@stacksjs/ts-cloud 0.16.46 → 0.16.48

package/dist/{chunk-79snvzcx.js → chunk-p7myt05d.js}

@@ -1,6 +1,6 @@
-var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function ee(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function Ai(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?Js(n.path):".*";if(!Ai(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${ee(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${ee(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${ee(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${ee(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${ee(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function Js(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function Vc(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
+var l={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},d={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function ee(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function Ai(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function b(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let c=n.path?Xs(n.path):".*";if(!Ai(c)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let u=[`SecRule REQUEST_URI "@rx ${ee(c)}"`];if(n.methods?.length)u.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${ee(n.id)}'"`);else u.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${ee(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${ee(n.id)}".`),t.push(u.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${ee(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function Xs(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function Vc(e={},r=[]){let t=e.mode??l.mode,o=[],s=e.paranoiaLevel??l.paranoiaLevel,n=e.inboundThreshold??l.inboundThreshold,c=e.outboundThreshold??l.outboundThreshold,u=e.maxBodyBytes??l.maxBodyBytes,h=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!h)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
 `)}
-`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${ee(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=Js(a);if(!Ai(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${ee(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${ee(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${ee(a.reason)}`),a.pathPattern){if(!Ai(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${ee(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
+`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${u}`,`SecRequestBodyNoFilesLimit ${Math.min(u,131072)}`,`SecRequestBodyLimitAction ${h?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${ee(e.auditLogPath??l.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??l.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${c}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let g=d.bypassBase;for(let a of e.bypassPaths??[]){let y=Xs(a);if(!Ai(y)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${ee(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${ee(y)}" "id:${g},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),g++}let m=d.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${ee(a.reason)}`),a.pathPattern){if(!Ai(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${ee(a.pathPattern)}" "id:${m},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),m++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let p=b(r,d.rateLimitBase);if(p.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...p.lines);let f=d.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${f}.`,a.trim(),""),f++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??l.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
 `)}
 `,unmappedRateLimits:p.unmapped,warnings:o,mode:t}}function yi(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=Vc(e,r);return`#!/usr/bin/env bash
 # Managed by ts-cloud. Installs the zig-waf ruleset.
@@ -34,4 +34,4 @@ fi
 mv "${s}.new" "${s}"
 echo "ts-cloud: WAF config installed (mode: ${n.mode})"
 `}function Xg(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
-export{ee,Ai,Js,Vc,yi,Xg};
+export{ee,Ai,Xs,Vc,yi,Xg};

package/dist/{chunk-yxzdwe7j.js → chunk-vnarc5gc.js}

@@ -1,5 +1,5 @@
-import{No,tn,bl,nn,Lo,$o}from"./chunk-j73ntebp.js";import{$e}from"./chunk-xzcpzxtj.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as k,mkdtempSync as U,rmSync as L,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function S(t,e){return`${r[e]}${t}${r.reset}`}function wn(t){console.log(`${r.green}✓${r.reset} ${t}`)}function eg(t){console.error(`${r.red}✗${r.reset} ${t}`)}function Is(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function B(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function w(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function bs(t){console.log(`
+import{ko,tn,bl,nn,$o,Mo}from"./chunk-kr8aeva1.js";import{$e}from"./chunk-xzcpzxtj.js";import{execFileSync as A}from"node:child_process";import{mkdirSync as k,mkdtempSync as U,rmSync as L,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function S(t,e){return`${r[e]}${t}${r.reset}`}function wn(t){console.log(`${r.green}✓${r.reset} ${t}`)}function eg(t){console.error(`${r.red}✗${r.reset} ${t}`)}function Is(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function B(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function w(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function bs(t){console.log(`
 ${r.bright}${r.cyan}${t}${r.reset}
 `)}var F=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function tg(t,e="cyan"){let n=t.split(`
-`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(S(`┌${a}┐`,e)),n.forEach((l)=>{console.log(S(`│ ${l.padEnd(i)} │`,e))}),console.log(S(`└${a}┘`,e))}function R(t,e){for(let n of e){let i=s(t,n.name);k(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function Ya(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",P=l==="arm64"?"linux/arm64":"linux/amd64",E=e.kind==="php",c=t.onStep??(()=>{}),p=U(s(O(),"tscloud-img-"));try{let f=s(p,"app");k(f,{recursive:!0});let y,v;if(E){Lo({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=$o(n);R(f,o),R(s(p,"runtime"),nn().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let I=e.handlers?.http??"public/index.php";y={http:I,queue:e.handlers?.queue??I,cli:e.handlers?.cli??I},v=No(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await tn({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,v=o.sha256}let C=v.slice(0,16);d(s(p,"Dockerfile"),bl({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let x=new $e(i),u;try{u=(await x.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await x.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${C}`;c("docker build"),A("docker",["build","--platform",P,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await x.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let T=h.proxyEndpoint.replace(/^https?:\/\//,""),b=s(p,".docker");return k(b,{recursive:!0}),d(s(b,"config.json"),JSON.stringify({auths:{[T]:{auth:h.authorizationToken}}})),A("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:b}}),B(`Image: ${m}`),{imageUri:m,tag:C,handlers:y}}finally{L(p,{recursive:!0,force:!0})}}
-export{wn,eg,Is,B,w,bs,tg,Ya};
+`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(S(`┌${a}┐`,e)),n.forEach((l)=>{console.log(S(`│ ${l.padEnd(i)} │`,e))}),console.log(S(`└${a}┘`,e))}function R(t,e){for(let n of e){let i=s(t,n.name);k(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function Za(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",P=l==="arm64"?"linux/arm64":"linux/amd64",E=e.kind==="php",c=t.onStep??(()=>{}),p=U(s(O(),"tscloud-img-"));try{let f=s(p,"app");k(f,{recursive:!0});let y,v;if(E){$o({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=Mo(n);R(f,o),R(s(p,"runtime"),nn().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let I=e.handlers?.http??"public/index.php";y={http:I,queue:e.handlers?.queue??I,cli:e.handlers?.cli??I},v=ko(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await tn({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,v=o.sha256}let C=v.slice(0,16);d(s(p,"Dockerfile"),bl({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let x=new $e(i),u;try{u=(await x.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await x.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${C}`;c("docker build"),A("docker",["build","--platform",P,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await x.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let T=h.proxyEndpoint.replace(/^https?:\/\//,""),b=s(p,".docker");return k(b,{recursive:!0}),d(s(b,"config.json"),JSON.stringify({auths:{[T]:{auth:h.authorizationToken}}})),A("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:b}}),B(`Image: ${m}`),{imageUri:m,tag:C,handlers:y}}finally{L(p,{recursive:!0,force:!0})}}
+export{wn,eg,Is,B,w,bs,tg,Za};

