@stacksjs/ts-cloud 0.16.49 → 0.16.50

package/dist/{chunk-fpkpwbv3.js → chunk-8b2mxhcm.js}

@@ -1,4 +1,4 @@
-import{X,ue,D,ge,Sr}from"./chunk-gh0ghb21.js";import{o}from"./chunk-jpdpr7k6.js";import{Le,S}from"./chunk-yme6q7k4.js";import{I}from"./chunk-vb4t2r4r.js";import{h}from"./chunk-vjph4eh0.js";function Ja(t){let{bucketName:s,domain:c,aliases:e,certificateArn:g,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:m=!1,computeOriginDomain:w,computeOriginPort:O=3008,computeOriginId:F="app-compute",retainOnStackDelete:v=!1}=t,C=v?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=m&&!!w,B=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],E=N?["GET","HEAD"]:["GET","HEAD"],R={},x={};R.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},x.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},x.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},R.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let y;if(a&&N)y="InstallRootRedirectFunction",R[y]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{ie,Ae,k,ye,Dr}from"./chunk-m9r0a1v9.js";import{o}from"./chunk-j99nkav5.js";import{Qe,S}from"./chunk-0cz2s19h.js";import{I}from"./chunk-jtvw9d4x.js";import{h}from"./chunk-zf5wdx6v.js";function ic(t){let{bucketName:s,domain:c,aliases:e,certificateArn:g,defaultRootObject:i="index.html",errorDocument:r="404.html",passthroughUrls:a=!1,singlePageApp:d=!1,dynamicApp:m=!1,computeOriginDomain:w,computeOriginPort:O=3008,computeOriginId:F="app-compute",retainOnStackDelete:v=!1}=t,C=v?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},N=m&&!!w,B=N?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],E=N?["GET","HEAD"]:["GET","HEAD"],R={},x={};R.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},x.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},x.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},R.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let y;if(a&&N)y="InstallRootRedirectFunction",R[y]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -24,7 +24,7 @@ import{X,ue,D,ge,Sr}from"./chunk-gh0ghb21.js";import{o}from"./chunk-jpdpr7k6.js"
   }
 
   return request;
-}`}};let P={Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}},u=N?{Id:F,DomainName:w,CustomOriginConfig:{HTTPPort:O,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}:null,k=N?F:`S3-${s}`,p={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:u?[u,P]:[P],DefaultCacheBehavior:{TargetOriginId:k,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:B,CachedMethods:E,Compress:!0,...N?{CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",...a&&y?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[y,"FunctionARN"]}}]}:{}}:{CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...!a&&{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]}}},...N&&a?{CacheBehaviors:[{PathPattern:"/install.sh",TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"}]}:{},CustomErrorResponses:d?[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300}]:[{ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(c&&g)p.Aliases=e&&e.length>0?e:[c],p.ViewerCertificate={AcmCertificateArn:g,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else p.ViewerCertificate={CloudFrontDefaultCertificate:!0};return R.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",...C,DependsOn:["S3Bucket","CloudFrontOAC",...a&&N&&y?[y]:[],...!a?["UrlRewriteFunction"]:[]],Properties:{DistributionConfig:p}},x.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},x.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},R.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",...C,DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},x.SiteUrl={Description:"Site URL",Value:c?`https://${c}`:{"Fn::Sub":"https://${CloudFrontDistribution.DomainName}"}},{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${c||s} (External DNS)`,Resources:R,Outputs:x}}async function vn(t){let s=t.region||"us-east-1",c="us-east-1",e=t.domain,g=t.bucket||e.replace(/\./g,"-"),i=t.stackName||`${t.siteName}-static-site`,r=new h("us-east-1"),a=new ge("us-east-1"),d=null;if(!t.skipDnsVerification){d=D(t.dnsProvider),console.log(`Verifying DNS provider can manage ${e}...`);let n=await d.listRecords(e);if(!n.success){let l=n.message||"unknown error — check API credentials and domain ownership";return{success:!1,stackName:i,bucket:g,message:`DNS provider '${d.name}' cannot manage domain ${e}: ${l}`}}console.log(`DNS provider '${d.name}' verified for ${e}`)}else console.log(`Skipping DNS verification for ${e}`);let m=t.certificateArn,F=e.split(".").length===2?`www.${e}`:void 0;if(!m){console.log(`Checking for existing SSL certificate for ${e}...`);let n=await a.findCertificateByDomain(e),l=!1;if(n&&n.Status==="ISSUED"){if(F&&n.SubjectAlternativeNames)l=n.SubjectAlternativeNames.includes(F)||n.SubjectAlternativeNames.some((b)=>b===`*.${e}`);else l=!0;if(l)m=n.CertificateArn,console.log(`Found existing certificate with www coverage: ${m}`);else console.log(`Existing certificate doesn't cover ${F}, requesting new one...`)}if(!m){if(!d)return{success:!1,stackName:i,bucket:g,message:`No DNS provider available to validate SSL certificate for ${e}. Provide a certificateArn or enable DNS verification.`};console.log(`Requesting new SSL certificate for ${e}${F?` (including ${F})`:""}...`);let A=await new ue(d,"us-east-1").findOrCreateCertificate({domainName:e,subjectAlternativeNames:F?[F]:void 0,waitForValidation:!0,maxWaitMinutes:10});if(A.status!=="issued")return{success:!1,stackName:i,bucket:g,message:`SSL certificate validation failed. Status: ${A.status}`};m=A.certificateArn,console.log(`Certificate issued: ${m}`)}}let v=!1,C;try{let n=await r.describeStacks({stackName:i});if(n.Stacks.length>0){let l=n.Stacks[0],b=l.StackStatus;if(b==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),v=!1;else if(b==="DELETE_COMPLETE")v=!1;else v=!0,C=(l.Outputs||[]).find((f)=>f.OutputKey==="BucketName")?.OutputValue}}catch(n){if(n.message?.includes("does not exist")||n.code==="ValidationError")v=!1;else throw n}let N=C||g;if(!v){let n=new o(s),l=new S,b=!1;if(e)try{console.log(`Checking for existing CloudFront distributions with alias ${e}...`);let A=await l.listDistributions();for(let f of A)if((f.Aliases?.Items??[]).includes(e)){b=!0,console.log(`Found existing CloudFront distribution ${f.Id} with alias ${e}`),console.log("Reusing existing infrastructure for updates...");let V=await l.getDistributionConfig(f.Id),U=Le(V.DistributionConfig);if(U)return console.log(`Using existing S3 bucket: ${U}`),{success:!0,stackName:`existing-${f.Id}`,bucket:U,distributionId:f.Id,distributionDomain:f.DomainName,domain:e,certificateArn:m,message:"Using existing CloudFront distribution",_existingInfrastructure:!0}}}catch{}if(!b)try{if((await n.headBucket(g)).exists){console.log(`Found orphaned S3 bucket ${g}, cleaning up...`);try{let f=n.emptyBucket(g).then(()=>n.deleteBucket(g)),T=new Promise((V,U)=>setTimeout(()=>U(Error("Bucket cleanup timeout")),30000));await Promise.race([f,T]),console.log(`Deleted orphaned S3 bucket ${g}`)}catch(f){console.log(`Note: Could not clean up S3 bucket: ${f.message}`);let T=Date.now().toString(36);N=`${g}-${T}`,console.log(`Using alternative bucket name: ${N}`)}}}catch{}}let E=Ja({bucketName:N,domain:e,aliases:F?[e,F]:[e],certificateArn:m,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,passthroughUrls:t.passthroughUrls,singlePageApp:t.singlePageApp,dynamicApp:t.dynamicApp,computeOriginDomain:t.computeOriginDomain,computeOriginPort:t.computeOriginPort,computeOriginId:t.computeOriginId}),R=Object.entries(t.tags||{}).map(([n,l])=>({Key:n,Value:l}));if(R.push({Key:"ManagedBy",Value:"ts-cloud"}),R.push({Key:"Application",Value:t.siteName}),d)R.push({Key:"DnsProvider",Value:d.name});let x,y=!1;if(v){y=!0,console.log(`Updating CloudFormation stack: ${i}`);try{x=(await r.updateStack({stackName:i,templateBody:JSON.stringify(E),capabilities:["CAPABILITY_IAM"],tags:R})).StackId,console.log(`Update initiated, stack ID: ${x}`)}catch(n){if(n.message?.includes("No updates are to be performed")){let l=await r.describeStacks({stackName:i});x=l.Stacks[0].StackId;let b=l.Stacks[0]?.Outputs||[],A=(T)=>b.find((V)=>V.OutputKey===T)?.OutputValue,f=A("DistributionDomain");if(f)await W(d,e,f);return{success:!0,stackId:x,stackName:i,bucket:A("BucketName")||N,distributionId:A("DistributionId"),distributionDomain:f,domain:e,certificateArn:m,message:"Static site infrastructure is already up to date"}}else throw n}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${N}`),console.log(`Domain: ${e}`),console.log(`Certificate ARN: ${m}`),x=(await r.createStack({stackName:i,templateBody:JSON.stringify(E),capabilities:["CAPABILITY_IAM"],tags:R,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${x}`);console.log(`Waiting for stack to reach ${y?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,y?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(n){if(n.message?.includes("must be verified")||n.message?.includes("Access denied for operation")){console.log("CloudFront account verification required - checking for existing infrastructure...");try{let b=new S,A=await b.listDistributions();for(let f of A)if((f.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${f.Id} with alias ${e}`),console.log("Using existing infrastructure despite account verification requirement...");let V=await b.getDistributionConfig(f.Id),U=Le(V.DistributionConfig);if(U){console.log(`Using existing S3 bucket: ${U}`);let M=f.DomainName;if(M)await W(d,e,M);return{success:!0,stackName:`existing-${f.Id}`,bucket:U,distributionId:f.Id,distributionDomain:f.DomainName,domain:e,certificateArn:m,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}catch{}return console.log(`
+}`}};let P={Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}},u=N?{Id:F,DomainName:w,CustomOriginConfig:{HTTPPort:O,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}:null,D=N?F:`S3-${s}`,p={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:u?[u,P]:[P],DefaultCacheBehavior:{TargetOriginId:D,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:B,CachedMethods:E,Compress:!0,...N?{CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac",...a&&y?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[y,"FunctionARN"]}}]}:{}}:{CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...!a&&{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]}}},...N&&a?{CacheBehaviors:[{PathPattern:"/install.sh",TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"}]}:{},CustomErrorResponses:d?[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300}]:[{ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(c&&g)p.Aliases=e&&e.length>0?e:[c],p.ViewerCertificate={AcmCertificateArn:g,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else p.ViewerCertificate={CloudFrontDefaultCertificate:!0};return R.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",...C,DependsOn:["S3Bucket","CloudFrontOAC",...a&&N&&y?[y]:[],...!a?["UrlRewriteFunction"]:[]],Properties:{DistributionConfig:p}},x.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},x.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},R.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",...C,DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},x.SiteUrl={Description:"Site URL",Value:c?`https://${c}`:{"Fn::Sub":"https://${CloudFrontDistribution.DomainName}"}},{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${c||s} (External DNS)`,Resources:R,Outputs:x}}async function Bn(t){let s=t.region||"us-east-1",c="us-east-1",e=t.domain,g=t.bucket||e.replace(/\./g,"-"),i=t.stackName||`${t.siteName}-static-site`,r=new h("us-east-1"),a=new ye("us-east-1"),d=null;if(!t.skipDnsVerification){d=k(t.dnsProvider),console.log(`Verifying DNS provider can manage ${e}...`);let n=await d.listRecords(e);if(!n.success){let l=n.message||"unknown error — check API credentials and domain ownership";return{success:!1,stackName:i,bucket:g,message:`DNS provider '${d.name}' cannot manage domain ${e}: ${l}`}}console.log(`DNS provider '${d.name}' verified for ${e}`)}else console.log(`Skipping DNS verification for ${e}`);let m=t.certificateArn,F=e.split(".").length===2?`www.${e}`:void 0;if(!m){console.log(`Checking for existing SSL certificate for ${e}...`);let n=await a.findCertificateByDomain(e),l=!1;if(n&&n.Status==="ISSUED"){if(F&&n.SubjectAlternativeNames)l=n.SubjectAlternativeNames.includes(F)||n.SubjectAlternativeNames.some((b)=>b===`*.${e}`);else l=!0;if(l)m=n.CertificateArn,console.log(`Found existing certificate with www coverage: ${m}`);else console.log(`Existing certificate doesn't cover ${F}, requesting new one...`)}if(!m){if(!d)return{success:!1,stackName:i,bucket:g,message:`No DNS provider available to validate SSL certificate for ${e}. Provide a certificateArn or enable DNS verification.`};console.log(`Requesting new SSL certificate for ${e}${F?` (including ${F})`:""}...`);let A=await new Ae(d,"us-east-1").findOrCreateCertificate({domainName:e,subjectAlternativeNames:F?[F]:void 0,waitForValidation:!0,maxWaitMinutes:10});if(A.status!=="issued")return{success:!1,stackName:i,bucket:g,message:`SSL certificate validation failed. Status: ${A.status}`};m=A.certificateArn,console.log(`Certificate issued: ${m}`)}}let v=!1,C;try{let n=await r.describeStacks({stackName:i});if(n.Stacks.length>0){let l=n.Stacks[0],b=l.StackStatus;if(b==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),v=!1;else if(b==="DELETE_COMPLETE")v=!1;else v=!0,C=(l.Outputs||[]).find((f)=>f.OutputKey==="BucketName")?.OutputValue}}catch(n){if(n.message?.includes("does not exist")||n.code==="ValidationError")v=!1;else throw n}let N=C||g;if(!v){let n=new o(s),l=new S,b=!1;if(e)try{console.log(`Checking for existing CloudFront distributions with alias ${e}...`);let A=await l.listDistributions();for(let f of A)if((f.Aliases?.Items??[]).includes(e)){b=!0,console.log(`Found existing CloudFront distribution ${f.Id} with alias ${e}`),console.log("Reusing existing infrastructure for updates...");let V=await l.getDistributionConfig(f.Id),U=Qe(V.DistributionConfig);if(U)return console.log(`Using existing S3 bucket: ${U}`),{success:!0,stackName:`existing-${f.Id}`,bucket:U,distributionId:f.Id,distributionDomain:f.DomainName,domain:e,certificateArn:m,message:"Using existing CloudFront distribution",_existingInfrastructure:!0}}}catch{}if(!b)try{if((await n.headBucket(g)).exists){console.log(`Found orphaned S3 bucket ${g}, cleaning up...`);try{let f=n.emptyBucket(g).then(()=>n.deleteBucket(g)),T=new Promise((V,U)=>setTimeout(()=>U(Error("Bucket cleanup timeout")),30000));await Promise.race([f,T]),console.log(`Deleted orphaned S3 bucket ${g}`)}catch(f){console.log(`Note: Could not clean up S3 bucket: ${f.message}`);let T=Date.now().toString(36);N=`${g}-${T}`,console.log(`Using alternative bucket name: ${N}`)}}}catch{}}let E=ic({bucketName:N,domain:e,aliases:F?[e,F]:[e],certificateArn:m,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,passthroughUrls:t.passthroughUrls,singlePageApp:t.singlePageApp,dynamicApp:t.dynamicApp,computeOriginDomain:t.computeOriginDomain,computeOriginPort:t.computeOriginPort,computeOriginId:t.computeOriginId}),R=Object.entries(t.tags||{}).map(([n,l])=>({Key:n,Value:l}));if(R.push({Key:"ManagedBy",Value:"ts-cloud"}),R.push({Key:"Application",Value:t.siteName}),d)R.push({Key:"DnsProvider",Value:d.name});let x,y=!1;if(v){y=!0,console.log(`Updating CloudFormation stack: ${i}`);try{x=(await r.updateStack({stackName:i,templateBody:JSON.stringify(E),capabilities:["CAPABILITY_IAM"],tags:R})).StackId,console.log(`Update initiated, stack ID: ${x}`)}catch(n){if(n.message?.includes("No updates are to be performed")){let l=await r.describeStacks({stackName:i});x=l.Stacks[0].StackId;let b=l.Stacks[0]?.Outputs||[],A=(T)=>b.find((V)=>V.OutputKey===T)?.OutputValue,f=A("DistributionDomain");if(f)await W(d,e,f);return{success:!0,stackId:x,stackName:i,bucket:A("BucketName")||N,distributionId:A("DistributionId"),distributionDomain:f,domain:e,certificateArn:m,message:"Static site infrastructure is already up to date"}}else throw n}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${N}`),console.log(`Domain: ${e}`),console.log(`Certificate ARN: ${m}`),x=(await r.createStack({stackName:i,templateBody:JSON.stringify(E),capabilities:["CAPABILITY_IAM"],tags:R,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${x}`);console.log(`Waiting for stack to reach ${y?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,y?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(n){if(n.message?.includes("must be verified")||n.message?.includes("Access denied for operation")){console.log("CloudFront account verification required - checking for existing infrastructure...");try{let b=new S,A=await b.listDistributions();for(let f of A)if((f.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${f.Id} with alias ${e}`),console.log("Using existing infrastructure despite account verification requirement...");let V=await b.getDistributionConfig(f.Id),U=Qe(V.DistributionConfig);if(U){console.log(`Using existing S3 bucket: ${U}`);let M=f.DomainName;if(M)await W(d,e,M);return{success:!0,stackName:`existing-${f.Id}`,bucket:U,distributionId:f.Id,distributionDomain:f.DomainName,domain:e,certificateArn:m,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}}catch{}return console.log(`
 ┌─────────────────────────────────────────────────────────────────────────────┐
 │  AWS ACCOUNT VERIFICATION REQUIRED                                          │
 ├─────────────────────────────────────────────────────────────────────────────┤
@@ -42,7 +42,7 @@ import{X,ue,D,ge,Sr}from"./chunk-gh0ghb21.js";import{o}from"./chunk-jpdpr7k6.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:x,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:x,stackName:i,bucket:N,message:`Stack deployment failed: ${n.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],k=(n)=>u.find((l)=>l.OutputKey===n)?.OutputValue,p=k("DistributionDomain");if(p&&d)console.log(`Creating DNS records via ${d.name}...`),await W(d,e,p);else if(p&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:x,stackName:i,bucket:k("BucketName")||N,distributionId:k("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function W(t,s,c){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof X){console.log(`Creating Route53 alias record for apex domain ${s} -> ${c}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:c});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created Route53 alias record: ${s} -> ${c}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${c}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:c});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${c}`);else console.log(`Created Route53 alias record: ${r} -> ${c}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let m of d.records){let w=m.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:m.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${c}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:c,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created ALIAS record: ${s} -> ${c}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${c}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:c,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${c}`);else console.log(`Created CNAME record: ${r} -> ${c}`)}else{console.log(`Creating CNAME record for ${s} -> ${c}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:c,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created CNAME record: ${s} -> ${c}`)}}async function Tn(t){let{sourceDir:s,cleanBucket:c=!1,onProgress:e,...g}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await vn(g);if(!i.success)return i;if(c){e?.("clean","Cleaning old files from S3...");try{await new o(g.region||"us-east-1").emptyBucket(i.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-gqadvddh.js"),a=await r({sourceDir:s,bucket:i.bucket,region:g.region||"us-east-1",cacheControl:g.cacheControl,onProgress:(m,w,O)=>{e?.("upload",`${m}/${w}: ${O}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-gqadvddh.js");await m(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function hs(t){let{bucketName:s,domain:c,certificateArn:e,hostedZoneId:g,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:x,stackName:i,bucket:N,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:x,stackName:i,bucket:N,message:`Stack deployment failed: ${n.message}`}}let u=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],D=(n)=>u.find((l)=>l.OutputKey===n)?.OutputValue,p=D("DistributionDomain");if(p&&d)console.log(`Creating DNS records via ${d.name}...`),await W(d,e,p);else if(p&&!d)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:x,stackName:i,bucket:D("BucketName")||N,distributionId:D("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function W(t,s,c){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(s.split(".").length===2)if(t instanceof ie){console.log(`Creating Route53 alias record for apex domain ${s} -> ${c}`);let i=await t.createCloudFrontAlias({domain:s,name:s,cloudFrontDomainName:c});if(!i.success)console.warn(`Warning: Could not create Route53 alias record: ${i.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created Route53 alias record: ${s} -> ${c}`);let r=`www.${s}`;console.log(`Creating Route53 alias record for ${r} -> ${c}`);let a=await t.createCloudFrontAlias({domain:s,name:r,cloudFrontDomainName:c});if(!a.success)console.warn(`Warning: Could not create www Route53 alias: ${a.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${r} -> ${c}`);else console.log(`Created Route53 alias record: ${r} -> ${c}`)}else{try{let d=await t.listRecords(s,"A");if(d.success)for(let m of d.records){let w=m.name.replace(/\.$/,"");if(w===s||w==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(s,{name:s,type:"A",content:m.content})}}catch(d){console.log(`Note: Could not check for conflicting A records: ${d instanceof Error?d.message:d}`)}console.log(`Creating ALIAS record for apex domain ${s} -> ${c}`);let i=await t.upsertRecord(s,{name:s,type:"ALIAS",content:c,ttl:600});if(!i.success)console.warn(`Warning: Could not create ALIAS record: ${i.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created ALIAS record: ${s} -> ${c}`);let r=`www.${s}`;console.log(`Creating CNAME record for ${r} -> ${c}`);let a=await t.upsertRecord(s,{name:r,type:"CNAME",content:c,ttl:600});if(!a.success)console.warn(`Warning: Could not create www DNS record: ${a.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${r} -> ${c}`);else console.log(`Created CNAME record: ${r} -> ${c}`)}else{console.log(`Creating CNAME record for ${s} -> ${c}`);let i=await t.upsertRecord(s,{name:s,type:"CNAME",content:c,ttl:600});if(!i.success)console.warn(`Warning: Could not create DNS record: ${i.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${s} -> ${c}`);else console.log(`Created CNAME record: ${s} -> ${c}`)}}async function xn(t){let{sourceDir:s,cleanBucket:c=!1,onProgress:e,...g}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await Bn(g);if(!i.success)return i;if(c){e?.("clean","Cleaning old files from S3...");try{await new o(g.region||"us-east-1").emptyBucket(i.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:r}=await import("./chunk-jgsey18z.js"),a=await r({sourceDir:s,bucket:i.bucket,region:g.region||"us-east-1",cacheControl:g.cacheControl,onProgress:(m,w,O)=>{e?.("upload",`${m}/${w}: ${O}`)}});if(a.errors.length>0)return{...i,success:!1,message:`Upload errors: ${a.errors.join(", ")}`,filesUploaded:a.uploaded};if(i.distributionId&&a.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-jgsey18z.js");await m(i.distributionId)}e?.("complete","Deployment complete!");let d=a.skipped>0?`Deployed ${a.uploaded} files (${a.skipped} unchanged) with external DNS`:`Deployed ${a.uploaded} files successfully with external DNS`;return{...i,filesUploaded:a.uploaded,filesSkipped:a.skipped,message:d}}function Is(t){let{bucketName:s,domain:c,certificateArn:e,hostedZoneId:g,defaultRootObject:i="index.html",errorDocument:r="404.html"}=t,a={},d={};a.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:s,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:i,ErrorDocument:r}}},d.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},d.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},a.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${s}`,Description:`OAC for ${s}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},a.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 
@@ -56,5 +56,5 @@ import{X,ue,D,ge,Sr}from"./chunk-gh0ghb21.js";import{o}from"./chunk-jpdpr7k6.js"
   }
 
