@stacksjs/ts-cloud 0.16.64 → 0.16.66

package/dist/index.js

@@ -1,4 +1,4 @@
-import{_I,LI,rl,Am,nl,il,cn,Q,l,sl,ym,K,ol,g,ey,C,Xe,Ji,dn,w,be,al,ty,r,t,$I,MI,m,FI,UI,QI,HI,GI,dr,cl,Xi,ry,VI,qI,xe,Ye,dl,Sm,Im,jI,bm,Cm,Em,Qo,ll,ce,ln,Dt,Ho,Pt,Ce,ny,ul,Go,vm,Tm,wm,Rm,gl,zI,W,E,iy,sy,Dm,a,S,Ze,f,Pm,et,J,kt,KI,km,X,pl,Oe,lr,Vo,de,ml,le,oy,qo,Y,Z,_,Yi,D,ur,Nt,ee,e,un,WI,Nm,fl,JI,XI,YI,ZI,hl,eb,tb,rb,nb,ib,sb,ob,ab,cb,db,lb,ub,ay,cy,dy,ly,uy,gy,py,gr,Bm,xm,pr,Zi,gb,Om,pb,mb,gn,fb,hb,Ab,yb,Sb,Ib,my,fy,hy,Ay,yy,es,bb,jo,Sy,_m,V,Iy,tt,zo,Bt,by,Lm,Cy,Ey,vy,$m,q,Cb,Eb,vb,Tb,Ty,wb,te,Rb,Db,Pb,Al,yl,wy,Mm,Fm,kb,Nb,Bb,xb,Ob,Ry,Sl,_b,Lb,$b,Mb,Fb,Dy,Py,Ub,Qb,Hb,Gb,Vb,qb,jb,ky,zb,Um,Il,Kb,Wb,Jb,Xb,Qm,Hm,Gm,Yb,bl,Ny,By,xy,Oy,Cl,_y,Zb,eC,tC,rC,nC,iC,sC,Ly,$y,My,Fy,Vm,oC,aC,cC,dC,lC,uC,gC,pC,mC,Uy,Qy,Hy,Gy,fC,hC,qm,AC,jm,zm,Km,Wm,yC,SC,IC,bC,_e,ts,CC,EC,vC,TC,wC,RC,DC,PC,Vy,kC,NC,Jm,Xm,BC,xC,qy,OC,_C,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,KC,WC,JC,XC,YC,ZC,eE,El,jy,vl,zy,Tl,Ky,wl,Wy,Rl,Jy,mr,Xy,Dl,Yy,rs,Zy,Pl,eS,kl,tS,Ym,tE,Zm,rE,Nl,rS,fr,nS,ef,nE,Bl,iS,tf,iE,rf,sE,nf,oE,xl,sS,sf,aE,of,cE,af,dE,cf,lE,Ol,oS,_l,aS,df,uE,lf,gE,uf,pE,gf,mE,pf,fE,mf,hE,Ll,cS,ff,AE,hf,yE,Af,SE,yf,IE,Sf,bE,If,CE,bf,Cf,Ef,vf,Tf,EE,wf,vE,Rf,TE,Df,wE,rt,Pf,dS,Ko,$l,pn,lS,ns,hr,Ml,Fl,uS,gS,Ul,kf,Ql,Nf,RE,DE,Wo,Jo,Xo,Hl,mn,Gl,Vl,is,Yo,Zo,Bf,pS,mS,fS,PE,xf,Of,kE,hS,_f,AS,yS,SS,NE,Lf,fn,ql,$f,BE,IS,ea,ta,jl,Mf,xE,zl,bS,Ff,OE,Uf,_E,Qf,LE}from"./chunk-r9ydamw0.js";import{Kl,k,Wl,ra,CS,Hf,ES,vS,TS,wS,RS,DS,PS,kS}from"./chunk-7s7w8kzc.js";import{ca,Gf,ru,OS,cs,nu,da,Vf,qf,An,la,iu,it,su,ou,au,ds,yn,jf,st,cu,ua,ga,pa,du,lu,uu,ls,ma,gu,Sn,us,fa,xt,zf,pu,mu,Kf,fu,ha,Ar,hu,Au,yu,Su,ot,Wf,Iu,yr,Aa,ya,Sa,gs,ps,In,bu,ms,Ia,ba,bn,Cu,Cn,Jf,Xf,Ot,En,Ca,Yf,Eu,vu,Ea,Tu,wu,Ru,_S,ue,Du,LS,$S,fs,hs,MS,Ee,Zf,_t,Le,$e,Lt,Pu,ku,Nu,Bu,eh,th,va,rh,nh,Ta,xu,Ou,ih,ge,sh,_u,ve,wa,at,$t,Mt,vn,As,Lu,FS,oh,ah,ch,dh,Ra,Da,$u,Pa,Tn,ka,Mu,ys,Fu,Na,Ba,xa,Oa,_a,La,$a,Ma,Uu,Sr,Fa,Qu,wn,Hu,Ua,Qa,Gu,Ir,Ha,Ga,lh,US,Ss,QS,HS,GS,Va,qa,Vu,uh,ja,Rn,qu,Is,ju,zu,Ku,za,gh,Ka,Wu,ph,Wa,mh,Dn,Pn,Ju,bs,rg,og,ag,cg,dg,lg,Es,br,Xa,kn,Nn,Cr,ct,Ch,Za,Eh,vh,pg,ec,Ts,mg,tc,Ut,Fe,fg,rc,nc,hg,ic,sc,oc,ac,Ag,yg,xn,cc,dc,lc,uc,Sg,ws,On,Rs,gc}from"./chunk-6k5demvz.js";import{U,zr,Ad,ho,d,qp,jp}from"./chunk-8jqv6wh7.js";import{Et,hd,xi,Oi,_i,Vp}from"./chunk-v90w8kbz.js";import{eA,tA,rA,Tp,wp,Rp,nA,Dp,Pp,iA,sA,kp,oA,aA,md,Np,cA,dA,Bp,lA,uA,gA,pA,mA,fA,hA,Bi,fd,xp,Op,_p,Lp,$p,Mp,Fp,Up,Qp,Hp,Gp,AA,yA,SA,IA,bA,CA,EA}from"./chunk-e97qhzfe.js";import{Ke,yd,Ie,rr,Sd,x,nr,vt,Id,Ao,wA,zp,bd,s,Li,yo,Kr,Cd,Ed,Wr,RA,vd,NI,BI,So,xI,OI,Td,wd,$i,Io,ae,c,bo,We,Jr,DA,PA,Rd,kA,Co,NA,BA,Eo,Dd,Xr,vo,xA,ir,Pd,Kp,sr,Yr,OA,To,_A,O,LA,kd,Wp,wo,$A,MA,FA,Nd,Mi,Ro,Bd,or,Tt,UA,Zr,QA,xd,Jp,Xp,Do,Od,_d,wt,Yp,Fi,Ld,Po,en,Zp,Ui,$d,Md,Qi,em,Fd,Ud,Qd,Hd,ko,tm,rm,HA,nm,Gd,Hi,im,sm,No,tn,Bo,xo,Oo,Vd,om,qd,_o,GA,ar,VA,jd,rn,zd,qA,Kd,am,Gi,nn,Lo,Vi,Je,jA,cm,dm,cr,Wd,Jd,Xd,qi,ji,zi,zA,KA,Rt,$o,WA,sn,lm,Mo,JA,um,gm,pm,XA,mm,fm,YA,i,ZA,Ki,Fo,Uo}from"./chunk-2phe49y7.js";import{n}from"./chunk-et77ydjb.js";import{Re,gt,jn}from"./chunk-rs8v7c67.js";import{o}from"./chunk-betvtvy7.js";import{Te,Os,_s,Cg,Ac,yc,Ls,Sc,dt,re,lt,pe,T,we,Mn,Ic,Ue,bc,Un,Qn,Hn,Qt,Ht,Gt,Gn,vr,Cc,Tr,wr,ut,Vn,vc,Vt,Rr,qn,wc,Rg,Dg,Rc,Dr}from"./chunk-f512g4fq.js";import{pt,he,Ge,Pg,qt,Pc,kc,jt,H,zn,zt,Kt,Kn,Us,Qs,Pr,kr,Wn,Nr,Hs,Gs,Vs,qs,ie,js,zs,Ks,Ws,Ae,Js,Xs,Ys,N,Nc,Jn,Bc,ye,Br}from"./chunk-bn3jfrg5.js";import{ne}from"./chunk-7mw4x3ay.js";import{kg,xc,Ng,De,Oc,Xn,Bg,_c,xg,Og,$h,Zn,eo,M,_r,ei,ti,Lr,Mr,ri,to,ni,ii,si,oi,ci,Fr,Se,Mc,ft,Fc,Ur,Hc,Ve,se,qe,je,At,ui,gi,Pe,St,ke,mi,fi,hi,Ai,yi,Si,Ii,Qr,F,io,op,Yc,Ci,Ei,vi,Ti,id,oo,sd,er,Ri,ao,co,od,Di,ad}from"./chunk-v3qf7v5z.js";import{uo,po,mo,B,Ne}from"./chunk-b0s2605f.js";import{Jl,na,ss,os,ia,Xl,Yl,as,sa,oa,eu,tu,aa}from"./chunk-mqbsnpsv.js";import{pc,_n,Ln,Ds,Ps,ks,Ns,mc,fc}from"./chunk-r41cawtf.js";import{hc}from"./chunk-sqtzajrx.js";import{Dc,Qe,I}from"./chunk-pjdp30dn.js";import{He}from"./chunk-n0xw26th.js";import{b}from"./chunk-n3sydv3m.js";import{oe,Pi,lo,cd,ki,Sp}from"./chunk-k2bb62em.js";import{Gr,Be}from"./chunk-bydj8p3h.js";import{A}from"./chunk-tt3pn05f.js";import{Yd,on,Zd,el,tl,Wi,hm,an}from"./chunk-8z3jfyk8.js";import{NS,nt}from"./chunk-t3ssg8p0.js";var Gh="https://api.machines.dev/v1";class $s extends Error{status;path;constructor(u,p,h){super(u);this.status=p;this.path=h;this.name="FlyApiError"}}function Qc(u){let p=u.ip.includes(":");if(p&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return p?"v6":"v4"}class fp{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,p,h={}){let y=new URL(`https://api.machines.dev/v1${p}`);for(let[L,z]of Object.entries(h.query??{}))y.searchParams.set(L,z);let R=await this.fetch(y,{method:u,headers:{Authorization:`Bearer ${this.token}`,...h.body!==void 0?{"Content-Type":"application/json"}:{},...h.headers},body:h.body===void 0?void 0:JSON.stringify(h.body)});if(R.status===404&&h.notFound==="null")return null;let v=await R.text(),P=v?hp(v):void 0;if(!R.