package/dist/{chunk-astzz50p.js → chunk-x0ep5ybv.js}

@@ -8,7 +8,7 @@ var v;try{v=await import("node:crypto")}catch{}var C=new Map,_=100,ee={appstream
 `),w=J(r,d,h,a,P,g??C);return o.searchParams.set("X-Amz-Signature",w),{url:o.toString(),method:t,headers:{},body:s||void 0}}async function ne(e){let{urlObj:n,method:t,body:s,accessKeyId:c,secretAccessKey:r,sessionToken:i,service:a,region:h,timestamp:m,date:d,credentialScope:f,algorithm:p,expiresIn:u,cache:g}=e,o=new URL(n.toString());o.searchParams.set("X-Amz-Algorithm",p),o.searchParams.set("X-Amz-Credential",`${c}/${f}`),o.searchParams.set("X-Amz-Date",m),o.searchParams.set("X-Amz-Expires",String(u));let y=a==="s3"?"UNSIGNED-PAYLOAD":await T(s);if(a==="s3")o.searchParams.set("X-Amz-Content-Sha256",y);let S="host";if(o.searchParams.set("X-Amz-SignedHeaders",S),i)o.searchParams.set("X-Amz-Security-Token",i);let b=O(o.pathname||"/"),A=`host:${o.hostname}
 `,x=j(o.searchParams),l=[t,b,x,A,S,y].join(`
 `),P=[p,m,f,await T(l)].join(`
-`),w=await V(r,d,h,a,P,g??C);return o.searchParams.set("X-Amz-Signature",w),{url:o.toString(),method:t,headers:{},body:s||void 0}}function Mo(e){let{url:n,method:t="GET",expiresIn:s=3600,...c}=e,r=Math.min(s,604800);return R({...c,url:n,method:t,signQuery:!0,expiresIn:r}).url}async function Zy(e){let{url:n,method:t="GET",expiresIn:s=3600,...c}=e,r=Math.min(s,604800);return(await Pl({...c,url:n,method:t,signQuery:!0,expiresIn:r})).url}function N(e){return Object.keys(e).sort().map((n)=>`${n.toLowerCase()}:${e[n].trim().replace(/\s+/g," ")}`).join(`
+`),w=await V(r,d,h,a,P,g??C);return o.searchParams.set("X-Amz-Signature",w),{url:o.toString(),method:t,headers:{},body:s||void 0}}function Fo(e){let{url:n,method:t="GET",expiresIn:s=3600,...c}=e,r=Math.min(s,604800);return R({...c,url:n,method:t,signQuery:!0,expiresIn:r}).url}async function Zy(e){let{url:n,method:t="GET",expiresIn:s=3600,...c}=e,r=Math.min(s,604800);return(await Pl({...c,url:n,method:t,signQuery:!0,expiresIn:r})).url}function N(e){return Object.keys(e).sort().map((n)=>`${n.toLowerCase()}:${e[n].trim().replace(/\s+/g," ")}`).join(`
 `)+`
 `}function G(e){return Object.keys(e).sort().map((n)=>n.toLowerCase()).join(";")}function j(e){let n=[];return e.forEach((t,s)=>{n.push([Q(s),Q(t)])}),n.sort((t,s)=>{if(t[0]<s[0])return-1;if(t[0]>s[0])return 1;if(t[1]<s[1])return-1;if(t[1]>s[1])return 1;return 0}),n.map(([t,s])=>`${t}=${s}`).join("&")}function O(e){return e.split("/").map((n)=>Q(n)).join("/")}function Q(e){return encodeURIComponent(e).replace(/[!'()*]/g,(n)=>`%${n.charCodeAt(0).toString(16).toUpperCase()}`)}function U(e){if(!v)throw Error("Synchronous hash not available in browser. Use signRequestAsync() instead.");return v.createHash("sha256").update(e,"utf8").digest("hex")}function z(e,n){if(!v)throw Error("Synchronous hmac not available in browser. Use signRequestAsync() instead.");return v.createHmac("sha256",e).update(n,"utf8").digest()}async function T(e){let t=new TextEncoder().encode(e),s=await crypto.subtle.digest("SHA-256",t);return Y(new Uint8Array(s))}async function E(e,n){let t=new TextEncoder,s=typeof e==="string"?t.encode(e):e,c=t.encode(n),r=await crypto.subtle.importKey("raw",s.buffer,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),i=await crypto.subtle.sign("HMAC",r,c.buffer);return new Uint8Array(i)}function Y(e){return Array.from(e).map((n)=>n.toString(16).padStart(2,"0")).join("")}function J(e,n,t,s,c,r){let i=`${e}:${n}:${t}:${s}`,a=r.get(i);if(!a){let h=z(`AWS4${e}`,n),m=z(h,t),d=z(m,s);if(a=z(d,"aws4_request"),r.size>=_){let f=r.keys().next().value;if(f)r.delete(f)}r.set(i,a)}return z(a,c).toString("hex")}async function V(e,n,t,s,c,r){let i=`${e}:${n}:${t}:${s}`,a=r.get(i);if(!a){let m=await E(`AWS4${e}`,n),d=await E(m,t),f=await E(d,s);if(a=await E(f,"aws4_request"),r.size>=_){let p=r.keys().next().value;if(p)r.delete(p)}r.set(i,a)}let h=await E(a,c);return Y(h)}function Z(e,n){return n.includes(e)}function H(e,n,t){let s=n*Math.pow(2,e),c=Math.random()*0.3*s;return Math.min(s+c,t)}function I(e){return new Promise((n)=>setTimeout(n,e))}async function Af(e,n){let{maxRetries:t=3,initialDelayMs:s=100,maxDelayMs:c=5000,retryableStatusCodes:r=[429,500,502,503,504],timeoutMs:i=30000}=n??{},a,h;for(let m=0;m<=t;m++){let d=R(e),f={method:d.method,headers:d.headers};if(d.body)f.body=d.body;let p=new AbortController,u=setTimeout(()=>p.abort(),i);f.signal=p.signal;try{let g=await fetch(d.url,f);if(clearTimeout(u),h=g,g.ok)return g;if(m<t&&Z(g.status,r)){let y=H(m,s,c);await I(y);continue}let o=await g.text();throw Error(`AWS API request failed (${g.status}): ${o}`)}catch(g){if(clearTimeout(u),a=g,g instanceof Error&&g.name==="AbortError")a=Error(`Request timed out after ${i}ms`);if(m<t&&!(g instanceof Error&&g.message.includes("AWS API request failed"))){let o=H(m,s,c);await I(o);continue}throw a}}throw a??Error("Request failed after retries")}async function eS(e){return Af(e,{maxRetries:0})}async function tS(e,n){let{maxRetries:t=3,initialDelayMs:s=100,maxDelayMs:c=5000,retryableStatusCodes:r=[429,500,502,503,504],timeoutMs:i=30000}=n??{},a;for(let h=0;h<=t;h++){let m=await Pl(e),d={method:m.method,headers:m.headers};if(m.body)d.body=m.body;let f=new AbortController,p=setTimeout(()=>f.abort(),i);d.signal=f.signal;try{let u=await fetch(m.url,d);if(clearTimeout(p),u.ok)return u;if(h<t&&Z(u.status,r)){let o=H(h,s,c);await I(o);continue}let g=await u.text();throw Error(`AWS API request failed (${u.status}): ${g}`)}catch(u){if(clearTimeout(p),a=u,u instanceof Error&&u.name==="AbortError")a=Error(`Request timed out after ${i}ms`);if(h<t&&!(u instanceof Error&&u.message.includes("AWS API request failed"))){let g=H(h,s,c);await I(g);continue}throw a}}throw a??Error("Request failed after retries")}async function rS(e){let n=await e.text(),t={},s=/<(\w+)>([^<]+)<\/\1>/g,c;while((c=s.exec(n))!==null){let[,r,i]=c;t[r]=i}return t}async function nS(e){return await e.json()}function iS(){C.clear()}function sS(){return C.size}function oS(){return v!==void 0}function aS(){return typeof crypto<"u"&&typeof crypto.subtle<"u"}
-export{Dl,R,Pl,Mo,Zy,Af,eS,tS,rS,nS,iS,sS,oS,aS};
+export{Dl,R,Pl,Fo,Zy,Af,eS,tS,rS,nS,iS,sS,oS,aS};

