ut=Kg(de);return`
+`}if(!de)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let xe=de.provider.toUpperCase(),Ut=qg(de);return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via ${xe})
 # ==========================================
@@ -312,7 +312,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${qg(de)}
+${Zg(de)}
 
 # Wait for DNS propagation
 echo "Waiting 60 seconds for DNS propagation..."
@@ -331,7 +331,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${Yg(de)}
+${Jg(de)}
 CLEANUPHOOK
 
 chmod +x /etc/letsencrypt/hooks/cleanup-hook.sh
@@ -363,7 +363,7 @@ else
 fi
 
 ${A?Nc(v):"# Auto-renewal disabled"}
-`}function Kg(l){switch(l.provider){case"porkbun":return`
+`}function qg(l){switch(l.provider){case"porkbun":return`
 # Porkbun API credentials
 export PORKBUN_API_KEY="${l.apiKey}"
 export PORKBUN_SECRET_KEY="${l.secretKey}"
@@ -374,7 +374,7 @@ export GODADDY_API_SECRET="${l.apiSecret}"
 export GODADDY_ENV="${l.environment||"production"}"
 `;case"route53":return`
 # Route53 uses IAM role credentials
-`;default:return""}}function qg(l){switch(l.provider){case"porkbun":return`
+`;default:return""}}function Zg(l){switch(l.provider){case"porkbun":return`
 # Extract root domain (last two parts)
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -418,7 +418,7 @@ curl -s -X PATCH "$API_URL/v1/domains/$ROOT_DOMAIN/records" \\
     "data": "'"$VALIDATION"'",
     "ttl": 600
   }]'
-`;default:return'echo "Unsupported DNS provider"'}}function Yg(l){switch(l.provider){case"porkbun":return`
+`;default:return'echo "Unsupported DNS provider"'}}function Jg(l){switch(l.provider){case"porkbun":return`
 # Extract root domain, and the challenge's subdomain the way the auth hook did
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -515,7 +515,7 @@ systemctl enable certbot-renewal.timer
 systemctl start certbot-renewal.timer
 
 echo "Certificate auto-renewal configured"
-`}function tR(l){let{httpPort:f=80,httpsPort:C=443,certPath:A="/etc/ssl/stacks",redirectHttp:w=!0}=l;return`
+`}function rR(l){let{httpPort:f=80,httpsPort:C=443,certPath:A="/etc/ssl/stacks",redirectHttp:w=!0}=l;return`
 // HTTPS Server with Let's Encrypt certificates
 import { existsSync } from 'node:fs'
 
@@ -601,5 +601,5 @@ async function handleRequest(request: Request): Promise<Response> {
   // Implement your request handling here
   return new Response('Hello from Stacks!')
 }
-`}async function Xg(l,f,C){let A=`_acme-challenge.${f}`;if(await Wf(l,f,A,C))return;let w=await l.createRecord(f,{name:A,type:"TXT",content:C,ttl:60});if(!w.success)throw Error(`Failed to create DNS challenge record: ${w.message}`)}async function Qg(l,f,C){let A=await l.deleteRecord(f,{name:`_acme-challenge.${f}`,type:"TXT",content:C});if(!A.success)console.warn(`Failed to delete DNS challenge record: ${A.message}`)}async function Wf(l,f,C,A){try{let w=await l.listRecords(f,"TXT"),B=C.replace(/\.$/,"").toLowerCase();return(w.records??[]).some((v)=>v.name.replace(/\.$/,"").toLowerCase()===B&&v.content.replace(/^"|"$/g,"")===A)}catch{return!1}}function ju(l){let{hostedZoneId:f,dnsProvider:C,region:A="us-east-1"}=l;if(C)return D(C);if(f)return new X(A,f);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function rR(l){await Xg(ju(l),l.domain,l.challengeValue)}async function nR(l){await Qg(ju(l),l.domain,l.challengeValue)}function iR(l){try{let{execSync:f}=Xe("node:child_process"),C=f(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as qu,createSign as Vf,generateKeyPairSync as eg}from"node:crypto";var tg={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class zf{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?tg.staging:tg.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=eg("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let A=this.nonce;return this.nonce=null,A}let l=await this.getDirectory(),C=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!C)throw Error("Failed to get nonce from ACME server");return C}getJwk(){let l=this.accountKey.split(`
-`).filter((B)=>!B.startsWith("-----")).join(""),f=Buffer.from(l,"base64"),C=f.length-65,A=f.subarray(C+1,C+33),w=f.subarray(C+33,C+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(A),y:this.base64UrlEncode(w)}}getJwkThumbprint(){let l=this.getJwk(),f=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),C=qu("sha256").update(f).digest();return this.base64UrlEncode(C)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,f){let C=await this.getNonce(),A=this.getJwk(),w={alg:"ES256",nonce:C,url:l};if(this.accountUrl)w.kid=this.accountUrl;else w.jwk=A;let B=this.base64UrlEncode(JSON.stringify(w)),v=f===""?"":this.base64UrlEncode(JSON.stringify(f)),ce=`${B}.${v}`,de=Vf("SHA256");de.update(ce);let ct=de.sign(this.accountKey),xe=ct.subarray(4,4+ct[3]),Ut=4+ct[3]+2,Qt=ct.subarray(Ut,Ut+ct[Ut-1]),gt=Buffer.alloc(32),lt=Buffer.alloc(32);xe.copy(gt,32-xe.length),Qt.copy(lt,32-Qt.length);let ut=Buffer.concat([gt,lt]);return JSON.stringify({protected:B,payload:v,signature:this.base64UrlEncode(ut)})}async acmeRequest(l,f){let C=await this.signPayload(l,f),A=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:C}),w=A.headers.get("replay-nonce");if(w)this.nonce=w;let B,v=A.headers.get("content-type");if(v?.includes("application/json")||v?.includes("application/problem+json"))B=await A.json();else B=await A.text();if(!A.ok)throw Error(`ACME request failed: ${JSON.stringify(B)}`);return{body:B,headers:A.headers}}async registerAccount(){let l=await this.getDirectory(),{body:f,headers:C}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),A=C.get("location");if(!A)throw Error("No account URL returned");return this.accountUrl=A,A}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let f=await this.getDirectory(),{body:C,headers:A}=await this.acmeRequest(f.newOrder,{identifiers:l.map((B)=>({type:"dns",value:B}))}),w=A.get("location");if(!w)throw Error("No order URL returned");return{orderUrl:w,authorizations:C.authorizations,finalize:C.finalize}}async getAuthorization(l){let{body:f}=await this.acmeRequest(l,""),C=f.identifier.value,A=this.getJwkThumbprint(),w=f.challenges.filter((B)=>B.type==="http-01"||B.type==="dns-01").map((B)=>{let v=`${B.token}.${A}`;if(B.type==="http-01")return{type:"http-01",token:B.token,keyAuthorization:v,identifier:`/.well-known/acme-challenge/${B.token}`};else{let ce=this.base64UrlEncode(qu("sha256").update(v).digest());return{type:"dns-01",token:B.token,keyAuthorization:v,identifier:`_acme-challenge.${C}`,dnsValue:ce}}});return{domain:C,challenges:w}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,f=30){for(let C=0;C<f;C++){let{body:A}=await this.acmeRequest(l,"");if(A.status==="valid")return;if(A.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(A)}`);await new Promise((w)=>setTimeout(w,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:f}=eg("rsa",{modulusLength:2048}),C=f.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,f),privateKey:C}}createSimpleCsr(l,f){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,f){let{csr:C,privateKey:A}=this.generateCsr(f),{body:w}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(C,"base64"))}),B=w.certificate;if(!B)throw Error("Certificate not immediately available - polling not implemented");let ce=await(await fetch(B)).text(),de=ce.split(/(?=-----BEGIN CERTIFICATE-----)/g),ct=de[0],xe=de.slice(1).join("");return{certificate:ct,privateKey:A,chain:xe,fullchain:ce,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var wn=(l)=>l===void 0?void 0:l?"on":"off";function Lc(l){let f={ssl:l.ssl,always_use_https:wn(l.alwaysUseHttps),automatic_https_rewrites:wn(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:wn(l.tls13),brotli:wn(l.brotli),http3:wn(l.http3),"0rtt":wn(l.zeroRtt),early_hints:wn(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:wn(l.alwaysOnline),websockets:wn(l.websockets),email_obfuscation:wn(l.emailObfuscation)};if(l.hsts)f.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let C of Object.keys(f))if(f[C]===void 0)delete f[C];return{...f,...l.raw??{}}}var Ts={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Gf}from"node:tls";async function Fc(l){let{address:f,serverName:C,port:A=443,timeoutMs:w=5000}=l;return new Promise((B)=>{let v=!1,ce=(ct)=>{if(v)return;v=!0;try{de.destroy()}catch{}B(ct)},de=Gf({host:f,port:A,servername:C,rejectUnauthorized:!1,timeout:w});de.once("secureConnect",()=>{if(de.authorized){ce({reachable:!0,trusted:!0});return}ce({reachable:!0,trusted:!1,reason:de.authorizationError?String(de.authorizationError):"origin certificate is not trusted for this hostname"})}),de.once("timeout",()=>{ce({reachable:!1,trusted:!1,reason:`no TLS handshake within ${w}ms`})}),de.once("error",(ct)=>{ce({reachable:!1,trusted:!1,reason:ct.message})})})}function jf(l,f){let C=f.replace(/\.$/,"").toLowerCase();return l.some((A)=>{let w=A.replace(/\.$/,"").toLowerCase();if(w===C)return!0;if(!w.startsWith("*."))return!1;let B=w.slice(2);if(!C.endsWith(`.${B}`))return!1;return!C.slice(0,C.length-B.length-1).includes(".")})}async function Kf(l){let{provider:f,zone:C,hosts:A,ipv4:w,ipv6:B,proxied:v=!0,settings:ce=Ts,cache:de,originGuard:ct,purge:xe=!0,ttl:Ut=300,skipOriginProbe:Qt=!1,skipEdgeCertificateCheck:gt=!1}=l,lt={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(A.length===0)return lt;let ut=[],Ee=v&&!gt?await f.listEdgeCertificateHosts(C):null;for(let ve of A){let Pt=v;if(Pt&&Ee&&!jf(Ee,ve)){Pt=!1;let lr=Ee.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Ee.join(", ")})`;lt.deferredProxy.push({host:ve,reason:lr}),lt.warnings.push(`${ve}: publishing DNS-only — ${lr}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Pt&&!Qt){let lr=await Fc({address:w,serverName:ve});if(!lr.trusted){Pt=!1;let Cr=lr.reason||"origin is not serving a trusted certificate";lt.deferredProxy.push({host:ve,reason:Cr}),lt.warnings.push(`${ve}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Cr}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Pt)ut.push(ve);let Ht=[{type:"A",content:w}];if(B&&Un(ve))Ht.push({type:"AAAA",content:B});for(let{type:lr,content:Cr}of Ht){let br=await f.upsertRecord(C,{name:ve,type:lr,content:Cr,ttl:Ut,proxied:Pt});if(br.success)lt.records.push({host:ve,type:lr,content:Cr,proxied:Pt});else lt.warnings.push(`${ve} ${lr} → ${Cr} failed: ${br.message||"unknown provider error"}`)}}if(ut.length===0){if(v)lt.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return lt}try{let ve=Lc(ce),Pt=await f.applyZoneSettings(C,ve);lt.settingsChanged=Pt.changed;for(let Ht of Pt.failed)lt.warnings.push(`zone setting '${Ht.id}' could not be applied: ${Ht.error}`)}catch(ve){lt.warnings.push(`zone settings could not be read: ${ve instanceof Error?ve.message:String(ve)}`)}let Ft=uc(ut,de);if(Ft.length>0){let ve=await f.putManagedPhaseRules(C,"http_request_cache_settings",Ft);if(ve.success)lt.cacheRules=Ft.length;else lt.warnings.push(`cache rules could not be written: ${ve.message}`)}if(ct){let ve=gc(ut,ct.header,ct.value);if(ve.length>0){let Pt=await f.putManagedPhaseRules(C,"http_request_late_transform",ve);if(Pt.success)lt.originGuard=!0;else lt.warnings.push(`origin guard header could not be written: ${Pt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(xe){if(lt.purged=await f.purgeCache(C,{hosts:ut}),!lt.purged)lt.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return lt}var qf=(l)=>process.env[l];function ng(l,f){let C=l.replace(/\.$/,"").toLowerCase();if(f){let A=f.replace(/\.$/,"").toLowerCase();if(C===A||C.endsWith(`.${A}`))return A}return C.split(".").slice(-2).join(".")}function Zf(l,f={}){let C=f.env??qf,A=l.infrastructure?.compute?.proxy?.cdn,w=[];if(!A||A.provider!=="cloudflare")return{plan:null,errors:w};if(A.originDomain)w.push(`compute.proxy.cdn.originDomain (${A.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let B=C("CLOUDFLARE_API_TOKEN");if(!B)return w.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:w};let v=l.sites??{},ce=A.frontedHosts?.length?[...new Set(A.frontedHosts.map((Qt)=>Qt.toLowerCase()))]:qn(v,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(ce.length===0)return w.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:w};let de=l.infrastructure?.dns?.domain,ct=new Set(ce.map((Qt)=>ng(Qt,de)));if(ct.size>1)return w.push(`Fronted hosts span more than one zone (${[...ct].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:w};let xe=A.cloudflare??{},Ut=A.secret?{header:A.secretHeader??"X-Origin-Verify",value:A.secret}:void 0;return{plan:{zone:[...ct][0],hosts:ce,apiToken:B,zoneId:xe.zoneId??C("CLOUDFLARE_ZONE_ID"),accountId:xe.accountId??C("CLOUDFLARE_ACCOUNT_ID"),proxied:xe.proxied!==!1,settings:xe.settings??Ts,cache:xe.cache,originGuard:Ut,purge:xe.purgeOnDeploy!==!1,skipOriginProbe:xe.skipOriginProbe===!0},errors:w}}var eh=26214400;var th=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class ig{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,f,C){return ac(l,`/accounts/${this.accountId}${f}`,`Bearer ${this.apiToken}`,C)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(f){if(f instanceof Error&&/\b8000007\b|not found/i.test(f.message))return null;throw f}}async ensureProject(l,f="main"){let C=await this.getProject(l);if(C)return C;return this.request("POST","/pages/projects",{name:l,production_branch:f})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,f){let C=await ac("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:f});return new Set(C)}async upsertHashes(l,f){await ac("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:f})}async uploadBatch(l,f){let C=f.map((A)=>({key:A.hash,value:A.base64,metadata:{contentType:nh(A.extension)},base64:!0}));await ac("POST","/pages/assets/upload",`Bearer ${l}`,C)}async createDeployment(l,f,C){let A={};for(let B of f)A[B.path]=B.hash;let w=new FormData;if(w.append("manifest",JSON.stringify(A)),C)w.append("branch",C);return this.request("POST",`/pages/projects/${l}/deployments`,w)}async deployDirectory(l){let f=await sg(l.directory);if(f.length===0)throw Error(`No files to deploy in ${l.directory}`);let C=await this.uploadToken(l.project),A=await this.missingHashes(C,f.map((de)=>de.hash)),w=f.filter((de)=>A.has(de.hash)),B=[];for(let de=0;de<w.length;de+=100)B.push(w.slice(de,de+100));let v=0;for(let de=0;de<B.length;de+=4){let ct=B.slice(de,de+4);await Promise.all(ct.map((xe)=>this.uploadBatch(C,xe))),v+=ct.reduce((xe,Ut)=>xe+Ut.length,0),l.onProgress?.(v,w.length)}return await this.upsertHashes(C,f.map((de)=>de.hash)),{deployment:await this.createDeployment(l.project,f,l.branch),total:f.length,uploaded:w.length,uploadedBytes:w.reduce((de,ct)=>de+ct.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((C)=>C.name)}async attachCustomDomain(l,f){if((await this.listCustomDomains(l)).includes(f))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:f}),!0}}function rh(l,f){return{type:"CNAME",name:l,value:f.endsWith(".pages.dev")?f:`${f}.pages.dev`,ttl:1,proxied:!0}}async function og(l,f){let{blake3:C}=await import("./chunk-7eaech9q.js").then((m)=>aS(m.default,1));return(await C(l+f)).slice(0,32)}async function sg(l){let{readdir:f}=await import("node:fs/promises"),{join:C,relative:A,sep:w}=await import("node:path"),B=[];async function v(ce){let de=await f(ce,{withFileTypes:!0});for(let ct of de){let xe=C(ce,ct.name);if(ct.isDirectory()){await v(xe);continue}if(!ct.isFile())continue;let Ut=`/${A(l,xe).split(w).join("/")}`;if(th.has(Ut))continue;let Qt=await Bun.file(xe).bytes();if(Qt.byteLength>26214400)throw Error(`${Ut} is ${Qt.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let gt=Buffer.from(Qt).toString("base64"),lt=ct.name.lastIndexOf("."),ut=lt>0?ct.name.slice(lt+1):"";B.push({path:Ut,hash:await og(gt,ut),base64:gt,extension:ut,size:Qt.byteLength})}}return await v(l),B.sort((ce,de)=>ce.path.localeCompare(de.path)),B}function nh(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function ac(l,f,C,A){let w={Authorization:C},B;if(A instanceof FormData)B=A;else if(A!==void 0)w["Content-Type"]="application/json",B=JSON.stringify(A);let v=await fetch(`https://api.cloudflare.com/client/v4${f}`,{method:l,headers:w,body:B}),ce=await v.text(),de;try{de=JSON.parse(ce)}catch{throw Error(`Cloudflare Pages API returned ${v.status} with a non-JSON body: ${ce.slice(0,200)}`)}if(!de.success){let ct=(de.errors??[]).map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw Error(`Cloudflare Pages API error (${v.status}): ${ct||ce.slice(0,200)}`)}return de.result}import{createHash as ih}from"node:crypto";var fg="https://api.cloudflare.com/client/v4",hg=10042,oh=10006,sh=10059;class ti extends Error{status;errors;constructor(l,f,C=[]){super(l);this.name="R2ApiError",this.status=f,this.errors=C}hasCode(l){return this.errors.some((f)=>f.code===l)}}class jn extends ti{accountId;constructor(l,f,C=[]){super(`R2 is not enabled on Cloudflare account ${l}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,f,C);this.name="R2NotEnabledError",this.accountId=l}}class Si{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(l){if(!l.apiToken)throw Error("Cloudflare R2 needs an API token");if(!l.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId,this.fetchImpl=l.fetch??((f,C)=>fetch(f,C))}async requestEnvelope(l,f,C,A={}){let w={Authorization:`Bearer ${this.apiToken}`};if(C!==void 0)w["Content-Type"]="application/json";if(A.jurisdiction&&A.jurisdiction!=="default")w["cf-r2-jurisdiction"]=A.jurisdiction;let B=await this.fetchImpl(`${fg}/accounts/${this.accountId}/r2${f}`,{method:l,headers:w,body:C===void 0?void 0:JSON.stringify(C)}),v=await B.text(),ce;try{ce=JSON.parse(v)}catch{throw new ti(`Cloudflare R2 API returned ${B.status} with a non-JSON body: ${v.slice(0,200)}`,B.status)}if(!ce.success){let de=ce.errors??