   return request;
-}`}};let m={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(c&&e)m.Aliases=[c],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(a.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},d.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},d.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},a.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},c&&g)a.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:g,Name:c,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},a.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:g,Name:c,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},d.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${c||s}`,Resources:a,Outputs:d}}async function As(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let u=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!u)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return vn({siteName:t.siteName,region:t.region,domain:u,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let s=t.region||"us-east-1",c="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let g=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),i=t.stackName||`${t.siteName}-static-site`,r=new h(c),a=new I,d=new ge("us-east-1"),m=new Sr("us-east-1"),{hostedZoneId:w,certificateArn:O}=t;if(e&&!w){let u=await a.findHostedZoneForDomain(e);if(u)w=u.Id.replace("/hostedzone/","");else return{success:!1,stackName:i,bucket:g,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!O&&w){let u=await d.findCertificateByDomain(e);if(u&&u.Status==="ISSUED")O=u.CertificateArn;else O=(await m.requestAndValidate({domainName:e,hostedZoneId:w,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let F=!1,v;try{let u=await r.describeStacks({stackName:i});if(u.Stacks.length>0){let k=u.Stacks[0],p=k.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),F=!1;else if(p==="DELETE_COMPLETE")F=!1;else F=!0,v=(k.Outputs||[]).find((l)=>l.OutputKey==="BucketName")?.OutputValue}}catch(u){if(u.message?.includes("does not exist")||u.code==="ValidationError")F=!1;else throw u}let C=v||g;if(!F){let u=new o(s),k=new S,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let n=await k.listDistributions();for(let l of n)if((l.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${l.Id} for ${e}`);let A=await k.getDistributionConfig(l.Id),f=Le(A.DistributionConfig);if(f){let T=e.replace(/\./g,"-");if(!f.startsWith(T)&&!f.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${f}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${f}`),w&&l.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:l.DomainName,EvaluateTargetHealth:!1}),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:l.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(V){console.log(`Note: Could not update Route53 records: ${V.message}`)}return{success:!0,stackName:`existing-${l.Id}`,bucket:f,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:O,message:"Using existing CloudFront distribution"}}}}catch{}if(w)try{let l=(await a.listResourceRecordSets({HostedZoneId:w})).ResourceRecordSets||[];for(let b of l)if(b.Name===`${e}.`&&(b.Type==="A"||b.Type==="AAAA")){if(b.AliasTarget){console.log(`Found orphaned Route53 ${b.Type} record for ${e}, cleaning up...`);try{await a.deleteRecord({HostedZoneId:w,RecordSet:b}),console.log(`Deleted orphaned Route53 ${b.Type} record for ${e}`)}catch(A){console.log(`Note: Could not delete Route53 record: ${A.message}`)}}}}catch{}}if(!p)try{if((await u.headBucket(g)).exists){console.log(`Found orphaned S3 bucket ${g}, cleaning up...`);try{let l=u.emptyBucket(g).then(()=>u.deleteBucket(g)),b=new Promise((A,f)=>setTimeout(()=>f(Error("Bucket cleanup timeout")),30000));await Promise.race([l,b]),console.log(`Deleted orphaned S3 bucket ${g}`)}catch(l){console.log(`Note: Could not clean up S3 bucket: ${l.message}`);let b=Date.now().toString(36);C=`${g}-${b}`,console.log(`Using alternative bucket name: ${C}`)}}}catch{}}let N=hs({bucketName:C,domain:e,certificateArn:O,hostedZoneId:w,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),B=Object.entries(t.tags||{}).map(([u,k])=>({Key:u,Value:k}));B.push({Key:"ManagedBy",Value:"ts-cloud"}),B.push({Key:"Application",Value:t.siteName});let E,R=!1;if(F){R=!0,console.log(`Updating CloudFormation stack: ${i}`),console.log(`Using existing bucket: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${O||"not specified"}`);try{E=(await r.updateStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:B})).StackId,console.log(`Update initiated, stack ID: ${E}`)}catch(u){if(u.message?.includes("No updates are to be performed")){let k=await r.describeStacks({stackName:i});E=k.Stacks[0].StackId;let p=k.Stacks[0]?.Outputs||[],n=(l)=>p.find((b)=>b.OutputKey===l)?.OutputValue;return{success:!0,stackId:E,stackName:i,bucket:n("BucketName")||C,distributionId:n("DistributionId"),distributionDomain:n("DistributionDomain"),domain:e,certificateArn:O,message:"Static site infrastructure is already up to date"}}else throw u}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${O||"not specified"}`),console.log("Stack does not exist, creating..."),E=(await r.createStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:B,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${E}`);console.log(`Waiting for stack to reach ${R?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,R?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(u){if(u.message?.includes("must be verified")||u.message?.includes("Access denied for operation")||u.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let k=new S;if(e)try{let p=await k.listDistributions();for(let n of p)if((n.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${n.Id} with alias ${e}`);let b=await k.getDistributionConfig(n.Id),A=Le(b.DistributionConfig);if(A)return console.log(`Using existing S3 bucket: ${A}`),{success:!0,stackName:`existing-${n.Id}`,bucket:A,distributionId:n.Id,distributionDomain:n.DomainName,domain:e,certificateArn:O,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new o(s);if((await p.headBucket(C)).exists)console.log(`Using existing S3 bucket: ${C}`);else console.log(`Creating S3 bucket: ${C}...`),await p.createBucket(C);await p.putBucketWebsite(C,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(C,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${C} configured`);let l=`OAC-${C}`;console.log(`Creating Origin Access Control: ${l}...`);let b=await k.findOrCreateOriginAccessControl(l);console.log(`Origin Access Control ${b.Id} ready`),console.log("Creating CloudFront distribution...");let A=await k.createDistributionForS3({bucketName:C,bucketRegion:s,originAccessControlId:b.Id,aliases:e?[e]:[],certificateArn:O,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||C}`});console.log(`CloudFront distribution ${A.Id} created`),console.log("Updating S3 bucket policy...");let f=S.getS3BucketPolicyForCloudFront(C,A.ARN);if(await p.putBucketPolicy(C,f),console.log("S3 bucket policy updated"),e&&w){console.log(`Creating Route53 records for ${e}...`);try{await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:A.DomainName,EvaluateTargetHealth:!1}),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:A.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(T){console.log(`Note: Could not create Route53 records: ${T.message}`)}}return{success:!0,stackName:`direct-${A.Id}`,bucket:C,distributionId:A.Id,distributionDomain:A.DomainName,domain:e,certificateArn:O,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:E,stackName:i,bucket:C,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:E,stackName:i,bucket:C,message:`Stack deployment failed: ${u.message}`}}let y=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],P=(u)=>y.find((k)=>k.OutputKey===u)?.OutputValue;return{success:!0,stackId:E,stackName:i,bucket:P("BucketName")||C,distributionId:P("DistributionId"),distributionDomain:P("DistributionDomain"),domain:e,certificateArn:O,message:"Static site infrastructure deployed successfully"}}async function ys(t){let{sourceDir:s,bucket:c,region:e,cacheControl:g="max-age=31536000, public",onProgress:i}=t,r=new o(e),{readdir:a}=await import("node:fs/promises"),{join:d,relative:m}=await import("node:path"),{createHash:w}=await import("node:crypto");async function O(y){let P=[],u=await a(y,{withFileTypes:!0});for(let k of u){let p=d(y,k.name);if(k.isDirectory())P.push(...await O(p));else P.push(p)}return P}function F(y){let P=y.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[P||""]||"application/octet-stream"}function v(y){return w("md5").update(y).digest("hex")}async function C(){let y=new Map,P;do{let u=await r.listObjects({bucket:c,maxKeys:1000,continuationToken:P});for(let k of u.objects){let p=k.ETag?.replace(/"/g,"")||"";y.set(k.Key,p)}P=u.nextContinuationToken}while(P);return y}let N=await O(s),B=[],E=0,R=0,x=await C();for(let y of N){let P=m(s,y),u=F(y),k=y.endsWith(".html")?"max-age=3600, public":g;try{let p=Buffer.from(await Bun.file(y).arrayBuffer()),n=v(p),l=x.get(P);if(l&&l===n){R++,i?.(E+R,N.length,P);continue}await r.putObject({bucket:c,key:P,body:p,contentType:u,cacheControl:k}),E++,i?.(E+R,N.length,P)}catch(p){B.push(`Failed to upload ${P}: ${p.message}`)}}return{uploaded:E,skipped:R,errors:B}}async function Ss(t){return{invalidationId:(await new S().invalidateAll(t)).Id}}async function Xa(t,s="us-east-1"){let c=new h(s);try{let r=((await c.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((a)=>a.OutputKey==="BucketName")?.OutputValue;if(r)await new o(s).emptyBucket(r)}catch{}await c.deleteStack(t);let e=await c.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function Ya(t){let{sourceDir:s,cleanBucket:c=!1,onProgress:e,...g}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await As(g);if(!i.success)return i;if(c){e?.("clean","Cleaning old files from S3...");try{await new o(g.region||"us-east-1").emptyBucket(i.bucket)}catch(d){console.log(`Note: Could not clean bucket: ${d.message}`)}}e?.("upload","Uploading files to S3...");let r=await ys({sourceDir:s,bucket:i.bucket,region:g.region||"us-east-1",cacheControl:g.cacheControl,onProgress:(d,m,w)=>{e?.("upload",`${d}/${m}: ${w}`)}});if(r.errors.length>0)return{...i,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(i.distributionId&&r.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Ss(i.distributionId);e?.("complete","Deployment complete!");let a=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged)`:`Deployed ${r.uploaded} files successfully`;return{...i,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:a}}
-export{Ja,vn,Tn,hs,As,ys,Ss,Xa,Ya};
+}`}};let m={Enabled:!0,DefaultRootObject:i,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${s}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${s}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${i}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${r}`,ErrorCachingMinTTL:300}]};if(c&&e)m.Aliases=[c],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(a.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},d.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},d.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},a.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},c&&g)a.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:g,Name:c,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},a.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:g,Name:c,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},d.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${c||s}`,Resources:a,Outputs:d}}async function bs(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let u=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!u)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return Bn({siteName:t.siteName,region:t.region,domain:u,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let s=t.region||"us-east-1",c="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let g=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),i=t.stackName||`${t.siteName}-static-site`,r=new h(c),a=new I,d=new ye("us-east-1"),m=new Dr("us-east-1"),{hostedZoneId:w,certificateArn:O}=t;if(e&&!w){let u=await a.findHostedZoneForDomain(e);if(u)w=u.Id.replace("/hostedzone/","");else return{success:!1,stackName:i,bucket:g,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!O&&w){let u=await d.findCertificateByDomain(e);if(u&&u.Status==="ISSUED")O=u.CertificateArn;else O=(await m.requestAndValidate({domainName:e,hostedZoneId:w,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let F=!1,v;try{let u=await r.describeStacks({stackName:i});if(u.Stacks.length>0){let D=u.Stacks[0],p=D.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await r.waitForStack(i,"stack-delete-complete"),F=!1;else if(p==="DELETE_COMPLETE")F=!1;else F=!0,v=(D.Outputs||[]).find((l)=>l.OutputKey==="BucketName")?.OutputValue}}catch(u){if(u.message?.includes("does not exist")||u.code==="ValidationError")F=!1;else throw u}let C=v||g;if(!F){let u=new o(s),D=new S,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let n=await D.listDistributions();for(let l of n)if((l.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${l.Id} for ${e}`);let A=await D.getDistributionConfig(l.Id),f=Qe(A.DistributionConfig);if(f){let T=e.replace(/\./g,"-");if(!f.startsWith(T)&&!f.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${f}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${f}`),w&&l.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:l.DomainName,EvaluateTargetHealth:!1}),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:l.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(V){console.log(`Note: Could not update Route53 records: ${V.message}`)}return{success:!0,stackName:`existing-${l.Id}`,bucket:f,distributionId:l.Id,distributionDomain:l.DomainName,domain:e,certificateArn:O,message:"Using existing CloudFront distribution"}}}}catch{}if(w)try{let l=(await a.listResourceRecordSets({HostedZoneId:w})).ResourceRecordSets||[];for(let b of l)if(b.Name===`${e}.`&&(b.Type==="A"||b.Type==="AAAA")){if(b.AliasTarget){console.log(`Found orphaned Route53 ${b.Type} record for ${e}, cleaning up...`);try{await a.deleteRecord({HostedZoneId:w,RecordSet:b}),console.log(`Deleted orphaned Route53 ${b.Type} record for ${e}`)}catch(A){console.log(`Note: Could not delete Route53 record: ${A.message}`)}}}}catch{}}if(!p)try{if((await u.headBucket(g)).exists){console.log(`Found orphaned S3 bucket ${g}, cleaning up...`);try{let l=u.emptyBucket(g).then(()=>u.deleteBucket(g)),b=new Promise((A,f)=>setTimeout(()=>f(Error("Bucket cleanup timeout")),30000));await Promise.race([l,b]),console.log(`Deleted orphaned S3 bucket ${g}`)}catch(l){console.log(`Note: Could not clean up S3 bucket: ${l.message}`);let b=Date.now().toString(36);C=`${g}-${b}`,console.log(`Using alternative bucket name: ${C}`)}}}catch{}}let N=Is({bucketName:C,domain:e,certificateArn:O,hostedZoneId:w,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),B=Object.entries(t.tags||{}).map(([u,D])=>({Key:u,Value:D}));B.push({Key:"ManagedBy",Value:"ts-cloud"}),B.push({Key:"Application",Value:t.siteName});let E,R=!1;if(F){R=!0,console.log(`Updating CloudFormation stack: ${i}`),console.log(`Using existing bucket: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${O||"not specified"}`);try{E=(await r.updateStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:B})).StackId,console.log(`Update initiated, stack ID: ${E}`)}catch(u){if(u.message?.includes("No updates are to be performed")){let D=await r.describeStacks({stackName:i});E=D.Stacks[0].StackId;let p=D.Stacks[0]?.Outputs||[],n=(l)=>p.find((b)=>b.OutputKey===l)?.OutputValue;return{success:!0,stackId:E,stackName:i,bucket:n("BucketName")||C,distributionId:n("DistributionId"),distributionDomain:n("DistributionDomain"),domain:e,certificateArn:O,message:"Static site infrastructure is already up to date"}}else throw u}}else console.log(`Creating CloudFormation stack: ${i}`),console.log(`Bucket name: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${O||"not specified"}`),console.log("Stack does not exist, creating..."),E=(await r.createStack({stackName:i,templateBody:JSON.stringify(N),capabilities:["CAPABILITY_IAM"],tags:B,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${E}`);console.log(`Waiting for stack to reach ${R?"stack-update-complete":"stack-create-complete"}...`);try{await r.waitForStack(i,R?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(u){if(u.message?.includes("must be verified")||u.message?.includes("Access denied for operation")||u.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let D=new S;if(e)try{let p=await D.listDistributions();for(let n of p)if((n.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${n.Id} with alias ${e}`);let b=await D.getDistributionConfig(n.Id),A=Qe(b.DistributionConfig);if(A)return console.log(`Using existing S3 bucket: ${A}`),{success:!0,stackName:`existing-${n.Id}`,bucket:A,distributionId:n.Id,distributionDomain:n.DomainName,domain:e,certificateArn:O,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new o(s);if((await p.headBucket(C)).exists)console.log(`Using existing S3 bucket: ${C}`);else console.log(`Creating S3 bucket: ${C}...`),await p.createBucket(C);await p.putBucketWebsite(C,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(C,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${C} configured`);let l=`OAC-${C}`;console.log(`Creating Origin Access Control: ${l}...`);let b=await D.findOrCreateOriginAccessControl(l);console.log(`Origin Access Control ${b.Id} ready`),console.log("Creating CloudFront distribution...");let A=await D.createDistributionForS3({bucketName:C,bucketRegion:s,originAccessControlId:b.Id,aliases:e?[e]:[],certificateArn:O,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||C}`});console.log(`CloudFront distribution ${A.Id} created`),console.log("Updating S3 bucket policy...");let f=S.getS3BucketPolicyForCloudFront(C,A.ARN);if(await p.putBucketPolicy(C,f),console.log("S3 bucket policy updated"),e&&w){console.log(`Creating Route53 records for ${e}...`);try{await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"A",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:A.DomainName,EvaluateTargetHealth:!1}),await a.createAliasRecord({HostedZoneId:w,Name:e,Type:"AAAA",TargetHostedZoneId:I.CloudFrontHostedZoneId,TargetDNSName:A.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(T){console.log(`Note: Could not create Route53 records: ${T.message}`)}}return{success:!0,stackName:`direct-${A.Id}`,bucket:C,distributionId:A.Id,distributionDomain:A.DomainName,domain:e,certificateArn:O,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:E,stackName:i,bucket:C,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:E,stackName:i,bucket:C,message:`Stack deployment failed: ${u.message}`}}let y=(await r.describeStacks({stackName:i})).Stacks[0]?.Outputs||[],P=(u)=>y.find((D)=>D.OutputKey===u)?.OutputValue;return{success:!0,stackId:E,stackName:i,bucket:P("BucketName")||C,distributionId:P("DistributionId"),distributionDomain:P("DistributionDomain"),domain:e,certificateArn:O,message:"Static site infrastructure deployed successfully"}}async function Cs(t){let{sourceDir:s,bucket:c,region:e,cacheControl:g="max-age=31536000, public",onProgress:i}=t,r=new o(e),{readdir:a}=await import("node:fs/promises"),{join:d,relative:m}=await import("node:path"),{createHash:w}=await import("node:crypto");async function O(y){let P=[],u=await a(y,{withFileTypes:!0});for(let D of u){let p=d(y,D.name);if(D.isDirectory())P.push(...await O(p));else P.push(p)}return P}function F(y){let P=y.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[P||""]||"application/octet-stream"}function v(y){return w("md5").update(y).digest("hex")}async function C(){let y=new Map,P;do{let u=await r.listObjects({bucket:c,maxKeys:1000,continuationToken:P});for(let D of u.objects){let p=D.ETag?.replace(/"/g,"")||"";y.set(D.Key,p)}P=u.nextContinuationToken}while(P);return y}let N=await O(s),B=[],E=0,R=0,x=await C();for(let y of N){let P=m(s,y),u=F(y),D=y.endsWith(".html")?"max-age=3600, public":g;try{let p=Buffer.from(await Bun.file(y).arrayBuffer()),n=v(p),l=x.get(P);if(l&&l===n){R++,i?.(E+R,N.length,P);continue}await r.putObject({bucket:c,key:P,body:p,contentType:u,cacheControl:D}),E++,i?.(E+R,N.length,P)}catch(p){B.push(`Failed to upload ${P}: ${p.message}`)}}return{uploaded:E,skipped:R,errors:B}}async function Es(t){return{invalidationId:(await new S().invalidateAll(t)).Id}}async function sc(t,s="us-east-1"){let c=new h(s);try{let r=((await c.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((a)=>a.OutputKey==="BucketName")?.OutputValue;if(r)await new o(s).emptyBucket(r)}catch{}await c.deleteStack(t);let e=await c.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function oc(t){let{sourceDir:s,cleanBucket:c=!1,onProgress:e,...g}=t;e?.("infrastructure","Deploying CloudFormation stack...");let i=await bs(g);if(!i.success)return i;if(c){e?.("clean","Cleaning old files from S3...");try{await new o(g.region||"us-east-1").emptyBucket(i.bucket)}catch(d){console.log(`Note: Could not clean bucket: ${d.message}`)}}e?.("upload","Uploading files to S3...");let r=await Cs({sourceDir:s,bucket:i.bucket,region:g.region||"us-east-1",cacheControl:g.cacheControl,onProgress:(d,m,w)=>{e?.("upload",`${d}/${m}: ${w}`)}});if(r.errors.length>0)return{...i,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(i.distributionId&&r.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Es(i.distributionId);e?.("complete","Deployment complete!");let a=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged)`:`Deployed ${r.uploaded} files successfully`;return{...i,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:a}}
+export{ic,Bn,xn,Is,bs,Cs,Es,sc,oc};