package/dist/{chunk-r86dh7h7.js → chunk-yme6q7k4.js}

@@ -1,4 +1,4 @@
-import{n}from"./chunk-2sc0s7pc.js";import{A}from"./chunk-r3m1fjd4.js";function E(e){let i=Array.isArray(e?.Items)?e.Items:A(e?.Items?.CNAME);return{Quantity:i.length,Items:i.map(String)}}function lc(e){return A(e?.Origins?.Items?.Origin)}function Le(e){for(let i of lc(e)){let t=String(i.DomainName??"").match(/^(.+?)\.s3[.-]/)?.[1];if(t)return t}return}class S{client;constructor(e,i){this.client=i??new n(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let r=t[i]??t.Item;if(r===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(r)?r:[r]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([r,s])=>!/^[A-Za-z0-9-]{1,64}$/.test(r)||!s||s.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||r.ETag||"",o=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!o||o.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(o.Origins,"Origin"),c=this.collectionItems(o.CacheBehaviors,"CacheBehavior"),u=a.find((f)=>String(f.Id)===t.id),d=c.find((f)=>String(f.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${u.DomainName}; pass replaceExisting only after reviewing the live config`);if(d&&String(d.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${d.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let g={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([f,T])=>({HeaderName:f,HeaderValue:T}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},y=u?a.map((f)=>String(f.Id)===t.id?g:f):[...a,g],m=d?c.map((f)=>String(f.PathPattern)===t.pathPattern?l:f):[...c,l],b=JSON.stringify(a)!==JSON.stringify(y)||JSON.stringify(c)!==JSON.stringify(m);if(!b||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:b,applied:!1,etag:s};o.Origins={Quantity:y.length,Items:{Origin:y}},o.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let p=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(o),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:p.headers?.etag||p.headers?.ETag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||r.ETag||"",o=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!o||o.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(o.Origins,"Origin"),c=this.collectionItems(o.CacheBehaviors,"CacheBehavior"),u=a.find((m)=>String(m.Id)===t.id),d=c.find((m)=>String(m.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(d&&String(d.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!d)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:s};let g=c.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(o.DefaultCacheBehavior?.TargetOriginId)===t.id||g.some((m)=>String(m.TargetOriginId)===t.id),l=h?a:a.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!u,etag:s};o.Origins={Quantity:l.length,Items:{Origin:l}},o.CacheBehaviors={Quantity:g.length,...g.length?{Items:{CacheBehavior:g}}:{}};let y=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(o),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!u,etag:y.headers?.etag||y.headers?.ETag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
+import{n}from"./chunk-2sc0s7pc.js";import{A}from"./chunk-r3m1fjd4.js";function E(e){let i=Array.isArray(e?.Items)?e.Items:A(e?.Items?.CNAME);return{Quantity:i.length,Items:i.map(String)}}function uc(e){return A(e?.Origins?.Items?.Origin)}function Le(e){for(let i of uc(e)){let t=String(i.DomainName??"").match(/^(.+?)\.s3[.-]/)?.[1];if(t)return t}return}class S{client;constructor(e,i){this.client=i??new n(void 0,{profile:e})}collectionItems(e,i){let t=e?.Items??e?.[i];if(!t)return[];if(Array.isArray(t))return t;let r=t[i]??t.Item;if(r===void 0)return typeof t==="object"&&(t.Id||t.PathPattern)?[t]:[];return Array.isArray(r)?r:[r]}validateExistingOriginInput(e,i){if(!/^[A-Z0-9]{8,32}$/.test(e))throw Error("CloudFront distribution ID is invalid");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(i.id))throw Error("CloudFront origin ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(i.domainName))throw Error("CloudFront origin must be a hostname without a scheme or path");let t=i.pathPattern.startsWith("/")?i.pathPattern:`/${i.pathPattern}`;if(t==="/"||t==="/*"||!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]{1,255}$/.test(t))throw Error("CloudFront path pattern must be a non-default absolute pattern");if(i.originPath&&(!i.originPath.startsWith("/")||i.originPath.includes("..")))throw Error("CloudFront origin path must be absolute and traversal-free");if(Object.entries(i.customHeaders??{}).some(([r,s])=>!/^[A-Za-z0-9-]{1,64}$/.test(r)||!s||s.length>1024))throw Error("CloudFront custom origin headers are invalid");return{...i,pathPattern:t}}async upsertExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||r.ETag||"",o=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!o||o.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(o.Origins,"Origin"),c=this.collectionItems(o.CacheBehaviors,"CacheBehavior"),u=a.find((f)=>String(f.Id)===t.id),d=c.find((f)=>String(f.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName&&!t.replaceExisting)throw Error(`Origin ${t.id} already targets ${u.DomainName}; pass replaceExisting only after reviewing the live config`);if(d&&String(d.TargetOriginId)!==t.id&&!t.replaceExisting)throw Error(`Path ${t.pathPattern} already targets ${d.TargetOriginId}; pass replaceExisting only after reviewing the live config`);let g={Id:t.id,DomainName:t.domainName,OriginPath:t.originPath??"",CustomHeaders:{Quantity:Object.keys(t.customHeaders??{}).length,...Object.keys(t.customHeaders??{}).length?{Items:{OriginCustomHeader:Object.entries(t.customHeaders).map(([f,T])=>({HeaderName:f,HeaderValue:T}))}}:{}},CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:t.protocolPolicy??"https-only",OriginSslProtocols:{Quantity:1,Items:{SslProtocol:["TLSv1.2"]}},OriginReadTimeout:30,OriginKeepaliveTimeout:5},ConnectionAttempts:3,ConnectionTimeout:10,...t.originAccessControlId?{OriginAccessControlId:t.originAccessControlId}:{}},h=["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],l={PathPattern:t.pathPattern,TargetOriginId:t.id,ViewerProtocolPolicy:"redirect-to-https",Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",AllowedMethods:{Quantity:h.length,Items:{Method:h},CachedMethods:{Quantity:2,Items:{Method:["GET","HEAD"]}}},SmoothStreaming:!1,FieldLevelEncryptionId:"",TrustedSigners:{Enabled:!1,Quantity:0},TrustedKeyGroups:{Enabled:!1,Quantity:0},LambdaFunctionAssociations:{Quantity:0},FunctionAssociations:{Quantity:0}},y=u?a.map((f)=>String(f.Id)===t.id?g:f):[...a,g],m=d?c.map((f)=>String(f.PathPattern)===t.pathPattern?l:f):[...c,l],b=JSON.stringify(a)!==JSON.stringify(y)||JSON.stringify(c)!==JSON.stringify(m);if(!b||t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:b,applied:!1,etag:s};o.Origins={Quantity:y.length,Items:{Origin:y}},o.CacheBehaviors={Quantity:m.length,...m.length?{Items:{CacheBehavior:m}}:{}};let p=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(o),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,etag:p.headers?.etag||p.headers?.ETag||""}}async removeExistingDistributionOrigin(e,i){let t=this.validateExistingOriginInput(e,i),r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),s=r.headers?.etag||r.headers?.ETag||r.ETag||"",o=r.body?.DistributionConfig||r.DistributionConfig||r.body;if(!o||o.Enabled===void 0||!s)throw Error("Failed to read an ETag-protected CloudFront distribution config");let a=this.collectionItems(o.Origins,"Origin"),c=this.collectionItems(o.CacheBehaviors,"CacheBehavior"),u=a.find((m)=>String(m.Id)===t.id),d=c.find((m)=>String(m.PathPattern)===t.pathPattern);if(u&&String(u.DomainName)!