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):v||R.statusText;throw new $s(`Fly.io ${u} ${p} failed (${R.status}): ${L}`,R.status,p)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,p){return this.rest("POST","/apps",{body:{app_name:u,org_slug:p}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,p){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:p})}updateMachine(u,p,h,y){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}`,{body:h,headers:{"fly-machine-lease-nonce":y}})}async acquireLease(u,p,h=120){let R=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}/lease`,{body:{ttl:h}})).data?.nonce;if(!R)throw new $s(`Fly.io gave no lease nonce for Machine ${p}`,200,`/machines/${p}/lease`);return R}async releaseLease(u,p,h){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}/lease`,{headers:{"fly-machine-lease-nonce":h}})}async waitForState(u,p,h,y={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}/wait`,{query:{state:h,timeout:String(y.timeoutSeconds??60),...y.instanceId?{instance_id:y.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,p){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...p,encrypted:!0}})}async setSecrets(u,p){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:p}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,p){let h=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:p}});if(!h.ip)throw new $s(`Fly.io assigned no ${p} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:h.ip,shared:h.shared??p==="shared_v4",region:h.region}}async requestCertificate(u,p){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:p}})}}function hp(u){try{return JSON.parse(u)}catch{return}}var Lc="ts-cloud-role";function qh(u,p){let h=u.fly??{},y=h.app??`${u.project.slug}-${p.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(y))throw Error(`"${y}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let R=h.internalPort??3000,v=h.count??1;if(!Number.isInteger(v)||v<1)throw Error(`fly.count must be a whole number of at least 1, got ${v}.`);return{app:y,org:h.org??"personal",image:p.image,regions:h.regions?.length?h.regions:["iad"],count:v,internalPort:R,healthPath:h.healthPath??"/",vm:{cpuKind:h.vm?.cpuKind??"shared",cpus:h.vm?.cpus??1,memoryMb:h.vm?.memoryMb??512},...h.volume?{volume:{name:h.volume.name??"data",sizeGb:h.volume.sizeGb,path:h.volume.path}}:{},autoStop:h.autoStop??!1,env:{...p.env,PORT:String(R)},secrets:p.secrets??{},hostnames:h.hostnames??[],release:p.release}}function yp(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Lc]:"app","ts-cloud-release":u.release}}}async function Zh(u,p,h=()=>{}){let y=!1;if(!await u.getApp(p.app))h(`Creating Fly app ${p.app} in ${p.org}`),await u.createApp(p.app,p.org),y=!0;let R;if(Object.keys(p.secrets).length>0)R=await u.setSecrets(p.app,p.secrets),h(`Set ${Object.keys(p.secrets).length} secret(s) (version ${R})`);let v=await u.listIpAssignments(p.app),P=new Set(v.map(Qc));if(!P.has("v6"))v.push(await u.assignIp(p.app,"v6")),h("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))v.push(await u.assignIp(p.app,"shared_v4")),h("Assigned a shared IPv4");let L=yp(p),z=(await u.listMachines(p.