package/dist/{chunk-r3m1fjd4.js → chunk-9ggg2ktx.js}

@@ -1,2 +1,2 @@
-function f(n,r){return(n?.[`${r}Response`]??n)?.[`${r}Result`]}function A(n){if(n===void 0||n===null||n==="")return[];return Array.isArray(n)?n:[n]}function qc(n){return n===!0||n==="true"}
-export{f,A,qc};
+function f(n,r){return(n?.[`${r}Response`]??n)?.[`${r}Result`]}function A(n){if(n===void 0||n===null||n==="")return[];return Array.isArray(n)?n:[n]}function rd(n){return n===!0||n==="true"}
+export{f,A,rd};

package/dist/chunk-a8hs75xd.js

@@ -0,0 +1,5 @@
+import{Fo,ln,Nl,gn,qo,jo}from"./chunk-18h7na1g.js";import{He}from"./chunk-qcj3hkba.js";var r={reset:"\x1B[0m",bright:"\x1B[1m",dim:"\x1B[2m",red:"\x1B[31m",green:"\x1B[32m",yellow:"\x1B[33m",blue:"\x1B[34m",magenta:"\x1B[35m",cyan:"\x1B[36m",white:"\x1B[37m",gray:"\x1B[90m"};function b(t,e){return`${r[e]}${t}${r.reset}`}function On(t){console.log(`${r.green}✓${r.reset} ${t}`)}function dg(t){console.error(`${r.red}✗${r.reset} ${t}`)}function vs(t){console.warn(`${r.yellow}⚠${r.reset} ${t}`)}function L(t){console.log(`${r.blue}ℹ${r.reset} ${t}`)}function P(t){console.log(`${r.cyan}→${r.reset} ${t}`)}function Ts(t){console.log(`
+${r.bright}${r.cyan}${t}${r.reset}
+`)}var F=!!(process.env.CI||process.env.GITHUB_ACTIONS||process.env.BUILDKITE||process.env.CIRCLECI||process.env.GITLAB_CI);function lg(t,e="cyan"){let n=t.split(`
+`),i=Math.max(...n.map((l)=>l.length)),a="─".repeat(i+2);console.log(b(`┌${a}┐`,e)),n.forEach((l)=>{console.log(b(`│ ${l.padEnd(i)} │`,e))}),console.log(b(`└${a}┘`,e))}import{execFileSync as k}from"node:child_process";import{mkdirSync as I,mkdtempSync as M,rmSync as U,writeFileSync as d}from"node:fs";import{tmpdir as O}from"node:os";import{dirname as j,join as s}from"node:path";function C(t,e){for(let n of e){let i=s(t,n.name);I(j(i),{recursive:!0}),d(i,n.data,n.mode?{mode:n.mode}:void 0)}}async function ac(t){let{app:e,projectRoot:n,region:i,repository:a}=t,l=e.architecture??"x86_64",A=l==="arm64"?"linux/arm64":"linux/amd64",R=e.kind==="php",c=t.onStep??(()=>{}),p=M(s(O(),"tscloud-img-"));try{let f=s(p,"app");I(f,{recursive:!0});let y,w;if(R){qo({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c}),c("staging application tree");let o=jo(n);C(f,o),C(s(p,"runtime"),gn().map((g)=>({name:g.path,data:g.contents,mode:g.mode})));let B=e.handlers?.http??"public/index.php";y={http:B,queue:e.handlers?.queue??B,cli:e.handlers?.cli??B},w=Fo(o.map((g)=>`${g.name}:${g.data.length}`).join("|"))}else{c("bundling application");let o=await ln({projectRoot:n,app:e,skipBuild:t.skipBuild,onStep:c});d(s(f,"index.mjs"),o.bundle),y=o.handlers,w=o.sha256}let S=w.slice(0,16);d(s(p,"Dockerfile"),Nl({kind:e.kind??"node",phpVersion:e.phpVersion,architecture:l}));let v=new He(i),u;try{u=(await v.describeRepositories({repositoryNames:[a]})).repositories?.[0]?.repositoryUri??""}catch{u=""}if(!u)c(`creating ECR repository ${a}`),u=(await v.createRepository({repositoryName:a,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!u)throw Error(`could not resolve ECR repository URI for ${a}`);let m=`${u}:${S}`;c("docker build"),k("docker",["build","--platform",A,"--provenance=false","--sbom=false","-t",m,p],{stdio:"inherit"}),c("ecr auth + push");let h=(await v.getAuthorizationToken()).authorizationData?.[0];if(!h?.authorizationToken||!h.proxyEndpoint)throw Error("failed to get an ECR authorization token");let E=h.proxyEndpoint.replace(/^https?:\/\//,""),x=s(p,".docker");return I(x,{recursive:!0}),d(s(x,"config.json"),JSON.stringify({auths:{[E]:{auth:h.authorizationToken}}})),k("docker",["push",m],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:x}}),L(`Image: ${m}`),{imageUri:m,tag:S,handlers:y}}finally{U(p,{recursive:!0,force:!0})}}
+export{On,dg,vs,L,P,Ts,lg,ac};