==t.domainName)throw Error(`Origin ${t.id} no longer targets ${t.domainName}; refusing ambiguous removal`);if(d&&String(d.TargetOriginId)!==t.id)throw Error(`Path ${t.pathPattern} no longer targets ${t.id}; refusing ambiguous removal`);if(!d)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!1,applied:!1,originRemoved:!1,etag:s};let g=c.filter((m)=>String(m.PathPattern)!==t.pathPattern),h=String(o.DefaultCacheBehavior?.TargetOriginId)===t.id||g.some((m)=>String(m.TargetOriginId)===t.id),l=h?a:a.filter((m)=>String(m.Id)!==t.id);if(t.dryRun)return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!1,originRemoved:!h&&!!u,etag:s};o.Origins={Quantity:l.length,Items:{Origin:l}},o.CacheBehaviors={Quantity:g.length,...g.length?{Items:{CacheBehavior:g}}:{}};let y=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:this.buildDistributionConfigXml(o),headers:{"Content-Type":"application/xml","If-Match":s},returnHeaders:!0});return{distributionId:e,originId:t.id,domainName:t.domainName,pathPattern:t.pathPattern,changed:!0,applied:!0,originRemoved:!h&&!!u,etag:y.headers?.etag||y.headers?.ETag||""}}async createInvalidation(e){let i=e.callerReference||Date.now().toString(),t=`<?xml version="1.0" encoding="UTF-8"?>
 <InvalidationBatch>
   <Paths>
     <Quantity>${e.paths.length}</Quantity>
@@ -128,4 +128,4 @@ ${Object.entries(e).filter(([a])=>!a.startsWith("@_")).map(([a,c])=>o(a,c,"  ","
     </Items>
   </CustomErrorResponses>`}
 </DistributionConfig>`,C=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/distribution",body:T,headers:{"Content-Type":"application/xml"},returnHeaders:!0}),I=C.body?.Distribution||C.Distribution||C.body||C;return{Id:I.Id,ARN:I.ARN,DomainName:I.DomainName,Status:I.Status,ETag:C.headers?.etag||C.ETag||""}}async createMediaDistributionForS3(e){return this.createDistributionForS3({...e,defaultRootObject:"",mediaDelivery:!0,comment:e.comment??`Media distribution for ${e.bucketName}`})}async listPublicKeys(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/public-key"});return this.collectionItems(e.PublicKeyList??e,"PublicKeySummary").map((t)=>({Id:String(t.Id),Name:String(t.Name),Comment:t.Comment?String(t.Comment):void 0}))}async createPublicKey(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront public key name is invalid");if(!e.encodedKey.includes("BEGIN PUBLIC KEY"))throw TypeError("CloudFront public key must be PEM encoded");let i=(s)=>s.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/public-key",headers:{"Content-Type":"application/xml"},body:`<PublicKeyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><CallerReference>${i(e.callerReference??`${Date.now()}-${e.name}`)}</CallerReference><Name>${i(e.name)}</Name><EncodedKey>${i(e.encodedKey)}</EncodedKey><Comment>${i(e.comment??"")}</Comment></PublicKeyConfig>`}),r=t.PublicKey??t;return{Id:String(r.Id),Name:String(r.PublicKeyConfig?.Name??e.name),EncodedKey:String(r.PublicKeyConfig?.EncodedKey??e.encodedKey),Comment:String(r.PublicKeyConfig?.Comment??e.comment??"")}}async listKeyGroups(){let e=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:"/2020-05-31/key-group"});return this.collectionItems(e.KeyGroupList??e,"KeyGroupSummary").map((t)=>({Id:String(t.KeyGroup?.Id??t.Id),Name:String(t.KeyGroup?.KeyGroupConfig?.Name??t.KeyGroupConfig?.Name??t.Name),Items:this.collectionItems(t.KeyGroup?.KeyGroupConfig?.Items??t.KeyGroupConfig?.Items??t.Items,"Item").map(String),Comment:t.KeyGroup?.KeyGroupConfig?.Comment??t.KeyGroupConfig?.Comment??t.Comment}))}async createKeyGroup(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e.name))throw TypeError("CloudFront key group name is invalid");let i=[...new Set(e.publicKeyIds)];if(i.length===0)throw TypeError("CloudFront key group requires at least one public key");let t=(a)=>a.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;"),r=i.map((a)=>`<Item>${t(a)}</Item>`).join(""),s=await this.client.request({service:"cloudfront",region:"us-east-1",method:"POST",path:"/2020-05-31/key-group",headers:{"Content-Type":"application/xml"},body:`<KeyGroupConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/"><Name>${t(e.name)}</Name><Items>${r}</Items><Comment>${t(e.comment??"")}</Comment></KeyGroupConfig>`}),o=s.KeyGroup??s;return{Id:String(o.Id),Name:String(o.KeyGroupConfig?.Name??e.name),Items:i,Comment:String(o.KeyGroupConfig?.Comment??e.comment??"")}}static getS3BucketPolicyForCloudFront(e,i){return{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:`arn:aws:s3:::${e}/*`,Condition:{StringEquals:{"AWS:SourceArn":i}}}]}}async waitForDistributionDeployed(e,i=60){for(let t=0;t<i;t++){if((await this.getDistribution(e)).Status==="Deployed")return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async disableDistribution(e){let i=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),t=i.headers?.etag||i.headers?.ETag||"",r=i.body?.DistributionConfig||(i.body?.Enabled!==void 0?i.body:void 0)||i.DistributionConfig;if(!r||r.Enabled===void 0)throw Error("Failed to get current distribution config");r.Enabled=!1;let s=this.buildDistributionConfigXml(r),o=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:s,headers:{"Content-Type":"application/xml","If-Match":t},returnHeaders:!0});return{ETag:o.headers?.etag||o.headers?.ETag||o.ETag||""}}async deleteDistribution(e,i){let t=i||"";if(!t){let r=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}`,returnHeaders:!0});t=r.headers?.etag||r.headers?.ETag||""}await this.client.request({service:"cloudfront",region:"us-east-1",method:"DELETE",path:`/2020-05-31/distribution/${e}`,headers:{"If-Match":t}})}async waitForDistributionDisabled(e,i=60){for(let t=0;t<i;t++){let r=await this.getDistribution(e);if(r.Status==="Deployed"&&!r.Enabled)return!0;await new Promise((s)=>setTimeout(s,30000))}return!1}async removeAlias(e,i){let t=await this.client.request({service:"cloudfront",region:"us-east-1",method:"GET",path:`/2020-05-31/distribution/${e}/config`,returnHeaders:!0}),r=t.headers?.etag||t.headers?.ETag||"",s=t.body?.DistributionConfig||(t.body?.Enabled!==void 0?t.body:void 0)||t.DistributionConfig;if(!s||s.Enabled===void 0)throw Error("Failed to get current distribution config");let o=E(s.Aliases).Items;if(o.length===0)throw Error("Distribution has no aliases to remove");let a=o.filter((d)=>d!==i);if(a.length===o.length)throw Error(`Alias ${i} not found in distribution`);if(s.Aliases.Quantity=a.length,s.Aliases.Items=a.length>0?{CNAME:a}:void 0,a.length===0)s.ViewerCertificate={CloudFrontDefaultCertificate:!0,MinimumProtocolVersion:"TLSv1.2_2021"};let c=this.buildDistributionConfigXml(s),u=await this.client.request({service:"cloudfront",region:"us-east-1",method:"PUT",path:`/2020-05-31/distribution/${e}/config`,body:c,headers:{"Content-Type":"application/xml","If-Match":r},returnHeaders:!0});return{ETag:u.headers?.etag||u.headers?.ETag||u.ETag||""}}}
-export{lc,Le,S};
+export{uc,Le,S};