[];if(de.some((xe)=>xe.code===hg))throw new jn(this.accountId,B.status,de);let ct=de.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw new ti(`Cloudflare R2 API error (${B.status}) on ${l} ${f}: ${ct||v.slice(0,200)}`,B.status,de)}return ce}async request(l,f,C,A){return(await this.requestEnvelope(l,f,C,A)).result}bucketPath(l){return`/buckets/${encodeURIComponent(l)}`}async listBuckets(l={}){let f=[],C;do{let A=new URLSearchParams({per_page:"1000"});if(C)A.set("cursor",C);let w=await this.requestEnvelope("GET",`/buckets?${A}`,void 0,l),B=w.result?.buckets??[];f.push(...B),C=B.length>0?w.result_info?.cursor||void 0:void 0}while(C);return f}async getBucket(l,f={}){try{return await this.request("GET",this.bucketPath(l),void 0,f)}catch(C){if(C instanceof jn)throw C;if(C instanceof ti&&(C.hasCode(oh)||C.status===404))return null;throw C}}async ensureBucket(l,f={}){let C={jurisdiction:f.jurisdiction},A=await this.getBucket(l,C);if(A)return{bucket:A,created:!1};let w={name:l};if(f.locationHint)w.locationHint=f.locationHint;let B=await this.request("POST","/buckets",w,C);return{bucket:{...B,name:B?.name||l},created:!0}}async getCors(l,f={}){try{return(await this.request("GET",`${this.bucketPath(l)}/cors`,void 0,f))?.rules??[]}catch(C){if(C instanceof ti&&!(C instanceof jn)&&(C.hasCode(sh)||C.status===404))return[];throw C}}async putCors(l,f,C={}){if(f.length===0){await this.request("DELETE",`${this.bucketPath(l)}/cors`,void 0,C);return}await this.request("PUT",`${this.bucketPath(l)}/cors`,{rules:f},C)}async ensureCors(l,f,C={}){let A=await this.getCors(l,C);if(yc(A,f))return!1;return await this.putCors(l,f,C),!0}async getLifecycle(l,f={}){return(await this.request("GET",`${this.bucketPath(l)}/lifecycle`,void 0,f))?.rules??[]}async putLifecycle(l,f,C={}){await this.request("PUT",`${this.bucketPath(l)}/lifecycle`,{rules:f},C)}async ensureLifecycle(l,f,C={}){let A=await this.getLifecycle(l,C);if(Cc(A,f))return!1;return await this.putLifecycle(l,f,C),!0}async listCustomDomains(l,f={}){return(await this.request("GET",`${this.bucketPath(l)}/domains/custom`,void 0,f))?.domains??[]}async attachCustomDomain(l,f,C={}){return this.request("POST",`${this.bucketPath(l)}/domains/custom`,{domain:f.domain,zoneId:f.zoneId,enabled:f.enabled??!0,minTLS:f.minTLS??"1.2"},C)}async updateCustomDomain(l,f,C,A={}){return this.request("PUT",`${this.bucketPath(l)}/domains/custom/${encodeURIComponent(f)}`,C,A)}async ensureCustomDomain(l,f,C={},A){let w=f.minTLS??"1.2",v=(A??await this.listCustomDomains(l,C)).find((ct)=>ct.domain.toLowerCase()===f.domain.toLowerCase());if(!v){let ct=await this.attachCustomDomain(l,{...f,minTLS:w,enabled:!0},C);return{action:"attached",domain:{...ct,domain:ct?.domain||f.domain}}}let ce=v.minTLS??"1.0";if(v.enabled&&ce===w)return{action:"unchanged",domain:v};let de=await this.updateCustomDomain(l,v.domain,{enabled:!0,minTLS:w},C);return{action:"updated",domain:{...v,...de}}}async getManagedDomain(l,f={}){return this.request("GET",`${this.bucketPath(l)}/domains/managed`,void 0,f)}async setManagedDomain(l,f,C={}){let A=await this.getManagedDomain(l,C);if(A?.enabled===f)return{changed:!1,domain:A};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(l)}/domains/managed`,{enabled:f},C)}}}function yg(l){return`https://${l}.r2.cloudflarestorage.com`}async function ah(l){let{apiToken:f,accountId:C}=l;if(!f)throw Error("r2S3Credentials needs an API token");if(!C)throw Error("r2S3Credentials needs an account id");let A=l.fetch??((v,ce)=>fetch(v,ce)),w=[],B;for(let v of[`/accounts/${C}/tokens/verify`,"/user/tokens/verify"]){let ce=await A(`${fg}${v}`,{method:"GET",headers:{Authorization:`Bearer ${f}`}}),de=await ce.json().catch(()=>null);if(ce.ok&&de?.success&&de.result?.id){B=de.result.id;break}let ct=de?.errors?.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");w.push(`${v} -> ${ce.status}${ct?` (${ct})`:""}`)}if(!B)throw Error(`Could not verify the Cloudflare API token to derive R2 credentials: ${w.join("; ")}`);return{accessKeyId:B,secretAccessKey:ih("sha256").update(f).digest("hex"),endpoint:yg(C),region:"auto"}}function ws(l){if(Array.isArray(l))return`[${l.map(ws).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${ws(A)}`).join(",")}}`;return JSON.stringify(l)}function mg(l,f){let C=(A)=>A&&A.length>0?[...A].map(String).sort():void 0;return{id:f?l.id:void 0,allowed:{origins:C(l.allowed?.origins),methods:C(l.allowed?.methods?.map((A)=>A.toUpperCase())),headers:C(l.allowed?.headers?.map((A)=>A.toLowerCase()))},exposeHeaders:C(l.exposeHeaders?.map((A)=>A.toLowerCase())),maxAgeSeconds:l.maxAgeSeconds}}function yc(l,f){if(l.length!==f.length)return!1;return f.every((C,A)=>{let w=C.id!==void 0;return ws(mg(l[A],w))===ws(mg(C,w))})}function Cc(l,f){if(l.length!==f.length)return!1;let C=(A)=>ws([...A].map((w)=>({...w,storageClassTransitions:w.storageClassTransitions?.length?w.storageClassTransitions:void 0})).sort((w,B)=>w.id.localeCompare(B.id)));return C(l)===C(f)}var ch="r2 cache",lh=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function dh(l,f={}){let C=f.log??(()=>{}),A={buckets:[],warnings:[]},w=l.infrastructure?.r2??l.r2,B=Object.entries(w?.buckets??{});if(B.length===0)return C("R2: no buckets declared, skipping."),A;if(!f.apiToken||!f.accountId){let xe=[!f.apiToken&&"CLOUDFLARE_API_TOKEN",!f.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),Ut=`R2: ${B.length} bucket(s) declared but ${xe} is not set, skipping.`;return C(Ut),A.warnings.push(Ut),A}let v=f.dryRun===!0,ce=new Si({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),de=new M(f.apiToken,{zoneId:f.zoneId,accountId:f.accountId}),ct=new Map;for(let[xe,Ut]of B){let Qt=Ut?.name;if(!Qt||!lh.test(Qt)){A.warnings.push(`R2: bucket '${xe}' has an invalid name '${Qt??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}C(`R2: ${v?"checking":"reconciling"} bucket ${Qt}...`);let gt={name:Qt,changes:[],domains:[]};if(A.buckets.push(gt),await ph(Ut,{r2:ce,cloudflare:de,dryRun:v,summary:gt,warnings:A.warnings,claimed:ct,log:C}),gt.changes.length===0)C(`R2: ${Qt} is in sync.`);else for(let lt of gt.changes)C(`R2: ${Qt}: ${lt}`)}return A}async function ph(l,f){let{r2:C,dryRun:A,summary:w,warnings:B}=f,v=l.name,ce={jurisdiction:l.jurisdiction},de=(gt,lt)=>{let ut=A?lt&&`would ${lt}`:gt;if(ut)w.changes.push(ut)},ct;if(A)ct=await C.getBucket(v,ce)!==null;else{let{created:gt}=await C.ensureBucket(v,{locationHint:l.locationHint,jurisdiction:l.jurisdiction});if(ct=!0,gt)de("created","")}if(!ct)de("","create bucket");let xe=gh(l.customDomains);await Is(f,`cors on ${v}`,async()=>{if(!l.cors)return;if(!ct){de("cors updated","set cors");return}let gt=await C.getCors(v,ce);if(yc(gt,l.cors))return;if(!A)await C.putCors(v,l.cors,ce);de(l.cors.length===0?"cors removed":"cors updated",l.cors.length===0?"remove cors":"update cors")}),await Is(f,`lifecycle on ${v}`,async()=>{if(!l.lifecycle)return;let gt=l.lifecycle.map(Rg);if(ct){let lt=await C.getLifecycle(v,ce);if(Cc(lt,gt))return}if(!A)await C.putLifecycle(v,gt,ce);de("lifecycle updated","update lifecycle")}),await Is(f,`r2.dev URL on ${v}`,async()=>{let gt=l.publicDevUrl===!0;if(!ct){if(gt)de("r2.dev URL enabled","enable r2.dev URL");return}if((await C.getManagedDomain(v,ce))?.enabled===gt)return;if(!A)await C.setManagedDomain(v,gt,ce);de(gt?"r2.dev URL enabled":"r2.dev URL disabled",gt?"enable r2.dev URL":"disable r2.dev URL")});let Ut=[];if(xe.length>0&&ct)try{Ut=await C.listCustomDomains(v,ce)}catch(gt){if(gt instanceof jn)throw gt;B.push(`R2: could not list custom domains on ${v}: ${Bc(gt)}`)}let Qt=new Map;for(let{domain:gt,minTLS:lt}of xe){let ut=f.claimed.get(gt);if(ut&&ut!==v){B.push(`R2: ${gt} is declared on both ${ut} and ${v}; leaving it on ${ut}.`);continue}f.claimed.set(gt,v);let Ee=Ut.find((ve)=>ve.domain.toLowerCase()===gt),Ft=lt??"1.2";if(Ee&&Ee.enabled&&(Ee.minTLS??"1.0")===Ft){if(w.domains.push({domain:gt,status:Mc(Ee)}),Ee.zoneId)Qt.set(gt,Ee.zoneId);continue}await Is(f,`custom domain ${gt} on ${v}`,async()=>{if(Ee){if(!A)await C.updateCustomDomain(v,Ee.domain,{enabled:!0,minTLS:Ft},ce);if(de(`custom domain ${gt} updated`,`update custom domain ${gt}`),w.domains.push({domain:gt,status:Mc({...Ee,enabled:!0})}),Ee.zoneId)Qt.set(gt,Ee.zoneId);return}let ve=await f.cloudflare.zoneIdFor(gt);if(Qt.set(gt,ve),!A)await C.ensureCustomDomain(v,{domain:gt,zoneId:ve,minTLS:Ft},ce,Ut);de(`custom domain ${gt} attached`,`attach custom domain ${gt}`),w.domains.push({domain:gt,status:A?"not attached":"pending"})},()=>w.domains.push({domain:gt,status:"error"}))}if(l.cache&&xe.length>0)await mh(l,xe.map((gt)=>gt.domain).filter((gt)=>f.claimed.get(gt)===v),Qt,f,de)}async function mh(l,f,C,A,w){let B=Cg(l.cache);if(!B||f.length===0)return;let v=new Map;for(let ce of f){let de=C.get(ce);if(!de)try{de=await A.cloudflare.zoneIdFor(ce)}catch(ct){A.warnings.push(`R2: could not resolve the zone for ${ce}, cache rule skipped: ${Bc(ct)}`);continue}v.set(de,[...v.get(de)??[],ce])}for(let ce of v.values()){let de={action:"set_cache_settings",description:`${Lt} ${ch}`,expression:`(${_t(ce)})`,enabled:!0,action_parameters:B};await Is(A,`cache rule for ${ce.join(", ")}`,async()=>{let ct=await A.cloudflare.getPhaseRules(ce[0],"http_request_cache_settings");if(Sg(ct,de))return;if(!A.dryRun){let xe=await A.cloudflare.putManagedPhaseRules(ce[0],"http_request_cache_settings",[de]);if(!xe.success)throw Error(xe.message||"cache rule write failed")}w(`cache rule updated for ${ce.join(", ")}`,`update cache rule for ${ce.join(", ")}`)})}}function Cg(l){if(l.edgeTtl===void 0&&l.browserTtl===void 0)return null;let f={cache:!0};if(l.edgeTtl!==void 0)f.edge_ttl={mode:"override_origin",default:l.edgeTtl};if(l.browserTtl!==void 0)f.browser_ttl={mode:"override_origin",default:l.browserTtl};return f}function Sg(l,f){let C=$t(f.expression),A=_n(f.expression),w=(ce)=>(ce.description||"").startsWith(Lt),B=(ce)=>ce.action===f.action&&ce.description===f.description&&(ce.enabled??!0)===(f.enabled??!0)&&_n(ce.expression)===A&&Sc(ce.action_parameters)===Sc(f.action_parameters),v=!1;for(let ce of l){if(!w(ce))continue;let de=$t(ce.expression);if(!C.some((xe)=>de.includes(xe)))continue;if(B(ce)&&C.every((xe)=>de.includes(xe))&&!v){v=!0;continue}return!1}return v}function Rg(l){let f={id:l.id,enabled:l.enabled??!0,conditions:{prefix:l.prefix??""}};if(l.expireAfterDays!==void 0)f.deleteObjectsTransition={condition:{type:"Age",maxAge:_c(l.expireAfterDays)}};else if(l.expireOn!==void 0)f.deleteObjectsTransition={condition:{type:"Date",date:l.expireOn}};if(l.abortMultipartUploadsAfterDays!==void 0)f.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:_c(l.abortMultipartUploadsAfterDays)}};if(l.infrequentAccessAfterDays!==void 0)f.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:_c(l.infrequentAccessAfterDays)}}];return f}function _c(l){return Math.round(l*86400)}function gh(l){let f=new Set,C=[];for(let A of l??[]){let w=typeof A==="string"?{domain:A}:A,B=w.domain?.trim().replace(/\.$/,"").toLowerCase();if(!B||f.has(B))continue;f.add(B),C.push({domain:B,minTLS:w.minTLS})}return C}function Mc(l){if(!l.enabled)return"disabled";let f=l.status?.ownership,C=l.status?.ssl;if(f==="active"&&C==="active")return"active";for(let A of[f,C])if(A==="error"||A==="blocked"||A==="deactivated")return A;return"pending"}async function Is(l,f,C,A){try{await C()}catch(w){if(w instanceof jn)throw w;l.warnings.push(`R2: ${f} failed: ${Bc(w)}`),A?.()}}function Bc(l){return l instanceof Error?l.message:String(l)}function Sc(l){if(Array.isArray(l))return`[${l.map(Sc).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${Sc(A)}`).join(",")}}`;return JSON.stringify(l)}import{basename as bh,extname as Ah}from"node:path";import{createHash as fh}from"node:crypto";var hh="https://api.cloudflare.com/client/v4",Qn="TS_CLOUD_CONTENT_HASH",Vs="2025-09-01",xl="application/javascript+module",yh=10007,Ch=[1e4,9109];class ls extends Error{status;errors;constructor(l,f,C=[]){super(l);this.name="WorkersApiError",this.status=f,this.errors=C}hasCode(l){return this.errors.some((f)=>f.code===l)}}class Rc extends ls{permission;constructor(l,f,C,A=[]){super(`The Cloudflare API token is missing the "${l}" permission (${f}). Edit the token in the Cloudflare dashboard (My Profile, API Tokens), add it, then re-run the deploy.`,C,A);this.name="WorkersPermissionError",this.permission=l}}class Tc{name="cloudflare-workers";apiToken;accountId;fetchImpl;constructor(l){if(!l.apiToken)throw Error("Cloudflare Workers needs an API token");if(!l.accountId)throw Error("Cloudflare Workers needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId,this.fetchImpl=l.fetch??((f,C)=>fetch(f,C))}async request(l,f,C){let A={Authorization:`Bearer ${this.apiToken}`},w;if(C instanceof FormData)w=C;else if(C!==void 0)A["Content-Type"]="application/json",w=JSON.stringify(C);let B=await this.fetchImpl(`${hh}/accounts/${this.accountId}/workers${f}`,{method:l,headers:A,body:w}),v=await B.text(),ce;try{ce=JSON.parse(v)}catch{throw new ls(`Cloudflare Workers API returned ${B.status} with a non-JSON body: ${v.slice(0,200)}`,B.status)}if(!ce.success){let de=ce.errors??[],ct=de.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");if(Sh(B.status,de))throw new Rc(Rh(f),`${l} ${f} -> ${B.status}${ct?`, ${ct}`:""}`,B.status,de);throw new ls(`Cloudflare Workers API error (${B.status}) on ${l} ${f}: ${ct||v.slice(0,200)}`,B.status,de)}return ce.result}scriptPath(l){return`/scripts/${encodeURIComponent(l)}`}async getSettings(l){try{return await this.request("GET",`${this.scriptPath(l)}/settings`)}catch(f){if(f instanceof Rc)throw f;if(f instanceof ls&&(f.hasCode(yh)||f.status===404))return null;throw f}}async getScript(l){return this.getSettings(l)}async uploadModuleScript(l,f){return this.request("PUT",this.scriptPath(l),Ag(f))}async ensureModuleScript(l,f){let C=qs(f),A=await this.getSettings(l);if(A&&Pc(A,f,C))return{action:"unchanged",hash:C};return await this.uploadModuleScript(l,Tg(f,C)),{action:A?"updated":"created",hash:C}}async listCustomDomains(l={}){let f=new URLSearchParams;if(l.service)f.set("service",l.service);if(l.hostname)f.set("hostname",l.hostname);if(l.zoneId)f.set("zone_id",l.zoneId);let C=f.toString(),A=C?`?${C}`:"";return await this.request("GET",`/domains${A}`)??[]}async attachCustomDomain(l,f){let C={hostname:l,service:f.service,environment:f.environment??"production"};if(f.zoneId)C.zone_id=f.zoneId;return this.request("PUT","/domains",C)}async detachCustomDomain(l){await this.request("DELETE",`/domains/${encodeURIComponent(l)}`)}async ensureCustomDomain(l,f,C){let w=(C??await this.listCustomDomains({hostname:l})).find((v)=>v.hostname.toLowerCase()===l.toLowerCase());if(w&&w.service===f.service)return{action:"unchanged",domain:w};if(w)throw Error(`${l} is attached to the Worker '${w.service}'. Detach it there first (Workers & Pages, ${w.service}, Settings, Domains & Routes); ts-cloud does not move it.`);let B=await this.attachCustomDomain(l,f);return{action:"attached",domain:{...B,hostname:B?.hostname||l}}}}function Sh(l,f){if(f.some((C)=>Ch.includes(C.code)))return!0;return(l===401||l===403)&&f.length===0}function Rh(l){if(l.startsWith("/domains"))return"Workers Routes: Edit (zone, for Workers custom domains) and Workers Scripts: Edit (account)";return"Workers Scripts: Edit (account)"}function Ag(l){if(!l.modules.some((A)=>A.name===l.mainModule))throw Error(`Worker main module '${l.mainModule}' is not one of the uploaded modules`);let f={main_module:l.mainModule,bindings:l.bindings??[],compatibility_date:l.compatibilityDate??Vs,compatibility_flags:l.compatibilityFlags??[],keep_bindings:["secret_text"]},C=new FormData;C.append("metadata",JSON.stringify(f));for(let A of l.modules)C.append(A.name,new Blob([A.content],{type:A.type}),A.name);return C}function qs(l){let f={mainModule:l.mainModule,modules:[...l.modules].sort((C,A)=>C.name.localeCompare(A.name)).map((C)=>({name:C.name,type:C.type,sha256:bg(C.content)})),bindings:[...l.bindings??[]].filter((C)=>C.name!==Qn).sort((C,A)=>C.name.localeCompare(A.name)),compatibilityDate:l.compatibilityDate??Vs,compatibilityFlags:[...l.compatibilityFlags??[]].sort()};return bg(qc(f))}function Tg(l,f=qs(l)){return{...l,bindings:[...(l.bindings??[]).filter((C)=>C.name!==Qn),{type:"plain_text",name:Qn,text:f}]}}function Pc(l,f,C){let A=l.bindings??[],w=A.find((B)=>B.name===Qn&&B.type==="plain_text");if(!w||w.text!==C)return!1;return(f.bindings??[]).every((B)=>{let v=A.find((de)=>de.name===B.name);if(!v||v.type!==B.type)return!1;let ce=B.type==="r2_bucket"?"bucket_name":B.type==="plain_text"?"text":void 0;return!ce||v[ce]===B[ce]})}function bg(l){return fh("sha256").update(l).digest("hex")}function qc(l){if(Array.isArray(l))return`[${l.map(qc).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${qc(A)}`).join(",")}}`;return JSON.stringify(l)}async function $u(l){if(!await Bun.file(l).exists())throw Error(`Worker entry not found: ${l}`);let f;try{f=await Bun.build({entrypoints:[l],target:"browser",format:"esm",minify:!0,external:["cloudflare:*"]})}catch(w){throw Error(`Bundling Worker ${l} failed: ${Th(w)}`)}if(!f.success)throw Error(`Bundling Worker ${l} failed: ${f.logs.map((w)=>String(w.message??w)).join("; ")}`);if(f.outputs.length!==1)throw Error(`Bundling Worker ${l} produced ${f.outputs.length} files (${f.outputs.map((w)=>w.path).join(", ")}); a Worker is uploaded as a single module, so remove the dynamic imports or asset imports that split it.`);let C=f.outputs[0];if(C.kind!