package/dist/chunk-ca191b00.js

@@ -0,0 +1,6 @@
+var j={amp:"&",lt:"<",gt:">",quot:'"',apos:"'"},z={nbsp:" ",copy:"©",reg:"®",trade:"™",euro:"€",pound:"£",yen:"¥",cent:"¢",deg:"°",micro:"µ",middot:"·",bull:"•",hellip:"…",prime:"′",Prime:"″",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",ndash:"–",mdash:"—",iexcl:"¡",iquest:"¿",sect:"§",para:"¶",dagger:"†",Dagger:"‡",lsaquo:"‹",rsaquo:"›",oline:"‾",frasl:"⁄",ensp:" ",emsp:" ",thinsp:" ",zwnj:"‌",zwj:"‍",lrm:"‎",rlm:"‏",times:"×",divide:"÷",plusmn:"±",ne:"≠",le:"≤",ge:"≥",infin:"∞",fnof:"ƒ",Alpha:"Α",Beta:"Β",Gamma:"Γ",Delta:"Δ",Epsilon:"Ε",Zeta:"Ζ",Eta:"Η",Theta:"Θ",Iota:"Ι",Kappa:"Κ",Lambda:"Λ",Mu:"Μ",Nu:"Ν",Xi:"Ξ",Omicron:"Ο",Pi:"Π",Rho:"Ρ",Sigma:"Σ",Tau:"Τ",Upsilon:"Υ",Phi:"Φ",Chi:"Χ",Psi:"Ψ",Omega:"Ω",alpha:"α",beta:"β",gamma:"γ",delta:"δ",epsilon:"ε",zeta:"ζ",eta:"η",theta:"θ",iota:"ι",kappa:"κ",lambda:"λ",mu:"μ",nu:"ν",xi:"ξ",omicron:"ο",pi:"π",rho:"ρ",sigmaf:"ς",sigma:"σ",tau:"τ",upsilon:"υ",phi:"φ",chi:"χ",psi:"ψ",omega:"ω",thetasym:"ϑ",upsih:"ϒ",piv:"ϖ",larr:"←",uarr:"↑",rarr:"→",darr:"↓",harr:"↔",crarr:"↵",lArr:"⇐",uArr:"⇑",rArr:"⇒",dArr:"⇓",hArr:"⇔",forall:"∀",part:"∂",exist:"∃",empty:"∅",nabla:"∇",isin:"∈",notin:"∉",ni:"∋",prod:"∏",sum:"∑",minus:"−",lowast:"∗",radic:"√",prop:"∝",ang:"∠",and:"∧",or:"∨",cap:"∩",cup:"∪",int:"∫",there4:"∴",sim:"∼",cong:"≅",asymp:"≈",equiv:"≡",sub:"⊂",sup:"⊃",nsub:"⊄",sube:"⊆",supe:"⊇",oplus:"⊕",otimes:"⊗",perp:"⊥",sdot:"⋅",lceil:"⌈",rceil:"⌉",lfloor:"⌊",rfloor:"⌋",lang:"〈",rang:"〉",loz:"◊",spades:"♠",clubs:"♣",hearts:"♥",diams:"♦",Agrave:"À",Aacute:"Á",Acirc:"Â",Atilde:"Ã",Auml:"Ä",Aring:"Å",AElig:"Æ",Ccedil:"Ç",Egrave:"È",Eacute:"É",Ecirc:"Ê",Euml:"Ë",Igrave:"Ì",Iacute:"Í",Icirc:"Î",Iuml:"Ï",ETH:"Ð",Ntilde:"Ñ",Ograve:"Ò",Oacute:"Ó",Ocirc:"Ô",Otilde:"Õ",Ouml:"Ö",Oslash:"Ø",Ugrave:"Ù",Uacute:"Ú",Ucirc:"Û",Uuml:"Ü",Yacute:"Ý",THORN:"Þ",szlig:"ß",agrave:"à",aacute:"á",acirc:"â",atilde:"ã",auml:"ä",aring:"å",aelig:"æ",ccedil:"ç",egrave:"è",eacute:"é",ecirc:"ê",euml:"ë",igrave:"ì",iacute:"í",icirc:"î",iuml:"ï",eth:"ð",ntilde:"ñ",ograve:"ò",oacute:"ó",ocirc:"ô",otilde:"õ",ouml:"ö",oslash:"ø",ugrave:"ù",uacute:"ú",ucirc:"û",uuml:"ü",yacute:"ý",thorn:"þ",yuml:"ÿ",OElig:"Œ",oelig:"œ",Scaron:"Š",scaron:"š",Yuml:"Ÿ",circ:"ˆ",tilde:"˜"};class D{customEntities={};useHtmlEntities;constructor(t=!1){this.useHtmlEntities=t}addEntity(t,e){this.customEntities[t]=e}decodeEntities(t){let e=t.indexOf("&");if(e===-1)return t;let r=t.length,i="",s=0;while(e!==-1&&e<r){if(e>s)i+=t.substring(s,e);let a=t.indexOf(";",e+1);if(a===-1||a-e>32){i+="&",s=e+1,e=t.indexOf("&",s);continue}let o=t.substring(e+1,a);if(o.charCodeAt(0)===35){let c=o.length,f=0,m=!1;if(c>2&&(o.charCodeAt(1)===120||o.charCodeAt(1)===88)){m=!0;for(let A=2;A<c;A++){let l=o.charCodeAt(A);if(l>=48&&l<=57)f=f<<4|l-48;else if(l>=65&&l<=70)f=f<<4|l-55;else if(l>=97&&l<=102)f=f<<4|l-87;else{m=!1;break}}}else if(c>1){m=!0;for(let A=1;A<c;A++){let l=o.charCodeAt(A);if(l>=48&&l<=57)f=f*10+(l-48);else{m=!1;break}}}if(m)i+=String.fromCodePoint(f);else i+=t.substring(e,a+1)}else{let c=this.customEntities[o];if(c===void 0){let f=o.length;if(f>=2&&f<=4){let m=o.charCodeAt(0);if(m===108&&f===2&&o.charCodeAt(1)===116)c="<";else if(m===103&&f===2&&o.charCodeAt(1)===116)c=">";else if(m===97&&f===3&&o.charCodeAt(1)===109&&o.charCodeAt(2)===112)c="&";else if(m===113&&f===4)c=o==="quot"?'"':void 0;else if(m===97&&f===4)c=o==="apos"?"'":void 0}if(c===void 0)c=j[o]??(this.useHtmlEntities?z[o]:void 0)}if(c!==void 0)i+=c;else i+=t.substring(e,a+1)}s=a+1,e=t.indexOf("&",s)}if(s<r)i+=t.substring(s);return i}}var P=[];P[38]="&amp;";P[60]="&lt;";P[62]="&gt;";P[34]="&quot;";P[39]="&apos;";var H={attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,alwaysCreateTextNode:!1,trimValues:!0,parseTagValue:!0,parseAttributeValue:!1,processEntities:!0,htmlEntities:!1,commentPropName:!1,cdataPropName:!1,piPropName:!1,preserveOrder:!1,stopNodes:[],unpairedTags:[],isArray:void 0,tagValueProcessor:void 0,attributeValueProcessor:void 0,updateTag:void 0,numberParseOptions:{hex:!0,leadingZeros:!0,scientific:!0},ignorePiTags:!1,transformAttributeName:void 0,transformTagName:void 0,ignoreDeclaration:!1};function _(t){return t===32||t===9||t===10||t===13}function O(t){return t>=65&&t<=90||t>=97&&t<=122||t===95||t===58||t>=192&&t<=214||t>=216&&t<=246||t>=248&&t<=767||t>=880&&t<=893||t>=895&&t<=8191||t>=8204&&t<=8205||t>=8304&&t<=8591||t>=11264&&t<=12271||t>=12289&&t<=55295||t>=63744&&t<=64975||t>=65008&&t<=65533}function R(t){return O(t)||t===45||t===46||t>=48&&t<=57||t===183||t>=768&&t<=879||t>=8255&&t<=8256}var L=/^0x[\da-fA-F]+$/,X=/^[+-]?\d+(\.\d+)?[eE][+-]?\d+$/,M=/^[+-]?(\d+\.?\d*|\.\d+)$/;function I(t,e){return t.charCodeAt(e)===91&&t.charCodeAt(e+1)===67&&t.charCodeAt(e+2)===68&&t.charCodeAt(e+3)===65&&t.charCodeAt(e+4)===84&&t.charCodeAt(e+5)===65&&t.charCodeAt(e+6)===91}function k(t,e){let r=t.charCodeAt(e),i=t.charCodeAt(e+1),s=t.charCodeAt(e+2),a=t.charCodeAt(e+3),o=t.charCodeAt(e+4),c=t.charCodeAt(e+5),f=t.charCodeAt(e+6);return(r===68||r===100)&&(i===79||i===111)&&(s===67||s===99)&&(a===84||a===116)&&(o===89||o===121)&&(c===80||c===112)&&(f===69||f===101)}function G(t,e,r){if(e>=r||!O(t.charCodeAt(e)))return e;e++;while(e<r&&R(t.charCodeAt(e)))e++;return e}class St{options;entityDecoder;unpairedSet;exactStopNodes;wildcardStopSuffixes;needsJPath;_ignoreAttributes=!0;_textNodeName="#text";_commentPropName=!1;_cdataPropName=!1;_piPropName=!1;_alwaysCreateTextNode=!1;_trimValues=!0;_processEntities=!0;_parseTagValue=!0;_parseAttributeValue=!1;_removeNSPrefix=!1;_attrPrefix="@_";_attrsGroupName=!1;_ignorePiTags=!1;_ignoreDeclaration=!1;constructor(t){this.options={...H,...t},this.entityDecoder=new D(this.options.htmlEntities),this.unpairedSet=new Set(this.options.unpairedTags),this.exactStopNodes=new Set,this.wildcardStopSuffixes=[];for(let e of this.options.stopNodes)if(e.startsWith("*."))this.wildcardStopSuffixes.push(e.substring(2));else this.exactStopNodes.add(e);this._ignoreAttributes=this.options.ignoreAttributes,this._textNodeName=this.options.textNodeName,this._commentPropName=this.options.commentPropName,this._cdataPropName=this.options.cdataPropName,this._piPropName=this.options.piPropName,this._alwaysCreateTextNode=this.options.alwaysCreateTextNode,this._trimValues=this.options.trimValues,this._processEntities=this.options.processEntities,this._parseTagValue=this.options.parseTagValue,this._parseAttributeValue=this.options.parseAttributeValue,this._removeNSPrefix=this.options.removeNSPrefix,this._attrPrefix=this.options.attributeNamePrefix,this._attrsGroupName=this.options.attributesGroupName,this._ignorePiTags=this.options.ignorePiTags,this._ignoreDeclaration=this.options.ignoreDeclaration,this.needsJPath=this.options.stopNodes.length>0||this.options.isArray!==void 0||this.options.updateTag!==void 0||this.options.tagValueProcessor!==void 0||this.options.attributeValueProcessor!==void 0}addEntity(t,e){this.entityDecoder.addEntity(t,e)}parse(t){if(t instanceof Uint8Array)t=new TextDecoder().decode(t);let e=t;if(this.options.preserveOrder)return this.parseOrdered(e);return this.parseUnordered(e)}parseUnordered(t){let e={},r=t.length,i=0;if(r>0&&t.charCodeAt(0)===65279)i=1;return i=this.parseChildren(t,i,r,e,"",[]),e}parseOrdered(t){let e=t.length,r=0;if(e>0&&t.charCodeAt(0)===65279)r=1;let i=[];return this.parseChildrenOrdered(t,r,e,i,""),i}readTagName(t,e,r){return G(t,e,r)}extractTagName(t,e,r){let i=t.substring(e,r);if(this._removeNSPrefix){let s=i.indexOf(":");if(s!==-1)i=i.substring(s+1)}if(this.options.transformTagName)i=this.options.transformTagName(i);return i}parseAttributes(t,e,r,i,s){let a=0,o=this._removeNSPrefix,c=this.options.transformAttributeName,f=this._trimValues,m=this._processEntities,A=this.options.attributeValueProcessor;while(e<r){let l=t.charCodeAt(e);while(l===32||l===9||l===10||l===13){if(e++,e>=r)break;l=t.charCodeAt(e)}if(e>=r)break;if(l===62||l===47)break;let b=e;if(!O(l))break;e++;while(e<r&&R(t.charCodeAt(e)))e++;let p=t.substring(b,e);if(o){let C=p.indexOf(":");if(C!==-1)p=p.substring(C+1)}if(c)p=c(p);while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===61){e++;while(e<r&&_(t.charCodeAt(e)))e++;if(e>=r)break;let C=t.charCodeAt(e);if(C===34||C===39){e++;let E=e;while(e<r&&t.charCodeAt(e)!==C)e++;let h=t.substring(E,e);if(f&&h.length>0){let d=h.charCodeAt(0),g=h.charCodeAt(h.length-1);if(d<=32||g<=32)h=h.trim()}if(m)h=this.entityDecoder.decodeEntities(h);if(A)h=A(p,h,i)??h;if(s[p]=h,a++,e<r)e++}}else s[p]="true",a++}return a>0?-e-1:e}processTagValue(t,e,r,i,s){if(this._trimValues){let a=t.length;if(a>0){let o=t.charCodeAt(0),c=t.charCodeAt(a-1);if(o<=32||c<=32)t=t.trim()}}if(this._processEntities)t=this.entityDecoder.decodeEntities(t);if(this.options.tagValueProcessor){let a=this.options.tagValueProcessor(e,t,r,i,s);if(a!==void 0)t=a}if(!t)return t;if(this._parseTagValue)return this.parseValue(t);return t}parseValue(t){if(t==="true")return!0;if(t==="false")return!1;if(!t)return t;let e=t.charCodeAt(0);if(!(e>=48&&e<=57||e===43||e===45||e===46))return t;let i=this.options.numberParseOptions;if(i.skipLike?.test(t))return t;if(i.hex&&e===48&&L.test(t))return Number.parseInt(t,16);if(t.length>1&&e===48&&t.charCodeAt(1)!==46){if(i.leadingZeros)return t}if(i.scientific&&X.test(t)){let s=Number(t);if(!Number.isNaN(s))return s}if(M.test(t)){let s=Number(t);if(!Number.isNaN(s))return s}return t}parseAttributeValue(t){if(!this._parseAttributeValue)return t;return this.parseValue(t)}isStopNode(t){if(this.exactStopNodes.has(t))return!0;for(let e of this.wildcardStopSuffixes)if(t.endsWith(`.${e}`)||t===e)return!0;return!1}readStopNodeContent(t,e,r,i){let s=`</${i}`,a=t.indexOf(s,e);if(a===-1)return{content:t.substring(e),pos:r};let o=t.substring(e,a),c=a+s.length;while(c<r&&t.charCodeAt(c)!==62)c++;if(c<r)c++;return{content:o,pos:c}}addToObj(t,e,r,i,s,a){let o=t[e];if(o!==void 0)if(!Array.isArray(o))t[e]=[o,r];else o.push(r);else if(this.options.isArray?.(e,i,s,a))t[e]=[r];else t[e]=r}flushText(t,e,r,i){if(!t&&!e)return;let s=this._textNodeName;if(e){let a=t;if(a&&this._processEntities)a=this.entityDecoder.decodeEntities(a);let o=e+a;if(this._trimValues&&o.length>0){let c=o.charCodeAt(0),f=o.charCodeAt(o.length-1);if(c<=32||f<=32)o=o.trim()}if(this.options.tagValueProcessor){let c=this.options.tagValueProcessor(s,o,r,!1,!0);if(c!==void 0)o=c}if(o){let c=this._parseTagValue?this.parseValue(o):o;if(c!==void 0&&c!=="")this.addToObj(i,s,c,r,!0,!1)}}else{let a=this.processTagValue(t,s,r,!1,!0);if(a!==void 0&&a!=="")this.addToObj(i,s,a,r,!0,!1)}}parseChildren(t,e,r,i,s,a){let o="",c="",f=this.needsJPath;while(e<r){if(t.charCodeAt(e)!==60){let d=e;e++;while(e<r&&t.charCodeAt(e)!==60)e++;if(!o)o=t.substring(d,e);else o+=t.substring(d,e);continue}if(e+1>=r)break;let A=t.charCodeAt(e+1);if(A===33&&e+3<r&&t.charCodeAt(e+2)===45&&t.charCodeAt(e+3)===45){if(o||c)this.flushText(o,c,s,i),o="",c="";e+=4;let d=t.indexOf("-->",e);if(d===-1){e=r;break}if(this._commentPropName){let g=t.substring(e,d);this.addToObj(i,this._commentPropName,g,s,!0,!1)}e=d+3;continue}if(A===33&&e+8<r&&I(t,e+2)){e+=9;let d=t.indexOf("]]>",e);if(d===-1){e=r;break}let g=t.substring(e,d);if(this._cdataPropName)this.flushText(o,c,s,i),o="",c="",this.addToObj(i,this._cdataPropName,g,s,!0,!1);else{if(o){let y=o;if(this._processEntities)y=this.entityDecoder.decodeEntities(y);c+=y,o=""}c+=g}e=d+3;continue}if(A===33&&e+9<r&&k(t,e+2)){e+=9;let d=1;while(e<r&&d>0){let g=t.charCodeAt(e);if(g===60)d++;else if(g===62)d--;e++}continue}if(A===63){e+=2;let d=e;while(e<r&&!_(t.charCodeAt(e))&&t.charCodeAt(e)!==63)e++;let g=t.substring(d,e),y=t.indexOf("?>",e);if(y===-1){e=r;break}let N=t.substring(e,y).trim();if(g==="xml"){if(!this._ignoreDeclaration&&this._piPropName){let w=this.parsePiAttributes(N);this.addToObj(i,this._piPropName,{[g]:w},s,!0,!1)}}else if(!this._ignorePiTags&&this._piPropName)this.addToObj(i,this._piPropName,{[g]:N},s,!0,!1);e=y+2;continue}if(A===47){if(o||c)this.flushText(o,c,s,i),o="",c="";e+=2;let d=e,g=this.readTagName(t,e,r),y=this.extractTagName(t,d,g);e=g;while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===62)e++;if(a.length>0&&a[a.length-1]===y){a.pop();continue}return e}if(o||c)this.flushText(o,c,s,i),o="",c="";e++;let l=e,b=this.readTagName(t,e,r),p=this.extractTagName(t,l,b);if(!p){e=b+1;continue}e=b;let C=f?s?`${s}.${p}`:p:"",E={},h=!1;if(!this._ignoreAttributes){let d=this.parseAttributes(t,e,r,C,E);if(d<0)e=-d-1,h=!0;else e=d}else while(e<r){let d=t.charCodeAt(e);if(d===62||d===47)break;if(d===34||d===39){e++;while(e<r&&t.charCodeAt(e)!==d)e++}e++}if(this.options.updateTag){if(this.options.updateTag(p,C,E)===!1){while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===47)e+=2;else if(e<r&&t.charCodeAt(e)===62){e++;let g=`</${p}>`,y=t.indexOf(g,e);if(y!==-1)e=y+g.length}continue}}while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===47){if(e+=2,h||this._alwaysCreateTextNode){let d={};if(h)this.applyAttributes(d,E,C);if(this._alwaysCreateTextNode)d[this._textNodeName]="";this.addToObj(i,p,d,C,!0,!1)}else this.addToObj(i,p,"",C,!0,!1);continue}if(e<r&&t.charCodeAt(e)===62){if(e++,this.unpairedSet.has(p)){if(h){let N={};this.applyAttributes(N,E,C),this.addToObj(i,p,N,C,!0,!1)}else this.addToObj(i,p,"",C,!0,!1);a.push(p);continue}if(this.exactStopNodes.size>0||this.wildcardStopSuffixes.length>0){if(this.isStopNode(C)){let N=this.readStopNodeContent(t,e,r,p),w={};if(h)this.applyAttributes(w,E,C);if(N.content)w[this._textNodeName]=N.content;this.addToObj(i,p,w,C,!0,!1),e=N.pos;continue}}let d={};if(h)this.applyAttributes(d,E,C);e=this.parseChildren(t,e,r,d,C,a);let g=this._textNodeName,y=d[g];if(!h&&!this._alwaysCreateTextNode){let N=!0;for(let w in d)if(w!==g){N=!1;break}if(N){this.addToObj(i,p,y!==void 0?y:"",C,!0,!1);continue}}this.addToObj(i,p,d,C,!1,!1)}}if(o||c)this.flushText(o,c,s,i);return e}parseChildrenOrdered(t,e,r,i,s){let a="",o=this.needsJPath;while(e<r){if(t.charCodeAt(e)!==60){let h=e;e++;while(e<r&&t.charCodeAt(e)!==60)e++;if(!a)a=t.substring(h,e);else a+=t.substring(h,e);continue}if(e+1>=r)break;let f=t.charCodeAt(e+1);if(f===33&&e+3<r&&t.charCodeAt(e+2)===45&&t.charCodeAt(e+3)===45){if(a){let d=this.processTagValue(a,this._textNodeName,s,!1,!0);if(d!==void 0&&d!=="")i.push({[this._textNodeName]:d});a=""}e+=4;let h=t.indexOf("-->",e);if(h===-1){e=r;break}if(this._commentPropName)i.push({[this._commentPropName]:[{[this._textNodeName]:t.substring(e,h)}]});e=h+3;continue}if(f===33&&e+8<r&&I(t,e+2)){e+=9;let h=t.indexOf("]]>",e);if(h===-1){e=r;break}let d=t.substring(e,h);if(this._cdataPropName){if(a){let g=this.processTagValue(a,this._textNodeName,s,!1,!0);if(g!