package/dist/deploy/index.js

@@ -1 +1 @@
-import{An,yn,Nu,ds,ku,Bu,xu,Ba,Ou,_u,Vf,Lu,C,$u,ls,xe,Mu,Fu,bS,Uu,Qu,Hu,Gu,Vu,qf,CS,ES,vS,jf,zf,TS,wS,Kf,Wf,RS,us,cr,xa,Sn,In,dr,rt,Pt,gs,Jf,bn,qu,ju,Oa,ms,En,fs,Ka}from"../chunk-j2jex596.js";import{Wa,vn,Tn,hs,As,ys,Ss,Ja,Xa}from"../chunk-wmxw3pe4.js";import{Ya}from"../chunk-yxzdwe7j.js";import"../chunk-1dbe68z7.js";import"../chunk-nryh43p1.js";import"../chunk-r86dh7h7.js";import"../chunk-xzcpzxtj.js";import"../chunk-fh7apa5n.js";import"../chunk-v1bzy3tp.js";import"../chunk-vb4t2r4r.js";import{lg,fc,ug,Ce,hc,Un,gg,Ac,Uc,zs,Qc,Gt,fi,Ks}from"../chunk-46bazfbh.js";import"../chunk-xxq1ygp9.js";import"../chunk-vjph4eh0.js";import"../chunk-jpdpr7k6.js";import"../chunk-2sc0s7pc.js";import{pt,tA,Kc,bi,Ci,Ei,Sp}from"../chunk-zwkm3pkb.js";import{_,_r,Lr,Wc,Xs,u,rA,Ip,bp,iI,sI}from"../chunk-tj852ns1.js";import"../chunk-jzpwfgg1.js";import"../chunk-j73ntebp.js";import"../chunk-astzz50p.js";export{tA as DEFAULT_SITE_PORT_RANGE,pt as HOST_SITES_DIR,hc as IPV6_EXCLUDED_HOST_LABELS,Uc as MANAGEMENT_DASHBOARD_SITE,An as addSiteToCloudConfig,Sp as allocateSitePorts,RS as buildAndPushContainerImage,Ya as buildAndPushServerlessImage,cr as buildFunctionEnv,Ci as buildHostSitePortsScript,Ks as buildManagementDashboardArtifact,Pt as buildServerTopology,gs as buildServerlessTopology,Jf as buildTopology,Oa as collectEgressMetrics,lg as collectServerDnsDomains,Wf as createContainerImageDependencies,jf as createExistingStaticFullStackDependencies,qf as createStaticApiOriginDependencies,En as dashboardActions,zs as dashboardCredentialsFile,Mu as dashboardPageRoutes,Gu as deleteFailoverReplicaBuckets,Ja as deleteStaticSite,TS as deployExistingStaticFullStack,xa as deployServerlessApp,sI as deployShipsFiles,Vu as deploySite,CS as deployStaticApiOrigin,As as deployStaticSite,Xa as deployStaticSiteFull,vn as deployStaticSiteWithExternalDns,Tn as deployStaticSiteWithExternalDnsFull,qu as egressReportMetrics,C as ensureDashboardActor,Uu as ensureFailoverReplicaBuckets,fi as ensureManagementDashboard,wS as estimateExistingStaticFullStackMonthlyCost,vS as estimateStaticApiOriginMonthlyCost,ju as fetchEgressReport,zf as generateExistingStaticFullStackTemplate,Wa as generateExternalDnsStaticSiteTemplate,hs as generateStaticSiteTemplate,Qu as grantFailoverReplicaAccess,rA as hasComputeConfigured,Wc as hasProxyUpstream,Kf as hashContainerContext,Un as hostAcceptsIpv6,us as infraEnvFromOutputs,$u as initializeDashboardControlPlane,Ss as invalidateCache,_r as isPhpSite,Ba as isValidHostname,Ce as normalizePublicIpv6,bi as occupiedHostPorts,Ei as parseHostSiteFragments,Kc as parseUpstreamPort,gg as reconcileAddressRecords,Sn as redeployServerlessApp,ug as removeAddressRecords,yn as removeSiteFromCloudConfig,fc as removeStaleServerAddressRecords,Ou as renderAliasesValue,xu as renderEnvValue,_u as renderRedirectsValue,Vf as renderSiteSnippet,ku as renderSslValue,Bu as renderStringValue,fs as resolveDashboardAction,Qc as resolveDashboardAuth,bn as resolveDashboardData,Fu as resolveLegacyDashboardRoute,Lr as resolveProxyUpstreams,Xs as resolveSiteDeployTarget,u as resolveSiteKind,Gt as resolveUiSource,In as rollbackServerlessApp,bS as routesForDashboard,rt as runRemoteCommand,ms as sanitizeCloudConfig,Hu as seedFailoverReplicas,Lu as setAttachToInCloudConfig,dr as setMaintenance,ds as setSitePropertyInCloudConfig,bp as shipsARelease,iI as shipsToBucket,_ as siteInstallBase,Ka as startLocalDashboardServer,ls as synchronizeDashboardUsers,xe as trackDashboardOperation,Nu as updateSiteInCloudConfig,ys as uploadStaticFiles,Ip as validateDeploymentConfig,Ac as verifyAddressRecord,ES as verifyStaticApiOrigin};
+import{An,yn,Nu,ds,ku,Bu,xu,xa,Ou,_u,Vf,Lu,C,$u,ls,xe,Mu,Fu,bS,Uu,Qu,Hu,Gu,Vu,qf,CS,ES,vS,jf,zf,TS,wS,Kf,Wf,RS,us,cr,Oa,Sn,In,dr,rt,Pt,gs,Jf,bn,qu,ju,_a,ms,En,fs,Wa}from"../chunk-8vtrjmmj.js";import{Ja,vn,Tn,hs,As,ys,Ss,Xa,Ya}from"../chunk-fpkpwbv3.js";import{Za}from"../chunk-vnarc5gc.js";import"../chunk-2pns2rkf.js";import"../chunk-nryh43p1.js";import"../chunk-yme6q7k4.js";import"../chunk-xzcpzxtj.js";import"../chunk-fh7apa5n.js";import"../chunk-gh0ghb21.js";import"../chunk-vb4t2r4r.js";import{lg,hc,ug,Ce,Ac,Un,gg,yc,Uc,Ks,Qc,Gt,fi,Ws}from"../chunk-ndrpehf8.js";import"../chunk-xxq1ygp9.js";import"../chunk-vjph4eh0.js";import"../chunk-jpdpr7k6.js";import"../chunk-2sc0s7pc.js";import{pt,tA,Kc,bi,Ci,Ei,Sp}from"../chunk-6mp1fyxe.js";import{_,_r,Lr,Wc,Ys,u,rA,Ip,bp,iI,sI}from"../chunk-jhtp3m31.js";import"../chunk-da62knsv.js";import"../chunk-kr8aeva1.js";import"../chunk-x0ep5ybv.js";export{tA as DEFAULT_SITE_PORT_RANGE,pt as HOST_SITES_DIR,Ac as IPV6_EXCLUDED_HOST_LABELS,Uc as MANAGEMENT_DASHBOARD_SITE,An as addSiteToCloudConfig,Sp as allocateSitePorts,RS as buildAndPushContainerImage,Za as buildAndPushServerlessImage,cr as buildFunctionEnv,Ci as buildHostSitePortsScript,Ws as buildManagementDashboardArtifact,Pt as buildServerTopology,gs as buildServerlessTopology,Jf as buildTopology,_a as collectEgressMetrics,lg as collectServerDnsDomains,Wf as createContainerImageDependencies,jf as createExistingStaticFullStackDependencies,qf as createStaticApiOriginDependencies,En as dashboardActions,Ks as dashboardCredentialsFile,Mu as dashboardPageRoutes,Gu as deleteFailoverReplicaBuckets,Xa as deleteStaticSite,TS as deployExistingStaticFullStack,Oa as deployServerlessApp,sI as deployShipsFiles,Vu as deploySite,CS as deployStaticApiOrigin,As as deployStaticSite,Ya as deployStaticSiteFull,vn as deployStaticSiteWithExternalDns,Tn as deployStaticSiteWithExternalDnsFull,qu as egressReportMetrics,C as ensureDashboardActor,Uu as ensureFailoverReplicaBuckets,fi as ensureManagementDashboard,wS as estimateExistingStaticFullStackMonthlyCost,vS as estimateStaticApiOriginMonthlyCost,ju as fetchEgressReport,zf as generateExistingStaticFullStackTemplate,Ja as generateExternalDnsStaticSiteTemplate,hs as generateStaticSiteTemplate,Qu as grantFailoverReplicaAccess,rA as hasComputeConfigured,Wc as hasProxyUpstream,Kf as hashContainerContext,Un as hostAcceptsIpv6,us as infraEnvFromOutputs,$u as initializeDashboardControlPlane,Ss as invalidateCache,_r as isPhpSite,xa as isValidHostname,Ce as normalizePublicIpv6,bi as occupiedHostPorts,Ei as parseHostSiteFragments,Kc as parseUpstreamPort,gg as reconcileAddressRecords,Sn as redeployServerlessApp,ug as removeAddressRecords,yn as removeSiteFromCloudConfig,hc as removeStaleServerAddressRecords,Ou as renderAliasesValue,xu as renderEnvValue,_u as renderRedirectsValue,Vf as renderSiteSnippet,ku as renderSslValue,Bu as renderStringValue,fs as resolveDashboardAction,Qc as resolveDashboardAuth,bn as resolveDashboardData,Fu as resolveLegacyDashboardRoute,Lr as resolveProxyUpstreams,Ys as resolveSiteDeployTarget,u as resolveSiteKind,Gt as resolveUiSource,In as rollbackServerlessApp,bS as routesForDashboard,rt as runRemoteCommand,ms as sanitizeCloudConfig,Hu as seedFailoverReplicas,Lu as setAttachToInCloudConfig,dr as setMaintenance,ds as setSitePropertyInCloudConfig,bp as shipsARelease,iI as shipsToBucket,_ as siteInstallBase,Wa as startLocalDashboardServer,ls as synchronizeDashboardUsers,xe as trackDashboardOperation,Nu as updateSiteInCloudConfig,ys as uploadStaticFiles,Ip as validateDeploymentConfig,yc as verifyAddressRecord,ES as verifyStaticApiOrigin};