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Lc])return ze[Lc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=p.volume?await u.listVolumes(p.app):[],me=[],bt=[],It=new Set;for(let Me of p.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<p.count;j++){let yt=ze[j];if(yt){It.add(yt.id),await Cp(u,p.app,yt,L,R),bt.push(yt.id),h(`Updated ${yt.id} (${Me}) to ${p.image}`);continue}let G=p.volume?[{volume:(await bp(u,p,Me,fe)).id,path:p.volume.path}]:void 0,ht=await u.createMachine(p.app,{region:Me,name:`${p.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...R!==void 0?{min_secrets_version:R}:{}});await u.waitForState(p.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),h(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of p.hostnames)mt.push(await u.requestCertificate(p.app,Me));return{app:p.app,url:`https://${p.app}.fly.dev`,createdApp:y,created:me,updated:bt,untouched:z.filter((Me)=>!It.has(Me.id)).map((Me)=>Me.id),ips:v,certificates:mt}}async function Cp(u,p,h,y,R){let v=await u.acquireLease(p,h.id);try{let P=await u.updateMachine(p,h.id,{config:{...y,...h.config?.mounts?.length?{mounts:h.config.mounts}:{}},...R!==void 0?{min_secrets_version:R}:{}},v);await u.waitForState(p,h.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(p,h.id,v)}}async function bp(u,p,h,y){let R=y.find((P)=>P.region===h&&P.name===p.volume.name&&!P.attached_machine_id);if(R)return R.attached_machine_id="pending",R;let v=await u.createVolume(p.app,{name:p.volume.name,region:h,size_gb:p.volume.sizeGb});return y.push({...v,attached_machine_id:"pending"}),v}import{createHmac as Zl,createSign as Ap,timingSafeEqual as Ip}from"node:crypto";function bi(u){let p=u instanceof Date?u.getTime():u;if(!Number.isFinite(p))throw TypeError("Media access timestamp must be finite");return Math.floor(p/1000)}function Zu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function vp(u){return Buffer.from(u).toString("base64url")}function Yu(u,p=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let h=p?u.replaceAll("*","wildcard"):u,y=new URL(h);if(!["http:","https:"].includes(y.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!p&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Xu(u,p){let h=Ap("RSA-SHA1");return h.update(u),h.end(),Zu(h.sign(p))}function ed(u){Yu(u.resource,!0);let h={DateLessThan:{"AWS:EpochTime":bi(u.expiresAt)}};if(u.activeAt!