==void 0&&g!=="")i.push({[this._textNodeName]:g});a=""}i.push({[this._cdataPropName]:[{[this._textNodeName]:d}]})}else a+=d;e=h+3;continue}if(f===33&&e+9<r&&k(t,e+2)){e+=9;let h=1;while(e<r&&h>0){let d=t.charCodeAt(e);if(d===60)h++;else if(d===62)h--;e++}continue}if(f===63){e+=2;let h=t.indexOf("?>",e);if(h===-1){e=r;break}e=h+2;continue}if(f===47){if(a){let d=this.processTagValue(a,this._textNodeName,s,!1,!0);if(d!==void 0&&d!=="")i.push({[this._textNodeName]:d});a=""}e+=2,e=this.readTagName(t,e,r);while(e<r&&_(t.charCodeAt(e)))e++;if(e<r&&t.charCodeAt(e)===62)e++;return e}if(a){let h=this.processTagValue(a,this._textNodeName,s,!1,!0);if(h!==void 0&&h!=="")i.push({[this._textNodeName]:h});a=""}e++;let m=e,A=this.readTagName(t,e,r),l=this.extractTagName(t,m,A);if(!l){e=A+1;continue}e=A;let b=o?s?`${s}.${l}`:l:"",p={},C=!1;if(!this._ignoreAttributes){let h=this.parseAttributes(t,e,r,b,p);if(h<0)e=-h-1,C=!0;else e=h}else while(e<r){let h=t.charCodeAt(e);if(h===62||h===47)break;if(h===34||h===39){e++;while(e<r&&t.charCodeAt(e)!==h)e++}e++}while(e<r&&_(t.charCodeAt(e)))e++;let E={[l]:[]};if(C){E[":@"]={};for(let d in p)E[":@"][this._attrPrefix+d]=this.parseAttributeValue(p[d])}if(e<r&&t.charCodeAt(e)===47){e+=2,i.push(E);continue}if(e<r&&t.charCodeAt(e)===62)e++,e=this.parseChildrenOrdered(t,e,r,E[l],b),i.push(E)}if(a){let c=this.processTagValue(a,this._textNodeName,s,!1,!0);if(c!==void 0&&c!=="")i.push({[this._textNodeName]:c})}return e}applyAttributes(t,e,r){let i=this._attrPrefix;if(this._attrsGroupName){let s={};for(let a in e)s[i+a]=this.parseAttributeValue(e[a]);t[this._attrsGroupName]=s}else for(let s in e)t[i+s]=this.parseAttributeValue(e[s])}parsePiAttributes(t){let e={},r=0,i=t.length;while(r<i){while(r<i&&_(t.charCodeAt(r)))r++;if(r>=i)break;let s=r;while(r<i&&!_(t.charCodeAt(r))&&t.charCodeAt(r)!==61)r++;let a=t.substring(s,r);if(!a)break;while(r<i&&_(t.charCodeAt(r)))r++;if(r<i&&t.charCodeAt(r)===61){r++;while(r<i&&_(t.charCodeAt(r)))r++;if(r<i){let o=t.charCodeAt(r);if(o===34||o===39){r++;let c=r;while(r<i&&t.charCodeAt(r)!==o)r++;if(e[a]=t.substring(c,r),r<i)r++}}}}return e}}import*as T from"node:crypto";import{existsSync as V,readFileSync as Y}from"node:fs";import{homedir as W}from"node:os";import{join as K}from"node:path";function Hr(t){let e=t.endpoint||`s3.${t.region}.amazonaws.com`,r=new URL(/^https?:\/\//i.test(e)?e:`https://${e}`);if(r.protocol!=="http:"&&r.protocol!=="https:"||r.pathname!=="/"&&r.pathname!==""||r.search||r.hash||r.username||r.password)throw Error("S3 endpoint must be an HTTP(S) origin without a path");let i=r.protocol.slice(0,-1),s=r.host;if(!t.bucket)return{protocol:i,host:s,path:t.path};if(t.forcePathStyle){let a=t.path==="/"?`/${t.bucket}`:`/${t.bucket}${t.path}`;return{protocol:i,host:s,path:a}}return{protocol:i,host:`${t.bucket}.${s}`,path:t.path}}var J={email:"ses","bedrock-runtime":"bedrock","bedrock-agent":"bedrock","bedrock-agent-runtime":"bedrock","personalize-runtime":"personalize","personalize-events":"personalize"};function dp(t){return J[t]??t}function lp(t,e){if(t==="s3")return e;return e.split("/").map((r)=>encodeURIComponent(r).replace(/[!'()*]/g,(i)=>`%${i.charCodeAt(0).toString(16).toUpperCase()}`)).join("/")}function Ei(t){if(typeof t==="string"){if(t==="true")return!0;if(t==="false")return!1;let e=Number(t);if(t!==""&&Number.isFinite(e)&&String(e)===t)return e;return t}if(Array.isArray(t))return t.map(Ei);if(t&&typeof t==="object"){let e={};for(let[r,i]of Object.entries(t))e[r]=Ei(i);return e}return t}var Z=new Set(["InvalidClientTokenId","UnrecognizedClientException","InvalidAccessKeyId","SignatureDoesNotMatch","IncompleteSignature","ExpiredToken","ExpiredTokenException","InvalidToken","AuthFailure"]);class n{credentials;credentialSource="no credentials";config;cache;xmlParser;constructor(t,e){if(this.config={maxRetries:3,retryDelay:1000,cacheEnabled:!0,defaultCacheTTL:60000,...e},t)this.credentialSource="credentials passed to AWSClient";this.credentials=t||this.loadCredentials(),this.cache=new Map,this.xmlParser=new St({ignoreAttributes:!1,attributeNamePrefix:"@_",textNodeName:"#text",parseTagValue:!1,parseAttributeValue:!1,trimValues:!0})}loadCredentials(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY,r=process.env.AWS_SESSION_TOKEN;if(t&&e)return this.credentialSource="AWS_ACCESS_KEY_ID in the environment",{accessKeyId:t,secretAccessKey:e,sessionToken:r};let i=this.loadCredentialsFromFile();if(i)return i;return{accessKeyId:"",secretAccessKey:""}}loadCredentialsFromFile(){let t=this.config?.profile||process.env.AWS_PROFILE||"default",e=process.env.AWS_SHARED_CREDENTIALS_FILE||K(W(),".aws","credentials");if(!V(e))return null;try{let r=Y(e,"utf-8"),i=this.parseCredentialsFile(r,t);if(i.accessKeyId&&i.secretAccessKey)return this.credentialSource=`profile "${t}" in ${e}`,i}catch{}return null}parseCredentialsFile(t,e){let r=t.split(`
+`),i="",s="",a="",o;for(let c of r){let f=c.trim();if(!f||f.startsWith("#"))continue;let m=f.match(/^\[([^\]]+)\]$/);if(m){i=m[1];continue}if(i===e){let[A,...l]=f.split("="),b=l.join("=").trim();if(A.trim()==="aws_access_key_id")s=b;else if(A.trim()==="aws_secret_access_key")a=b;else if(A.trim()==="aws_session_token")o=b}}return{accessKeyId:s,secretAccessKey:a,sessionToken:o}}ec2CredentialsCache;async getCredentials(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY;if(t&&e)return this.credentialSource="AWS_ACCESS_KEY_ID in the environment",{accessKeyId:t,secretAccessKey:e,sessionToken:process.env.AWS_SESSION_TOKEN};let r=this.loadCredentialsFromFile();if(r)return r;if(this.ec2CredentialsCache){let i=Date.now();if(this.ec2CredentialsCache.expiration>i+300000)return this.credentialSource="EC2 instance metadata",this.ec2CredentialsCache.credentials}try{let s=await(await fetch("http://169.254.169.254/latest/api/token",{method:"PUT",headers:{"X-aws-ec2-metadata-token-ttl-seconds":"21600"}})).text(),o=await(await fetch("http://169.254.169.254/latest/meta-data/iam/security-credentials/",{headers:{"X-aws-ec2-metadata-token":s}})).text(),f=await(await fetch(`http://169.254.169.254/latest/meta-data/iam/security-credentials/${o}`,{headers:{"X-aws-ec2-metadata-token":s}})).json(),m={accessKeyId:f.AccessKeyId,secretAccessKey:f.SecretAccessKey,sessionToken:f.Token};return this.credentialSource="EC2 instance metadata",this.ec2CredentialsCache={credentials:m,expiration:new Date(f.Expiration).getTime()},m}catch(i){throw Error("AWS credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, or run on an EC2 instance with an IAM role.")}}async request(t){if(t.method==="GET"&&this.config.cacheEnabled&&t.cacheKey){let i=this.getFromCache(t.cacheKey);if(i!==null)return i}let e=t.retries??this.config.maxRetries??3,r=null;for(let i=0;i<=e;i++)try{let s=await this.makeRequest(t);if(t.method==="GET"&&this.config.cacheEnabled&&t.cacheKey)this.setInCache(t.cacheKey,s,t.cacheTTL??this.config.defaultCacheTTL??60000);return s}catch(s){if(r=s,!this.shouldRetry(s))throw s;if(i===e)throw s;let o=this.calculateRetryDelay(i);await this.sleep(o)}throw r||Error("Request failed after retries")}async makeRequest(t){let e=t.credentials||(this.credentials?.accessKeyId?this.credentials:await this.getCredentials());if(!e||!e.accessKeyId||!e.secretAccessKey)throw Error("AWS credentials not provided");let r=this.buildUrl(t),i=this.signRequest(t,e),s=await fetch(r,{method:t.method,headers:i,body:t.body});if(t.streamResponse&&s.ok)return s;let a=await s.text();if(!s.ok){let c=this.parseError(a,s.status,s.headers);if(c.code&&Z.has(String(c.code).split("#").pop())){let f=t.credentials?"credentials passed with the request":this.credentialSource;c.message+=` (credentials from ${f})`}throw c}if(!a||a.trim()===""){if(t.returnHeaders)return{body:null,headers:this.headersToObject(s.headers)};return null}if(t.rawResponse){if(t.returnHeaders)return{body:a,headers:this.headersToObject(s.headers)};return a}let o;if(a.startsWith("<"))o=this.parseXmlResponse(a);else try{o=JSON.parse(a)}catch{o=a}if(t.returnHeaders)return{body:o,headers:this.headersToObject(s.headers)};return o}headersToObject(t){let e={};return t.forEach((r,i)=>{e[i]=r}),e}buildUrl(t){let{service:e,region:r,queryParams:i}=t,{path:s}=t,a,o="https";if(e==="s3"){let f=Hr({region:r,path:s,bucket:t.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});o=f.protocol,a=f.host,s=f.path}else if(e==="cloudfront")a="cloudfront.amazonaws.com";else if(e==="iam")a="iam.amazonaws.com";else if(e==="route53")a="route53.amazonaws.com";else if(e==="route53domains")a="route53domains.us-east-1.amazonaws.com";else if(e==="ecr")a=`api.ecr.${r}.amazonaws.com`;else if(e==="ses")a=`email.${r}.amazonaws.com`;else a=`${e}.${r}.amazonaws.com`;let c=`${o}://${a}${s}`;if(i&&Object.keys(i).length>0){let f=Object.keys(i).map((m)=>`${this.uriEncode(m)}=${this.uriEncode(i[m])}`).join("&");c+=`?${f}`}return c}signRequest(t,e){let{service:r,region:i,method:s,queryParams:a,body:o}=t,{path:c}=t,f=new Date,m=this.getAmzDate(f),A=this.getDateStamp(f),l;if(r==="s3"){let S=Hr({region:i,path:c,bucket:t.bucket,endpoint:this.config.endpoint,forcePathStyle:this.config.forcePathStyle});l=S.host,c=S.path}else if(r==="cloudfront")l="cloudfront.amazonaws.com";else if(r==="iam")l="iam.amazonaws.com";else if(r==="route53")l="route53.amazonaws.com";else if(r==="route53domains")l="route53domains.us-east-1.amazonaws.com";else if(r==="ecr")l=`api.ecr.${i}.amazonaws.com`;else if(r==="ses")l=`email.${i}.amazonaws.com`;else l=`${r}.${i}.amazonaws.com`;let b={host:l,"x-amz-date":m,...t.headers||{}};if(e.sessionToken)b["x-amz-security-token"]=e.sessionToken;if(o){if(!Object.keys(b).some((x)=>x.toLowerCase()==="content-type"))b["content-type"]="application/x-www-form-urlencoded";b["content-length"]=Buffer.byteLength(o).toString()}let p=this.sha256(o||"");b["x-amz-content-sha256"]=p;let C=lp(r,c),E=a?Object.keys(a).sort().map((S)=>`${this.uriEncode(S)}=${this.uriEncode(a[S])}`).join("&"):"",h=Object.keys(b).sort((S,x)=>S.toLowerCase().localeCompare(x.toLowerCase())),d=h.map((S)=>`${S.toLowerCase()}:${b[S].trim()}
+`).join(""),g=h.map((S)=>S.toLowerCase()).join(";"),y=[s,C,E,d,g,p].join(`
+`),N="AWS4-HMAC-SHA256",w=dp(r),v=`${A}/${i}/${w}/aws4_request`,B=[N,m,v,this.sha256(y)].join(`
+`),F=this.getSignatureKey(e.secretAccessKey,A,i,w),q=this.hmac(F,B),U=`${N} Credential=${e.accessKeyId}/${v}, SignedHeaders=${g}, Signature=${q}`;return{...b,Authorization:U}}getAmzDate(t){return t.toISOString().replace(/[:-]|\.\d{3}/g,"")}getDateStamp(t){return t.toISOString().slice(0,10).replace(/-/g,"")}uriEncode(t){return encodeURIComponent(t).replace(/[!'()*]/g,(e)=>`%${e.charCodeAt(0).toString(16).toUpperCase()}`)}sha256(t){return T.createHash("sha256").update(t,"utf8").digest("hex")}hmac(t,e){return T.createHmac("sha256",t).update(e,"utf8").digest("hex")}getSignatureKey(t,e,r,i){let s=T.createHmac("sha256",`AWS4${t}`).update(e).digest(),a=T.createHmac("sha256",s).update(r).digest(),o=T.createHmac("sha256",a).update(i).digest();return T.createHmac("sha256",o).update("aws4_request").digest()}parseXmlResponse(t){try{let e=Ei(this.xmlParser.parse(t));if(e.ErrorResponse)throw this.createErrorFromXml(e.ErrorResponse.Error);let r=Object.keys(e);if(r.length===1)return e[r[0]];return e}catch(e){if(e.code||e.statusCode)throw e;return{}}}parseError(t,e,r){let i=Error();if(i.statusCode=e,i.requestId=r.get("x-amzn-requestid")||r.get("x-amz-request-id")||void 0,t.startsWith("<"))try{let s=Ei(this.xmlParser.parse(t));if(s.ErrorResponse?.Error){let a=s.ErrorResponse.Error;return i.code=a.Code,i.message=`AWS Error [${a.Code}]: ${a.Message||"Unknown error"}`,i.type=a.Type,i}if(s.Error)return i.code=s.Error.Code,i.message=`AWS Error [${s.Error.Code}]: ${s.Error.Message||"Unknown error"}`,i}catch{}try{let s=JSON.parse(t);if(s.__type||s.code)return i.code=s.__type||s.code,i.message=`AWS Error [${i.code}]: ${s.message||s.Message||"Unknown error"}`,i}catch{}return i.message=`AWS API Error (${e}): ${t}`,i}createErrorFromXml(t){let e=Error();return e.code=t.Code,e.message=`AWS Error [${t.Code}]: ${t.Message||"Unknown error"}`,e.type=t.Type,e}isRetryableError(t){return["RequestTimeout","RequestTimeoutException","PriorRequestNotComplete","ConnectionError","ThrottlingException","Throttling","TooManyRequestsException","ProvisionedThroughputExceededException","RequestLimitExceeded","BandwidthLimitExceeded","SlowDown","ServiceUnavailable","ServiceUnavailableException","InternalError","InternalFailure","InternalServerError","InternalServiceException","TransientError","TransientFailure","IDPCommunicationErrorException","NetworkError","ConnectionRefusedException","EC2ThrottledException","503 Slow Down","500 InternalError"].includes(t)}isRetryableStatusCode(t){return t>=500||t===429}shouldRetry(t){if(t.name==="FetchError"||t.name==="TypeError"||t.code==="ECONNRESET")return!0;if(t.code&&this.isRetryableError(t.code))return!0;if(t.statusCode&&this.isRetryableStatusCode(t.statusCode))return!0;if(t.statusCode&&t.statusCode>=400&&t.statusCode<500&&t.statusCode!==429)return!1;if(t.statusCode)return!1;return!0}calculateRetryDelay(t){let e=this.config.retryDelay??1000,r=30000,i=Math.min(e*2**t,30000),s=Math.random()*0.3*i;return i+s}sleep(t){return new Promise((e)=>setTimeout(e,t))}getFromCache(t){let e=this.cache.get(t);if(!e)return null;if(Date.now()>e.expires)return this.cache.delete(t),null;return e.data}setInCache(t,e,r){this.cache.set(t,{data:e,expires:Date.now()+r})}clearCache(){this.cache.clear()}clearExpiredCache(){let t=Date.now();for(let[e,r]of this.cache.entries())if(t>r.expires)this.cache.delete(e)}}function u(t){let e={};for(let[r,i]of Object.entries(t)){if(i===void 0||i===null)continue;if(Array.isArray(i))i.forEach((s,a)=>{e[`${r}.${a+1}`]=String(s)});else if(typeof i==="object")for(let[s,a]of Object.entries(i))e[`${r}.${s}`]=String(a);else e[r]=String(i)}return e}function Qh(){let t=process.env.AWS_ACCESS_KEY_ID,e=process.env.AWS_SECRET_ACCESS_KEY,r=t==="",i=e==="";if(t&&e)return{source:"env",emptyEnvKey:r,emptyEnvSecret:i,description:"environment variables (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)"};let s=process.env.AWS_PROFILE||"default",a=process.env.AWS_SHARED_CREDENTIALS_FILE||K(W(),".aws","credentials");if(V(a))return{source:"file",profile:s,emptyEnvKey:r,emptyEnvSecret:i,description:`~/.aws/credentials (profile: ${s})`};return{source:"ec2",emptyEnvKey:r,emptyEnvSecret:i,description:"EC2 instance metadata service (IMDSv2)"}}
+export{St,Hr,dp,lp,Ei,n,u,Qh};