=="entry-point")throw Error(`Bundling Worker ${l} produced a ${C.kind} instead of an entry module`);let A=await C.text();return{name:`${bh(l,Ah(l))}.js`,content:A,type:xl,size:new TextEncoder().encode(A).byteLength}}function Th(l){if(l instanceof AggregateError&&l.errors.length>0)return l.errors.map((f)=>f instanceof Error?f.message:String(f?.message??f)).join("; ");return l instanceof Error?l.message:String(l)}import{isAbsolute as Ph,resolve as wh}from"node:path";var Ih="https://api.cloudflare.com/client/v4",Dh=/^[a-z0-9][a-z0-9_-]{0,62}$/;async function vh(l,f={}){let C=f.log??(()=>{}),A={workers:[],warnings:[]},w=Object.entries(l.infrastructure?.workers??l.workers??{});if(w.length===0)return C("Workers: none declared, skipping."),A;if(!f.apiToken||!f.accountId){let ce=[!f.apiToken&&"CLOUDFLARE_API_TOKEN",!f.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),de=`Workers: ${w.length} Worker(s) declared but ${ce} is not set, skipping.`;return C(de),A.warnings.push(de),A}let B=l.infrastructure?.r2??l.r2,v={workers:new Tc({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),r2:new Si({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),cloudflare:new M(f.apiToken,{zoneId:f.zoneId,accountId:f.accountId}),apiToken:f.apiToken,fetch:f.fetch??((ce,de)=>fetch(ce,de)),projectRoot:f.projectRoot??process.cwd(),dryRun:f.dryRun===!0,warnings:A.warnings,log:C,r2ConfigDomains:bS(B),r2Buckets:B,claimed:new Map};for(let[ce,de]of w){let ct=de?.name;if(!ct||!Dh.test(ct)){A.warnings.push(`Workers: '${ce}' has an invalid name '${ct??""}' (1-63 chars: lowercase letters, digits, '-' and '_'), skipping.`);continue}if(!de.entry){A.warnings.push(`Workers: ${ct} has no entry, skipping.`);continue}C(`Workers: ${v.dryRun?"checking":"reconciling"} ${ct}...`);let xe={name:ct,changes:[],domains:[]};A.workers.push(xe),await Eh(de,xe,v);for(let Ut of xe.changes)C(`Workers: ${ct}: ${Ut}`)}return A}async function Eh(l,f,C){let A=l.name,w=Ph(l.entry)?l.entry:wh(C.projectRoot,l.entry),B;try{B=await $u(w)}catch(ce){throw Error(`Worker ${A}: ${gs(ce)}`)}f.changes.push(`bundled ${PS(B.size)}`);let v={mainModule:B.name,modules:[{name:B.name,content:B.content,type:B.type}],bindings:Pg(l,C),compatibilityDate:l.compatibilityDate??Vs,compatibilityFlags:l.compatibilityFlags??[]};if(C.dryRun){let ce=await C.workers.getSettings(A);f.changes.push(ce&&Pc(ce,v,qs(v))?"unchanged":"would upload")}else{let{action:ce}=await C.workers.ensureModuleScript(A,v);f.changes.push(ce==="unchanged"?"unchanged":"uploaded")}for(let ce of TS(l.customDomains))await cS(A,ce,f,C)}async function cS(l,f,C,A){let w=(gt)=>{C.domains.push({domain:f,status:gt})},B=(gt)=>{A.warnings.push(`Workers: ${gt}`),w("conflict")},v=A.claimed.get(f);if(v&&v!==l){B(`${f} is declared on both ${v} and ${l}; leaving it on ${v}.`);return}A.claimed.set(f,l);let ce=A.r2ConfigDomains.get(f);if(ce){B(`${f} is also declared as a custom domain of the R2 bucket '${ce}' (r2.buckets). A hostname serves either a bucket or a Worker. Remove it from the bucket's customDomains and detach it in the dashboard (R2, ${ce}, Settings, Custom Domains) first; to serve the bucket through the Worker, bind it with bindings.r2Buckets instead.`);return}let de=await dS(A);if(de===null){w("error");return}let ct=de.find((gt)=>gt.hostname.toLowerCase()===f);if(ct?.service===l){w("active");return}if(ct){B(`${f} is attached to the Worker '${ct.service}'. Detach it there first (Workers & Pages, ${ct.service}, Settings, Domains & Routes); it is not moved automatically.`);return}let xe=(await CS(A))?.get(f);if(xe){B(`${f} is attached to the R2 bucket '${xe}' as a custom domain. Detach it first (R2, ${xe}, Settings, Custom Domains, then re-run the deploy); it is not detached automatically. To serve the bucket through the Worker, bind it with bindings.r2Buckets.`);return}let Ut;try{Ut=await A.cloudflare.zoneIdFor(f)}catch(gt){A.warnings.push(`Workers: could not resolve the zone for ${f}, not attached: ${gs(gt)}`),w("error");return}let Qt=await RS(A,Ut,f);if(Qt.length>0){let gt=Qt.map((lt)=>`${lt.type} ${lt.content}`).join(", ");B(`${f} already has a DNS record (${gt}). A Worker custom domain creates its own record, so Cloudflare will not attach over it. Delete the record first (DNS, Records), then re-run the deploy; it is not deleted automatically.`);return}if(A.dryRun){C.changes.push(`would attach custom domain ${f}`),w("not attached");return}try{await A.workers.ensureCustomDomain(f,{service:l,zoneId:Ut},de),C.changes.push(`custom domain ${f} attached`),de.push({id:"",hostname:f,service:l,zone_id:Ut}),w("pending")}catch(gt){A.warnings.push(`Workers: custom domain ${f} on ${l} failed: ${gs(gt)}`),w("error")}}async function dS(l){if(l.attached!==void 0)return l.attached;try{l.attached=await l.workers.listCustomDomains()}catch(f){l.warnings.push(`Workers: could not list Worker custom domains, none attached: ${gs(f)}`),l.attached=null}return l.attached}async function CS(l){if(l.r2AccountDomains!==void 0)return l.r2AccountDomains;let f=new Map;try{let C=(await l.r2.listBuckets()).map((A)=>({name:A.name}));for(let A of Object.values(l.r2Buckets?.buckets??{}))if(A.jurisdiction&&A.jurisdiction!=="default")C.push({name:A.name,jurisdiction:A.jurisdiction});for(let A of C){let w=await l.r2.listCustomDomains(A.name,{jurisdiction:A.jurisdiction}).catch(()=>[]);for(let B of w)f.set(B.domain.toLowerCase(),A.name)}l.r2AccountDomains=f}catch(C){l.log(`Workers: could not check R2 custom domains (${gs(C)}); relying on the DNS check.`),l.r2AccountDomains=null}return l.r2AccountDomains}async function RS(l,f,C){try{let A=await l.fetch(`${Ih}/zones/${f}/dns_records?name=${encodeURIComponent(C)}&per_page=100`,{method:"GET",headers:{Authorization:`Bearer ${l.apiToken}`}}),w=await A.json();if(!w?.success)throw Error(`HTTP ${A.status}`);return(w.result??[]).filter((B)=>B.name?.toLowerCase()===C).map((B)=>({type:B.type??"?",content:B.content??""}))}catch(A){return l.log(`Workers: could not read DNS records for ${C} (${gs(A)}); attaching anyway.`),[]}}function Pg(l,f){let C=[],A=new Set,w=(v)=>{if(v===Qn)return f.warnings.push(`Workers: ${l.name}: binding name ${Qn} is reserved for ts-cloud, ignored.`),!1;if(A.has(v))return f.warnings.push(`Workers: ${l.name}: binding ${v} is declared twice; the first one wins.`),!1;return A.add(v),!0},B=new Map;for(let v of Object.values(f.r2Buckets?.buckets??{}))if(v.jurisdiction&&v.jurisdiction!=="default")B.set(v.name,v.jurisdiction);for(let[v,ce]of Object.entries(l.bindings?.r2Buckets??{})){if(!w(v))continue;let de=B.get(ce);C.push(de?{type:"r2_bucket",name:v,bucket_name:ce,jurisdiction:de}:{type:"r2_bucket",name:v,bucket_name:ce})}for(let[v,ce]of Object.entries(l.bindings?.vars??{}))if(w(v))C.push({type:"plain_text",name:v,text:String(ce)});return C}function bS(l){let f=new Map;for(let C of Object.values(l?.buckets??{}))for(let A of C?.customDomains??[]){let w=$g(typeof A==="string"?A:A.domain);if(w)f.set(w,C.name)}return f}function TS(l){return[...new Set((l??[]).map($g).filter(Boolean))]}function $g(l){return(l??"").trim().replace(/\.$/,"").toLowerCase()}function PS(l){if(l<1024)return`${l} B`;if(l<1048576)return`${(l/1024).toFixed(1)} KB`;return`${(l/1024/1024).toFixed(1)} MB`}function gs(l){return l instanceof Error?l.message:String(l)}export{dl as ABTestManager,ge as ACMClient,Sr as ACMDnsValidator,tg as ACME_DIRECTORIES,Pe as AI,ql as API_IDEMPOTENCY_TTL_MS,Gl as API_TOKEN_DEFAULT_TTL_MS,Vl as API_TOKEN_MAX_TTL_MS,rs as API_VERSION,me as AUTHORIZATION_CAPABILITIES,Fl as AUTH_ACTION_TOKEN_TTL_MS,Ul as AUTH_MFA_CHALLENGE_TTL_MS,Ql as AUTH_OIDC_TRANSACTION_TTL_MS,Ye as AUTH_SESSION_ABSOLUTE_TTL_MS,Ml as AUTH_SESSION_IDLE_TTL_MS,YA as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,S as AWSCloudFrontClient,sl as AWSConfigManager,vI as AWS_PSEUDO_PARAMETERS,Ne as AWS_REGIONS,zf as AcmeClient,jr as AlertEvaluator,ki as AlertStore,po as AnomalyConfigStore,Kd as ApiGateway,i as ApiServiceError,oc as ApplicationAutoScalingClient,Yr as Arn,k as AssetHasher,q as Auth,Xi as AuthenticationStore,Li as AutomationApiService,Yi as AutomationIdentityStore,ma as AwsAuroraDataAdapter,Sa as AwsAuroraTransport,$a as AwsDatabaseBackupSource,vr as AwsDriver,fa as AwsElastiCacheDataAdapter,Ia as AwsElastiCacheTransport,wf as AwsIamCapabilityScanner,Ha as AwsInfrastructureBackupSource,pa as AwsRdsDataAdapter,ya as AwsRdsTransport,Ff as AwsRegionalDriver,Va as AwsSecretsManagerConfigurationBackend,Hp as AwsSpendTransport,qa as AwsSsmConfigurationBackend,ps as BackupCoordinator,nl as BackupManager,_a as BackupStore,ef as BatchProcessingManager,Nn as BedrockClient,Pn as BedrockRuntimeClient,Yl as BitbucketSourceAdapter,cl as BlueGreenManager,Vm as BounceComplaintHandler,_m as BuildOptimizationManager,Iu as BunDockerRuntime,Ju as BunDockerVolumeRuntime,Wu as BunFilesystemArchiveRuntime,he as CDN,Bo as CHAIN_HEADER,Lt as CLOUDFLARE_MANAGED_RULE_PREFIX,Gd as CLOUDFRONT_FAILOVER_STATUS_CODES,lC as COMMON_CROSS_ACCOUNT_ROLES,Qn as CONTENT_HASH_BINDING,Ge as CONTROL_PLANE_SCHEMA_VERSION,wo as Cache,Vi as CanaryManager,Bm as CertificateManager,dA as CloudBlockVolumeDriver,js as CloudDriverFactory,We as CloudError,sm as CloudFormationBuilder,h as CloudFormationClient,S as CloudFrontClient,ol as CloudTrailManager,Ie as CloudWatchLogsClient,ig as CloudflarePagesProvider,M as CloudflareProvider,Sy as CommandHistory,z as Communication,Qr as ComposeApplicationService,zt as ComposeApplicationStore,kt as ComprehendClient,a as Compute,Gp as ComputeSpendTransport,Po as ConfigurationError,za as ConfigurationService,Ga as ConfigurationStore,Rn as ConnectClient,Aa as ContainerDataAdapter,ml as ContainerRegistryManager,Qa as ControlPlaneBackupSource,ka as ControlPlaneCleanupDriver,vi as ControlPlaneStore,lo as CounterTracker,Ct as CredentialError,Im as CrossRegionReferenceManager,MA as DASHBOARD_ENTRY,FA as DASHBOARD_PORT_BASE,UA as DASHBOARD_PORT_SPAN,$A as DASHBOARD_STATE_DIR,Qo as DEFAULT_ATTACK_MODE_HOURS,Vs as DEFAULT_COMPATIBILITY_DATE,Nd as DEFAULT_DDOS_THRESHOLDS,zp as DEFAULT_FAILOVER_STATUS_CODES,ud as DEFAULT_METER_MAPPINGS,dd as DEFAULT_PRICE_BOOK,rn as DEFAULT_RECURSION_LIMITS,Gn as DEFAULT_RPX_CERTS_DIR,K as DEFAULT_SERVICE_LIMITS,Od as DEFAULT_STATE_DIR,dg as DEFAULT_STATIC_ASSET_EXTENSIONS,xA as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,CA as DEFAULT_TELEMETRY_POLICY,wp as DEFAULT_THRESHOLDS,iA as DEPLOYMENT_QUEUE_KINDS,ko as DEPTH_HEADER,Vr as DETECTABLE_SIGNALS,fu as DIAGNOSTIC_PRESETS,Zm as DLQMonitoringManager,H as DNS,Hm as DNSSECManager,os as DataServiceLifecycle,ga as DataServiceStore,Yt as Database,Nm as DatabaseUserManager,U as DebugLogger,BA as DependencyGraph,j as Deployment,XA as DeploymentError,il as DisasterRecoveryManager,Mn as DnsProviderFactory,or as DockerDataTransport,oa as DockerDiscoveryAdapter,Ur as DockerNamedVolumeDriver,Ua as DockerVolumeBackupSource,c as DurableOperationQueue,ro as DurableQueueWorker,_e as DynamoDBClient,Br as EC2Client,$e as ECRClient,nt as ECSClient,fr as EFSClient,rc as ELBv2Client,uA as ENFORCEMENT_ACTIONS,Pi as ENFORCEMENT_DESCRIPTIONS,N as ENFORCEMENT_SEVERITY,ep as ENVIRONMENT_LABEL,pu as EcsRuntimeAdapter,Uo as EdgeRateLimiter,st as ElastiCacheClient,m as Email,Km as EmailAdvanced,qm as EmailAnalyticsManager,On as EmailClient,Wm as EmailHandlers,zm as EmailTemplateManager,ba as EncryptedDataSecretStore,ZA as ErrorCodes,pr as EventBridgeClient,Lf as EventBridgeJobAdapter,ja as ExternalConfigurationBackend,To as FAILOVER_REPLICA_POLICY_SID,Ym as FIFOQueueManager,$S as FLY_MACHINES_API,Op as FOCUS_VERSION,Xd as FileCache,ze as FileSystem,Ma as FilesystemBackupSource,Ea as FleetService,Ca as FleetStore,sc as FlyApiError,Dg as FlyClient,e as Fn,Zl as GiteaSourceAdapter,Jl as GithubSourceAdapter,Xl as GitlabSourceAdapter,bm as GlobalResourceManager,Me as GoDaddyProvider,al as GuardDutyManager,pt as HOST_SITES_DIR,ny as HashCache,pf as HealthCheckManager,qe as HealthCheckRunner,Dr as HetznerClient,Te as HetznerDriver,be as IAMClient,hc as IPV6_EXCLUDED_HOST_LABELS,Om as ImageScanningManager,_g as InfrastructureGenerator,Yc as InvalidOperationTransitionError,It as JobLoader,$f as JobProviderReconciler,ua as JobService,da as JobStore,gr as KendraClient,uf as LARAVEL_SERVERLESS_BUILD_STEPS,E as LambdaClient,Mm as LambdaConcurrencyManager,Qm as LambdaDLQManager,Fm as LambdaDestinationsManager,Lm as LambdaLayersManager,mu as LambdaRuntimeAdapter,Um as LambdaVPCManager,$m as LambdaVersionsManager,Cn as LocalEncryptedConfigurationBackend,Fa as LogicalDatabaseBackupSource,ul as LogsManager,Uy as MANAGED_NODE_VERSIONS,Uc as MANAGEMENT_DASHBOARD_SITE,om as MANAGEMENT_DASHBOARD_SITE_PREFIX,Wi as MAX_CONTROL_HOURS,Zc as MAX_CONTROL_PLANE_ERROR_BYTES,bp as MAX_CONTROL_PLANE_JSON_BYTES,oo as METERS,lA as METER_KEYS,gA as MICRO_CENTS,Rp as MIN_PROJECTION_CONFIDENCE,pg as MTA_STS_PORT,Na as MaintenanceService,Pa as MaintenanceStore,ie as Messaging,Rm as MetricsManager,Dm as MigrationManager,fm as MockCloudFormation,Am as MockDynamoDB,hm as MockS3,Ro as Monitoring,vm as MultiAccountManager,Sm as MultiRegionManager,py as MultiStepProgress,y as Network,mf as NetworkSecurityManager,Bi as NotificationRouter,Jp as ORIGIN_CONNECTION_ATTEMPTS,Xp as ORIGIN_CONNECTION_TIMEOUT,Kp as ORIGIN_GROUP_ALLOWED_METHODS,bI as ORIGIN_GROUP_ID_SUFFIX,Wp as ORIGIN_GROUP_SELECTION_CRITERIA,nc as OpenSearchClient,mt as OptimisticConcurrencyError,Tm as OrganizationManager,eh as PAGES_MAX_FILE_BYTES,Jy as PHP_DEFAULT_EXCLUDES,Qy as PHP_LAYER_EXTENSIONS,Zg as PROJECT_LABEL,at as PROXIABLE_RECORD_TYPES,T as ParameterStore,Pm as PerformanceManager,ne as Permissions,ic as PersonalizeClient,Ke as Phone,Jm as PhoneAdvanced,nm as PhoneHandlers,Ta as PlacementService,va as PlacementStore,kn as PollyClient,le as PorkbunProvider,un as PreDeployScanner,tl as PreviewEnvironmentManager,Fr as PreviewEnvironmentService,Ve as PreviewEnvironmentStore,rl as PreviewNotificationService,gy as ProgressBar,ll as ProgressiveDeploymentManager,Ho as ProtectionControlStore,kA as Pseudo,G as Queue,Ti as QueueCancellationError,tf as QueueManagementManager,dI as QueuePresets,to as QueueTimeoutError,ti as R2ApiError,jn as R2NotEnabledError,Si as R2Provider,hg as R2_NOT_ENABLED_ERROR_CODE,Nl as RATE_LIMIT_KEY_SEPARATOR,J as RDSClient,by as RECOMMENDED_ACCOUNT_STRUCTURES,dC as RECOMMENDED_SCPS,Cf as RELEASE_QUEUE_KINDS,hy as REPL,yy as REPLCommandBuilder,Ay as REPLContext,tp as ROLE_LABEL,iy as RateLimiter,lI as RealtimePresets,_p as RecordingSpendTransport,ji as RecursionGuard,bt as Redirects,Cm as RegionPairManager,Ra as RegionService,wa as RegionStore,je as Registry,Bt as RekognitionClient,Et as ReleaseService,Xo as ReleaseStore,Mf as RemoteBuildService,gl as ReplicaManager,ff as ResourceManagementManager,te as RetryableOperationError,I as Route53Client,tc as Route53DomainsClient,X as Route53Provider,Gm as Route53ResolverManager,hl as Route53RoutingManager,ye as RuntimeOperationService,ca as RuntimeStreamRegistry,La as S3BackupDestinationAdapter,o as S3Client,F as S3Error,ru as SECRET_PATTERNS,Bp as SENSITIVITY_THRESHOLDS,ot as SESClient,V as SMS,it as SNSClient,Qp as SPEND_CYCLE_SECONDS,vd as SPEND_GATE_SETTING,wA as SPEND_LEASE_SETTING,ae as SQSClient,we as SSH_BOOTSTRAP_VERSION,si as SSH_PREFLIGHT_SCRIPT,Re as SSMClient,qp as STATE_DIR_ENV_VAR,Ts as STATIC_SITE_ZONE_SETTINGS,qd as STORAGE_FAILOVER_METADATA_KEY,Se as STSClient,Bn as SchedulerClient,Zt as Search,gn as SecretFindingScanner,Ui as Secrets,pl as SecretsManager,W as SecretsManagerClient,km as SecretsRotationManager,b as Security,tr as SecurityHubManager,ln as SecurityPostureStore,vt as SecurityScannerRunner,xm as SecurityScanningManager,jm as SenderReputationManager,_f as ServerCronJobAdapter,ha as ServerDataAdapter,so as ServerPathVolumeDriver,fl as ServiceMeshManager,zd as Sftp,fo as SignalSource,Xm as SmsAdvanced,Ot as SmsClient,im as SmsHandlers,dc as SmsVoiceClient,Yo as SourceConnectionStore,ir as SourceProviderError,Td as SpendCapError,qr as SpendGate,Fp as SpendLoopLease,Io as SpendNotificationRouter,Up as SpendRunner,Wt as SpendService,Ri as SpendStore,my as Spinner,Nr as SshDriver,fn as SshFleetDriver,Em as StackDependencyManager,EI as StacksIntegration,gf as StaticSiteManager,De as Storage,Rl as StorageAdvancedManager,xn as SupportClient,rr as SyntheticsManager,bu as SystemFleetSshTransport,Pr as SystemSshTransport,aa as SystemdDiscoveryAdapter,xo as TRACE_HEADER,fy as TaskList,At as TelemetryStore,Qd as TemplateBuilder,Yd as TemplateCache,xt as TextractClient,Dn as TranscribeClient,ur as TranslateClient,Hf as TransportDisasterRecoveryDriver,Qf as TransportPlatformMaintenanceDriver,as as TransportRemoteBuildDriver,ia as TrivyImageScanner,Jo as TsCloudApiError,jl as TsCloudClient,TA as URGENT_SPEND_EVENTS,Dp as USER_VISIBLE_ACTIONS,Da as UnavailableRegionalDriver,ue as UnifiedDnsValidator,Ys as UnsupportedSchemaVersionError,lm as ValidationError,mr as VoiceClient,io as VolumeService,jt as VolumeStore,xl as WORKER_MODULE_TYPE,ls as WorkersApiError,Rc as WorkersPermissionError,Tc as WorkersProvider,LA as Workflow,wm as XRayManager,Ny as abTestManager,zl as activateImmutableRelease,Xg as addDns01ChallengeRecord,An as addSiteToCloudConfig,wt as ageSeconds,pd as aggregateDeltas,yp as allocateSitePorts,rm as amazonLinuxImageId,_A as amazonLinuxImageParameter,SI as analyzeStackDiff,Ni as anomalyOptionsForSignal,Go as applyControlsToDdos,_l as applyControlsToRateLimits,Bs as applyDeclaredZoneSettings,Wr as applyMitigationFactor,Fh as applyPlan,Ls as applyZoneMigration,Al as artifactKey,yt as assertOriginGroupMethods,Zi as assertReleaseStrategy,bA as assertSpendAllows,Vh as attachConflicts,qh as attachIsViable,Gh as attachPreconditions,au as attachProvenanceToRelease,sa as attachSbomToRelease,su as attachVulnerabilitySummary,If as authEncryptionKeyFile,P as authorizeOrganization,xf as authorizeRuntimePath,Fb as autocomplete,vy