==void 0)h.DateGreaterThan={"AWS:EpochTime":bi(u.activeAt)};if(u.ipAddress)h.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:h}]})}function BS(u,p,h){Yu(u);let y=bi(p),R=u.includes("?")?"&":"?",v=ed({resource:u,expiresAt:p}),P=Xu(v,h.privateKey);return`${u}${R}Expires=${y}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(h.keyPairId)}`}function WS(u,p){let h=ed(u);return{"CloudFront-Key-Pair-Id":p.keyPairId,"CloudFront-Policy":Zu(Buffer.from(h)),"CloudFront-Signature":Xu(h,p.privateKey)}}function VS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let p=vp(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:bi(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),h=Zl("sha256",u.secret).update(p).digest("base64url");return`${p}.${h}`}function zS(u,p){let[h,y,R]=u.split(".");if(!h||!y||R)return null;let v=Zl("sha256",p.secret).update(h).digest(),P;try{P=Buffer.from(y,"base64url")}catch{return null}if(v.length!==P.length||!Ip(v,P))return null;try{let L=JSON.parse(Buffer.from(h,"base64url").toString("utf8")),z=bi(p.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(p.resource&&L.resource!==p.resource)return null;if(p.audience&&L.audience!==p.audience)return null;return L}catch{return null}}function jS(u,p=!1){let h=new URL(u,"https://media.invalid").pathname.toLowerCase(),y=/\.(?:m3u8|mpd|vtt|json)$/.test(h),R=/\.(?:key|license)$/.test(h)||h.includes("/keys/")||h.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":p&&(y||R)?"private, no-store":y?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function KS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let p=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",h=u.protected??!1,y="public, max-age=31536000, immutable",R=h?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:p,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:R,compress:!0,signed:h},{pathPattern:"*.mpd",cacheControl:R,compress:!0,signed:h},{pathPattern:"*.vtt",cacheControl:R,compress:!0,signed:h},{pathPattern:"*",cacheControl:y,compress:!1,signed:h}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class Ep{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new al(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let p=this.config.environments[this.environment]?.infrastructure;if(!p)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...p,compute:{...this.config.infrastructure?.compute,...p.compute},storage:{...this.config.infrastructure?.storage,...p.storage},functions:{...this.config.infrastructure?.functions,...p.functions},servers:{...this.config.infrastructure?.servers,...p.servers},databases:{...this.config.infrastructure?.databases,...p.databases},cdn:{...this.config.infrastructure?.cdn,...p.cdn},sftp:p.