package/dist/{chunk-jhtp3m31.js → chunk-cpba1hz2.js}

@@ -1,2 +1,2 @@
-import{Q,Md}from"./chunk-kr8aeva1.js";function _(t,s){return`/var/www/${t}-${s}`}var y=new Set(["laravel","php","statamic","wordpress"]);function _r(t){return t.type!=null&&y.has(t.type)}function Lr(t){let s=t.proxyTo;if(s==null)return[];return(Array.isArray(s)?s:[s]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function Wc(t){return Lr(t).length>0}function Ys(t){if(t.deploy)return t.deploy;if(_r(t))return"server";if(t.start)return"server";return"bucket"}function u(t){if(t.redirect)return"redirect";if(Wc(t))return"proxy";if(_r(t))return"server-php";if(Ys(t)==="bucket")return"bucket";return t.start?"server-app":"server-static"}function rA(t){return t.infrastructure?.compute!=null||Boolean(t.cloud?.attachTo?.trim())}function Ip(t,s={}){let r=[],n=[],c=t.sites||{},p=rA(t),f=Md(t);if(f)r.push(f);let d=new Map;for(let[o,e]of Object.entries(c)){if(!e)continue;let h=Ys(e),l=u(e);if(l==="redirect"){if(!e.domain)r.push(`Site '${o}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof e.redirect==="string"?e.redirect:e.redirect?.to))r.push(`Site '${o}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!p)r.push(`Site '${o}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let a=[];if(e.start)a.push("start");if(e.root)a.push("root");if(e.proxyTo)a.push("proxyTo");if(a.length>0)n.push(`Site '${o}' is a redirect site but also sets ${a.join(", ")}. These are ignored.`);continue}if(l==="proxy"){if(!e.domain)r.push(`Site '${o}' is a proxy site but has no \`domain\` to route from.`);if(!p)r.push(`Site '${o}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let i=[];if(e.start)i.push("start");if(e.root)i.push("root");if(typeof e.port==="number")i.push("port");if(e.build)i.push("build");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${i.join(", ")} ${i.length===1?"is":"are"} ignored — remove ${i.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(h==="server"&&!e.start&&!e.root){r.push(`Site '${o}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(l==="server-php"){if(!p)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!e.repository?.url)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(l==="server-app"){if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server'${e.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof e.port==="number"){let i=s.occupiedPorts?.get(e.port);if(i)r.push(`Site '${o}' wants port ${e.port}, which project '${i}' already serves on this box. Attached projects share one port namespace. Give '${o}' a free port, or let the attach allocate one.`);let a=d.get(e.port);if(a)r.push(`Sites '${a}' and '${o}' both use port ${e.port}. Server apps sharing a box must use distinct ports.`);else d.set(e.port,o)}}else if(l==="server-static"){if(!e.root)r.push(`Site '${o}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!e.root)r.push(`Site '${o}' deploys to a bucket but has no \`root\` directory to upload.`);let i=[];if(e.start)i.push("start");if(typeof e.port==="number")i.push("port");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' deploys to a bucket but sets server-only field(s): ${i.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function bp(t){let s=u(t);return s!=="bucket"&&s!=="redirect"&&s!=="proxy"}function iI(t){return u(t)==="bucket"}function sI(t,s){if(Q(t)==="serverless")return!0;let r=Object.entries(t.sites??{}).filter(([,c])=>c!=null),n=s?r.filter(([c])=>c===s):r;if(n.length===0)return!0;return!n.every(([,c])=>{let p=u(c);return p==="redirect"||p==="proxy"})}
-export{_,_r,Lr,Wc,Ys,u,rA,Ip,bp,iI,sI};
+import{K,Wd}from"./chunk-18h7na1g.js";function U(t,s){return`/var/www/${t}-${s}`}var y=new Set(["laravel","php","statamic","wordpress"]);function Gr(t){return t.type!=null&&y.has(t.type)}function Vr(t){let s=t.proxyTo;if(s==null)return[];return(Array.isArray(s)?s:[s]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function od(t){return Vr(t).length>0}function oo(t){if(t.deploy)return t.deploy;if(Gr(t))return"server";if(t.start)return"server";return"bucket"}function d(t){if(t.redirect)return"redirect";if(od(t))return"proxy";if(Gr(t))return"server-php";if(oo(t)==="bucket")return"bucket";return t.start?"server-app":"server-static"}function pA(t){return t.infrastructure?.compute!=null||Boolean(t.cloud?.attachTo?.trim())}function kp(t,s={}){let r=[],n=[],a=t.sites||{},p=pA(t),l=Wd(t);if(l)r.push(l);let f=new Map;for(let[o,e]of Object.entries(a)){if(!e)continue;let h=oo(e),c=d(e);if(c==="redirect"){if(!e.domain)r.push(`Site '${o}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof e.redirect==="string"?e.redirect:e.redirect?.to))r.push(`Site '${o}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!p)r.push(`Site '${o}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let u=[];if(e.start)u.push("start");if(e.root)u.push("root");if(e.proxyTo)u.push("proxyTo");if(u.length>0)n.push(`Site '${o}' is a redirect site but also sets ${u.join(", ")}. These are ignored.`);continue}if(c==="proxy"){if(!e.domain)r.push(`Site '${o}' is a proxy site but has no \`domain\` to route from.`);if(!p)r.push(`Site '${o}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let i=[];if(e.start)i.push("start");if(e.root)i.push("root");if(typeof e.port==="number")i.push("port");if(e.build)i.push("build");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${i.join(", ")} ${i.length===1?"is":"are"} ignored — remove ${i.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(h==="server"&&!e.start&&!e.root){r.push(`Site '${o}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(c==="server-php"){if(!p)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!e.repository?.url)r.push(`Site '${o}' is a PHP site (type:'${e.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(c==="server-app"){if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server'${e.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof e.port==="number"){let i=s.occupiedPorts?.get(e.port);if(i)r.push(`Site '${o}' wants port ${e.port}, which project '${i}' already serves on this box. Attached projects share one port namespace. Give '${o}' a free port, or let the attach allocate one.`);let u=f.get(e.port);if(u)r.push(`Sites '${u}' and '${o}' both use port ${e.port}. Server apps sharing a box must use distinct ports.`);else f.set(e.port,o)}}else if(c==="server-static"){if(!e.root)r.push(`Site '${o}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!p)r.push(`Site '${o}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!e.root)r.push(`Site '${o}' deploys to a bucket but has no \`root\` directory to upload.`);let i=[];if(e.start)i.push("start");if(typeof e.port==="number")i.push("port");if(e.preStart&&e.preStart.length>0)i.push("preStart");if(i.length>0)n.push(`Site '${o}' deploys to a bucket but sets server-only field(s): ${i.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function Bp(t){let s=d(t);return s!=="bucket"&&s!=="redirect"&&s!=="proxy"}function hI(t){return d(t)==="bucket"}function yI(t,s){if(K(t)==="serverless")return!0;let r=Object.entries(t.sites??{}).filter(([,a])=>a!=null),n=s?r.filter(([a])=>a===s):r;if(n.length===0)return!0;return!n.every(([,a])=>{let p=d(a);return p==="redirect"||p==="proxy"})}
+export{U,Gr,Vr,od,oo,d,pA,kp,Bp,hI,yI};

package/dist/{chunk-ynprwawa.js → chunk-erfh93dq.js}

@@ -1,2 +1,2 @@
-import{createRequire as s}from"node:module";var k=Object.create;var{getPrototypeOf:l,defineProperty:f,getOwnPropertyNames:m}=Object;var j=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,cS=(a,b,c)=>{var g=a!=null&&typeof a==="object";if(g){var h=b?o??=new WeakMap:p??=new WeakMap,i=h.get(a);if(i)return i}c=a!=null?k(l(a)):{};let d=b||!a||!a.__esModule||!j.call(a,"default")?f(c,"default",{value:a,enumerable:!0}):c;if(a&&typeof a==="object"||typeof a==="function"){for(let e of m(a))if(!j.call(d,e))f(d,e,{get:n.bind(a,e),enumerable:!0})}if(g)h.set(a,d);return d};var dS=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var q=(a)=>a;function r(a,b){this[a]=q.bind(null,b)}var sn=(a,b)=>{for(var c in b)f(a,c,{get:b[c],enumerable:!0,configurable:!0,set:r.bind(b,c)})};var Xe=s(import.meta.url);
-export{cS,dS,sn,Xe};
+import{createRequire as s}from"node:module";var k=Object.create;var{getPrototypeOf:l,defineProperty:f,getOwnPropertyNames:m}=Object;var j=Object.prototype.hasOwnProperty;function n(a){return this[a]}var o,p,SS=(a,b,c)=>{var g=a!=null&&typeof a==="object";if(g){var h=b?o??=new WeakMap:p??=new WeakMap,i=h.get(a);if(i)return i}c=a!=null?k(l(a)):{};let d=b||!a||!a.__esModule||!j.call(a,"default")?f(c,"default",{value:a,enumerable:!0}):c;if(a&&typeof a==="object"||typeof a==="function"){for(let e of m(a))if(!j.call(d,e))f(d,e,{get:n.bind(a,e),enumerable:!0})}if(g)h.set(a,d);return d};var IS=(a,b)=>()=>(b||a((b={exports:{}}).exports,b),b.exports);var q=(a)=>a;function r(a,b){this[a]=q.bind(null,b)}var pn=(a,b)=>{for(var c in b)f(a,c,{get:b[c],enumerable:!0,configurable:!0,set:r.bind(b,c)})};var nt=s(import.meta.url);
+export{SS,IS,pn,nt};

package/dist/{chunk-22hfejjs.js → chunk-ffyx50xx.js}

@@ -1 +1 @@
-import{Kr}from"./chunk-6rcj3km0.js";var Nl="\x00";function Uo(t,i){if(t==="*"||t==="**")return!0;let e=t.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*");return new RegExp(`^${e}$`).test(i)}function f(t,i){if(t.startsWith("*.")){let e=t.slice(1);return i.endsWith(e)&&i.length>e.length}return t===i}function zi(t,i){if(t.enabled===!1)return!1;if(t.methods?.length&&!t.methods.some((e)=>e.toUpperCase()===i.method.toUpperCase()))return!1;if(t.path&&!Uo(t.path,i.path))return!1;if(t.host&&!f(t.host,i.host??""))return!1;return!0}function Ki(t,i){let e=t.key??{source:"ip"},o=e.fallbackToIp!==!1,r;if(e.source==="ip")r=i.ip;else if(e.source==="global")r="global";else if(e.source==="host")r=i.host??"";else if(e.source==="path")r=i.path;else if(e.source==="header")r=e.name?i.headers?.[e.name.toLowerCase()]:void 0;else if(e.source==="cookie")r=e.name?i.cookies?.[e.name]:void 0;if(!r&&e.source!=="global")r=o?i.ip:"__missing__";return`${t.id}\x00${r}`}class Qo{clock;maxTrackedKeys;buckets=new Map;windows=new Map;rules;constructor(t,i=()=>Date.now(),e=1e5){this.clock=i;this.maxTrackedKeys=e;this.rules=[...t].sort((o,r)=>(o.priority??0)-(r.priority??0))}check(t){let i=this.clock(),e=this.rules.filter((n)=>zi(n,t)),o;for(let n of e){let s=this.test(n,t,i);if(s.allowed)continue;if(!o||d(s.action)>d(o.action))o=s}if(o)return o;let r={action:"allow",allowed:!0};for(let n of e){let s=this.consume(n,t,i);if(s.remaining!=null&&(r.remaining??1/0)>s.remaining)r=s}return r}test(t,i,e){let o=Ki(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let n=t.burst??t.limit,s=this.buckets.get(o),a=s?Math.min(n,s.tokens+this.refill(t,e-s.updatedAt)):n;if(a>=1)return{action:"allow",allowed:!0};return this.blocked(t,o,0,this.msPerToken(t)*(1-a),e)}let r=(this.windows.get(o)?.hits??[]).filter((n)=>n>e-t.windowMs);if(r.length<t.limit)return{action:"allow",allowed:!0};return this.blocked(t,o,0,r[0]+t.windowMs-e,e)}peek(t){let i=this.clock();for(let e of this.rules){if(!zi(e,t))continue;let o=this.test(e,t,i);if(!o.allowed)return o}return{action:"allow",allowed:!0}}msPerToken(t){return t.windowMs/Math.max(1,t.limit)}refill(t,i){return Math.max(0,i)/this.msPerToken(t)}blocked(t,i,e,o,r){let n=t.action??"deny";return{action:n,allowed:n==="allow"||n==="log",ruleId:t.id,limit:t.limit,remaining:e,retryAfterMs:Math.max(0,Math.ceil(o)),resetAt:r+Math.max(0,o),key:i}}consume(t,i,e){let o=Ki(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let l=t.burst??t.limit,u=this.buckets.get(o)??{tokens:l,updatedAt:e},c=Math.min(l,u.tokens+this.refill(t,e-u.updatedAt));if(c<1)return this.buckets.set(o,{tokens:c,updatedAt:e}),this.blocked(t,o,0,this.msPerToken(t)*(1-c),e);return this.evictIfNeeded(this.buckets),this.buckets.set(o,{tokens:c-1,updatedAt:e}),{action:"allow",allowed:!0,ruleId:t.id,limit:l,remaining:Math.floor(c-1),resetAt:e+this.msPerToken(t)*(l-(c-1)),key:o}}let n=this.windows.get(o)??{hits:[]},s=e-t.windowMs,a=n.hits.filter((l)=>l>s);if(a.length>=t.limit)return this.windows.set(o,{hits:a}),this.blocked(t,o,0,a[0]+t.windowMs-e,e);return a.push(e),this.evictIfNeeded(this.windows),this.windows.set(o,{hits:a}),{action:"allow",allowed:!0,ruleId:t.id,limit:t.limit,remaining:t.limit-a.length,resetAt:a[0]+t.windowMs,key:o}}evictIfNeeded(t){if(t.size<this.maxTrackedKeys)return;let i=t.size-this.maxTrackedKeys+1,e=0;for(let o of t.keys())if(t.delete(o),++e>=i)break}sweep(){let t=this.clock(),i=0;for(let[e,o]of this.windows){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n){this.windows.delete(e),i++;continue}if(o.hits.every((s)=>s<=t-n.windowMs))this.windows.delete(e),i++}for(let[e,o]of this.buckets){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n||t-o.updatedAt>n.windowMs*2)this.buckets.delete(e),i++}return i}get trackedKeys(){return this.buckets.size+this.windows.size}}function d(t){return{allow:0,log:1,throttle:2,challenge:3,deny:4}[t]}function kl(t){let i={};if(t.limit!=null)i["ratelimit-limit"]=String(t.limit);if(t.remaining!