as awsConfigManager,zu as backupCredentialStatus,Cy as backupManager,lb as batch,eE as batchProcessingManager,Ko as beginOidcAuthorization,Dy as blueGreenManager,KC as bounceComplaintHandler,ft as budgetWindow,Ya as buildAndPushServerlessImage,nE as buildBunRuntimeLayerZip,Xh as buildCertificatePackScript,Kh as buildCertificateStateScript,Yh as buildCertificateUnpackScript,Wd as buildCloudFormationTemplate,xc as buildCloudInitFirstBoot,nd as buildComposeLogsCommand,aI as buildComposeRuntimeCommand,cI as buildComposeScaleCommand,id as buildComposeShellCommand,fp as buildDrainSourceScript,Nh as buildDrainedSiteScanScript,jd as buildFailoverReplicaPolicyStatement,cr as buildFunctionEnv,mp as buildHealthGateScript,Xn as buildHostCleanupDeployScript,Gs as buildHostCleanupInstallScript,Jn as buildHostCleanupScript,Ci as buildHostSitePortsScript,Ud as buildMailEnv,Ks as buildManagementDashboardArtifact,WS as buildMediaCdnPlan,gg as buildMtaStsPolicy,uh as buildMtaStsServer,rE as buildNodeRuntimeLayerZip,FC as buildOptimizationManager,Vd as buildOriginGroup,Xr as buildOriginGroups,gc as buildOriginGuardRule,ap as buildPauseWorkersScript,aE as buildPhpRuntimeLayerZip,tm as buildReplicationConfiguration,em as buildReplicationRole,up as buildRestoreScript,Y as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Qh as buildSetHostnameScript,Zn as buildSiteDeployScript,lp as buildSnapshotScript,hp as buildSourceStateScript,zn as buildSshArgs,ni as buildSshBootstrapScript,uc as buildStaticSiteCacheRules,ei as buildStaticSiteDeployScript,gp as buildTargetStateScript,Ag as buildUploadForm,cp as buildWorkersStateScript,$u as bundleWorker,du as bytes,Cg as cacheRuleParameters,Py as canaryManager,hn as canonicalJson,Tt as capabilities,ar as capacity,Sb as categorizeChanges,LC as certificateManager,Jh as certificatesMatch,eb as checkIAMPermissions,af as checkInvocation,rb as checkServiceQuotas,sy as chunk,nR as cleanupDns01Challenge,nS as clearSigningKeyCache,ea as cloneSourceBinding,oy as cloudConfigSchema,Fg as cloudDrivers,Ty as cloudTrailManager,sg as collectAssets,$o as collectPhpAppEntries,lg as collectServerDnsDomains,Cp as completeComposeVolumeDeletion,Wo as completeOidcAuthorization,HI as composePresets,eo as composeProjectName,Sl as composeServerlessAppTemplate,DA as compositeSpendTransport,Nt as compressBackup,lS as config,lc as configOrigins,yu as connectionGuidance,Ly as containerRegistryManager,rA as controlPlaneDatabaseFile,Jc as controlPlaneMigrations,NI as createApiBackendPreset,na as createApiV1Handler,SS as createAsgBuildDriver,Ku as createBackupQueueHandlers,Wy as createCliHandler,O as createCloudDriver,Bu as createCloudFrontPolicy,JI as createCredentialProvider,UI as createDashboardSite,_I as createDataPipelinePreset,Su as createDataServiceQueueHandlers,sd as createDeploymentQueueHandlers,D as createDnsProvider,yS as createEcsBuildDriver,wd as createEnforcementHandlers,um as createError,Jd as createExistingStaticFullStackPreset,Cu as createFleetQueueHandlers,PI as createFullStackAppPreset,Fs as createGoDaddyValidator,oE as createHandlers,zy as createHttpHandler,BI as createJamstackPreset,Au as createJobQueueHandlers,MI as createLaravelPreset,LI as createMLApiPreset,Pu as createMaintenanceQueueHandlers,_S as createMediaAccessToken,xI as createMicroservicesPreset,Rb as createMockAWS,wI as createNodeJsServerPreset,RI as createNodeJsServerlessPreset,vs as createObjectStorageClient,Ms as createPorkbunValidator,GI as createPreset,Mo as createPresignedUrl,Yy as createPresignedUrlAsync,Ky as createQueueHandler,OI as createRealtimeAppPreset,vu as createRegionQueueHandlers,ou as createReleaseProvenance,Wl as createReleaseQueueHandlers,hS as createRemoteBuildQueueHandlers,Us as createRoute53Validator,Bf as createRuntimeAdapters,JA as createS3Client,AS as createServerBuildDriver,FI as createServerlessLaravelPreset,DI as createServerlessNodePreset,cg as createSmsInfrastructure,et as createSourceAdapter,TI as createStaticSitePreset,$I as createTraditionalWebAppPreset,od as createVolumeQueueHandlers,kI as createWordPressPreset,Je as createZip,zb as crossRegionReferenceManager,En as dashboardActions,zs as dashboardCredentialsFile,mn as dataServiceCapabilities,OC as databaseUserManager,$l as decodeBase32,Oe as decompressBackup,Yf as decryptBackup,Vo as defaultConfig,mm as defaultLocalConfig,Bl as defaultRateLimitRules,yr as delegateZone,Ns as delegateZoneFromConfig,Gu as deleteFailoverReplicaBuckets,Ja as deleteStaticSite,Hc as deployAllComputeSites,xa as deployServerlessApp,Vu as deploySite,Ws as deploySiteRelease,As as deployStaticSite,Xa as deployStaticSiteFull,vn as deployStaticSiteWithExternalDns,Tn as deployStaticSiteWithExternalDnsFull,kS as deployToFly,Md as deploymentCoexistenceError,QA as deriveManagementDashboardPort,ks as describeDelegation,Ol as describePosture,xs as describeZoneSettings,Of as desiredJobProviderState,kp as detectAnomalies,jp as detectDeploymentTargets,pc as detectDnsProvider,bd as detectLatestAnomaly,YI as detectMisconfigurations,Dl as detectServiceRegion,td as diffCompose,hb as diffTemplates,Zo as discoverGitRefs,zo as discoverOidcProvider,lu as discoverRuntimeInventory,ZC as dlqMonitoringManager,mc as dnsProviders,jC as dnssecManager,Pf as dockerWorkloads,cs as documentDigest,Mc as domainStatus,Ey as drManager,Qe as driverStatePath,uu as ecsWorkloads,qt as effectiveCapabilities,WC as emailAnalyticsManager,XC as emailTemplateManager,Ji as encodeBase32,Xf as encryptBackup,cu as ensureDefaultSecurityPolicies,Uu as ensureFailoverReplicaBuckets,gi as ensureFirewall,fi as ensureManagementDashboard,pi as ensureServer,ui as ensureSshKey,ee as escapeSecLang,fd as evaluateBudget,ai as evaluatePreflight,So as evaluateTelemetryAlertRules,hu as eventBridgeScheduleInput,jy as eventToRequest,yA as ewma,ed as exportCompose,Os as exportRoute53Zone,cm as extendPreset,YC as fifoQueueManager,db as findChangedFiles,vp as findMapping,Ep as findPriceEntry,DS as flyDeployOptions,Ou as flyIpType,vg as flyMachineConfig,mC as formatAccountStructure,jh as formatAttachPlan,kb as formatBytes,zr as formatCents,II as formatDiff,Bh as formatDrainedSiteRefusal,Bb as formatDuration,Qb as formatFlagSuggestions,Vb as formatHistory,qb as formatHistoryStats,Lh as formatInventory,Ob as formatKeyValue,xb as formatList,Mh as formatPlan,di as formatPreflightFindings,Nb as formatProgressBar,Iy as formatRegion,sC as formatRegionList,Tf as formatScanResults,_b as formatSuggestion,Db as formatTable,Gr as formatTimeToExhaustion,Pb as formatTree,jA as fromEC2Metadata,zA as fromECSMetadata,VA as fromEnvironment,qA as fromSharedCredentials,KA as fromWebIdentity,Cl as functionFingerprint,qn as gatewayHostnames,bl as generateAppImageDockerfile,DC as generateApprovalConfig,rf as generateBootstrap,dy as generateCleanupWorkflow,ly as generateCostReportWorkflow,gC as generateCrossAccountRoleCF,nu as generateCycloneDxSbom,TC as generateDeploymentConfig,IC as generateDeploymentPipeline,fC as generateDeploymentWorkflow,Wa as generateExternalDnsStaticSiteTemplate,tR as generateHttpsServerCode,iu as generateImageSbom,eR as generateLetsEncryptUserData,t as generateLogicalId,vC as generateManualPipeline,SC as generateMatrixWorkflow,wC as generateMultiEnvConfig,bC as generateMultiEnvPipeline,hC as generateMultiEnvWorkflow,AC as generatePRPreviewWorkflow,PC as generateParallelConfig,lf as generatePhpFpmConfig,nf as generatePhpLayerDockerfile,CC as generatePreviewPipeline,cy as generatePreviewWorkflow,r as generateResourceName,RC as generateScheduledConfig,EC as generateScheduledPipeline,yC as generateScheduledWorkflow,hs as generateStaticSiteTemplate,x as generateUbuntuAppCloudInit,dm as getAccountId,Xb as getAllRegions,rC as getClosestRegion,Hb as getCommandUsage,nA as getComposeTemplate,Af as getConfig,$b as getContextualHelp,Hi as getCredentials,Ib as getDeploymentStrategy,bb as getDiffStats,Ab as getDiffSummary,ey as getErrorDetails,el as getLocalConfig,Tb as getLocalCredentials,vb as getLocalEndpoint,wb as getLocalEnvVars,nb as getQuotaUsageSummary,uC as getRecommendedStructure,Gi as getRegion,oC as getRegionStats,Zb as getRegionsByCompliance,Yb as getRegionsByLocation,eC as getRegionsByPricingTier,ty as getRequiredPermissions,iS as getSigningKeyCacheSize,ag as getSmsInfrastructureStatus,uI as getTimestamp,Fo as globMatches,Js as globToRegex,Kb as globalResourceManager,Di as governingLimitCents,Qu as grantFailoverReplicaAccess,wy as guardDutyManager,bo as handleSpendRequest,Vn as hasAutoWwwVariant,er as hasManagementDashboardSite,Wc as hasProxyUpstream,sb as hashBuffer,ob as hashDirectory,gm as hashFile,ab as hashManifest,pm as hashString,dE as healthCheckManager,Un as hostAcceptsIpv6,_t as hostCondition,qo as hotp,Hr as hourBucket,AA as hourBucketsBetween,MC as imageScanningManager,us as infraEnvFromOutputs,vl as inspectInvocation,Vy as installRecursionFetch,Ss as invalidateCache,of as invocationContext,OA as isArmInstanceType,Lb as isLikelyTypo,Hn as isLocalDatabase,Eb as isLocalDevelopment,Zr as isManagementDashboardSiteName,hr as isNameserverRegistrar,sS as isNodeCryptoAvailable,Id as isOperationAllowed,yo as isQuietHours,vo as isS3RestEndpoint,Ai as isSafePattern,Ld as isStateDirConfigured,$d as isStatePath,Kr as isValidCidr,tC as isValidRegion,wi as isValidTimeZone,oS as isWebCryptoAvailable,Ar as isZoneHost,pn as jobProviderCapability,Es as keyMatchesFilters,HC as lambdaConcurrencyManager,qC as lambdaDLQManager,GC as lambdaDestinationsManager,UC as lambdaLayersManager,VC as lambdaVPCManager,QC as lambdaVersionsManager,gu as lambdaWorkloads,Tl as laravelServerlessEnvDefaults,Mr as listComposeTemplates,ts as listSourceReferences,Ll as loadCloudConfig,Jt as loadTelemetryPolicy,By as logsManager,Cd as lookbackHoursForSignal,NA as mailEnabled,Fd as mailFirewallPorts,Uf as maintenanceWindowOpen,hf as makeAWSRequest,eS as makeAWSRequestAsync,Zy as makeAWSRequestOnce,Sg as managedRuleInSync,am as managementDashboardSiteName,Tu as manifestDigest,on as matchTotpCounter,BS as mediaObjectHeaders,go as median,Pp as medianAbsoluteDeviation,hd as mergeDecisions,en as mergeInfrastructure,fA as mergePriceBooks,gd as meterTelemetry,kC as metricsManager,rg as migrateObjectStorage,BC as migrationManager,aC as multiAccountManager,jb as multiRegionManager,iR as needsRenewal,lE as networkSecurityManager,Rt as nextScheduleRuns,Ce as normalizePublicIpv6,ke as normalizeRuntimeStatus,tt as normalizeScheduleExpression,Ef as normalizeSourceEvent,Ue as normalizeSshPublicKey,Lp as normalizeTelemetryPolicy,bi as occupiedHostPorts,ra as openApiDocument,ho as optionsForSignal,cC as organizationManager,wl as packagePhpApp,tn as packageServerlessApp,og as pagesAssetHash,rh as pagesDnsRecord,Zd as parallel,ub as parallelMap,gb as parallelWithRetry,Wh as parseCertificateState,El as parseChain,$r as parseCompose,sI as parseComposeCatalog,Df as parseDockerInspect,Xu as parseDotenv,kh as parseDrainedSites,Ei as parseHostSiteFragments,rS as parseJSONResponse,oi as parsePreflightFacts,Ap as parseSourceDrained,Nf as parseSystemdRecords,pp as parseTargetReady,Kc as parseUpstreamPort,dp as parseWorkersPaused,tS as parseXMLResponse,Oi as pathTemplate,jc as pendingSteps,uo as percentOfLimit,xC as performanceManager,Il as phpLayerBuildStage,Hy as phpLayerPackages,nn as phpRuntimeLayerAssets,oI as planComposeTemplateUpgrade,Ad as planEnforcement,sp as planIsDestructive,Vp as planMitigation,Uh as planServerRename,Zh as planSiteMove,_s as planZoneMigration,Mt as policyTag,ci as preflightFailed,ay as previewManager,uy as previewNotifications,Dt as previewSchedule,hA as previousBudgetWindow,ao as priceUsage,pA as priceUsageLines,Oh as probeHostRoutes,Fc as probeOriginTls,fb as processInChunks,eu as processSourceWebhook,is as productionChangeReview,ky as progressiveDeploymentManager,md as projectSpend,Oo as propagationHeaders,Za as providerEndpoint,wu as publicKeyFingerprint,Ln as qualifyName,tE as queueManagementManager,cb as quickHash,yg as r2Endpoint,ah as r2S3Credentials,kl as rateLimitHeaders,Ki as rateLimitKey,He as readDriverState,_h as reconcile,ug as reconcileAddressRecords,Kf as reconcileCloudflareCdn,vh as reconcileCloudflareWorkers,Ps as reconcileDeclaredRecords,fS as reconcileJobObservation,dh as reconcileR2Buckets,dn as reconcileSourceWebhook,ns as recordDashboardHostPosture,gS as recordPreDeploySecretScan,pS as recordSkippedSecretScan,_o as recursionBlockedResponse,Be as redactRuntimeConfig,Pd as redactTelemetryText,xi as redactTelemetryValue,Sn as redeployServerlessApp,Wb as regionPairManager,cn as releaseStrategyCapabilities,bf as releaseTrafficPlan,hi as reloadRpxGateway,Cs as remapKey,Qg as removeDns01ChallengeRecord,yn as removeSiteFromCloudConfig,tu as removeSourceWebhook,fc as removeStaleServerAddressRecords,rd as renderComposeTemplate,$i as renderDdosInstallScript,xd as renderNftablesRuleset,ss as renderServerCron,Bd as renderSysctlFile,Vc as renderWafConfig,yi as renderWafInstallScript,Gc as renewRpxCertificates,Oy as replicaManager,PA as requestHash,yb as requiresReplacement,iE as resetRecursionRuntime,sE as resolveApp,g as resolveAppDatabase,Hh as resolveAttachTarget,Ze as resolveAuthEncryptionKey,fe as resolveCloudProvider,Zf as resolveCloudflareCdnPlan,Do as resolveCredentials,fs as resolveDashboardAction,Qc as resolveDashboardAuth,HA as resolveDashboardDomain,GA as resolveDashboardDomains,Ds as resolveDeclaredRecords,yI as resolveDeployBucketName,Q as resolveDeploymentMode,Yn as resolveExecStart,Eo as resolveFailoverStatusCodes,wc as resolveHetznerApiToken,Rr as resolveHostCleanupConfig,Mi as resolveMailService,QI as resolveManagementDashboardSite,Qi as resolveManagementDashboardSites,ec as resolveObjectStorage,re as resolveOriginConnection,$h as resolvePlan,p as resolveProjectStackName,Lr as resolveProxyUpstreams,yl as resolveQueueNames,sA as resolveQueuedDeploymentCommand,nr as resolveQueues,Gy as resolveRecursionConfig,WA as resolveRegion,oe as resolveRuntimeInventory,Xt as resolveServerlessAppStackName,Hd as resolveServerlessArtifactBucketName,Fi as resolveServerlessAssetBucketName,qi as resolveServerlessRuntime,fI as resolveSiteBucketName,Xs as resolveSiteDeployTarget,u as resolveSiteKind,mI as resolveSiteResourceName,pI as resolveSiteStackName,ii as resolveSshSettings,d as resolveStatePath,hI as resolveStorageBucketName,Yp as resolveStorageFailover,Gt as resolveUiSource,ng as resolveZoneApex,uE as resourceManagementManager,df as responseToResult,Np as robustZScore,Vt as roleCapabilities,Kl as rollbackImmutableRelease,In as rollbackServerlessApp,mA as roundCents,zC as route53ResolverManager,My as route53RoutingManager,xp as routeMatches,rp as routesFromFragments,zi as ruleMatches,Fy as runBuildHooks,yd as runEnforcement,Lo as runPhpBuildHooks,rt as runRemoteCommand,Ae as runtimeId,Le as s3OriginBucket,Zp as s3RegionalDomain,yc as sameCorsRules,Cc as sameLifecycleRules,$n as sameNameservers,ms as sanitizeCloudConfig,s as sanitizeControlPlaneValue,gI as sanitizeName,Hl as sanitizeOidcReturnPath,Rd as saveTelemetryPolicy,vf as scanForSecrets,Xc as scopeContains,ht as scopeKey,Ic as scpUpload,Mb as searchCommands,Zs as searchControlPlane,_y as secretsManager,_C as secretsRotationManager,mS as secureContainerRelease,Ry as securityHubManager,$C as securityScanningManager,se as securityScope,Hu as seedFailoverReplicas,an as sendAuthenticationEmail,JC as senderReputationManager,pb as sequence,Yu as serializeDotenv,mi as serverPublicIpv4,$y as serviceMeshManager,Lu as setAttachToInCloudConfig,dr as setMaintenance,ds as setSitePropertyInCloudConfig,_d as setStateDir,rR as setupDns01Challenge,cc as setupSmsInfrastructure,No as sha256,qy as sharedRecursionGuard,sf as sharedRuntimeLoop,Ip as shipsARelease,FS as signCloudFrontCookies,LS as signCloudFrontUrl,R as signRequest,Pl as signRequestAsync,mo as signalDefinition,_ as siteInstallBase,Ii as siteMoveArchivePath,zh as siteMoveCertArchivePath,zc as siteUnitGlob,Mp as spendNotificationText,Co as spendOpenApiPaths,Tr as sshExec,pe as sshExecOrThrow,Jb as stackDependencyManager,Ka as startLocalDashboardServer,RA as startSpendLoop,Jr as stateDir,L as statePath,cE as staticSiteManager,Xy as storageAdvancedManager,CI as storageFailoverReplicasFromTemplate,SA as streamFocusJsonl,Sd as strongestActiveAction,ym as suggestCommand,Ub as suggestFlags,tb as suggestIAMPolicy,ib as suggestQuotaIncrease,iC as suggestRegionPairs,nC as suggestRegions,es as syncSourceRepositories,ad as synchronizeComposeVolumes,Zu as synchronizeConfiguredConfiguration,la as synchronizeConfiguredJobs,xy as syntheticsManager,kd as sysctlHardening,kf as systemdWorkloads,vA as telemetryBucketLabel,_i as telemetryCursor,Dd as telemetryEstimatedMonthlyCost,EA as telemetryPercentile,$p as telemetryPolicyKey,ry as templateCache,np as tenantsOf,ta as testSourceConnection,cd as tieredMicroCents,Rg as toApiLifecycleRule,Lc as toCloudflareZoneSettings,Ao as toFocusJsonl,Ed as toFocusRecords,xh as toInventoryServer,yf as totp,jo as totpUri,ip as unaccountedSites,Rf as unsupportedCapabilities,oA as unsupportedVolumeCapabilities,Du as updateCompatibility,Nu as updateSiteInCloudConfig,ys as uploadStaticFiles,Tp as usageDeltaKey,Kt as utcInstantOfLocal,pC as validateAccountStructure,Cb as validateAgainstSchema,cA as validateAttachment,Jf as validateBackupDestination,Gb as validateCommand,XI as validateConfiguration,ZI as validateCredentials,Sp as validateDeploymentConfig,aA as validateMountPath,St as validateOriginGroups,Ug as validateResourceLimits,op as validateServerName,Mg as validateTemplate,Hg as validateTemplateSize,Ac as verifyAddressRecord,uS as verifyArtifactSignature,MS as verifyMediaAccessToken,Sf as verifyTotp,Ru as verifyUpdateSignature,$s as verifyZoneParity,no as volumeCapabilities,Jg as wafEventTelemetry,bc as waitForCloudInit,Kn as waitForSsh,sr as webhookEndpoint,KI as withCDN,zI as withCache,Tg as withContentHash,jI as withDatabase,cf as withInvocation,VI as withMonitoring,WI as withQueue,qI as withSecurity,mb as withTimeout,Pg as workerBindings,qs as workerContentHash,Pc as workerInSync,Z as wrapCloudInitUserData,dt as writeDriverState,NC as xrayManager,Eu as zeroCapacity,IA as zeroFill,ld as zoneOffsetMs,co as zonedParts};