package/dist/deploy/server-dns.d.ts

@@ -1,11 +1,17 @@
 import type { DnsProvider, DnsRecordResult } from '../dns/types';
 interface ServerSite {
     domain?: string;
+    aliases?: string[];
     deploy?: string;
     redirect?: string;
     start?: string;
 }
-/** Domains served by a compute box, including redirect-only virtual hosts. */
+/**
+ * Domains served by a compute box, including redirect-only virtual hosts and
+ * every site's `aliases`. A wildcard alias (`*.example.com`) is published as
+ * the wildcard record itself, which every name under it resolves through
+ * unless it has a record of its own.
+ */
 export declare function collectServerDnsDomains(sites?: Record<string, ServerSite>): Set<string>;
 /**
  * A compute deployment owns one address per managed hostname. After an upsert,

package/dist/dns/index.js

@@ -1 +1 @@
-import{at,le,Me,M,Mt,Ln,Ds,Ps,hr,Ar,$n,yr,Ns,ks,Bs,xs,X,Os,_s,Ls,$s,ue,Ms,Fs,Us,D,pc,Mn,mc}from"../chunk-v1bzy3tp.js";import"../chunk-vb4t2r4r.js";import"../chunk-2sc0s7pc.js";export{M as CloudflareProvider,Mn as DnsProviderFactory,Me as GoDaddyProvider,at as PROXIABLE_RECORD_TYPES,le as PorkbunProvider,X as Route53Provider,ue as UnifiedDnsValidator,Bs as applyDeclaredZoneSettings,Ls as applyZoneMigration,D as createDnsProvider,Fs as createGoDaddyValidator,Ms as createPorkbunValidator,Us as createRoute53Validator,yr as delegateZone,Ns as delegateZoneFromConfig,ks as describeDelegation,xs as describeZoneSettings,pc as detectDnsProvider,mc as dnsProviders,Os as exportRoute53Zone,hr as isNameserverRegistrar,Ar as isZoneHost,_s as planZoneMigration,Mt as policyTag,Ln as qualifyName,Ps as reconcileDeclaredRecords,Ds as resolveDeclaredRecords,$n as sameNameservers,$s as verifyZoneParity};
+import{at,le,Me,M,Mt,Ln,Ds,Ps,hr,Ar,$n,yr,Ns,ks,Bs,xs,X,Os,_s,Ls,$s,ue,Ms,Fs,Us,D,mc,Mn,fc}from"../chunk-gh0ghb21.js";import"../chunk-vb4t2r4r.js";import"../chunk-2sc0s7pc.js";export{M as CloudflareProvider,Mn as DnsProviderFactory,Me as GoDaddyProvider,at as PROXIABLE_RECORD_TYPES,le as PorkbunProvider,X as Route53Provider,ue as UnifiedDnsValidator,Bs as applyDeclaredZoneSettings,Ls as applyZoneMigration,D as createDnsProvider,Fs as createGoDaddyValidator,Ms as createPorkbunValidator,Us as createRoute53Validator,yr as delegateZone,Ns as delegateZoneFromConfig,ks as describeDelegation,xs as describeZoneSettings,mc as detectDnsProvider,fc as dnsProviders,Os as exportRoute53Zone,hr as isNameserverRegistrar,Ar as isZoneHost,_s as planZoneMigration,Mt as policyTag,Ln as qualifyName,Ps as reconcileDeclaredRecords,Ds as resolveDeclaredRecords,$n as sameNameservers,$s as verifyZoneParity};