=null)i["ratelimit-remaining"]=String(t.remaining);if(t.resetAt!=null)i["ratelimit-reset"]=String(Math.max(0,Math.ceil((t.resetAt-Date.now())/1000)));if(!t.allowed&&t.retryAfterMs!=null)i["retry-after"]=String(Math.max(1,Math.ceil(t.retryAfterMs/1000)));return i}function Bl(){return[{id:"global-ip",limit:600,windowMs:60000,burst:100,key:{source:"ip"},action:"deny",priority:100},{id:"api-ip",limit:120,windowMs:60000,burst:30,path:"/api/**",key:{source:"ip"},action:"deny",priority:50},{id:"auth-ip",limit:10,windowMs:60000,algorithm:"sliding_window",path:"/auth/**",methods:["POST"],key:{source:"ip"},action:"challenge",priority:10}]}var xl="protection.controls",Wi=24,Ho=4,g={ipRules:{allow:[],block:[]}};function m(t,i){if(!t?.enabled)return;return new Date(t.expiresAt).getTime()>i.getTime()?t:void 0}function p(t,i){let e=Number.isFinite(t)?Number(t):i;return Math.min(Wi,Math.max(0.25,e))}var h=500;class Go{controlPlane;options;constructor(t,i={}){this.controlPlane=t;this.options=i}now(){return this.options.now?.()??new Date}read(){let t=this.controlPlane.getSetting(xl);if(!t||typeof t!=="object"||Array.isArray(t))return{...g,ipRules:{allow:[],block:[]}};let i=t;return{attackMode:i.attackMode,mitigationPause:i.mitigationPause,ipRules:{allow:Array.isArray(i.ipRules?.allow)?i.ipRules.allow:[],block:Array.isArray(i.ipRules?.block)?i.ipRules.block:[]},updatedAt:i.updatedAt}}write(t){let i={...t,updatedAt:this.now().toISOString()};return this.controlPlane.setSetting(xl,i),i}raw(){return this.read()}current(){let t=this.now(),i=this.read();return{attackMode:m(i.attackMode,t),mitigationPause:m(i.mitigationPause,t),ipRules:i.ipRules}}enableAttackMode(t){let i=this.now(),e={enabled:!0,startedAt:i.toISOString(),expiresAt:new Date(i.getTime()+p(t.hours,Ho)*3600000).toISOString(),reason:t.reason.trim()||"Attack mode enabled by an operator.",actorId:t.actorId};return this.write({...this.read(),attackMode:e}),e}disableAttackMode(){let t=this.read();if(!t.attackMode?.enabled)return!1;return this.write({...t,attackMode:{...t.attackMode,enabled:!1}}),!0}pauseMitigations(t){let i=t.reason.trim();if(!i)throw Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");let e=this.now(),o={enabled:!0,startedAt:e.toISOString(),expiresAt:new Date(e.getTime()+p(t.hours,Wi)*3600000).toISOString(),reason:i,actorId:t.actorId};return this.write({...this.read(),mitigationPause:o}),o}resumeMitigations(){let t=this.read();if(!t.mitigationPause?.enabled)return!1;return this.write({...t,mitigationPause:{...t.mitigationPause,enabled:!1}}),!0}addIpRule(t,i){let e=i.trim();if(!Kr(e))throw Error(`Not a valid IP or CIDR: ${i}`);let o=this.read(),r={...o.ipRules,[t]:[...new Set([...o.ipRules[t],e])]};if(r[t].length>h)throw Error(`At most ${h} ${t} rules are supported.`);let n=t==="allow"?"block":"allow";return r[n]=r[n].filter((s)=>s!==e),this.write({...o,ipRules:r}),r}removeIpRule(t,i){let e=this.read(),o={...e.ipRules,[t]:e.ipRules[t].filter((r)=>r!==i.trim())};return this.write({...e,ipRules:o}),o}}function Ol(t){if(t.mitigationPause)return{attackMode:!!t.attackMode,mitigationPaused:!0,summary:`Automatic mitigation is paused until ${t.mitigationPause.expiresAt}. All traffic is being served and billed.`,expiresAt:t.mitigationPause.expiresAt};if(t.attackMode)return{attackMode:!0,mitigationPaused:!1,summary:`Attack mode is on until ${t.attackMode.expiresAt}. Every visitor is being challenged.`,expiresAt:t.attackMode.expiresAt};return{attackMode:!1,mitigationPaused:!1,summary:"Protection is in its normal posture."}}function _l(t,i){if(i.mitigationPause)return t.map((e)=>({...e,enabled:!1}));if(!i.attackMode)return[...t];return t.map((e)=>({...e,action:e.action==="deny"?"deny":"challenge",burst:Math.max(1,Math.min(e.burst??e.limit,5))}))}function Vo(t,i){let e=[...new Set([...t.allowlist??[],...i.ipRules.allow])],o=[...new Set([...t.blocklist??[],...i.ipRules.block])];if(i.mitigationPause)return{...t,allowlist:e,blocklist:o,monitorOnly:!0};if(!i.attackMode)return{...t,allowlist:e,blocklist:o};let r=t.thresholds??{};return{...t,allowlist:e,blocklist:o,thresholds:{...r,newConnectionsPerSecond:Math.max(1,Math.floor((r.newConnectionsPerSecond??50)/5)),concurrentPerSource:Math.max(1,Math.floor((r.concurrentPerSource??100)/5))}}}function lS(t,i){let e=t?.infrastructure?.compute;if(!e||e.ddos===!1)return t;let o=typeof e.ddos==="object"&&e.ddos!==null?e.ddos:{};return{...t,infrastructure:{...t.infrastructure,compute:{...e,ddos:Vo(o,i)}}}}export{Nl,Uo,zi,Ki,Qo,kl,Bl,xl,Wi,Ho,Go,Ol,_l,Vo,lS};
+import{rn}from"./chunk-3ncnrrvm.js";var Fl="\x00";function Ko(t,i){if(t==="*"||t==="**")return!0;let e=t.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*");return new RegExp(`^${e}$`).test(i)}function f(t,i){if(t.startsWith("*.")){let e=t.slice(1);return i.endsWith(e)&&i.length>e.length}return t===i}function Xi(t,i){if(t.enabled===!1)return!1;if(t.methods?.length&&!t.methods.some((e)=>e.toUpperCase()===i.method.toUpperCase()))return!1;if(t.path&&!Ko(t.path,i.path))return!1;if(t.host&&!f(t.host,i.host??""))return!1;return!0}function Yi(t,i){let e=t.key??{source:"ip"},o=e.fallbackToIp!==!1,r;if(e.source==="ip")r=i.ip;else if(e.source==="global")r="global";else if(e.source==="host")r=i.host??"";else if(e.source==="path")r=i.path;else if(e.source==="header")r=e.name?i.headers?.[e.name.toLowerCase()]:void 0;else if(e.source==="cookie")r=e.name?i.cookies?.[e.name]:void 0;if(!r&&e.source!=="global")r=o?i.ip:"__missing__";return`${t.id}\x00${r}`}class Wo{clock;maxTrackedKeys;buckets=new Map;windows=new Map;rules;constructor(t,i=()=>Date.now(),e=1e5){this.clock=i;this.maxTrackedKeys=e;this.rules=[...t].sort((o,r)=>(o.priority??0)-(r.priority??0))}check(t){let i=this.clock(),e=this.rules.filter((n)=>Xi(n,t)),o;for(let n of e){let s=this.test(n,t,i);if(s.allowed)continue;if(!o||d(s.action)>d(o.action))o=s}if(o)return o;let r={action:"allow",allowed:!0};for(let n of e){let s=this.consume(n,t,i);if(s.remaining!=null&&(r.remaining??1/0)>s.remaining)r=s}return r}test(t,i,e){let o=Yi(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let n=t.burst??t.limit,s=this.buckets.get(o),a=s?Math.min(n,s.tokens+this.refill(t,e-s.updatedAt)):n;if(a>=1)return{action:"allow",allowed:!0};return this.blocked(t,o,0,this.msPerToken(t)*(1-a),e)}let r=(this.windows.get(o)?.hits??[]).filter((n)=>n>e-t.windowMs);if(r.length<t.limit)return{action:"allow",allowed:!0};return this.blocked(t,o,0,r[0]+t.windowMs-e,e)}peek(t){let i=this.clock();for(let e of this.rules){if(!Xi(e,t))continue;let o=this.test(e,t,i);if(!o.allowed)return o}return{action:"allow",allowed:!0}}msPerToken(t){return t.windowMs/Math.max(1,t.limit)}refill(t,i){return Math.max(0,i)/this.msPerToken(t)}blocked(t,i,e,o,r){let n=t.action??"deny";return{action:n,allowed:n==="allow"||n==="log",ruleId:t.id,limit:t.limit,remaining:e,retryAfterMs:Math.max(0,Math.ceil(o)),resetAt:r+Math.max(0,o),key:i}}consume(t,i,e){let o=Yi(t,i);if((t.algorithm??"token_bucket")==="token_bucket"){let l=t.burst??t.limit,u=this.buckets.get(o)??{tokens:l,updatedAt:e},c=Math.min(l,u.tokens+this.refill(t,e-u.updatedAt));if(c<1)return this.buckets.set(o,{tokens:c,updatedAt:e}),this.blocked(t,o,0,this.msPerToken(t)*(1-c),e);return this.evictIfNeeded(this.buckets),this.buckets.set(o,{tokens:c-1,updatedAt:e}),{action:"allow",allowed:!0,ruleId:t.id,limit:l,remaining:Math.floor(c-1),resetAt:e+this.msPerToken(t)*(l-(c-1)),key:o}}let n=this.windows.get(o)??{hits:[]},s=e-t.windowMs,a=n.hits.filter((l)=>l>s);if(a.length>=t.limit)return this.windows.set(o,{hits:a}),this.blocked(t,o,0,a[0]+t.windowMs-e,e);return a.push(e),this.evictIfNeeded(this.windows),this.windows.set(o,{hits:a}),{action:"allow",allowed:!0,ruleId:t.id,limit:t.limit,remaining:t.limit-a.length,resetAt:a[0]+t.windowMs,key:o}}evictIfNeeded(t){if(t.size<this.maxTrackedKeys)return;let i=t.size-this.maxTrackedKeys+1,e=0;for(let o of t.keys())if(t.delete(o),++e>=i)break}sweep(){let t=this.clock(),i=0;for(let[e,o]of this.windows){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n){this.windows.delete(e),i++;continue}if(o.hits.every((s)=>s<=t-n.windowMs))this.windows.delete(e),i++}for(let[e,o]of this.buckets){let r=e.split("\x00")[0],n=this.rules.find((s)=>s.id===r);if(!n||t-o.updatedAt>n.windowMs*2)this.buckets.delete(e),i++}return i}get trackedKeys(){return this.buckets.size+this.windows.size}}function d(t){return{allow:0,log:1,throttle:2,challenge:3,deny:4}[t]}function Ul(t){let i={};if(t.limit!=null)i["ratelimit-limit"]=String(t.limit);if(t.remaining!=null)i["ratelimit-remaining"]=String(t.remaining);if(t.resetAt!=null)i["ratelimit-reset"]=String(Math.max(0,Math.ceil((t.resetAt-Date.now())/1000)));if(!t.allowed&&t.retryAfterMs!=null)i["retry-after"]=String(Math.max(1,Math.ceil(t.retryAfterMs/1000)));return i}function Ql(){return[{id:"global-ip",limit:600,windowMs:60000,burst:100,key:{source:"ip"},action:"deny",priority:100},{id:"api-ip",limit:120,windowMs:60000,burst:30,path:"/api/**",key:{source:"ip"},action:"deny",priority:50},{id:"auth-ip",limit:10,windowMs:60000,algorithm:"sliding_window",path:"/auth/**",methods:["POST"],key:{source:"ip"},action:"challenge",priority:10}]}var Hl="protection.controls",Zi=24,Jo=4,g={ipRules:{allow:[],block:[]}};function m(t,i){if(!t?.enabled)return;return new Date(t.expiresAt).getTime()>i.getTime()?t:void 0}function p(t,i){let e=Number.isFinite(t)?Number(t):i;return Math.min(Zi,Math.max(0.25,e))}var h=500;class Xo{controlPlane;options;constructor(t,i={}){this.controlPlane=t;this.options=i}now(){return this.options.now?.()??new Date}read(){let t=this.controlPlane.getSetting(Hl);if(!t||typeof t!=="object"||Array.isArray(t))return{...g,ipRules:{allow:[],block:[]}};let i=t;return{attackMode:i.attackMode,mitigationPause:i.mitigationPause,ipRules:{allow:Array.isArray(i.ipRules?.allow)?i.ipRules.allow:[],block:Array.isArray(i.ipRules?.block)?i.ipRules.block:[]},updatedAt:i.updatedAt}}write(t){let i={...t,updatedAt:this.now().toISOString()};return this.controlPlane.setSetting(Hl,i),i}raw(){return this.read()}current(){let t=this.now(),i=this.read();return{attackMode:m(i.attackMode,t),mitigationPause:m(i.mitigationPause,t),ipRules:i.ipRules}}enableAttackMode(t){let i=this.now(),e={enabled:!0,startedAt:i.toISOString(),expiresAt:new Date(i.getTime()+p(t.hours,Jo)*3600000).toISOString(),reason:t.reason.trim()||"Attack mode enabled by an operator.",actorId:t.actorId};return this.write({...this.read(),attackMode:e}),e}disableAttackMode(){let t=this.read();if(!t.attackMode?.enabled)return!1;return this.write({...t,attackMode:{...t.attackMode,enabled:!1}}),!0}pauseMitigations(t){let i=t.reason.trim();if(!i)throw Error("Pausing mitigations requires a reason: you are liable for the traffic it admits.");let e=this.now(),o={enabled:!0,startedAt:e.toISOString(),expiresAt:new Date(e.getTime()+p(t.hours,Zi)*3600000).toISOString(),reason:i,actorId:t.actorId};return this.write({...this.read(),mitigationPause:o}),o}resumeMitigations(){let t=this.read();if(!t.mitigationPause?.enabled)return!1;return this.write({...t,mitigationPause:{...t.mitigationPause,enabled:!1}}),!0}addIpRule(t,i){let e=i.trim();if(!rn(e))throw Error(`Not a valid IP or CIDR: ${i}`);let o=this.read(),r={...o.ipRules,[t]:[...new Set([...o.ipRules[t],e])]};if(r[t].length>h)throw Error(`At most ${h} ${t} rules are supported.`);let n=t==="allow"?"block":"allow";return r[n]=r[n].filter((s)=>s!==e),this.write({...o,ipRules:r}),r}removeIpRule(t,i){let e=this.read(),o={...e.ipRules,[t]:e.ipRules[t].filter((r)=>r!==i.trim())};return this.write({...e,ipRules:o}),o}}function Gl(t){if(t.mitigationPause)return{attackMode:!!t.attackMode,mitigationPaused:!0,summary:`Automatic mitigation is paused until ${t.mitigationPause.expiresAt}. All traffic is being served and billed.`,expiresAt:t.mitigationPause.expiresAt};if(t.attackMode)return{attackMode:!0,mitigationPaused:!1,summary:`Attack mode is on until ${t.attackMode.expiresAt}. Every visitor is being challenged.`,expiresAt:t.attackMode.expiresAt};return{attackMode:!1,mitigationPaused:!1,summary:"Protection is in its normal posture."}}function Vl(t,i){if(i.mitigationPause)return t.map((e)=>({...e,enabled:!1}));if(!i.attackMode)return[...t];return t.map((e)=>({...e,action:e.action==="deny"?"deny":"challenge",burst:Math.max(1,Math.min(e.burst??e.limit,5))}))}function Yo(t,i){let e=[...new Set([...t.allowlist??[],...i.ipRules.allow])],o=[...new Set([...t.blocklist??[],...i.ipRules.block])];if(i.mitigationPause)return{...t,allowlist:e,blocklist:o,monitorOnly:!0};if(!i.attackMode)return{...t,allowlist:e,blocklist:o};let r=t.thresholds??{};return{...t,allowlist:e,blocklist:o,thresholds:{...r,newConnectionsPerSecond:Math.max(1,Math.floor((r.newConnectionsPerSecond??50)/5)),concurrentPerSource:Math.max(1,Math.floor((r.concurrentPerSource??100)/5))}}}function bS(t,i){let e=t?.infrastructure?.compute;if(!e||e.ddos===!1)return t;let o=typeof e.ddos==="object"&&e.ddos!==null?e.ddos:{};return{...t,infrastructure:{...t.infrastructure,compute:{...e,ddos:Yo(o,i)}}}}export{Fl,Ko,Xi,Yi,Wo,Ul,Ql,Hl,Zi,Jo,Xo,Gl,Vl,Yo,bS};