+`}async function Yg(l,f,C){let A=`_acme-challenge.${f}`;if(await Wf(l,f,A,C))return;let w=await l.createRecord(f,{name:A,type:"TXT",content:C,ttl:60});if(!w.success)throw Error(`Failed to create DNS challenge record: ${w.message}`)}async function Qg(l,f,C){let A=await l.deleteRecord(f,{name:`_acme-challenge.${f}`,type:"TXT",content:C});if(!A.success)console.warn(`Failed to delete DNS challenge record: ${A.message}`)}async function Wf(l,f,C,A){try{let w=await l.listRecords(f,"TXT"),B=C.replace(/\.$/,"").toLowerCase();return(w.records??[]).some((v)=>v.name.replace(/\.$/,"").toLowerCase()===B&&v.content.replace(/^"|"$/g,"")===A)}catch{return!1}}function ju(l){let{hostedZoneId:f,dnsProvider:C,region:A="us-east-1"}=l;if(C)return D(C);if(f)return new X(A,f);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function nR(l){await Yg(ju(l),l.domain,l.challengeValue)}async function iR(l){await Qg(ju(l),l.domain,l.challengeValue)}function oR(l){try{let{execSync:f}=Xe("node:child_process"),C=f(`openssl x509 -checkend 2592000 -noout -in ${l}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as qu,createSign as Vf,generateKeyPairSync as eg}from"node:crypto";var tg={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class zf{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(l){this.directoryUrl=l.staging?tg.staging:tg.production,this.email=l.email,this.accountKey=l.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:l}=eg("ec",{namedCurve:"P-256"});return l.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let l=await fetch(this.directoryUrl);if(!l.ok)throw Error(`Failed to fetch ACME directory: ${l.status}`);return this.directory=await l.json(),this.directory}async getNonce(){if(this.nonce){let A=this.nonce;return this.nonce=null,A}let l=await this.getDirectory(),C=(await fetch(l.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!C)throw Error("Failed to get nonce from ACME server");return C}getJwk(){let l=this.accountKey.split(`
+`).filter((B)=>!B.startsWith("-----")).join(""),f=Buffer.from(l,"base64"),C=f.length-65,A=f.subarray(C+1,C+33),w=f.subarray(C+33,C+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(A),y:this.base64UrlEncode(w)}}getJwkThumbprint(){let l=this.getJwk(),f=JSON.stringify({crv:l.crv,kty:l.kty,x:l.x,y:l.y}),C=qu("sha256").update(f).digest();return this.base64UrlEncode(C)}base64UrlEncode(l){return(typeof l==="string"?Buffer.from(l):l).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(l,f){let C=await this.getNonce(),A=this.getJwk(),w={alg:"ES256",nonce:C,url:l};if(this.accountUrl)w.kid=this.accountUrl;else w.jwk=A;let B=this.base64UrlEncode(JSON.stringify(w)),v=f===""?"":this.base64UrlEncode(JSON.stringify(f)),ce=`${B}.${v}`,de=Vf("SHA256");de.update(ce);let ct=de.sign(this.accountKey),xe=ct.subarray(4,4+ct[3]),Ut=4+ct[3]+2,Qt=ct.subarray(Ut,Ut+ct[Ut-1]),gt=Buffer.alloc(32),lt=Buffer.alloc(32);xe.copy(gt,32-xe.length),Qt.copy(lt,32-Qt.length);let ut=Buffer.concat([gt,lt]);return JSON.stringify({protected:B,payload:v,signature:this.base64UrlEncode(ut)})}async acmeRequest(l,f){let C=await this.signPayload(l,f),A=await fetch(l,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:C}),w=A.headers.get("replay-nonce");if(w)this.nonce=w;let B,v=A.headers.get("content-type");if(v?.includes("application/json")||v?.includes("application/problem+json"))B=await A.json();else B=await A.text();if(!A.ok)throw Error(`ACME request failed: ${JSON.stringify(B)}`);return{body:B,headers:A.headers}}async registerAccount(){let l=await this.getDirectory(),{body:f,headers:C}=await this.acmeRequest(l.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),A=C.get("location");if(!A)throw Error("No account URL returned");return this.accountUrl=A,A}async createOrder(l){if(!this.accountUrl)await this.registerAccount();let f=await this.getDirectory(),{body:C,headers:A}=await this.acmeRequest(f.newOrder,{identifiers:l.map((B)=>({type:"dns",value:B}))}),w=A.get("location");if(!w)throw Error("No order URL returned");return{orderUrl:w,authorizations:C.authorizations,finalize:C.finalize}}async getAuthorization(l){let{body:f}=await this.acmeRequest(l,""),C=f.identifier.value,A=this.getJwkThumbprint(),w=f.challenges.filter((B)=>B.type==="http-01"||B.type==="dns-01").map((B)=>{let v=`${B.token}.${A}`;if(B.type==="http-01")return{type:"http-01",token:B.token,keyAuthorization:v,identifier:`/.well-known/acme-challenge/${B.token}`};else{let ce=this.base64UrlEncode(qu("sha256").update(v).digest());return{type:"dns-01",token:B.token,keyAuthorization:v,identifier:`_acme-challenge.${C}`,dnsValue:ce}}});return{domain:C,challenges:w}}async respondToChallenge(l){await this.acmeRequest(l,{})}async waitForAuthorization(l,f=30){for(let C=0;C<f;C++){let{body:A}=await this.acmeRequest(l,"");if(A.status==="valid")return;if(A.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(A)}`);await new Promise((w)=>setTimeout(w,2000))}throw Error("Authorization timed out")}generateCsr(l){let{privateKey:f}=eg("rsa",{modulusLength:2048}),C=f.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(l,f),privateKey:C}}createSimpleCsr(l,f){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(l,f){let{csr:C,privateKey:A}=this.generateCsr(f),{body:w}=await this.acmeRequest(l,{csr:this.base64UrlEncode(Buffer.from(C,"base64"))}),B=w.certificate;if(!B)throw Error("Certificate not immediately available - polling not implemented");let ce=await(await fetch(B)).text(),de=ce.split(/(?=-----BEGIN CERTIFICATE-----)/g),ct=de[0],xe=de.slice(1).join("");return{certificate:ct,privateKey:A,chain:xe,fullchain:ce,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var wn=(l)=>l===void 0?void 0:l?"on":"off";function Lc(l){let f={ssl:l.ssl,always_use_https:wn(l.alwaysUseHttps),automatic_https_rewrites:wn(l.automaticHttpsRewrites),min_tls_version:l.minTlsVersion,tls_1_3:wn(l.tls13),brotli:wn(l.brotli),http3:wn(l.http3),"0rtt":wn(l.zeroRtt),early_hints:wn(l.earlyHints),browser_cache_ttl:l.browserCacheTtl,always_online:wn(l.alwaysOnline),websockets:wn(l.websockets),email_obfuscation:wn(l.emailObfuscation)};if(l.hsts)f.security_header={strict_transport_security:{enabled:l.hsts.enabled,max_age:l.hsts.maxAge??31536000,include_subdomains:l.hsts.includeSubdomains??!1,preload:l.hsts.preload??!1,nosniff:l.hsts.noSniff??!0}};for(let C of Object.keys(f))if(f[C]===void 0)delete f[C];return{...f,...l.raw??{}}}var Ts={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as jf}from"node:tls";async function Fc(l){let{address:f,serverName:C,port:A=443,timeoutMs:w=5000}=l;return new Promise((B)=>{let v=!1,ce=(ct)=>{if(v)return;v=!0;try{de.destroy()}catch{}B(ct)},de=jf({host:f,port:A,servername:C,rejectUnauthorized:!1,timeout:w});de.once("secureConnect",()=>{if(de.authorized){ce({reachable:!0,trusted:!0});return}ce({reachable:!0,trusted:!1,reason:de.authorizationError?String(de.authorizationError):"origin certificate is not trusted for this hostname"})}),de.once("timeout",()=>{ce({reachable:!1,trusted:!1,reason:`no TLS handshake within ${w}ms`})}),de.once("error",(ct)=>{ce({reachable:!1,trusted:!1,reason:ct.message})})})}function Kf(l,f){let C=f.replace(/\.$/,"").toLowerCase();return l.some((A)=>{let w=A.replace(/\.$/,"").toLowerCase();if(w===C)return!0;if(!w.startsWith("*."))return!1;let B=w.slice(2);if(!C.endsWith(`.${B}`))return!1;return!C.slice(0,C.length-B.length-1).includes(".")})}async function qf(l){let{provider:f,zone:C,hosts:A,ipv4:w,ipv6:B,proxied:v=!0,settings:ce=Ts,cache:de,originGuard:ct,purge:xe=!0,ttl:Ut=300,skipOriginProbe:Qt=!1,skipEdgeCertificateCheck:gt=!1}=l,lt={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(A.length===0)return lt;let ut=[],Ee=v&&!gt?await f.listEdgeCertificateHosts(C):null;for(let ve of A){let Pt=v;if(Pt&&Ee&&!Kf(Ee,ve)){Pt=!1;let lr=Ee.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Ee.join(", ")})`;lt.deferredProxy.push({host:ve,reason:lr}),lt.warnings.push(`${ve}: publishing DNS-only — ${lr}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Pt&&!Qt){let lr=await Fc({address:w,serverName:ve});if(!lr.trusted){Pt=!1;let Cr=lr.reason||"origin is not serving a trusted certificate";lt.deferredProxy.push({host:ve,reason:Cr}),lt.warnings.push(`${ve}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Cr}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Pt)ut.push(ve);let Ht=[{type:"A",content:w}];if(B&&Un(ve))Ht.push({type:"AAAA",content:B});for(let{type:lr,content:Cr}of Ht){let br=await f.upsertRecord(C,{name:ve,type:lr,content:Cr,ttl:Ut,proxied:Pt});if(br.success)lt.records.push({host:ve,type:lr,content:Cr,proxied:Pt});else lt.warnings.push(`${ve} ${lr} → ${Cr} failed: ${br.message||"unknown provider error"}`)}}if(ut.length===0){if(v)lt.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return lt}try{let ve=Lc(ce),Pt=await f.applyZoneSettings(C,ve);lt.settingsChanged=Pt.changed;for(let Ht of Pt.failed)lt.warnings.push(`zone setting '${Ht.id}' could not be applied: ${Ht.error}`)}catch(ve){lt.warnings.push(`zone settings could not be read: ${ve instanceof Error?ve.message:String(ve)}`)}let Ft=uc(ut,de);if(Ft.length>0){let ve=await f.putManagedPhaseRules(C,"http_request_cache_settings",Ft);if(ve.success)lt.cacheRules=Ft.length;else lt.warnings.push(`cache rules could not be written: ${ve.message}`)}if(ct){let ve=gc(ut,ct.header,ct.value);if(ve.length>0){let Pt=await f.putManagedPhaseRules(C,"http_request_late_transform",ve);if(Pt.success)lt.originGuard=!0;else lt.warnings.push(`origin guard header could not be written: ${Pt.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(xe){if(lt.purged=await f.purgeCache(C,{hosts:ut}),!lt.purged)lt.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return lt}var Jf=(l)=>process.env[l];function ng(l,f){let C=l.replace(/\.$/,"").toLowerCase();if(f){let A=f.replace(/\.$/,"").toLowerCase();if(C===A||C.endsWith(`.${A}`))return A}return C.split(".").slice(-2).join(".")}function eh(l,f={}){let C=f.env??Jf,A=l.infrastructure?.compute?.proxy?.cdn,w=[];if(!A||A.provider!=="cloudflare")return{plan:null,errors:w};if(A.originDomain)w.push(`compute.proxy.cdn.originDomain (${A.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let B=C("CLOUDFLARE_API_TOKEN");if(!B)return w.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:w};let v=l.sites??{},ce=A.frontedHosts?.length?[...new Set(A.frontedHosts.map((Qt)=>Qt.toLowerCase()))]:qn(v,{autoWww:l.infrastructure?.compute?.proxy?.autoWww!==!1});if(ce.length===0)return w.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:w};let de=l.infrastructure?.dns?.domain,ct=new Set(ce.map((Qt)=>ng(Qt,de)));if(ct.size>1)return w.push(`Fronted hosts span more than one zone (${[...ct].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:w};let xe=A.cloudflare??{},Ut=A.secret?{header:A.secretHeader??"X-Origin-Verify",value:A.secret}:void 0;return{plan:{zone:[...ct][0],hosts:ce,apiToken:B,zoneId:xe.zoneId??C("CLOUDFLARE_ZONE_ID"),accountId:xe.accountId??C("CLOUDFLARE_ACCOUNT_ID"),proxied:xe.proxied!==!1,settings:xe.settings??Ts,cache:xe.cache,originGuard:Ut,purge:xe.purgeOnDeploy!==!1,skipOriginProbe:xe.skipOriginProbe===!0},errors:w}}var th=26214400;var rh=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class ig{name="cloudflare-pages";apiToken;accountId;constructor(l){if(!l.apiToken)throw Error("Cloudflare Pages needs an API token");if(!l.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId}async request(l,f,C){return ac(l,`/accounts/${this.accountId}${f}`,`Bearer ${this.apiToken}`,C)}async getProject(l){try{return await this.request("GET",`/pages/projects/${l}`)}catch(f){if(f instanceof Error&&/\b8000007\b|not found/i.test(f.message))return null;throw f}}async ensureProject(l,f="main"){let C=await this.getProject(l);if(C)return C;return this.request("POST","/pages/projects",{name:l,production_branch:f})}async uploadToken(l){return(await this.request("GET",`/pages/projects/${l}/upload-token`)).jwt}async missingHashes(l,f){let C=await ac("POST","/pages/assets/check-missing",`Bearer ${l}`,{hashes:f});return new Set(C)}async upsertHashes(l,f){await ac("POST","/pages/assets/upsert-hashes",`Bearer ${l}`,{hashes:f})}async uploadBatch(l,f){let C=f.map((A)=>({key:A.hash,value:A.base64,metadata:{contentType:ih(A.extension)},base64:!0}));await ac("POST","/pages/assets/upload",`Bearer ${l}`,C)}async createDeployment(l,f,C){let A={};for(let B of f)A[B.path]=B.hash;let w=new FormData;if(w.append("manifest",JSON.stringify(A)),C)w.append("branch",C);return this.request("POST",`/pages/projects/${l}/deployments`,w)}async deployDirectory(l){let f=await sg(l.directory);if(f.length===0)throw Error(`No files to deploy in ${l.directory}`);let C=await this.uploadToken(l.project),A=await this.missingHashes(C,f.map((de)=>de.hash)),w=f.filter((de)=>A.has(de.hash)),B=[];for(let de=0;de<w.length;de+=100)B.push(w.slice(de,de+100));let v=0;for(let de=0;de<B.length;de+=4){let ct=B.slice(de,de+4);await Promise.all(ct.map((xe)=>this.uploadBatch(C,xe))),v+=ct.reduce((xe,Ut)=>xe+Ut.length,0),l.onProgress?.(v,w.length)}return await this.upsertHashes(C,f.map((de)=>de.hash)),{deployment:await this.createDeployment(l.project,f,l.branch),total:f.length,uploaded:w.length,uploadedBytes:w.reduce((de,ct)=>de+ct.size,0)}}async listCustomDomains(l){return(await this.request("GET",`/pages/projects/${l}/domains`)).map((C)=>C.name)}async attachCustomDomain(l,f){if((await this.listCustomDomains(l)).includes(f))return!1;return await this.request("POST",`/pages/projects/${l}/domains`,{name:f}),!0}}function nh(l,f){return{type:"CNAME",name:l,value:f.endsWith(".pages.dev")?f:`${f}.pages.dev`,ttl:1,proxied:!0}}async function og(l,f){let{blake3:C}=await import("./chunk-rpng90t9.js").then((m)=>cS(m.default,1));return(await C(l+f)).slice(0,32)}async function sg(l){let{readdir:f}=await import("node:fs/promises"),{join:C,relative:A,sep:w}=await import("node:path"),B=[];async function v(ce){let de=await f(ce,{withFileTypes:!0});for(let ct of de){let xe=C(ce,ct.name);if(ct.isDirectory()){await v(xe);continue}if(!ct.isFile())continue;let Ut=`/${A(l,xe).split(w).join("/")}`;if(rh.has(Ut))continue;let Qt=await Bun.file(xe).bytes();if(Qt.byteLength>26214400)throw Error(`${Ut} is ${Qt.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let gt=Buffer.from(Qt).toString("base64"),lt=ct.name.lastIndexOf("."),ut=lt>0?ct.name.slice(lt+1):"";B.push({path:Ut,hash:await og(gt,ut),base64:gt,extension:ut,size:Qt.byteLength})}}return await v(l),B.sort((ce,de)=>ce.path.localeCompare(de.path)),B}function ih(l){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[l.toLowerCase()]||"application/octet-stream"}async function ac(l,f,C,A){let w={Authorization:C},B;if(A instanceof FormData)B=A;else if(A!==void 0)w["Content-Type"]="application/json",B=JSON.stringify(A);let v=await fetch(`https://api.cloudflare.com/client/v4${f}`,{method:l,headers:w,body:B}),ce=await v.text(),de;try{de=JSON.parse(ce)}catch{throw Error(`Cloudflare Pages API returned ${v.status} with a non-JSON body: ${ce.slice(0,200)}`)}if(!de.success){let ct=(de.errors??[]).map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw Error(`Cloudflare Pages API error (${v.status}): ${ct||ce.slice(0,200)}`)}return de.result}import{createHash as oh}from"node:crypto";var hg="https://api.cloudflare.com/client/v4",yg=10042,sh=10006,ah=10059;class ti extends Error{status;errors;constructor(l,f,C=[]){super(l);this.name="R2ApiError",this.status=f,this.errors=C}hasCode(l){return this.errors.some((f)=>f.code===l)}}class jn extends ti{accountId;constructor(l,f,C=[]){super(`R2 is not enabled on Cloudflare account ${l}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,f,C);this.name="R2NotEnabledError",this.accountId=l}}class Si{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(l){if(!l.apiToken)throw Error("Cloudflare R2 needs an API token");if(!l.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId,this.fetchImpl=l.fetch??((f,C)=>fetch(f,C))}async requestEnvelope(l,f,C,A={}){let w={Authorization:`Bearer ${this.apiToken}`};if(C!==void 0)w["Content-Type"]="application/json";if(A.jurisdiction&&A.jurisdiction!=="default")w["cf-r2-jurisdiction"]=A.jurisdiction;let B=await this.fetchImpl(`${hg}/accounts/${this.accountId}/r2${f}`,{method:l,headers:w,body:C===void 0?void 0:JSON.stringify(C)}),v=await B.text(),ce;try{ce=JSON.parse(v)}catch{throw new ti(`Cloudflare R2 API returned ${B.status} with a non-JSON body: ${v.slice(0,200)}`,B.status)}if(!ce.success){let de=ce.errors??[];if(de.some((xe)=>xe.code===yg))throw new jn(this.accountId,B.status,de);let ct=de.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");throw new ti(`Cloudflare R2 API error (${B.status}) on ${l} ${f}: ${ct||v.slice(0,200)}`,B.status,de)}return ce}async request(l,f,C,A){return(await this.requestEnvelope(l,f,C,A)).result}bucketPath(l){return`/buckets/${encodeURIComponent(l)}`}async listBuckets(l={}){let f=[],C;do{let A=new URLSearchParams({per_page:"1000"});if(C)A.set("cursor",C);let w=await this.requestEnvelope("GET",`/buckets?${A}`,void 0,l),B=w.result?.buckets??