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...p.queues},redirects:{...this.config.infrastructure?.redirects,...p.redirects},realtime:{...this.config.infrastructure?.realtime,...p.realtime},cache:{...this.config.infrastructure?.cache,...p.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...p.fileSystem},email:{...this.config.infrastructure?.email,...p.email},search:{...this.config.infrastructure?.search,...p.search},ai:{...this.config.infrastructure?.ai,...p.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let p=this.config.features||{};if(!u.requiresFeatures.every((y)=>p[y]===!0))return!1}if(u.regions){let p=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(p))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,p=Number(u||3008);return Number.isFinite(p)&&p>0?p:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,p){return u==="public"||p.routeCompute===!0}storageBucketName(u,p,h){return this.mergedConfig.infrastructure?.storage?.[h]?.bucket??`${u}-${p}-${h}`}fileSystemLogicalId(u,p,h){return t(r({slug:`${u}-${h}`,environment:p,resourceType:"efs"}))}resolveSftpStorage(u,p,h){let y=u.storage;if(y?.type==="efs"&&y.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[y.fileSystem])throw Error(`sftp: storage.fileSystem "${y.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(p,h,y.fileSystem)},posixProfile:y.posixProfile}}if(y?.type==="s3"&&y.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[y.storageBucket])throw Error(`sftp: storage.storageBucket "${y.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(p,h,y.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,p){return{PathPattern:u,TargetOriginId:p,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,p,h,y,R,v){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${y}-${R}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,bt={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},It=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:bt,CustomOriginConfig:{HTTPPort:It,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),h.push(P),L)h.push(L);for(let mt of v)p.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let p=u.filter(([,R])=>typeof R.domain==="string"&&R.domain&&typeof R.port==="number");if(p.length===0)return;let h=new Map;for(let[,R]of p){let v=h.get(R.domain)??[];v.push({port:R.port,path:R.path}),h.set(R.domain,v)}let y=[];for(let[R,v]of h){let L=[...v].sort((z,fe)=>{let me=!z.path||z.path==="/",bt=!fe.path||fe.path==="/";if(me&&!bt)return 1;if(!me&&bt)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