package/dist/chunk-fqgvackc.js

@@ -0,0 +1,138 @@
+import{on,dr}from"./chunk-18h7na1g.js";import{Vr,d}from"./chunk-cpba1hz2.js";import{isIP as L}from"node:net";var to="/etc/rpx/certs",A="/etc/rpx/local-ca",M="rpx-root-ca.crt";function ro(e=A){return`${e.replace(/\/+$/,"")}/${M}`}function no(e){if(e.toLowerCase().endsWith(".local"))return!1;return e.split(".").length===2}function io(e,t={}){let r=new Set;for(let o of Object.values(e)){if(!o?.domain)continue;if(d(o)==="bucket")continue;r.add(o.domain)}let n=new Set;for(let o of Object.values(e)){if(!o?.domain||d(o)==="bucket")continue;for(let u of o.aliases??[]){let i=String(u).trim().toLowerCase();if(i&&i!==o.domain)n.add(i)}}if(t.autoWww!==!1)for(let o of[...r]){if(!no(o))continue;r.add(`www.${o}`)}for(let o of n)r.add(o);return[...r]}var k=["1.1.1.1","8.8.8.8"],I="/var/www/acme-challenge";function W(e){if(typeof e==="string")return{to:e};let t={to:e.to};if(e.status!=null)t.status=e.status;if(e.preservePath!=null)t.preservePath=e.preservePath;return t}function U(e){let t=e.auth;if(!t||t.enabled===!1||!t.password)return;return{username:t.username||"admin",password:t.password,...t.realm?{realm:t.realm}:{}}}function Yc(e){if(!e)return;return e.tls??"local-ca"}function op(e,t){if(e.cloud?.provider!=="ssh")return;let r=e.ssh?.lan;if(!r)return;return{...r.hostname?{hostname:r.hostname}:{},tls:r.tls??"local-ca",...t?{ip:t}:{}}}function ap(e){if(e.cloud?.provider!=="ssh")return;return e.ssh?.profile}function X(e){let t=e.trim().toLowerCase();if(!t||t.startsWith("*")||t.includes(":")||t.includes("/")||t.includes(" "))return!1;if(L(t)!==0)return!1;return t.endsWith(".local")||!t.includes(".")}function F(e,t,r){let n=[],o=new Set,u=(g,a)=>{let p=g.trim().toLowerCase();if(!p||o.has(p))return;o.add(p),n.push({host:p,source:a})},i=t.hostname?.trim(),c=(i||`${r}.local`).toLowerCase();if(u(c,i?"ssh.lan.hostname":`the ssh provider's default LAN name for project "${r}"`),Object.entries(e).some(([g,a])=>!!a&&dr(g)))u(`dashboard.${c}`,"the management dashboard site");for(let[g,a]of Object.entries(e)){if(!a?.domain)continue;if(d(a)==="bucket")continue;if(!X(a.domain))continue;u(a.domain,`site "${g}"`)}return n}function H(e,t){if(!t?.length)return;return t.find((r)=>{let n=(r.startsWith(".")?r.slice(1):r).toLowerCase();return e===n||e.endsWith(`.${n}`)})}function K(e,t){if(!t?.enabled)return;for(let{host:r,source:n}of e){let o=H(r,t.allowedSuffixes);if(!o)continue;throw Error(`The LAN certificate authority and public on-demand TLS both claim "${r}". LAN source: ${n}. Public source: the on-demand TLS allowed suffix "${o}", which is derived from the site domains. A host is either LAN-only, with a certificate signed by the box's own CA, or public, with one issued by Let's Encrypt, never both. Give the LAN a name no site domain covers (ssh.lan.hostname), or take that domain out of the sites this deploy routes.`)}}function V(e){let t=e.split(".");return t.length>=3&&t[0]==="*"&&t.slice(1).every((r)=>/^[a-z0-9-]+$/i.test(r))}function D(e,t={}){let{wildcardCerts:r,...n}=e;return JSON.stringify({...t,...n},null,2)}function Uh(e){if(!e||e==="/")return;let t=`/${e}`.replace(/\/+/g,"/").replace(/\/+$/,"");if(!t.startsWith("/"))t=`/${t}`;return t===""||t==="/"?void 0:t}function Zc(e,t){let n=(t?`${e}${t}`:e).replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,128);return n.length>0?n:"rpx"}function Y(e,t){if(!t||t.length===0)return`localhost:${e}`;return t.map((r)=>`${r.privateIp??r.publicIp}:${e}`)}function N(e,t,r){let n=(t.wwwRoot??"/var/www").replace(/\/+$/,""),o=t.slug??"app",u=t.proxy.certsDir??to,i=t.proxy.loadBalancer,c=[],f=new Set,g=new Map;for(let[l,s]of Object.entries(e)){if(!s||!s.domain)continue;let w=d(s);if(w==="bucket")continue;let v=c.length,E=[...new Set((s.aliases??[]).map((m)=>String(m).trim().toLowerCase()).filter((m)=>m&&m!==s.domain))],b=()=>{let m=c.slice(v).filter((h)=>h.to===s.domain);for(let h of E){for(let O of m)c.push({...O,to:h,id:Zc(h,O.path)});if(V(h)){if(!g.has(h))g.set(h,{domain:h,dnsEnvFile:`${n}/${o}-${l}/shared/.env`})}else f.add(h)}},C=Uh(s.path),S=Zc(s.domain,C),y=U(s);if(w==="redirect"){c.push({to:s.domain,path:C,redirect:W(s.redirect),id:S,...y?{auth:y}:{}}),f.add(s.domain),b();continue}if(w==="proxy"){let m=Vr(s);if(m.length===0)continue;let h=m.length===1?m[0]:m;c.push({to:s.domain,path:C,from:h,id:S,...y?{auth:y}:{},...Array.isArray(h)&&i?{loadBalancer:i}:{}}),f.add(s.domain),b();continue}if(w==="server-app"){if(typeof s.port!=="number")continue;let m=Y(s.port,r);c.push({to:s.domain,path:C,from:m,id:S,...y?{auth:y}:{},...Array.isArray(m)&&i?{loadBalancer:i}:{}})}else c.push({to:s.domain,path:C,static:{dir:`${n}/${o}-${l}/current`,spa:s.spa??!1,pathRewriteStyle:s.pathRewriteStyle??"directory"},cleanUrls:s.pathRewriteStyle!=="flat",...y?{auth:y}:{},id:S});f.add(s.domain),b()}if(t.proxy.autoWww!==!1)for(let l of[...f]){if(!no(l))continue;let s=`www.${l}`;if(f.has(s))continue;c.push({to:s,redirect:{to:`https://${l}`},id:Zc(s)}),f.add(s)}c.sort((l,s)=>{if(l.to!==s.to)return l.to.localeCompare(s.to);return(s.path?.length??0)-(l.path?.length??0)});let a={proxies:c,productionCerts:{certsDir:u,certsDirServerNames:[...f,...g.keys()]},https:!0,hostsManagement:!1,cleanup:{hosts:!1,certs:!1},...g.size>0?{wildcardCerts:[...g.values()]}:{}};if(t.proxy.onDemandTls&&f.size>0)a.onDemandTls={enabled:!0,allowedSuffixes:[...f],email:t.proxy.onDemandTlsEmail,certsDir:u,staging:t.proxy.onDemandTlsStaging??!1};if(t.proxy.onDemandTls)a.acmeChallengeWebroot=t.proxy.acmeWebroot??I;let p=t.proxy.cdn,x=p?.frontedHosts?.length?p.frontedHosts:[...f];if(p?.secret&&x.length>0)a.originGuard={header:p.secretHeader??"X-Origin-Verify",value:p.secret,hosts:x};if(t.lan)if(Yc(t.lan)==="off")a.https=!1;else{let l=F(e,t.lan,o);K(l,a.onDemandTls);let s=t.lan.ip&&L(t.lan.ip)!==0?[t.lan.ip]:[];a.localCa={dir:A,hosts:l.map((w)=>w.host),...s.length>0?{ips:s}:{},installTrust:!0}}return a}function B(e,t){return N({...e,...t.mail?on(t.mail):{}},t)}function Xt(e,t,r){return N({...e,...r.mail?on(r.mail):{}},r,t)}function fI(e){return`// Generated by ts-cloud — rpx reverse-proxy gateway.
+// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
+import { startProxies } from '@stacksjs/rpx'
+
+const config = ${D(e)} as const
+
+// Verbose is the hard default for ts-cloud-installed gateways (RPX_VERBOSE=false
+// opts out) — without it rpx's TLS/routing diagnostics never reach the journal.
+await startProxies({ verbose: process.env.RPX_VERBOSE !== 'false', ...config } as any)
+`}function j(e){return e?.webServer==="rpx"||e?.proxy?.engine==="rpx"}var so="/etc/rpx",R="/opt/rpx-gateway",cp="/etc/rpx/gateway.ts",yt="/etc/rpx/gateway",ze="rpx-gateway.service",z="/etc/rpx/sites.d";function J(e=z,t=to){return`// Generated by ts-cloud — rpx gateway assembler.
+// Merges every app's fragment in ${e} so independent deploys compose
+// without clobbering each other. Each deploy writes only its own <slug>.json.
+import { startProxies } from '@stacksjs/rpx'
+import { readdirSync, readFileSync } from 'node:fs'
+
+const dir = ${JSON.stringify(e)}
+const proxies = []
+const seen = new Set()
+const owners = new Map()
+const suffixes = new Set()
+const guardHosts = new Set()
+let email
+let certsDir = ${JSON.stringify(t)}
+let acmeChallengeWebroot
+let guard
+let anyProduction = false
+// LAN certificate authority, unioned across fragments. It is gateway-wide, but
+// it is carried per fragment because THIS file is rewritten wholesale by every
+// deploy on the box: a co-tenant's deploy would erase a CA baked in here, while
+// a fragment belongs to the project that configured it.
+let localCa
+const localCaHosts = new Set()
+const localCaIps = new Set()
+// TLS stays on unless every fragment asks for plain HTTP.
+let fragmentCount = 0
+let anyTls = false
+let files = []
+try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
+for (const f of files) {
+  let frag
+  // Fragments are written atomically (temp + rename by ts-cloud), so a parse
+  // failure here means a genuinely corrupt fragment, not a mid-write read. Log
+  // it LOUD — a silent skip drops that app's whole host from the routing table,
+  // which then answers 404 until someone notices. We still continue so one bad
+  // fragment can't take every other app down, but the drop is now visible.
+  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) }
+  catch (err) { console.error('[rpx-assembler] SKIPPING malformed fragment ' + f + ' — its host(s) will 404 until fixed: ' + err); continue }
+  fragmentCount++
+  if (frag.https !== false) anyTls = true
+  if (frag.localCa) {
+    if (!localCa) localCa = { dir: frag.localCa.dir }
+    else if (frag.localCa.dir !== localCa.dir) console.warn('[rpx-assembler] ' + f + ' asks for a local CA in ' + frag.localCa.dir + '; the box already uses ' + localCa.dir + ', so its hosts join that CA instead')
+    for (const h of frag.localCa.hosts ?? []) localCaHosts.add(h)
+    for (const ip of frag.localCa.ips ?? []) localCaIps.add(ip)
+    if (frag.localCa.installTrust) localCa.installTrust = true
+    if (localCa.validityDays === undefined) localCa.validityDays = frag.localCa.validityDays
+    if (localCa.renewBeforeDays === undefined) localCa.renewBeforeDays = frag.localCa.renewBeforeDays
+  }
+  for (const p of frag.proxies ?? []) {
+    const key = p.id || (p.to + (p.path ?? ''))
+    if (seen.has(key)) {
+      console.warn('[rpx-assembler] duplicate route ' + key + ' in ' + f + ' ignored; first declared by ' + owners.get(key))
+      continue
+    }
+    seen.add(key)
+    owners.set(key, f)
+    proxies.push(p)
+  }
+  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
+  email ??= frag.onDemandTls?.email
+  // One gateway, one ACME directory: production wins any disagreement between
+  // co-tenants, and a fragment predating the flag counts as production. A
+  // staging cert chains to an untrusted root, so defaulting the other way
+  // breaks every client of every tenant that wanted a real cert.
+  if (frag.onDemandTls && frag.onDemandTls.staging !== true) anyProduction = true
+  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
+  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
+  if (frag.originGuard) {
+    // One gateway means one origin-guard secret (rpx takes a single
+    // header/value). A tenant whose secret disagrees with the adopted one must
+    // NOT have its hosts guarded: its CDN would send a different value, the
+    // gateway would reject every request, and a working host would go dark.
+    // Unguarded is weaker but serving, and the mismatch is logged.
+    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
+    if (frag.originGuard.header === guard.header && frag.originGuard.value === guard.value) {
+      for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+    }
+    else {
+      console.warn('[rpx-assembler] origin-guard secret in ' + f + ' differs from the one already in force; its hosts stay unguarded rather than rejecting all traffic')
+    }
+  }
+}
+if (localCa) {
+  localCa.hosts = [...localCaHosts]
+  if (localCaIps.size > 0) localCa.ips = [...localCaIps]
+}
+const config = {
+  proxies,
+  productionCerts: {
+    certsDir,
+    // A shared host's cert directory also contains mail and retired-site PEMs.
+    // Keep those files on disk for their owners, but do not turn them into live
+    // OpenSSL SNI contexts when no current route can select them.
+    certsDirServerNames: [...new Set(proxies.map(p => p.to).filter(Boolean))],
+  },
+  https: fragmentCount === 0 ? true : anyTls,
+  hostsManagement: false,
+  cleanup: { hosts: false, certs: false },
+  // Verbose is the hard default for ts-cloud-installed gateways: without it,
+  // rpx's TLS/routing diagnostics (tlsx on-demand 'refused issuance',
+  // 'issuance failed', 'adopted existing on-disk cert') never reach the systemd
+  // journal and a production TLS failure looks like "nothing happens". Silence
+  // it by setting RPX_VERBOSE=false on the systemd unit.
+  verbose: process.env.RPX_VERBOSE !== 'false',
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir, staging: !anyProduction } } : {}),
+  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
+  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+  ...(localCa && localCa.hosts.length > 0 ? { localCa } : {}),
+}
+
+await startProxies(config)
+`}function _(e,t,r,n="0644"){return[`__tsc_tmp="$(mktemp "${e}.XXXXXX")"`,`cat > "$__tsc_tmp" <<'${r}'`,t,r,`mv -f "$__tsc_tmp" ${e}`,`chmod ${n} ${e}`]}function q(e){return`'${e.replaceAll("'","'\\''")}'`}function T(e,t,r,n){if(!n.preserveManagementDashboardRoutes)return _(e,t,r,"0600");let o=`
+const { readFileSync, writeFileSync } = require('node:fs')
+const currentPath = process.env.TS_CLOUD_RPX_CURRENT_FRAGMENT
+const candidatePath = process.env.TS_CLOUD_RPX_CANDIDATE_FRAGMENT
+const isDashboard = route => /^(?:dashboard|cloud)\\./i.test(String(route?.to || ''))
+const current = JSON.parse(readFileSync(currentPath, 'utf8'))
+const candidate = JSON.parse(readFileSync(candidatePath, 'utf8'))
+const retained = Array.isArray(current.proxies) ? current.proxies.filter(isDashboard) : []
+const next = Array.isArray(candidate.proxies) ? candidate.proxies.filter(route => !isDashboard(route)) : []
+candidate.proxies = [...next, ...retained]
+writeFileSync(candidatePath, JSON.stringify(candidate, null, 2) + '\\n', { mode: 0o600 })
+`.trim();return[`__tsc_fragment_candidate="$(mktemp "${e}.candidate.XXXXXX")"`,`cat > "$__tsc_fragment_candidate" <<'${r}'`,t,r,'chmod 0600 "$__tsc_fragment_candidate"',`if [ -f ${e} ]; then TS_CLOUD_RPX_CURRENT_FRAGMENT=${e} TS_CLOUD_RPX_CANDIDATE_FRAGMENT="$__tsc_fragment_candidate" ${n.bunBin} -e ${q(o)}; fi`,`mv -f "$__tsc_fragment_candidate" ${e}`,`chmod 0600 ${e}`]}var Q={high:"256M",max:"384M"},Z={high:"512M",max:"768M"};function ed(e){return`rpx-cert-renew-${(e||"app").replace(/[^a-z0-9._-]+/gi,"-")}.service`}function td(e){let t=new Set;for(let r of e.proxies){let n=r.to;if(!n||n.startsWith("*")||n.includes(":")||!n.includes("."))continue;t.add(n)}return[...t]}function ee(e){if(e.length===0)return[];let t=["# Wildcards: dns-01 (Porkbun), keys read from the site's env file for tlsx alone.","dns_env() {",'  [ -r "$1" ] || return 0',`  sed -n "s/^$2=//p" "$1" | tail -n 1 | sed -e 's/^"\\(.*\\)"$/\\1/' -e "s/^'\\(.*\\)'$/\\1/"`,"}","wildcard() {",'  apex="$1"','  envfile="$2"','  name="*.$apex"','  key=$(dns_env "$envfile" PORKBUN_API_KEY)','  secret=$(dns_env "$envfile" PORKBUN_SECRET_KEY)','  if [ -z "$key" ] || [ -z "$secret" ]; then','    echo "wildcard $name skipped: no PORKBUN_API_KEY / PORKBUN_SECRET_KEY in $envfile (non-fatal)"',"    return 0","  fi",'  if [ ! -s "$CERTS/_wildcard.$apex.crt" ]; then','    PORKBUN_API_KEY="$key" PORKBUN_SECRET_KEY="$secret" $TLSX acme:issue -d "$name" --method dns-01 --dns-provider porkbun --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $name failed (non-fatal)"',"  else",'    PORKBUN_API_KEY="$key" PORKBUN_SECRET_KEY="$secret" $TLSX acme:renew --domains "$name" --method dns-01 --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew $name failed (non-fatal)"',"  fi","}"];for(let r of e){let n=r.domain.replace(/^\*\./,"");t.push(`wildcard '${n}' '${r.dnsEnvFile.replace(/'/g,"")}'`)}return t}function P(e){let{config:t,proxy:r}=e,n=t.acmeChallengeWebroot,o=td(t);if(!r.onDemandTls||!n||o.length===0)return[];let u=e.bunBin??"/usr/local/bin/bun",i=r.tlsxVersion??"latest",c=t.productionCerts.certsDir,f=r.onDemandTlsEmail??`webmaster@${o[0]}`,g=`${u} ${R}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`,a=o.join(","),p=o.join(" "),x=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),l=`${so}/renew-certs-${x}.sh`,s=ed(x),w=`rpx-cert-renew-${x}.timer`,v=t.wildcardCerts??[],E=v.length>0?"tlsx http-01 + dns-01 wildcard":"tlsx http-01",b=["#!/bin/sh",`# Generated by ts-cloud — issue/renew rpx gateway TLS certs via ${E}.`,"# The running gateway serves the challenge from $WEBROOT on :80, so this needs","# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.","set -u",`CERTS='${c}'`,`WEBROOT='${n}'`,`EMAIL='${f}'`,`TLSX="${g}"`,`BUN='${u}'`,`DOMAINS='${a}'`,"DNS_ATTEMPTS='24'","DNS_DELAY_SECONDS='5'",`DNS_RESOLVERS='${k.join(" ")}'`,"dns_resolves() {",'  d="$1"',"  for ns in $DNS_RESOLVERS; do",`    if $BUN --eval "const{Resolver}=require('node:dns');const r=new Resolver();r.setServers([process.argv[1]]);r.resolve4(process.argv[2],e=>process.exit(e?1:0))" "$ns" "$d" >/dev/null 2>&1; then`,"      return 0","    fi","  done",'  getent ahosts "$d" >/dev/null 2>&1',"}","wait_for_dns() {",'  d="$1"',"  attempt=1",'  while ! dns_resolves "$d"; do','    if [ "$attempt" -ge "$DNS_ATTEMPTS" ]; then','      echo "DNS for $d did not become resolvable after $DNS_ATTEMPTS attempts" >&2',"      return 1","    fi",'    echo "Waiting for public DNS before ACME: $d (attempt $attempt/$DNS_ATTEMPTS)"','    sleep "$DNS_DELAY_SECONDS"',"    attempt=$((attempt + 1))","  done","}",'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`for d in ${p}; do`,'  if [ ! -s "$CERTS/$d.crt" ]; then','    if wait_for_dns "$d"; then','      $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',"    else",'      echo "issue $d skipped until DNS resolves (non-fatal)"',"    fi","    # rpx reloads its SNI set when a PEM appears. Complete that reload","    # before the next hostname starts http-01, or :80 can disappear in","    # the middle of the following challenge on a multi-domain deploy.",`    [ -s "$CERTS/$d.crt" ] && systemctl restart ${ze}`,"  fi","done",'$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',...ee(v),'rm -f "$CERTS"/*.chain.crt','after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',`[ "$before" = "$after" ] || systemctl restart ${ze}`].join(`
+`),C=["[Unit]",`Description=Issue/renew rpx gateway TLS certs for ${x} (${E})`,`After=network-online.target ${ze}`,"Wants=network-online.target","","[Service]","Type=oneshot",`ExecStart=${l}`].join(`
+`),S=["[Unit]",`Description=Daily rpx gateway TLS cert issuance/renewal for ${x}`,"","[Timer]","OnCalendar=*-*-* 03:30:00","RandomizedDelaySec=1h","Persistent=true","","[Install]","WantedBy=timers.target"].join(`
+`);return[`mkdir -p ${n}`,...e.tenant?[]:[`(cd ${R} && ${u} add @stacksjs/tlsx@${i}) || true`],..._(l,b,"TS_CLOUD_RENEW_EOF"),`chmod +x ${l}`,..._(`/etc/systemd/system/${s}`,C,"TS_CLOUD_RENEW_SVC_EOF"),..._(`/etc/systemd/system/${w}`,S,"TS_CLOUD_RENEW_TIMER_EOF"),"systemctl daemon-reload",`systemctl enable --now ${w} || true`,`${l} || true`]}function G(e){let{config:t,proxy:r}=e,n=e.bunBin??"/usr/local/bin/bun",o=r.version??"latest",u=t.productionCerts.certsDir,i=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),c=D(t,{slug:i}),f=J(z,u);if(e.tenant)return["set -euo pipefail",`if [ ! -x ${yt} ] || [ ! -d ${R}/node_modules/@stacksjs/rpx ]; then`,`  echo "ts-cloud: no rpx gateway on this box. This project attaches to another project's compute, so it does not provision one - deploy the owning project first." >&2`,"  exit 1","fi",`mkdir -p ${z} ${u}`,`__tsc_rpx_before="$(sha256sum ${z}/${i}.json 2>/dev/null | cut -d' ' -f1 || true)"`,...T(`${z}/${i}.json`,c,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:n,preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),`__tsc_rpx_after="$(sha256sum ${z}/${i}.json 2>/dev/null | cut -d' ' -f1 || true)"`,`if [ "$__tsc_rpx_before" != "$__tsc_rpx_after" ] || ! systemctl is-active --quiet ${ze}; then`,`  systemctl restart ${ze}`,"else",`  echo "[ts-cloud] rpx routes for ${i} unchanged - leaving the shared gateway alone"`,"fi",...P(e)];let a=[`Environment=RPX_UPSTREAM_TIMEOUT=${r.upstreamTimeout??60}`];if(typeof r.maxUpstreamConns==="number")a.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${r.maxUpstreamConns}`);let p=e.profile==="raspberry-pi"?Q:Z,x=r.memoryHigh??p.high,l=r.memoryMax??p.max;return["set -euo pipefail",`mkdir -p ${so} ${z} ${u} ${R}`,`rm -rf ${R}.next ${R}.prev`,`mkdir -p ${R}.next`,`(cd ${R}.next && ${n} add @stacksjs/rpx@${o})`,`mv ${R} ${R}.prev`,`mv ${R}.next ${R}`,`rm -rf ${R}.prev`,`ln -sfn ${R}/node_modules ${so}/node_modules`,...T(`${z}/${i}.json`,c,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:n,preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),..._(cp,f,"TS_CLOUD_RPX_EOF"),`${n} build --production --compile --outfile ${yt}.next ${cp}`,`chmod 0755 ${yt}.next`,`mv -f ${yt}.next ${yt}`,..._(`/etc/systemd/system/${ze}`,["[Unit]","Description=rpx reverse-proxy gateway (managed by ts-cloud)","After=network.target network-online.target","Wants=network-online.target","","[Service]","Type=simple",`ExecStart=${yt}`,`WorkingDirectory=${R}`,"Environment=BUN_INSTALL=/root/.bun","Environment=APP_ENV=production","Environment=NODE_ENV=production",...a,"MemoryAccounting=true",`MemoryHigh=${x}`,`MemoryMax=${l}`,"CPUWeight=500","IOWeight=500","OOMPolicy=stop","Restart=always","RestartSec=5","StartLimitIntervalSec=120","StartLimitBurst=5",`ExecStartPre=/bin/sh -c 'for p in 80 443; do fuser -k -n tcp "$p" 2>/dev/null || true; done; sleep 1'`,"LimitNOFILE=1048576","AmbientCapabilities=CAP_NET_BIND_SERVICE","","[Install]","WantedBy=multi-user.target"].join(`
+`),"TS_CLOUD_RPX_UNIT_EOF"),"systemctl daemon-reload","systemctl disable --now bun-gateway.service 2>/dev/null || true","systemctl disable --now bun-gateway-renew.timer bun-gateway-renew.service 2>/dev/null || true","rm -f /etc/systemd/system/bun-gateway-renew.timer /etc/systemd/system/bun-gateway-renew.service","systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",`for timer in /etc/systemd/system/rpx-cert-renew-*.timer; do [ -e "$timer" ] || continue; unit="$(basename "$timer")"; tenant="\${unit#rpx-cert-renew-}"; tenant="\${tenant%.timer}"; [ -f "${z}/$tenant.json" ] && continue; systemctl disable --now "$unit" 2>/dev/null || true; rm -f "$timer" "/etc/systemd/system/rpx-cert-renew-$tenant.service" "${so}/renew-certs-$tenant.sh"; done`,`systemctl enable ${ze}`,`systemctl restart ${ze}`,...P(e)]}function ke(e){let t=(e.slug||"app").replace(/[^a-z0-9._-]+/gi,"-"),r=D(e.config,{slug:t});return["set -euo pipefail",`mkdir -p ${z}`,...T(`${z}/${t}.json`,r,"TS_CLOUD_RPX_FRAGMENT_EOF",{bunBin:"/usr/local/bin/bun",preserveManagementDashboardRoutes:e.preserveManagementDashboardRoutes}),`systemctl restart ${ze}`]}
+export{to,ro,no,io,Yc,op,ap,Uh,Zc,B,Xt,fI,j,so,R,cp,yt,ze,z,ed,td,G,ke};