[];f.push(...B),C=B.length>0?w.result_info?.cursor||void 0:void 0}while(C);return f}async getBucket(l,f={}){try{return await this.request("GET",this.bucketPath(l),void 0,f)}catch(C){if(C instanceof jn)throw C;if(C instanceof ti&&(C.hasCode(sh)||C.status===404))return null;throw C}}async ensureBucket(l,f={}){let C={jurisdiction:f.jurisdiction},A=await this.getBucket(l,C);if(A)return{bucket:A,created:!1};let w={name:l};if(f.locationHint)w.locationHint=f.locationHint;let B=await this.request("POST","/buckets",w,C);return{bucket:{...B,name:B?.name||l},created:!0}}async getCors(l,f={}){try{return(await this.request("GET",`${this.bucketPath(l)}/cors`,void 0,f))?.rules??[]}catch(C){if(C instanceof ti&&!(C instanceof jn)&&(C.hasCode(ah)||C.status===404))return[];throw C}}async putCors(l,f,C={}){if(f.length===0){await this.request("DELETE",`${this.bucketPath(l)}/cors`,void 0,C);return}await this.request("PUT",`${this.bucketPath(l)}/cors`,{rules:f},C)}async ensureCors(l,f,C={}){let A=await this.getCors(l,C);if(yc(A,f))return!1;return await this.putCors(l,f,C),!0}async getLifecycle(l,f={}){return(await this.request("GET",`${this.bucketPath(l)}/lifecycle`,void 0,f))?.rules??[]}async putLifecycle(l,f,C={}){await this.request("PUT",`${this.bucketPath(l)}/lifecycle`,{rules:f},C)}async ensureLifecycle(l,f,C={}){let A=await this.getLifecycle(l,C);if(Cc(A,f))return!1;return await this.putLifecycle(l,f,C),!0}async listCustomDomains(l,f={}){return(await this.request("GET",`${this.bucketPath(l)}/domains/custom`,void 0,f))?.domains??[]}async attachCustomDomain(l,f,C={}){return this.request("POST",`${this.bucketPath(l)}/domains/custom`,{domain:f.domain,zoneId:f.zoneId,enabled:f.enabled??!0,minTLS:f.minTLS??"1.2"},C)}async updateCustomDomain(l,f,C,A={}){return this.request("PUT",`${this.bucketPath(l)}/domains/custom/${encodeURIComponent(f)}`,C,A)}async ensureCustomDomain(l,f,C={},A){let w=f.minTLS??"1.2",v=(A??await this.listCustomDomains(l,C)).find((ct)=>ct.domain.toLowerCase()===f.domain.toLowerCase());if(!v){let ct=await this.attachCustomDomain(l,{...f,minTLS:w,enabled:!0},C);return{action:"attached",domain:{...ct,domain:ct?.domain||f.domain}}}let ce=v.minTLS??"1.0";if(v.enabled&&ce===w)return{action:"unchanged",domain:v};let de=await this.updateCustomDomain(l,v.domain,{enabled:!0,minTLS:w},C);return{action:"updated",domain:{...v,...de}}}async getManagedDomain(l,f={}){return this.request("GET",`${this.bucketPath(l)}/domains/managed`,void 0,f)}async setManagedDomain(l,f,C={}){let A=await this.getManagedDomain(l,C);if(A?.enabled===f)return{changed:!1,domain:A};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(l)}/domains/managed`,{enabled:f},C)}}}function Cg(l){return`https://${l}.r2.cloudflarestorage.com`}async function ch(l){let{apiToken:f,accountId:C}=l;if(!f)throw Error("r2S3Credentials needs an API token");if(!C)throw Error("r2S3Credentials needs an account id");let A=l.fetch??((v,ce)=>fetch(v,ce)),w=[],B;for(let v of[`/accounts/${C}/tokens/verify`,"/user/tokens/verify"]){let ce=await A(`${hg}${v}`,{method:"GET",headers:{Authorization:`Bearer ${f}`}}),de=await ce.json().catch(()=>null);if(ce.ok&&de?.success&&de.result?.id){B=de.result.id;break}let ct=de?.errors?.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");w.push(`${v} -> ${ce.status}${ct?` (${ct})`:""}`)}if(!B)throw Error(`Could not verify the Cloudflare API token to derive R2 credentials: ${w.join("; ")}`);return{accessKeyId:B,secretAccessKey:oh("sha256").update(f).digest("hex"),endpoint:Cg(C),region:"auto"}}function ws(l){if(Array.isArray(l))return`[${l.map(ws).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${ws(A)}`).join(",")}}`;return JSON.stringify(l)}function fg(l,f){let C=(A)=>A&&A.length>0?[...A].map(String).sort():void 0;return{id:f?l.id:void 0,allowed:{origins:C(l.allowed?.origins),methods:C(l.allowed?.methods?.map((A)=>A.toUpperCase())),headers:C(l.allowed?.headers?.map((A)=>A.toLowerCase()))},exposeHeaders:C(l.exposeHeaders?.map((A)=>A.toLowerCase())),maxAgeSeconds:l.maxAgeSeconds}}function yc(l,f){if(l.length!==f.length)return!1;return f.every((C,A)=>{let w=C.id!==void 0;return ws(fg(l[A],w))===ws(fg(C,w))})}function Cc(l,f){if(l.length!==f.length)return!1;let C=(A)=>ws([...A].map((w)=>({...w,storageClassTransitions:w.storageClassTransitions?.length?w.storageClassTransitions:void 0})).sort((w,B)=>w.id.localeCompare(B.id)));return C(l)===C(f)}var lh="r2 cache",uh=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function dh(l,f={}){let C=f.log??(()=>{}),A={buckets:[],warnings:[]},w=l.infrastructure?.r2??l.r2,B=Object.entries(w?.buckets??{});if(B.length===0)return C("R2: no buckets declared, skipping."),A;if(!f.apiToken||!f.accountId){let xe=[!f.apiToken&&"CLOUDFLARE_API_TOKEN",!f.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),Ut=`R2: ${B.length} bucket(s) declared but ${xe} is not set, skipping.`;return C(Ut),A.warnings.push(Ut),A}let v=f.dryRun===!0,ce=new Si({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),de=new M(f.apiToken,{zoneId:f.zoneId,accountId:f.accountId}),ct=new Map;for(let[xe,Ut]of B){let Qt=Ut?.name;if(!Qt||!uh.test(Qt)){A.warnings.push(`R2: bucket '${xe}' has an invalid name '${Qt??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}C(`R2: ${v?"checking":"reconciling"} bucket ${Qt}...`);let gt={name:Qt,changes:[],domains:[]};if(A.buckets.push(gt),await ph(Ut,{r2:ce,cloudflare:de,dryRun:v,summary:gt,warnings:A.warnings,claimed:ct,log:C}),gt.changes.length===0)C(`R2: ${Qt} is in sync.`);else for(let lt of gt.changes)C(`R2: ${Qt}: ${lt}`)}return A}async function ph(l,f){let{r2:C,dryRun:A,summary:w,warnings:B}=f,v=l.name,ce={jurisdiction:l.jurisdiction},de=(gt,lt)=>{let ut=A?lt&&`would ${lt}`:gt;if(ut)w.changes.push(ut)},ct;if(A)ct=await C.getBucket(v,ce)!==null;else{let{created:gt}=await C.ensureBucket(v,{locationHint:l.locationHint,jurisdiction:l.jurisdiction});if(ct=!0,gt)de("created","")}if(!ct)de("","create bucket");let xe=fh(l.customDomains);await Is(f,`cors on ${v}`,async()=>{if(!l.cors)return;if(!ct){de("cors updated","set cors");return}let gt=await C.getCors(v,ce);if(yc(gt,l.cors))return;if(!A)await C.putCors(v,l.cors,ce);de(l.cors.length===0?"cors removed":"cors updated",l.cors.length===0?"remove cors":"update cors")}),await Is(f,`lifecycle on ${v}`,async()=>{if(!l.lifecycle)return;let gt=l.lifecycle.map(bg);if(ct){let lt=await C.getLifecycle(v,ce);if(Cc(lt,gt))return}if(!A)await C.putLifecycle(v,gt,ce);de("lifecycle updated","update lifecycle")}),await Is(f,`r2.dev URL on ${v}`,async()=>{let gt=l.publicDevUrl===!0;if(!ct){if(gt)de("r2.dev URL enabled","enable r2.dev URL");return}if((await C.getManagedDomain(v,ce))?.enabled===gt)return;if(!A)await C.setManagedDomain(v,gt,ce);de(gt?"r2.dev URL enabled":"r2.dev URL disabled",gt?"enable r2.dev URL":"disable r2.dev URL")});let Ut=[];if(xe.length>0&&ct)try{Ut=await C.listCustomDomains(v,ce)}catch(gt){if(gt instanceof jn)throw gt;B.push(`R2: could not list custom domains on ${v}: ${Bc(gt)}`)}let Qt=new Map;for(let{domain:gt,minTLS:lt}of xe){let ut=f.claimed.get(gt);if(ut&&ut!==v){B.push(`R2: ${gt} is declared on both ${ut} and ${v}; leaving it on ${ut}.`);continue}f.claimed.set(gt,v);let Ee=Ut.find((ve)=>ve.domain.toLowerCase()===gt),Ft=lt??"1.2";if(Ee&&Ee.enabled&&(Ee.minTLS??"1.0")===Ft){if(w.domains.push({domain:gt,status:Mc(Ee)}),Ee.zoneId)Qt.set(gt,Ee.zoneId);continue}await Is(f,`custom domain ${gt} on ${v}`,async()=>{if(Ee){if(!A)await C.updateCustomDomain(v,Ee.domain,{enabled:!0,minTLS:Ft},ce);if(de(`custom domain ${gt} updated`,`update custom domain ${gt}`),w.domains.push({domain:gt,status:Mc({...Ee,enabled:!0})}),Ee.zoneId)Qt.set(gt,Ee.zoneId);return}let ve=await f.cloudflare.zoneIdFor(gt);if(Qt.set(gt,ve),!A)await C.ensureCustomDomain(v,{domain:gt,zoneId:ve,minTLS:Ft},ce,Ut);de(`custom domain ${gt} attached`,`attach custom domain ${gt}`),w.domains.push({domain:gt,status:A?"not attached":"pending"})},()=>w.domains.push({domain:gt,status:"error"}))}if(l.cache&&xe.length>0)await mh(l,xe.map((gt)=>gt.domain).filter((gt)=>f.claimed.get(gt)===v),Qt,f,de)}async function mh(l,f,C,A,w){let B=Sg(l.cache);if(!B||f.length===0)return;let v=new Map;for(let ce of f){let de=C.get(ce);if(!de)try{de=await A.cloudflare.zoneIdFor(ce)}catch(ct){A.warnings.push(`R2: could not resolve the zone for ${ce}, cache rule skipped: ${Bc(ct)}`);continue}v.set(de,[...v.get(de)??[],ce])}for(let ce of v.values()){let de={action:"set_cache_settings",description:`${Lt} ${lh}`,expression:`(${_t(ce)})`,enabled:!0,action_parameters:B};await Is(A,`cache rule for ${ce.join(", ")}`,async()=>{let ct=await A.cloudflare.getPhaseRules(ce[0],"http_request_cache_settings");if(Rg(ct,de))return;if(!A.dryRun){let xe=await A.cloudflare.putManagedPhaseRules(ce[0],"http_request_cache_settings",[de]);if(!xe.success)throw Error(xe.message||"cache rule write failed")}w(`cache rule updated for ${ce.join(", ")}`,`update cache rule for ${ce.join(", ")}`)})}}function Sg(l){if(l.edgeTtl===void 0&&l.browserTtl===void 0)return null;let f={cache:!0};if(l.edgeTtl!==void 0)f.edge_ttl={mode:"override_origin",default:l.edgeTtl};if(l.browserTtl!==void 0)f.browser_ttl={mode:"override_origin",default:l.browserTtl};return f}function Rg(l,f){let C=$t(f.expression),A=_n(f.expression),w=(ce)=>(ce.description||"").startsWith(Lt),B=(ce)=>ce.action===f.action&&ce.description===f.description&&(ce.enabled??!0)===(f.enabled??!0)&&_n(ce.expression)===A&&Sc(ce.action_parameters)===Sc(f.action_parameters),v=!1;for(let ce of l){if(!w(ce))continue;let de=$t(ce.expression);if(!C.some((xe)=>de.includes(xe)))continue;if(B(ce)&&C.every((xe)=>de.includes(xe))&&!v){v=!0;continue}return!1}return v}function bg(l){let f={id:l.id,enabled:l.enabled??!0,conditions:{prefix:l.prefix??""}};if(l.expireAfterDays!==void 0)f.deleteObjectsTransition={condition:{type:"Age",maxAge:_c(l.expireAfterDays)}};else if(l.expireOn!==void 0)f.deleteObjectsTransition={condition:{type:"Date",date:l.expireOn}};if(l.abortMultipartUploadsAfterDays!==void 0)f.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:_c(l.abortMultipartUploadsAfterDays)}};if(l.infrequentAccessAfterDays!==void 0)f.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:_c(l.infrequentAccessAfterDays)}}];return f}function _c(l){return Math.round(l*86400)}function fh(l){let f=new Set,C=[];for(let A of l??[]){let w=typeof A==="string"?{domain:A}:A,B=w.domain?.trim().replace(/\.$/,"").toLowerCase();if(!B||f.has(B))continue;f.add(B),C.push({domain:B,minTLS:w.minTLS})}return C}function Mc(l){if(!l.enabled)return"disabled";let f=l.status?.ownership,C=l.status?.ssl;if(f==="active"&&C==="active")return"active";for(let A of[f,C])if(A==="error"||A==="blocked"||A==="deactivated")return A;return"pending"}async function Is(l,f,C,A){try{await C()}catch(w){if(w instanceof jn)throw w;l.warnings.push(`R2: ${f} failed: ${Bc(w)}`),A?.()}}function Bc(l){return l instanceof Error?l.message:String(l)}function Sc(l){if(Array.isArray(l))return`[${l.map(Sc).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${Sc(A)}`).join(",")}}`;return JSON.stringify(l)}import{basename as Ah,extname as Th}from"node:path";import{createHash as hh}from"node:crypto";var yh="https://api.cloudflare.com/client/v4",Qn="TS_CLOUD_CONTENT_HASH",Vs="2025-09-01",xl="application/javascript+module",Ch=10007,Sh=[1e4,9109];class ls extends Error{status;errors;constructor(l,f,C=[]){super(l);this.name="WorkersApiError",this.status=f,this.errors=C}hasCode(l){return this.errors.some((f)=>f.code===l)}}class Rc extends ls{permission;constructor(l,f,C,A=[]){super(`The Cloudflare API token is missing the "${l}" permission (${f}). Edit the token in the Cloudflare dashboard (My Profile, API Tokens), add it, then re-run the deploy.`,C,A);this.name="WorkersPermissionError",this.permission=l}}class Tc{name="cloudflare-workers";apiToken;accountId;fetchImpl;constructor(l){if(!l.apiToken)throw Error("Cloudflare Workers needs an API token");if(!l.accountId)throw Error("Cloudflare Workers needs an account id");this.apiToken=l.apiToken,this.accountId=l.accountId,this.fetchImpl=l.fetch??((f,C)=>fetch(f,C))}async request(l,f,C){let A={Authorization:`Bearer ${this.apiToken}`},w;if(C instanceof FormData)w=C;else if(C!==void 0)A["Content-Type"]="application/json",w=JSON.stringify(C);let B=await this.fetchImpl(`${yh}/accounts/${this.accountId}/workers${f}`,{method:l,headers:A,body:w}),v=await B.text(),ce;try{ce=JSON.parse(v)}catch{throw new ls(`Cloudflare Workers API returned ${B.status} with a non-JSON body: ${v.slice(0,200)}`,B.status)}if(!ce.success){let de=ce.errors??[],ct=de.map((xe)=>`${xe.code}: ${xe.message}`).join(", ");if(Rh(B.status,de))throw new Rc(bh(f),`${l} ${f} -> ${B.status}${ct?`, ${ct}`:""}`,B.status,de);throw new ls(`Cloudflare Workers API error (${B.status}) on ${l} ${f}: ${ct||v.slice(0,200)}`,B.status,de)}return ce.result}scriptPath(l){return`/scripts/${encodeURIComponent(l)}`}async getSettings(l){try{return await this.request("GET",`${this.scriptPath(l)}/settings`)}catch(f){if(f instanceof Rc)throw f;if(f instanceof ls&&(f.hasCode(Ch)||f.status===404))return null;throw f}}async getScript(l){return this.getSettings(l)}async uploadModuleScript(l,f){return this.request("PUT",this.scriptPath(l),Tg(f))}async ensureModuleScript(l,f){let C=qs(f),A=await this.getSettings(l);if(A&&Pc(A,f,C))return{action:"unchanged",hash:C};return await this.uploadModuleScript(l,Pg(f,C)),{action:A?"updated":"created",hash:C}}async listCustomDomains(l={}){let f=new URLSearchParams;if(l.service)f.set("service",l.service);if(l.hostname)f.set("hostname",l.hostname);if(l.zoneId)f.set("zone_id",l.zoneId);let C=f.toString(),A=C?`?${C}`:"";return await this.request("GET",`/domains${A}`)??[]}async attachCustomDomain(l,f){let C={hostname:l,service:f.service,environment:f.environment??"production"};if(f.zoneId)C.zone_id=f.zoneId;return this.request("PUT","/domains",C)}async detachCustomDomain(l){await this.request("DELETE",`/domains/${encodeURIComponent(l)}`)}async ensureCustomDomain(l,f,C){let w=(C??await this.listCustomDomains({hostname:l})).find((v)=>v.hostname.toLowerCase()===l.toLowerCase());if(w&&w.service===f.service)return{action:"unchanged",domain:w};if(w)throw Error(`${l} is attached to the Worker '${w.service}'. Detach it there first (Workers & Pages, ${w.service}, Settings, Domains & Routes); ts-cloud does not move it.`);let B=await this.attachCustomDomain(l,f);return{action:"attached",domain:{...B,hostname:B?.hostname||l}}}}function Rh(l,f){if(f.some((C)=>Sh.includes(C.code)))return!0;return(l===401||l===403)&&f.length===0}function bh(l){if(l.startsWith("/domains"))return"Workers Routes: Edit (zone, for Workers custom domains) and Workers Scripts: Edit (account)";return"Workers Scripts: Edit (account)"}function Tg(l){if(!l.modules.some((A)=>A.name===l.mainModule))throw Error(`Worker main module '${l.mainModule}' is not one of the uploaded modules`);let f={main_module:l.mainModule,bindings:l.bindings??[],compatibility_date:l.compatibilityDate??Vs,compatibility_flags:l.compatibilityFlags??[],keep_bindings:["secret_text"]},C=new FormData;C.append("metadata",JSON.stringify(f));for(let A of l.modules)C.append(A.name,new Blob([A.content],{type:A.type}),A.name);return C}function qs(l){let f={mainModule:l.mainModule,modules:[...l.modules].sort((C,A)=>C.name.localeCompare(A.name)).map((C)=>({name:C.name,type:C.type,sha256:Ag(C.content)})),bindings:[...l.bindings??[]].filter((C)=>C.name!==Qn).sort((C,A)=>C.name.localeCompare(A.name)),compatibilityDate:l.compatibilityDate??Vs,compatibilityFlags:[...l.compatibilityFlags??[]].sort()};return Ag(qc(f))}function Pg(l,f=qs(l)){return{...l,bindings:[...(l.bindings??[]).filter((C)=>C.name!==Qn),{type:"plain_text",name:Qn,text:f}]}}function Pc(l,f,C){let A=l.bindings??[],w=A.find((B)=>B.name===Qn&&B.type==="plain_text");if(!w||w.text!==C)return!1;return(f.bindings??[]).every((B)=>{let v=A.find((de)=>de.name===B.name);if(!v||v.type!==B.type)return!1;let ce=B.type==="r2_bucket"?"bucket_name":B.type==="plain_text"?"text":void 0;return!ce||v[ce]===B[ce]})}function Ag(l){return hh("sha256").update(l).digest("hex")}function qc(l){if(Array.isArray(l))return`[${l.map(qc).join(",")}]`;if(l&&typeof l==="object")return`{${Object.entries(l).filter(([,C])=>C!==void 0).sort(([C],[A])=>C.localeCompare(A)).map(([C,A])=>`${JSON.stringify(C)}:${qc(A)}`).join(",")}}`;return JSON.stringify(l)}async function $u(l){if(!await Bun.file(l).exists())throw Error(`Worker entry not found: ${l}`);let f;try{f=await Bun.build({entrypoints:[l],target:"browser",format:"esm",minify:!0,external:["cloudflare:*"]})}catch(w){throw Error(`Bundling Worker ${l} failed: ${Ph(w)}`)}if(!f.success)throw Error(`Bundling Worker ${l} failed: ${f.logs.map((w)=>String(w.message??w)).join("; ")}`);if(f.outputs.length!==1)throw Error(`Bundling Worker ${l} produced ${f.outputs.length} files (${f.outputs.map((w)=>w.path).join(", ")}); a Worker is uploaded as a single module, so remove the dynamic imports or asset imports that split it.`);let C=f.outputs[0];if(C.kind!=="entry-point")throw Error(`Bundling Worker ${l} produced a ${C.kind} instead of an entry module`);let A=await C.text();return{name:`${Ah(l,Th(l))}.js`,content:A,type:xl,size:new TextEncoder().encode(A).byteLength}}function Ph(l){if(l instanceof AggregateError&&l.errors.length>0)return l.errors.map((f)=>f instanceof Error?f.message:String(f?.message??f)).join("; ");return l instanceof Error?l.message:String(l)}import{isAbsolute as wh,resolve as Ih}from"node:path";var Dh="https://api.cloudflare.com/client/v4",vh=/^[a-z0-9][a-z0-9_-]{0,62}$/;async function Eh(l,f={}){let C=f.log??(()=>{}),A={workers:[],warnings:[]},w=Object.entries(l.infrastructure?.workers??l.workers??{});if(w.length===0)return C("Workers: none declared, skipping."),A;if(!f.apiToken||!f.accountId){let ce=[!f.apiToken&&"CLOUDFLARE_API_TOKEN",!f.