package/dist/drivers/index.js

@@ -1 +1 @@
-import{Qn,Ft,Ir,Ut,Hn,Gn,Vn,qn,hg,yc,Y,Er,ph,jn,Sc,Ee,ve,Fe,x,vr,zn,Tr,pe,Ic,Kn,bc,Wn,Cc,wr,mh,fh,Sg,Ig,hh,Ah,yh,Rr,Jn,bg,Gs,Xn,Yn,Zn,ei,ti,Ec,vc,Dr,wc,Ue,Z,Rc,ct,Qe,He,dt,Te,Vs,Dc,Cg,Eg,Pc,vg,lt,ri,Nc,Tg,wg,kc,Pr,we,Bc,Rg,Dg,qs,ni,ut,Pg,Ng,kg,Bg,xg,Og,_g,Lg,$g,ii,si,oi,ai,ci,di,li,Mg,Fg,Nr,O,js,Ug,Qg,Hg,xc,Gg,Vg,Sh,Oc,Ih,bh,qg,jg,Ch,Eh,vh,_c,zg,Th,wh,Rh,ui,gi,pi,mi,Lc,$c,Mc,Fc,Dh,Ws,Hc,hi,Gc,Kg,Wg,Jg,Ph}from"../chunk-46bazfbh.js";import"../chunk-xxq1ygp9.js";import"../chunk-vjph4eh0.js";import"../chunk-jpdpr7k6.js";import"../chunk-2sc0s7pc.js";import"../chunk-tj852ns1.js";import"../chunk-j73ntebp.js";import"../chunk-astzz50p.js";export{Fc as AwsBoxProvisioner,vr as AwsDriver,Hg as BOOT_PARTITION_LABEL,js as CloudDriverFactory,Ig as DEFAULT_HOST_CLEANUP_ESCALATED,Ah as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,hh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Sg as DEFAULT_HOST_CLEANUP_RETENTION,yh as DEFAULT_HOST_CLEANUP_SCHEDULE,Gn as DEFAULT_RPX_CERTS_DIR,Qg as FIRST_BOOT_SCRIPT_PATH,wr as HOST_ARTIFACT_CACHE_DIR,mh as HOST_CLEANUP_SCRIPT_PATH,fh as HOST_CLEANUP_UNIT,Mc as HetznerBoxProvisioner,Dr as HetznerClient,Te as HetznerDriver,Rc as LEGACY_DRIVER_STATE_DIR,Vs as LocalBoxDriver,Wg as MANAGED_CACHE_POLICY_DISABLED,Kg as MANAGED_CACHE_POLICY_OPTIMIZED,Jg as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Dg as RASPBERRY_PI_DEFAULT_SWAP_GB,Cc as REMOTE_SCRIPT_RUNNER,jn as RPX_DIR,Sc as RPX_LAUNCHER_PATH,Ee as RPX_SERVICE_NAME,Bc as SSH_BOOTSTRAP_MARKER_DIR,we as SSH_BOOTSTRAP_VERSION,ut as SSH_DEFAULTS,li as SSH_DEPLOY_STORAGE_PATH,Cg as SSH_INSECURE_HOST_KEY_OPTS,Eg as SSH_KEEPALIVE_OPTS,si as SSH_PREFLIGHT_SCRIPT,Mg as SSH_SKIP_BOOTSTRAP_ENV,Nr as SshDriver,Pr as SystemSshTransport,Lc as UBUNTU_2404_AMI_PARAM,Rh as acquireResizeLock,Ch as applyHetznerHostOptimization,qs as assertArchSupported,Fg as assertSshComputeConfig,Ec as buildAwsArtifactFetch,$c as buildBoxUserData,Ph as buildCloudFrontOriginConfig,xc as buildCloudInitFirstBoot,jg as buildHetznerHostOptimizationScript,Xn as buildHostCleanupDeployScript,bg as buildHostCleanupExecutable,Gs as buildHostCleanupInstallScript,Jn as buildHostCleanupScript,vc as buildLocalArtifactFetch,Y as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Er as buildRpxLbConfig,ve as buildRpxProvisionScript,vg as buildScpArgsFor,Zn as buildSiteDeployScript,zn as buildSshArgs,Pc as buildSshArgsFor,ni as buildSshBootstrapScript,ei as buildStaticSiteDeployScript,Ug as cloudDrivers,Eh as collectHetznerHostOptimizationReport,Oc as collectHetznerResizeManifest,Dh as createBoxProvisioner,O as createCloudDriver,Hc as deployAllComputeSites,Ws as deploySiteRelease,yc as deriveRouteId,Qn as describeScriptSyntaxError,ct as driverStateDir,Qe as driverStatePath,gi as ensureFirewall,pi as ensureServer,ui as ensureSshKey,ai as evaluatePreflight,Sh as executeHetznerServerResize,wg as findKnownHostKey,di as formatPreflightFindings,Ft as formatSshFailure,qn as gatewayHostnames,x as generateUbuntuAppCloudInit,Vn as hasAutoWwwVariant,Dc as isBoxMode,Vg as isHetznerCapacityError,Hn as isLocalDatabase,Tg as knownHostsLine,Nc as knownHostsToken,hg as normalizeRoutePath,Ue as normalizeSshPublicKey,oi as parsePreflightFacts,Gg as planHetznerServerResize,ci as preflightFailed,Ih as prepareHetznerResize,He as readDriverState,Th as readResizeCheckpoint,ti as releaseTarballTmpPath,hi as reloadRpxGateway,Wn as remoteScriptRunner,ph as renderRpxLauncher,Gc as renewRpxCertificates,_c as resizeCheckpointPath,zg as resizeLockPath,Yn as resolveExecStart,wc as resolveHetznerApiToken,qg as resolveHetznerHostOptimizationPlan,Rr as resolveHostCleanupConfig,xg as resolveSshHostKeyPolicy,Pg as resolveSshHosts,$g as resolveSshLan,kg as resolveSshPort,Bg as resolveSshPrivateKeyPath,_g as resolveSshProfile,Lg as resolveSshPublicIp,ii as resolveSshSettings,Og as resolveSshSudo,Ng as resolveSshUser,ri as scanHostKey,Ic as scpUpload,mi as serverPublicIpv4,Rg as sshBootstrapMarkerPath,Tr as sshExec,pe as sshExecOrThrow,lt as sshHostKeyFingerprint,kc as sshKnownHostsPath,Ut as summarizeRemoteFailures,Ir as surfaceRemoteNotices,vh as verifyHetznerHostOptimization,bh as verifyHetznerResize,bc as waitForCloudInit,Kn as waitForSsh,Z as wrapCloudInitUserData,dt as writeDriverState,wh as writeResizeCheckpoint};
+import{Qn,Ft,Ir,Ut,Hn,Gn,Vn,qn,hg,Gs,Y,Er,ph,jn,Sc,Ee,ve,Fe,x,vr,zn,Tr,pe,Ic,Kn,bc,Wn,Cc,wr,mh,fh,Sg,Ig,hh,Ah,yh,Rr,Jn,bg,Vs,Xn,Yn,Zn,ei,ti,Ec,vc,Dr,wc,Ue,Z,Rc,ct,Qe,He,dt,Te,qs,Dc,Cg,Eg,Pc,vg,lt,ri,Nc,Tg,wg,kc,Pr,we,Bc,Rg,Dg,js,ni,ut,Pg,Ng,kg,Bg,xg,Og,_g,Lg,$g,ii,si,oi,ai,ci,di,li,Mg,Fg,Nr,O,zs,Ug,Qg,Hg,xc,Gg,Vg,Sh,Oc,Ih,bh,qg,jg,Ch,Eh,vh,_c,zg,Th,wh,Rh,ui,gi,pi,mi,Lc,$c,Mc,Fc,Dh,Js,Hc,hi,Gc,Kg,Wg,Jg,Ph}from"../chunk-ndrpehf8.js";import"../chunk-xxq1ygp9.js";import"../chunk-vjph4eh0.js";import"../chunk-jpdpr7k6.js";import"../chunk-2sc0s7pc.js";import"../chunk-jhtp3m31.js";import"../chunk-kr8aeva1.js";import"../chunk-x0ep5ybv.js";export{Fc as AwsBoxProvisioner,vr as AwsDriver,Hg as BOOT_PARTITION_LABEL,zs as CloudDriverFactory,Ig as DEFAULT_HOST_CLEANUP_ESCALATED,Ah as DEFAULT_HOST_CLEANUP_HIGH_WATER_PERCENT,hh as DEFAULT_HOST_CLEANUP_LOW_WATER_PERCENT,Sg as DEFAULT_HOST_CLEANUP_RETENTION,yh as DEFAULT_HOST_CLEANUP_SCHEDULE,Gn as DEFAULT_RPX_CERTS_DIR,Qg as FIRST_BOOT_SCRIPT_PATH,wr as HOST_ARTIFACT_CACHE_DIR,mh as HOST_CLEANUP_SCRIPT_PATH,fh as HOST_CLEANUP_UNIT,Mc as HetznerBoxProvisioner,Dr as HetznerClient,Te as HetznerDriver,Rc as LEGACY_DRIVER_STATE_DIR,qs as LocalBoxDriver,Wg as MANAGED_CACHE_POLICY_DISABLED,Kg as MANAGED_CACHE_POLICY_OPTIMIZED,Jg as MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,Dg as RASPBERRY_PI_DEFAULT_SWAP_GB,Cc as REMOTE_SCRIPT_RUNNER,jn as RPX_DIR,Sc as RPX_LAUNCHER_PATH,Ee as RPX_SERVICE_NAME,Bc as SSH_BOOTSTRAP_MARKER_DIR,we as SSH_BOOTSTRAP_VERSION,ut as SSH_DEFAULTS,li as SSH_DEPLOY_STORAGE_PATH,Cg as SSH_INSECURE_HOST_KEY_OPTS,Eg as SSH_KEEPALIVE_OPTS,si as SSH_PREFLIGHT_SCRIPT,Mg as SSH_SKIP_BOOTSTRAP_ENV,Nr as SshDriver,Pr as SystemSshTransport,Lc as UBUNTU_2404_AMI_PARAM,Rh as acquireResizeLock,Ch as applyHetznerHostOptimization,js as assertArchSupported,Fg as assertSshComputeConfig,Ec as buildAwsArtifactFetch,$c as buildBoxUserData,Ph as buildCloudFrontOriginConfig,xc as buildCloudInitFirstBoot,jg as buildHetznerHostOptimizationScript,Xn as buildHostCleanupDeployScript,bg as buildHostCleanupExecutable,Vs as buildHostCleanupInstallScript,Jn as buildHostCleanupScript,vc as buildLocalArtifactFetch,Y as buildRpxConfig,Fe as buildRpxFragmentRefreshScript,Er as buildRpxLbConfig,ve as buildRpxProvisionScript,vg as buildScpArgsFor,Zn as buildSiteDeployScript,zn as buildSshArgs,Pc as buildSshArgsFor,ni as buildSshBootstrapScript,ei as buildStaticSiteDeployScript,Ug as cloudDrivers,Eh as collectHetznerHostOptimizationReport,Oc as collectHetznerResizeManifest,Dh as createBoxProvisioner,O as createCloudDriver,Hc as deployAllComputeSites,Js as deploySiteRelease,Gs as deriveRouteId,Qn as describeScriptSyntaxError,ct as driverStateDir,Qe as driverStatePath,gi as ensureFirewall,pi as ensureServer,ui as ensureSshKey,ai as evaluatePreflight,Sh as executeHetznerServerResize,wg as findKnownHostKey,di as formatPreflightFindings,Ft as formatSshFailure,qn as gatewayHostnames,x as generateUbuntuAppCloudInit,Vn as hasAutoWwwVariant,Dc as isBoxMode,Vg as isHetznerCapacityError,Hn as isLocalDatabase,Tg as knownHostsLine,Nc as knownHostsToken,hg as normalizeRoutePath,Ue as normalizeSshPublicKey,oi as parsePreflightFacts,Gg as planHetznerServerResize,ci as preflightFailed,Ih as prepareHetznerResize,He as readDriverState,Th as readResizeCheckpoint,ti as releaseTarballTmpPath,hi as reloadRpxGateway,Wn as remoteScriptRunner,ph as renderRpxLauncher,Gc as renewRpxCertificates,_c as resizeCheckpointPath,zg as resizeLockPath,Yn as resolveExecStart,wc as resolveHetznerApiToken,qg as resolveHetznerHostOptimizationPlan,Rr as resolveHostCleanupConfig,xg as resolveSshHostKeyPolicy,Pg as resolveSshHosts,$g as resolveSshLan,kg as resolveSshPort,Bg as resolveSshPrivateKeyPath,_g as resolveSshProfile,Lg as resolveSshPublicIp,ii as resolveSshSettings,Og as resolveSshSudo,Ng as resolveSshUser,ri as scanHostKey,Ic as scpUpload,mi as serverPublicIpv4,Rg as sshBootstrapMarkerPath,Tr as sshExec,pe as sshExecOrThrow,lt as sshHostKeyFingerprint,kc as sshKnownHostsPath,Ut as summarizeRemoteFailures,Ir as surfaceRemoteNotices,vh as verifyHetznerHostOptimization,bh as verifyHetznerResize,bc as waitForCloudInit,Kn as waitForSsh,Z as wrapCloudInitUserData,dt as writeDriverState,wh as writeResizeCheckpoint};