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),de=`Workers: ${w.length} Worker(s) declared but ${ce} is not set, skipping.`;return C(de),A.warnings.push(de),A}let B=l.infrastructure?.r2??l.r2,v={workers:new Tc({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),r2:new Si({apiToken:f.apiToken,accountId:f.accountId,fetch:f.fetch}),cloudflare:new M(f.apiToken,{zoneId:f.zoneId,accountId:f.accountId}),apiToken:f.apiToken,fetch:f.fetch??((ce,de)=>fetch(ce,de)),projectRoot:f.projectRoot??process.cwd(),dryRun:f.dryRun===!0,warnings:A.warnings,log:C,r2ConfigDomains:bS(B),r2Buckets:B,claimed:new Map};for(let[ce,de]of w){let ct=de?.name;if(!ct||!vh.test(ct)){A.warnings.push(`Workers: '${ce}' has an invalid name '${ct??""}' (1-63 chars: lowercase letters, digits, '-' and '_'), skipping.`);continue}if(!de.entry){A.warnings.push(`Workers: ${ct} has no entry, skipping.`);continue}C(`Workers: ${v.dryRun?"checking":"reconciling"} ${ct}...`);let xe={name:ct,changes:[],domains:[]};A.workers.push(xe),await Nh(de,xe,v);for(let Ut of xe.changes)C(`Workers: ${ct}: ${Ut}`)}return A}async function Nh(l,f,C){let A=l.name,w=wh(l.entry)?l.entry:Ih(C.projectRoot,l.entry),B;try{B=await $u(w)}catch(ce){throw Error(`Worker ${A}: ${gs(ce)}`)}f.changes.push(`bundled ${PS(B.size)}`);let v={mainModule:B.name,modules:[{name:B.name,content:B.content,type:B.type}],bindings:$g(l,C),compatibilityDate:l.compatibilityDate??Vs,compatibilityFlags:l.compatibilityFlags??[]};if(C.dryRun){let ce=await C.workers.getSettings(A);f.changes.push(ce&&Pc(ce,v,qs(v))?"unchanged":"would upload")}else{let{action:ce}=await C.workers.ensureModuleScript(A,v);f.changes.push(ce==="unchanged"?"unchanged":"uploaded")}for(let ce of TS(l.customDomains))await lS(A,ce,f,C)}async function lS(l,f,C,A){let w=(gt)=>{C.domains.push({domain:f,status:gt})},B=(gt)=>{A.warnings.push(`Workers: ${gt}`),w("conflict")},v=A.claimed.get(f);if(v&&v!==l){B(`${f} is declared on both ${v} and ${l}; leaving it on ${v}.`);return}A.claimed.set(f,l);let ce=A.r2ConfigDomains.get(f);if(ce){B(`${f} is also declared as a custom domain of the R2 bucket '${ce}' (r2.buckets). A hostname serves either a bucket or a Worker. Remove it from the bucket's customDomains and detach it in the dashboard (R2, ${ce}, Settings, Custom Domains) first; to serve the bucket through the Worker, bind it with bindings.r2Buckets instead.`);return}let de=await dS(A);if(de===null){w("error");return}let ct=de.find((gt)=>gt.hostname.toLowerCase()===f);if(ct?.service===l){w("active");return}if(ct){B(`${f} is attached to the Worker '${ct.service}'. Detach it there first (Workers & Pages, ${ct.service}, Settings, Domains & Routes); it is not moved automatically.`);return}let xe=(await CS(A))?.get(f);if(xe){B(`${f} is attached to the R2 bucket '${xe}' as a custom domain. Detach it first (R2, ${xe}, Settings, Custom Domains, then re-run the deploy); it is not detached automatically. To serve the bucket through the Worker, bind it with bindings.r2Buckets.`);return}let Ut;try{Ut=await A.cloudflare.zoneIdFor(f)}catch(gt){A.warnings.push(`Workers: could not resolve the zone for ${f}, not attached: ${gs(gt)}`),w("error");return}let Qt=await RS(A,Ut,f);if(Qt.length>0){let gt=Qt.map((lt)=>`${lt.type} ${lt.content}`).join(", ");B(`${f} already has a DNS record (${gt}). A Worker custom domain creates its own record, so Cloudflare will not attach over it. Delete the record first (DNS, Records), then re-run the deploy; it is not deleted automatically.`);return}if(A.dryRun){C.changes.push(`would attach custom domain ${f}`),w("not attached");return}try{await A.workers.ensureCustomDomain(f,{service:l,zoneId:Ut},de),C.changes.push(`custom domain ${f} attached`),de.push({id:"",hostname:f,service:l,zone_id:Ut}),w("pending")}catch(gt){A.warnings.push(`Workers: custom domain ${f} on ${l} failed: ${gs(gt)}`),w("error")}}async function dS(l){if(l.attached!==void 0)return l.attached;try{l.attached=await l.workers.listCustomDomains()}catch(f){l.warnings.push(`Workers: could not list Worker custom domains, none attached: ${gs(f)}`),l.attached=null}return l.attached}async function CS(l){if(l.r2AccountDomains!==void 0)return l.r2AccountDomains;let f=new Map;try{let C=(await l.r2.listBuckets()).map((A)=>({name:A.name}));for(let A of Object.values(l.r2Buckets?.buckets??{}))if(A.jurisdiction&&A.jurisdiction!=="default")C.push({name:A.name,jurisdiction:A.jurisdiction});for(let A of C){let w=await l.r2.listCustomDomains(A.name,{jurisdiction:A.jurisdiction}).catch(()=>[]);for(let B of w)f.set(B.domain.toLowerCase(),A.name)}l.r2AccountDomains=f}catch(C){l.log(`Workers: could not check R2 custom domains (${gs(C)}); relying on the DNS check.`),l.r2AccountDomains=null}return l.r2AccountDomains}async function RS(l,f,C){try{let A=await l.fetch(`${Dh}/zones/${f}/dns_records?name=${encodeURIComponent(C)}&per_page=100`,{method:"GET",headers:{Authorization:`Bearer ${l.apiToken}`}}),w=await A.json();if(!w?.success)throw Error(`HTTP ${A.status}`);return(w.result??[]).filter((B)=>B.name?.toLowerCase()===C).map((B)=>({type:B.type??"?",content:B.content??""}))}catch(A){return l.log(`Workers: could not read DNS records for ${C} (${gs(A)}); attaching anyway.`),[]}}function $g(l,f){let C=[],A=new Set,w=(v)=>{if(v===Qn)return f.warnings.push(`Workers: ${l.name}: binding name ${Qn} is reserved for ts-cloud, ignored.`),!1;if(A.has(v))return f.warnings.push(`Workers: ${l.name}: binding ${v} is declared twice; the first one wins.`),!1;return A.add(v),!0},B=new Map;for(let v of Object.values(f.r2Buckets?.buckets??{}))if(v.jurisdiction&&v.jurisdiction!=="default")B.set(v.name,v.jurisdiction);for(let[v,ce]of Object.entries(l.bindings?.r2Buckets??{})){if(!w(v))continue;let de=B.get(ce);C.push(de?{type:"r2_bucket",name:v,bucket_name:ce,jurisdiction:de}:{type:"r2_bucket",name:v,bucket_name:ce})}for(let[v,ce]of Object.entries(l.bindings?.vars??{}))if(w(v))C.push({type:"plain_text",name:v,text:String(ce)});return C}function bS(l){let f=new Map;for(let C of Object.values(l?.buckets??{}))for(let A of C?.customDomains??[]){let w=wg(typeof A==="string"?A:A.domain);if(w)f.set(w,C.name)}return f}function TS(l){return[...new Set((l??[]).map(wg).filter(Boolean))]}function wg(l){return(l??"").trim().replace(/\.$/,"").toLowerCase()}function PS(l){if(l<1024)return`${l} B`;if(l<1048576)return`${(l/1024).toFixed(1)} KB`;return`${(l/1024/1024).toFixed(1)} MB`}function gs(l){return l instanceof Error?l.message:String(l)}export{dl as ABTestManager,ge as ACMClient,Sr as ACMDnsValidator,tg as ACME_DIRECTORIES,Pe as AI,ql as API_IDEMPOTENCY_TTL_MS,Gl as API_TOKEN_DEFAULT_TTL_MS,Vl as API_TOKEN_MAX_TTL_MS,rs as API_VERSION,me as AUTHORIZATION_CAPABILITIES,Fl as AUTH_ACTION_TOKEN_TTL_MS,Ul as AUTH_MFA_CHALLENGE_TTL_MS,Ql as AUTH_OIDC_TRANSACTION_TTL_MS,Ye as AUTH_SESSION_ABSOLUTE_TTL_MS,Ml as AUTH_SESSION_IDLE_TTL_MS,ZA as AWSAPIError,n as AWSClient,h as AWSCloudFormationClient,S as AWSCloudFrontClient,sl as AWSConfigManager,TI as AWS_PSEUDO_PARAMETERS,Ne as AWS_REGIONS,zf as AcmeClient,jr as AlertEvaluator,ki as AlertStore,po as AnomalyConfigStore,Kd as ApiGateway,i as ApiServiceError,oc as ApplicationAutoScalingClient,Yr as Arn,k as AssetHasher,q as Auth,Xi as AuthenticationStore,Li as AutomationApiService,Yi as AutomationIdentityStore,ma as AwsAuroraDataAdapter,Sa as AwsAuroraTransport,$a as AwsDatabaseBackupSource,vr as AwsDriver,fa as AwsElastiCacheDataAdapter,Ia as AwsElastiCacheTransport,Rf as AwsIamCapabilityScanner,Ha as AwsInfrastructureBackupSource,pa as AwsRdsDataAdapter,ya as AwsRdsTransport,Uf as AwsRegionalDriver,Va as AwsSecretsManagerConfigurationBackend,Gp as AwsSpendTransport,qa as AwsSsmConfigurationBackend,ps as BackupCoordinator,nl as BackupManager,_a as BackupStore,tf as BatchProcessingManager,Nn as BedrockClient,Pn as BedrockRuntimeClient,Yl as BitbucketSourceAdapter,cl as BlueGreenManager,qm as BounceComplaintHandler,Lm as BuildOptimizationManager,Iu as BunDockerRuntime,Ju as BunDockerVolumeRuntime,Wu as BunFilesystemArchiveRuntime,he as CDN,Bo as CHAIN_HEADER,Lt as CLOUDFLARE_MANAGED_RULE_PREFIX,Gd as CLOUDFRONT_FAILOVER_STATUS_CODES,uC as COMMON_CROSS_ACCOUNT_ROLES,Qn as CONTENT_HASH_BINDING,Ge as CONTROL_PLANE_SCHEMA_VERSION,wo as Cache,Vi as CanaryManager,xm as CertificateManager,lA as CloudBlockVolumeDriver,js as CloudDriverFactory,We as CloudError,om as CloudFormationBuilder,h as CloudFormationClient,S as CloudFrontClient,ol as CloudTrailManager,Ie as CloudWatchLogsClient,ig as CloudflarePagesProvider,M as CloudflareProvider,Iy as CommandHistory,z as Communication,Qr as ComposeApplicationService,zt as ComposeApplicationStore,kt as ComprehendClient,a as Compute,Vp as ComputeSpendTransport,Po as ConfigurationError,za as ConfigurationService,Ga as ConfigurationStore,Rn as ConnectClient,Aa as ContainerDataAdapter,ml as ContainerRegistryManager,Qa as ControlPlaneBackupSource,ka as ControlPlaneCleanupDriver,vi as ControlPlaneStore,lo as CounterTracker,Ct as CredentialError,bm as CrossRegionReferenceManager,FA as DASHBOARD_ENTRY,UA as DASHBOARD_PORT_BASE,QA as DASHBOARD_PORT_SPAN,MA as DASHBOARD_STATE_DIR,Qo as DEFAULT_ATTACK_MODE_HOURS,Vs as DEFAULT_COMPATIBILITY_DATE,Nd as DEFAULT_DDOS_THRESHOLDS,Kp as DEFAULT_FAILOVER_STATUS_CODES,ud as DEFAULT_METER_MAPPINGS,dd as DEFAULT_PRICE_BOOK,rn as DEFAULT_RECURSION_LIMITS,Gn as DEFAULT_RPX_CERTS_DIR,K as DEFAULT_SERVICE_LIMITS,Od as DEFAULT_STATE_DIR,dg as DEFAULT_STATIC_ASSET_EXTENSIONS,OA as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,EA as DEFAULT_TELEMETRY_POLICY,Rp as DEFAULT_THRESHOLDS,sA as DEPLOYMENT_QUEUE_KINDS,ko as DEPTH_HEADER,Vr as DETECTABLE_SIGNALS,fu as DIAGNOSTIC_PRESETS,ef as DLQMonitoringManager,H as DNS,Gm as DNSSECManager,os as DataServiceLifecycle,ga as DataServiceStore,Yt as Database,km as DatabaseUserManager,U as DebugLogger,xA as DependencyGraph,j as Deployment,YA as DeploymentError,il as DisasterRecoveryManager,Mn as DnsProviderFactory,or as DockerDataTransport,oa as DockerDiscoveryAdapter,Ur as DockerNamedVolumeDriver,Ua as DockerVolumeBackupSource,c as DurableOperationQueue,ro as DurableQueueWorker,_e as DynamoDBClient,Br as EC2Client,$e as ECRClient,nt as ECSClient,fr as EFSClient,rc as ELBv2Client,gA as ENFORCEMENT_ACTIONS,Pi as ENFORCEMENT_DESCRIPTIONS,N as ENFORCEMENT_SEVERITY,tp as ENVIRONMENT_LABEL,pu as EcsRuntimeAdapter,Uo as EdgeRateLimiter,st as ElastiCacheClient,m as Email,Wm as EmailAdvanced,jm as EmailAnalyticsManager,On as EmailClient,Jm as EmailHandlers,Km as EmailTemplateManager,ba as EncryptedDataSecretStore,ey as ErrorCodes,pr as EventBridgeClient,$f as EventBridgeJobAdapter,ja as ExternalConfigurationBackend,To as FAILOVER_REPLICA_POLICY_SID,Zm as FIFOQueueManager,$S as FLY_MACHINES_API,_p as FOCUS_VERSION,Xd as FileCache,ze as FileSystem,Ma as FilesystemBackupSource,Ea as FleetService,Ca as FleetStore,sc as FlyApiError,kg as FlyClient,e as Fn,Zl as GiteaSourceAdapter,Jl as GithubSourceAdapter,Xl as GitlabSourceAdapter,Cm as GlobalResourceManager,Me as GoDaddyProvider,al as GuardDutyManager,pt as HOST_SITES_DIR,iy as HashCache,mf as HealthCheckManager,qe as HealthCheckRunner,Dr as HetznerClient,Te as HetznerDriver,be as IAMClient,hc as IPV6_EXCLUDED_HOST_LABELS,_m as ImageScanningManager,_g as InfrastructureGenerator,Yc as InvalidOperationTransitionError,It as JobLoader,Mf as JobProviderReconciler,ua as JobService,da as JobStore,gr as KendraClient,gf as LARAVEL_SERVERLESS_BUILD_STEPS,E as LambdaClient,Fm as LambdaConcurrencyManager,Hm as LambdaDLQManager,Um as LambdaDestinationsManager,$m as LambdaLayersManager,mu as LambdaRuntimeAdapter,Qm as LambdaVPCManager,Mm as LambdaVersionsManager,Cn as LocalEncryptedConfigurationBackend,Fa as LogicalDatabaseBackupSource,ul as LogsManager,Qy as MANAGED_NODE_VERSIONS,Uc as MANAGEMENT_DASHBOARD_SITE,am as MANAGEMENT_DASHBOARD_SITE_PREFIX,Wi as MAX_CONTROL_HOURS,Zc as MAX_CONTROL_PLANE_ERROR_BYTES,Cp as MAX_CONTROL_PLANE_JSON_BYTES,oo as METERS,uA as METER_KEYS,pA as MICRO_CENTS,Dp as MIN_PROJECTION_CONFIDENCE,mg as MTA_STS_PORT,Na as MaintenanceService,Pa as MaintenanceStore,ie as Messaging,Dm as MetricsManager,Pm as MigrationManager,hm as MockCloudFormation,ym as MockDynamoDB,Am as MockS3,Ro as Monitoring,Tm as MultiAccountManager,Im as MultiRegionManager,my as MultiStepProgress,y as Network,ff as NetworkSecurityManager,Bi as NotificationRouter,Xp as ORIGIN_CONNECTION_ATTEMPTS,Yp as ORIGIN_CONNECTION_TIMEOUT,Wp as ORIGIN_GROUP_ALLOWED_METHODS,CI as ORIGIN_GROUP_ID_SUFFIX,Jp as ORIGIN_GROUP_SELECTION_CRITERIA,nc as OpenSearchClient,mt as OptimisticConcurrencyError,wm as OrganizationManager,th as PAGES_MAX_FILE_BYTES,Xy as PHP_DEFAULT_EXCLUDES,Hy as PHP_LAYER_EXTENSIONS,ep as PROJECT_LABEL,at as PROXIABLE_RECORD_TYPES,T as ParameterStore,Nm as PerformanceManager,ne as Permissions,ic as PersonalizeClient,Ke as Phone,Xm as PhoneAdvanced,im as PhoneHandlers,Ta as PlacementService,va as PlacementStore,kn as PollyClient,le as PorkbunProvider,un as PreDeployScanner,tl as PreviewEnvironmentManager,Fr as PreviewEnvironmentService,Ve as PreviewEnvironmentStore,rl as PreviewNotificationService,py as ProgressBar,ll as ProgressiveDeploymentManager,Ho as ProtectionControlStore,BA as Pseudo,G as Queue,Ti as QueueCancellationError,rf as QueueManagementManager,lI as QueuePresets,to as QueueTimeoutError,ti as R2ApiError,jn as R2NotEnabledError,Si as R2Provider,yg as R2_NOT_ENABLED_ERROR_CODE,Nl as RATE_LIMIT_KEY_SEPARATOR,J as RDSClient,Cy as RECOMMENDED_ACCOUNT_STRUCTURES,lC as RECOMMENDED_SCPS,Ef as RELEASE_QUEUE_KINDS,Ay as REPL,Sy as REPLCommandBuilder,yy as REPLContext,rp as ROLE_LABEL,sy as RateLimiter,uI as RealtimePresets,Lp as RecordingSpendTransport,ji as RecursionGuard,bt as Redirects,Em as RegionPairManager,Ra as RegionService,wa as RegionStore,je as Registry,Bt as RekognitionClient,Et as ReleaseService,Xo as ReleaseStore,Ff as RemoteBuildService,gl as ReplicaManager,hf as ResourceManagementManager,te as RetryableOperationError,I as Route53Client,tc as Route53DomainsClient,X as Route53Provider,Vm as Route53ResolverManager,hl as Route53RoutingManager,ye as RuntimeOperationService,ca as RuntimeStreamRegistry,La as S3BackupDestinationAdapter,o as S3Client,F as S3Error,ru as SECRET_PATTERNS,xp as SENSITIVITY_THRESHOLDS,ot as SESClient,V as SMS,it as SNSClient,Hp as SPEND_CYCLE_SECONDS,vd as SPEND_GATE_SETTING,RA as SPEND_LEASE_SETTING,ae as SQSClient,we as SSH_BOOTSTRAP_VERSION,si as SSH_PREFLIGHT_SCRIPT,Re as SSMClient,jp as STATE_DIR_ENV_VAR,Ts as STATIC_SITE_ZONE_SETTINGS,qd as STORAGE_FAILOVER_METADATA_KEY,Se as STSClient,Bn as SchedulerClient,Zt as Search,gn as SecretFindingScanner,Ui as Secrets,pl as SecretsManager,W as SecretsManagerClient,Bm as SecretsRotationManager,b as Security,tr as SecurityHubManager,ln as SecurityPostureStore,vt as SecurityScannerRunner,Om as SecurityScanningManager,zm as SenderReputationManager,Lf as ServerCronJobAdapter,ha as ServerDataAdapter,so as ServerPathVolumeDriver,fl as ServiceMeshManager,zd as Sftp,fo as SignalSource,Ym as SmsAdvanced,Ot as SmsClient,sm as SmsHandlers,dc as SmsVoiceClient,Yo as SourceConnectionStore,ir as SourceProviderError,Td as SpendCapError,qr as SpendGate,Up as SpendLoopLease,Io as SpendNotificationRouter,Qp as SpendRunner,Wt as SpendService,Ri as SpendStore,fy as Spinner,Nr as SshDriver,fn as SshFleetDriver,vm as StackDependencyManager,vI as StacksIntegration,pf as StaticSiteManager,De as Storage,Rl as StorageAdvancedManager,xn as SupportClient,rr as SyntheticsManager,bu as SystemFleetSshTransport,Pr as SystemSshTransport,aa as SystemdDiscoveryAdapter,xo as TRACE_HEADER,hy as TaskList,At as TelemetryStore,Qd as TemplateBuilder,Yd as TemplateCache,xt as TextractClient,Dn as TranscribeClient,ur as TranslateClient,Gf as TransportDisasterRecoveryDriver,Hf as TransportPlatformMaintenanceDriver,as as TransportRemoteBuildDriver,ia as TrivyImageScanner,Jo as TsCloudApiError,jl as TsCloudClient,wA as URGENT_SPEND_EVENTS,Pp as USER_VISIBLE_ACTIONS,Da as UnavailableRegionalDriver,ue as UnifiedDnsValidator,Ys as UnsupportedSchemaVersionError,um as ValidationError,mr as VoiceClient,io as VolumeService,jt as VolumeStore,xl as WORKER_MODULE_TYPE,ls as WorkersApiError,Rc as WorkersPermissionError,Tc as WorkersProvider,$A as Workflow,Rm as XRayManager,ky as abTestManager,zl as activateImmutableRelease,Yg as addDns01ChallengeRecord,An as addSiteToCloudConfig,wt as ageSeconds,pd as aggregateDeltas,Sp as allocateSitePorts,nm as amazonLinuxImageId,LA as amazonLinuxImageParameter,II as analyzeStackDiff,Ni as anomalyOptionsForSignal,Go as applyControlsToDdos,_l as applyControlsToRateLimits,Bs as applyDeclaredZoneSettings,Wr as applyMitigationFactor,Uh as applyPlan,Ls as applyZoneMigration,Al as artifactKey,yt as assertOriginGroupMethods,Zi as assertReleaseStrategy,CA as assertSpendAllows,qh as attachConflicts,jh as attachIsViable,Vh as attachPreconditions,au as attachProvenanceToRelease,sa as attachSbomToRelease,su as attachVulnerabilitySummary,bf as authEncryptionKeyFile,P as authorizeOrganization,Of as authorizeRuntimePath,Ub as autocomplete,Ty as awsConfigManager,zu as backupCredentialStatus,Ey as backupManager,ub as batch,tE as batchProcessingManager,Ko as beginOidcAuthorization,Py as blueGreenManager,WC as bounceComplaintHandler,ft as budgetWindow,Ya as buildAndPushServerlessImage,iE as buildBunRuntimeLayerZip,Yh as buildCertificatePackScript,Wh as buildCertificateStateScript,Zh as buildCertificateUnpackScript,Wd as buildCloudFormationTemplate,xc as buildCloudInitFirstBoot,nd as buildComposeLogsCommand,cI as buildComposeRuntimeCommand,dI as buildComposeScaleCommand,id as buildComposeShellCommand,hp as buildDrainSourceScript,kh as buildDrainedSiteScanScript,jd as buildFailoverReplicaPolicyStatement,cr as buildFunctionEnv,fp as buildHealthGateScript,Xn as buildHostCleanupDeployScript,Gs as buildHostCleanupInstallScript,Jn as buildHostCleanupScript,Ci as buildHostSitePortsScript,Ud as buildMailEnv,Ks as buildManagementDashboardArtifact,VS as buildMediaCdnPlan,pg as buildMtaStsPolicy,gh as buildMtaStsServer,nE as buildNodeRuntimeLayerZip,UC as buildOptimizationManager,Vd as buildOriginGroup,Xr as buildOriginGroups,gc as buildOriginGuardRule,cp as buildPauseWorkersScript,cE as buildPhpRuntimeLayerZip,rm as buildReplicationConfiguration,tm as buildReplicationRole,gp as buildRestoreScript,Y as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Hh as buildSetHostnameScript,Zn as buildSiteDeployScript,up as buildSnapshotScript,Ap as buildSourceStateScript,zn as buildSshArgs,ni as buildSshBootstrapScript,uc as buildStaticSiteCacheRules,ei as buildStaticSiteDeployScript,pp as buildTargetStateScript,Tg as buildUploadForm,dp as buildWorkersStateScript,$u as bundleWorker,du as bytes,Sg as cacheRuleParameters,Ny as canaryManager,hn as canonicalJson,Tt as capabilities,ar as capacity,Ib as categorizeChanges,$C as certificateManager,Xh as certificatesMatch,tb as checkIAMPermissions,cf as checkInvocation,nb as checkServiceQuotas,oy as chunk,iR as cleanupDns01Challenge,iS as clearSigningKeyCache,ea as cloneSourceBinding,ay as cloudConfigSchema,Ug as cloudDrivers,wy as cloudTrailManager,sg as collectAssets,$o as collectPhpAppEntries,lg as collectServerDnsDomains,Ep as completeComposeVolumeDeletion,Wo as completeOidcAuthorization,GI as composePresets,eo as composeProjectName,Sl as composeServerlessAppTemplate,PA as compositeSpendTransport,Nt as compressBackup,uS as config,lc as configOrigins,yu as connectionGuidance,$y as containerRegistryManager,nA as controlPlaneDatabaseFile,Jc as controlPlaneMigrations,kI as createApiBackendPreset,na as createApiV1Handler,IS as createAsgBuildDriver,Ku as createBackupQueueHandlers,Jy as createCliHandler,O as createCloudDriver,Bu as createCloudFrontPolicy,XI as createCredentialProvider,QI as createDashboardSite,LI as createDataPipelinePreset,Su as createDataServiceQueueHandlers,sd as createDeploymentQueueHandlers,D as createDnsProvider,SS as createEcsBuildDriver,wd as createEnforcementHandlers,gm as createError,Jd as createExistingStaticFullStackPreset,Cu as createFleetQueueHandlers,NI as createFullStackAppPreset,Fs as createGoDaddyValidator,aE as createHandlers,Ky as createHttpHandler,xI as createJamstackPreset,Au as createJobQueueHandlers,FI as createLaravelPreset,$I as createMLApiPreset,Pu as createMaintenanceQueueHandlers,MS as createMediaAccessToken,OI as createMicroservicesPreset,Db as createMockAWS,RI as createNodeJsServerPreset,DI as createNodeJsServerlessPreset,vs as createObjectStorageClient,Ms as createPorkbunValidator,VI as createPreset,Mo as createPresignedUrl,Zy as createPresignedUrlAsync,Wy as createQueueHandler,_I as createRealtimeAppPreset,vu as createRegionQueueHandlers,ou as createReleaseProvenance,Wl as createReleaseQueueHandlers,AS as createRemoteBuildQueueHandlers,Us as createRoute53Validator,xf as createRuntimeAdapters,XA as createS3Client,yS as createServerBuildDriver,UI as createServerlessLaravelPreset,PI as createServerlessNodePreset,cg as createSmsInfrastructure,et as createSourceAdapter,wI as createStaticSitePreset,MI as createTraditionalWebAppPreset,od as createVolumeQueueHandlers,BI as createWordPressPreset,Je as createZip,Kb as crossRegionReferenceManager,En as dashboardActions,zs as dashboardCredentialsFile,mn as dataServiceCapabilities,_C as databaseUserManager,$l as decodeBase32,Oe as decompressBackup,Zf as decryptBackup,Vo as defaultConfig,fm as defaultLocalConfig,Bl as defaultRateLimitRules,yr as delegateZone,Ns as delegateZoneFromConfig,Gu as deleteFailoverReplicaBuckets,Ja as deleteStaticSite,Hc as deployAllComputeSites,xa as deployServerlessApp,Vu as deploySite,Ws as deploySiteRelease,As as deployStaticSite,Xa as deployStaticSiteFull,vn as deployStaticSiteWithExternalDns,Tn as deployStaticSiteWithExternalDnsFull,vS as deployToFly,Md as deploymentCoexistenceError,HA as deriveManagementDashboardPort,ks as describeDelegation,Ol as describePosture,xs as describeZoneSettings,_f as desiredJobProviderState,Bp as detectAnomalies,zp as detectDeploymentTargets,pc as detectDnsProvider,bd as detectLatestAnomaly,ZI as detectMisconfigurations,Dl as detectServiceRegion,td as diffCompose,Ab as diffTemplates,Zo as discoverGitRefs,zo as discoverOidcProvider,lu as discoverRuntimeInventory,eE as dlqMonitoringManager,mc as dnsProviders,zC as dnssecManager,Nf as dockerWorkloads,cs as documentDigest,Mc as domainStatus,vy as drManager,Qe as driverStatePath,uu as ecsWorkloads,qt as effectiveCapabilities,JC as emailAnalyticsManager,YC as emailTemplateManager,Ji as encodeBase32,Yf as encryptBackup,cu as ensureDefaultSecurityPolicies,Uu as ensureFailoverReplicaBuckets,gi as ensureFirewall,fi as ensureManagementDashboard,pi as ensureServer,ui as ensureSshKey,ee as escapeSecLang,fd as evaluateBudget,ai as evaluatePreflight,So as evaluateTelemetryAlertRules,hu as eventBridgeScheduleInput,zy as eventToRequest,SA as ewma,ed as exportCompose,Os as exportRoute53Zone,dm as extendPreset,ZC as fifoQueueManager,lb as findChangedFiles,Tp as findMapping,vp as findPriceEntry,kS as flyDeployOptions,Ou as flyIpType,Eg as flyMachineConfig,fC as formatAccountStructure,zh as formatAttachPlan,Bb as formatBytes,zr as formatCents,bI as formatDiff,xh as formatDrainedSiteRefusal,xb as formatDuration,Hb as formatFlagSuggestions,qb as formatHistory,jb as formatHistoryStats,$h as formatInventory,_b as formatKeyValue,Ob as formatList,Fh as formatPlan,di as formatPreflightFindings,kb as formatProgressBar,by as formatRegion,oC as formatRegionList,wf as formatScanResults,Lb as formatSuggestion,Pb as formatTable,Gr as formatTimeToExhaustion,Nb as formatTree,zA as fromEC2Metadata,KA as fromECSMetadata,qA as fromEnvironment,jA as fromSharedCredentials,WA as fromWebIdentity,Cl as functionFingerprint,qn as gatewayHostnames,bl as generateAppImageDockerfile,PC as generateApprovalConfig,nf as generateBootstrap,ly as generateCleanupWorkflow,uy as generateCostReportWorkflow,pC as generateCrossAccountRoleCF,nu as generateCycloneDxSbom,wC as generateDeploymentConfig,bC as generateDeploymentPipeline,hC as generateDeploymentWorkflow,Wa as generateExternalDnsStaticSiteTemplate,rR as generateHttpsServerCode,iu as generateImageSbom,tR as generateLetsEncryptUserData,t as generateLogicalId,TC as generateManualPipeline,IC as generateMatrixWorkflow,RC as generateMultiEnvConfig,CC as generateMultiEnvPipeline,AC as generateMultiEnvWorkflow,yC as generatePRPreviewWorkflow,NC as generateParallelConfig,uf as generatePhpFpmConfig,sf as generatePhpLayerDockerfile,EC as generatePreviewPipeline,dy as generatePreviewWorkflow,r as generateResourceName,DC as generateScheduledConfig,vC as generateScheduledPipeline,SC as generateScheduledWorkflow,hs as generateStaticSiteTemplate,x as generateUbuntuAppCloudInit,lm as getAccountId,Yb as getAllRegions,nC as getClosestRegion,Gb as getCommandUsage,iA as getComposeTemplate,yf as getConfig,Mb as getContextualHelp,Hi as getCredentials,bb as getDeploymentStrategy,Cb as getDiffStats,yb as getDiffSummary,ty as getErrorDetails,el as getLocalConfig,wb as getLocalCredentials,Tb as getLocalEndpoint,Rb as getLocalEnvVars,ib as getQuotaUsageSummary,gC as getRecommendedStructure,Gi as getRegion,aC as getRegionStats,eC as getRegionsByCompliance,Zb as getRegionsByLocation,tC as getRegionsByPricingTier,ry as getRequiredPermissions,sS as getSigningKeyCacheSize,ag as getSmsInfrastructureStatus,gI as getTimestamp,Fo as globMatches,Js as globToRegex,Wb as globalResourceManager,Di as governingLimitCents,Qu as grantFailoverReplicaAccess,Ry as guardDutyManager,bo as handleSpendRequest,Vn as hasAutoWwwVariant,er as hasManagementDashboardSite,Wc as hasProxyUpstream,ob as hashBuffer,ab as hashDirectory,pm as hashFile,cb as hashManifest,mm as hashString,lE as healthCheckManager,Un as hostAcceptsIpv6,_t as hostCondition,qo as hotp,Hr as hourBucket,yA as hourBucketsBetween,FC as imageScanningManager,us as infraEnvFromOutputs,vl as inspectInvocation,qy as installRecursionFetch,Ss as invalidateCache,af as invocationContext,_A as isArmInstanceType,$b as isLikelyTypo,Hn as isLocalDatabase,vb as isLocalDevelopment,Zr as isManagementDashboardSiteName,hr as isNameserverRegistrar,oS as isNodeCryptoAvailable,Id as isOperationAllowed,yo as isQuietHours,vo as isS3RestEndpoint,Ai as isSafePattern,Ld as isStateDirConfigured,$d as isStatePath,Kr as isValidCidr,rC as isValidRegion,wi as isValidTimeZone,aS as isWebCryptoAvailable,Ar as isZoneHost,pn as jobProviderCapability,Es as keyMatchesFilters,GC as lambdaConcurrencyManager,jC as lambdaDLQManager,VC as lambdaDestinationsManager,QC as lambdaLayersManager,qC as lambdaVPCManager,HC as lambdaVersionsManager,gu as lambdaWorkloads,Tl as laravelServerlessEnvDefaults,Mr as listComposeTemplates,ts as listSourceReferences,Ll as loadCloudConfig,Jt as loadTelemetryPolicy,xy as logsManager,Cd as lookbackHoursForSignal,kA as mailEnabled,Fd as mailFirewallPorts,Qf as maintenanceWindowOpen,Af as makeAWSRequest,tS as makeAWSRequestAsync,eS as makeAWSRequestOnce,Rg as managedRuleInSync,cm as managementDashboardSiteName,Tu as manifestDigest,on as matchTotpCounter,WS as mediaObjectHeaders,go as median,Np as medianAbsoluteDeviation,hd as mergeDecisions,en as mergeInfrastructure,hA as mergePriceBooks,gd as meterTelemetry,BC as metricsManager,rg as migrateObjectStorage,xC as migrationManager,cC as multiAccountManager,zb as multiRegionManager,oR as needsRenewal,uE as networkSecurityManager,Rt as nextScheduleRuns,Ce as normalizePublicIpv6,ke as normalizeRuntimeStatus,tt as normalizeScheduleExpression,vf as normalizeSourceEvent,Ue as normalizeSshPublicKey,$p as normalizeTelemetryPolicy,bi as occupiedHostPorts,ra as openApiDocument,ho as optionsForSignal,dC as organizationManager,wl as packagePhpApp,tn as packageServerlessApp,og as pagesAssetHash,nh as pagesDnsRecord,Zd as parallel,gb as parallelMap,pb as parallelWithRetry,Jh as parseCertificateState,El as parseChain,$r as parseCompose,oI as parseComposeCatalog,Pf as parseDockerInspect,Xu as parseDotenv,Bh as parseDrainedSites,Ei as parseHostSiteFragments,nS as parseJSONResponse,oi as parsePreflightFacts,yp as parseSourceDrained,kf as parseSystemdRecords,mp as parseTargetReady,Kc as parseUpstreamPort,lp as parseWorkersPaused,rS as parseXMLResponse,Oi as pathTemplate,jc as pendingSteps,uo as percentOfLimit,OC as performanceManager,Il as phpLayerBuildStage,Gy as phpLayerPackages,nn as phpRuntimeLayerAssets,aI as planComposeTemplateUpgrade,Ad as planEnforcement,op as planIsDestructive,qp as planMitigation,Qh as planServerRename,eA as planSiteMove,_s as planZoneMigration,Mt as policyTag,ci as preflightFailed,cy as previewManager,gy as previewNotifications,Dt as previewSchedule,AA as previousBudgetWindow,ao as priceUsage,mA as priceUsageLines,_h as probeHostRoutes,Fc as probeOriginTls,hb as processInChunks,eu as processSourceWebhook,is as productionChangeReview,By as progressiveDeploymentManager,md as projectSpend,Oo as propagationHeaders,Za as providerEndpoint,wu as publicKeyFingerprint,Ln as qualifyName,rE as queueManagementManager,db as quickHash,Cg as r2Endpoint,ch as r2S3Credentials,kl as rateLimitHeaders,Ki as rateLimitKey,He as readDriverState,Lh as reconcile,gg as reconcileAddressRecords,qf as reconcileCloudflareCdn,Eh as reconcileCloudflareWorkers,Ps as reconcileDeclaredRecords,hS as reconcileJobObservation,dh as reconcileR2Buckets,dn as reconcileSourceWebhook,ns as recordDashboardHostPosture,pS as recordPreDeploySecretScan,mS as recordSkippedSecretScan,_o as recursionBlockedResponse,Be as redactRuntimeConfig,Pd as redactTelemetryText,xi as redactTelemetryValue,Sn as redeployServerlessApp,Jb as regionPairManager,cn as releaseStrategyCapabilities,Cf as releaseTrafficPlan,hi as reloadRpxGateway,Cs as remapKey,ug as removeAddressRecords,Qg as removeDns01ChallengeRecord,yn as removeSiteFromCloudConfig,tu as removeSourceWebhook,fc as removeStaleServerAddressRecords,rd as renderComposeTemplate,$i as renderDdosInstallScript,xd as renderNftablesRuleset,ss as renderServerCron,Bd as renderSysctlFile,Vc as renderWafConfig,yi as renderWafInstallScript,Gc as renewRpxCertificates,_y as replicaManager,NA as requestHash,Sb as requiresReplacement,sE as resetRecursionRuntime,oE as resolveApp,g as resolveAppDatabase,Gh as resolveAttachTarget,Ze as resolveAuthEncryptionKey,fe as resolveCloudProvider,eh as resolveCloudflareCdnPlan,Do as resolveCredentials,fs as resolveDashboardAction,Qc as resolveDashboardAuth,GA as resolveDashboardDomain,VA as resolveDashboardDomains,Ds as resolveDeclaredRecords,SI as resolveDeployBucketName,Q as resolveDeploymentMode,Yn as resolveExecStart,Eo as resolveFailoverStatusCodes,wc as resolveHetznerApiToken,Rr as resolveHostCleanupConfig,Mi as resolveMailService,HI as resolveManagementDashboardSite,Qi as resolveManagementDashboardSites,ec as resolveObjectStorage,re as resolveOriginConnection,Mh as resolvePlan,p as resolveProjectStackName,Lr as resolveProxyUpstreams,yl as resolveQueueNames,oA as resolveQueuedDeploymentCommand,nr as resolveQueues,Vy as resolveRecursionConfig,JA as resolveRegion,oe as resolveRuntimeInventory,Xt as resolveServerlessAppStackName,Hd as resolveServerlessArtifactBucketName,Fi as resolveServerlessAssetBucketName,qi as resolveServerlessRuntime,hI as resolveSiteBucketName,Xs as resolveSiteDeployTarget,u as resolveSiteKind,fI as resolveSiteResourceName,mI as resolveSiteStackName,ii as resolveSshSettings,d as resolveStatePath,yI as resolveStorageBucketName,Zp as resolveStorageFailover,Gt as resolveUiSource,ng as resolveZoneApex,gE as resourceManagementManager,lf as responseToResult,kp as robustZScore,Vt as roleCapabilities,Kl as rollbackImmutableRelease,In as rollbackServerlessApp,fA as roundCents,KC as route53ResolverManager,Fy as route53RoutingManager,Op as routeMatches,np as routesFromFragments,zi as ruleMatches,Uy as runBuildHooks,yd as runEnforcement,Lo as runPhpBuildHooks,rt as runRemoteCommand,Ae as runtimeId,Le as s3OriginBucket,em as s3RegionalDomain,yc as sameCorsRules,Cc as sameLifecycleRules,$n as sameNameservers,ms as sanitizeCloudConfig,s as sanitizeControlPlaneValue,pI as sanitizeName,Hl as sanitizeOidcReturnPath,Rd as saveTelemetryPolicy,Tf as scanForSecrets,Xc as scopeContains,ht as scopeKey,Ic as scpUpload,Fb as searchCommands,Zs as searchControlPlane,Ly as secretsManager,LC as secretsRotationManager,fS as secureContainerRelease,Dy as securityHubManager,MC as securityScanningManager,se as securityScope,Hu as seedFailoverReplicas,an as sendAuthenticationEmail,XC as senderReputationManager,mb as sequence,Yu as serializeDotenv,mi as serverPublicIpv4,My as serviceMeshManager,Lu as setAttachToInCloudConfig,dr as setMaintenance,ds as setSitePropertyInCloudConfig,_d as setStateDir,nR as setupDns01Challenge,cc as setupSmsInfrastructure,No as sha256,jy as sharedRecursionGuard,of as sharedRuntimeLoop,bp as shipsARelease,_S as signCloudFrontCookies,FS as signCloudFrontUrl,R as signRequest,Pl as signRequestAsync,mo as signalDefinition,_ as siteInstallBase,Ii as siteMoveArchivePath,Kh as siteMoveCertArchivePath,zc as siteUnitGlob,Fp as spendNotificationText,Co as spendOpenApiPaths,Tr as sshExec,pe as sshExecOrThrow,Xb as stackDependencyManager,Ka as startLocalDashboardServer,DA as startSpendLoop,Jr as stateDir,L as statePath,dE as staticSiteManager,Yy as storageAdvancedManager,EI as storageFailoverReplicasFromTemplate,IA as streamFocusJsonl,Sd as strongestActiveAction,Sm as suggestCommand,Qb as suggestFlags,rb as suggestIAMPolicy,sb as suggestQuotaIncrease,sC as suggestRegionPairs,iC as suggestRegions,es as syncSourceRepositories,ad as synchronizeComposeVolumes,Zu as synchronizeConfiguredConfiguration,la as synchronizeConfiguredJobs,Oy as syntheticsManager,kd as sysctlHardening,Bf as systemdWorkloads,TA as telemetryBucketLabel,_i as telemetryCursor,Dd as telemetryEstimatedMonthlyCost,vA as telemetryPercentile,Mp as telemetryPolicyKey,ny as templateCache,ip as tenantsOf,ta as testSourceConnection,cd as tieredMicroCents,bg as toApiLifecycleRule,Lc as toCloudflareZoneSettings,Ao as toFocusJsonl,Ed as toFocusRecords,Oh as toInventoryServer,Sf as totp,jo as totpUri,sp as unaccountedSites,Df as unsupportedCapabilities,aA as unsupportedVolumeCapabilities,Du as updateCompatibility,Nu as updateSiteInCloudConfig,ys as uploadStaticFiles,wp as usageDeltaKey,Kt as utcInstantOfLocal,mC as validateAccountStructure,Eb as validateAgainstSchema,dA as validateAttachment,Xf as validateBackupDestination,Vb as validateCommand,YI as validateConfiguration,eb as validateCredentials,Ip as validateDeploymentConfig,cA as validateMountPath,St as validateOriginGroups,Gg as validateResourceLimits,ap as validateServerName,Mg as validateTemplate,Hg as validateTemplateSize,Ac as verifyAddressRecord,gS as verifyArtifactSignature,BS as verifyMediaAccessToken,If as verifyTotp,Ru as verifyUpdateSignature,$s as verifyZoneParity,no as volumeCapabilities,Xg as wafEventTelemetry,bc as waitForCloudInit,Kn as waitForSsh,sr as webhookEndpoint,WI as withCDN,KI as withCache,Pg as withContentHash,zI as withDatabase,df as withInvocation,qI as withMonitoring,JI as withQueue,jI as withSecurity,fb as withTimeout,$g as workerBindings,qs as workerContentHash,Pc as workerInSync,Z as wrapCloudInitUserData,dt as writeDriverState,kC as xrayManager,Eu as zeroCapacity,bA as zeroFill,ld as zoneOffsetMs,co as zonedParts};