package/dist/drivers/shared/rpx-gateway.d.ts

@@ -52,13 +52,15 @@ export declare function hasAutoWwwVariant(domain: string): boolean;
  * else's certificate and a browser warning, which is strictly worse than the
  * name not existing.
  *
- * Two rules, both mirroring the route builder:
+ * Three rules, all mirroring the route builder:
  *  - every site's literal `domain`, including an explicitly declared
  *    `www.<sub>.<apex>` (that host gets a real route here, so it needs a real
  *    record — collapsing it to its apex is what left `www.ps1.stacksjs.com`
  *    resolving onto another tenant's cert);
  *  - plus `www.<domain>` for two-label apexes, which the gateway synthesizes
- *    itself unless `autoWww` is off.
+ *    itself unless `autoWww` is off;
+ *  - plus every site's `aliases`, a wildcard one (`*.example.com`) as the
+ *    wildcard record.
  *
  * `bucket` sites are excluded: they live on object storage + CDN, not this box.
  */
@@ -274,7 +276,27 @@ export interface RpxGatewayConfig {
         value: string;
         hosts: string[];
     };
+    /**
+     * Wildcard certificates the box issues and renews over dns-01, from sites'
+     * wildcard `aliases`. ts-cloud's own: it feeds the renewal script and is
+     * removed before anything is written for rpx ({@link rpxGatewayJson}).
+     */
+    wildcardCerts?: WildcardCert[];
+}
+/** A wildcard certificate the renewal unit keeps, and where its DNS credentials live. */
+export interface WildcardCert {
+    /** `*.example.com`. */
+    domain: string;
+    /** The env file on the box holding `PORKBUN_API_KEY` / `PORKBUN_SECRET_KEY`. */
+    dnsEnvFile: string;
 }
+/** True for `*.example.com`: one leading wildcard label over a real domain. */
+export declare function isWildcardHost(host: string): boolean;
+/**
+ * The gateway config as rpx reads it: without the keys that are ts-cloud's
+ * own bookkeeping, which rpx would at best ignore and at worst reject.
+ */
+export declare function rpxGatewayJson(config: RpxGatewayConfig, extra?: Record<string, unknown>): string;
 export interface BuildRpxConfigOptions {
     /** Proxy config from `infrastructure.compute.proxy`. */
     proxy: ComputeProxyConfig;
@@ -457,6 +479,21 @@ export declare const RPX_CERT_RENEW_TIMER = "rpx-cert-renew.timer";
 export declare function rpxCertRenewServiceName(slug: string): string;
 /** The routable FQDNs in a gateway config — each terminates TLS so each needs a cert. */
 export declare function certDomainsForConfig(config: RpxGatewayConfig): string[];
+/**
+ * The renewal script's lines for wildcard certificates (sites' wildcard
+ * `aliases`): one dns-01 certificate per wildcard, issued once and renewed
+ * within 30 days of expiry, like the http-01 ones above it.
+ *
+ * http-01 cannot prove control of a wildcard, so these need the DNS
+ * provider's API. Its two keys are read from the site's own env file for the
+ * tlsx command alone - nothing else in that file is loaded, and nothing is
+ * written anywhere new. A site without them is skipped with a message, never
+ * a failed unit. The certificate lands as `_wildcard.<apex>.crt`, the name
+ * rpx serves as `*.<apex>`.
+ *
+ * Every name is quoted: a bare `*.example.com` in sh is a glob.
+ */
+export declare function wildcardCertLines(certs: WildcardCert[]): string[];
 /**
  * Commands that make ts-cloud manage the gateway's TLS certs end-to-end: install
  * tlsx, issue a Let's Encrypt cert for every routed domain via http-01 (the