+import{LI,$I,rl,ym,nl,il,cn,Q,l,sl,Sm,K,ol,g,ty,C,Xe,Ji,dn,w,be,al,ry,r,t,MI,FI,m,UI,QI,HI,GI,VI,dr,cl,Xi,ny,qI,jI,xe,Ye,dl,Im,bm,zI,Cm,Em,vm,Qo,ll,ce,ln,Dt,Ho,Pt,Ce,iy,ul,Go,Tm,wm,Rm,Dm,gl,KI,W,E,sy,oy,Pm,a,S,Ze,f,km,et,J,kt,WI,Nm,X,pl,Oe,lr,Vo,de,ml,le,ay,qo,Y,Z,_,Yi,D,ur,Nt,ee,e,un,JI,Bm,fl,XI,YI,ZI,eb,hl,tb,rb,nb,ib,sb,ob,ab,cb,db,lb,ub,gb,cy,dy,ly,uy,gy,py,my,gr,xm,Om,pr,Zi,pb,_m,mb,fb,gn,hb,Ab,yb,Sb,Ib,bb,fy,hy,Ay,yy,Sy,es,Cb,jo,Iy,Lm,V,by,tt,zo,Bt,Cy,$m,Ey,vy,Ty,Mm,q,Eb,vb,Tb,wb,wy,Rb,te,Db,Pb,kb,Al,yl,Ry,Fm,Um,Nb,Bb,xb,Ob,_b,Dy,Sl,Lb,$b,Mb,Fb,Ub,Py,ky,Qb,Hb,Gb,Vb,qb,jb,zb,Ny,Kb,Qm,Il,Wb,Jb,Xb,Yb,Hm,Gm,Vm,Zb,bl,By,xy,Oy,_y,Cl,Ly,eC,tC,rC,nC,iC,sC,oC,$y,My,Fy,Uy,qm,aC,cC,dC,lC,uC,gC,pC,mC,fC,Qy,Hy,Gy,Vy,hC,AC,jm,yC,zm,Km,Wm,Jm,SC,IC,bC,CC,_e,ts,EC,vC,TC,wC,RC,DC,PC,kC,qy,NC,BC,Xm,Ym,xC,OC,jy,_C,LC,$C,MC,FC,UC,QC,HC,GC,VC,qC,jC,zC,KC,WC,JC,XC,YC,ZC,eE,tE,El,zy,vl,Ky,Tl,Wy,wl,Jy,Rl,Xy,mr,Yy,Dl,Zy,rs,eS,Pl,tS,kl,rS,Zm,rE,ef,nE,Nl,nS,fr,iS,tf,iE,Bl,sS,rf,sE,nf,oE,sf,aE,xl,oS,of,cE,af,dE,cf,lE,df,uE,Ol,aS,_l,cS,lf,gE,uf,pE,gf,mE,pf,fE,mf,hE,ff,AE,Ll,dS,hf,yE,Af,SE,yf,IE,Sf,bE,If,CE,bf,EE,Cf,Ef,vf,Tf,wf,vE,Rf,TE,Df,wE,Pf,RE,rt,kf,lS,Ko,$l,pn,uS,ns,hr,Ml,Fl,gS,pS,Ul,Nf,Ql,Bf,DE,PE,Wo,Jo,Xo,Hl,mn,Gl,Vl,is,Yo,Zo,xf,mS,fS,hS,kE,Of,_f,NE,AS,Lf,yS,SS,IS,BE,$f,fn,ql,Mf,xE,bS,ea,ta,jl,Ff,OE,zl,CS,Uf,_E,Qf,LE,Hf,$E}from"./chunk-y9589qef.js";import{Kl,k,Wl,ra,ES,Gf,vS,TS,wS,RS,DS,PS,kS,NS}from"./chunk-m2a60evh.js";import{ca,Vf,ru,_S,cs,nu,da,qf,jf,An,la,iu,it,su,ou,au,ds,yn,zf,st,cu,ua,ga,pa,du,lu,uu,ls,ma,gu,Sn,us,fa,xt,Kf,pu,mu,Wf,fu,ha,Ar,hu,Au,yu,Su,ot,Jf,Iu,yr,Aa,ya,Sa,gs,ps,In,bu,ms,Ia,ba,bn,Cu,Cn,Xf,Yf,Ot,En,Ca,Zf,Eu,vu,Ea,Tu,wu,Ru,LS,ue,Du,$S,MS,fs,hs,FS,Ee,eh,_t,Le,$e,Lt,Pu,ku,Nu,Bu,th,rh,va,nh,ih,Ta,xu,Ou,sh,ge,oh,_u,ve,wa,at,$t,Mt,vn,As,Lu,US,ah,ch,dh,lh,Ra,Da,$u,Pa,Tn,ka,Mu,ys,Fu,Na,Ba,xa,Oa,_a,La,$a,Ma,Uu,Sr,Fa,Qu,wn,Hu,Ua,Qa,Gu,Ir,Ha,Ga,uh,QS,Ss,HS,GS,VS,Va,qa,Vu,gh,ja,Rn,qu,Is,ju,zu,Ku,za,ph,Ka,Wu,mh,Wa,fh,Dn,Pn,Ju,bs,rg,og,ag,cg,dg,lg,Es,br,Xa,kn,Nn,Cr,ct,Eh,Za,vh,Th,pg,ec,Ts,mg,tc,Ut,Fe,fg,rc,nc,hg,ic,sc,oc,ac,Ag,yg,xn,cc,dc,lc,uc,Sg,ws,On,Rs,gc}from"./chunk-f739f6d2.js";import{U,zr,Ad,ho,d,jp,zp}from"./chunk-0860mm00.js";import{Et,hd,xi,Oi,_i,qp}from"./chunk-pymc2aad.js";import{tA,rA,nA,wp,Rp,Dp,iA,Pp,kp,sA,oA,Np,aA,cA,md,Bp,dA,lA,xp,uA,gA,pA,mA,fA,hA,AA,Bi,fd,Op,_p,Lp,$p,Mp,Fp,Up,Qp,Hp,Gp,Vp,yA,SA,IA,bA,CA,EA,vA}from"./chunk-zgfzc46r.js";import{Ke,yd,Ie,rr,Sd,x,nr,vt,Id,Ao,RA,Kp,bd,s,Li,yo,Kr,Cd,Ed,Wr,DA,vd,BI,xI,So,OI,_I,Td,wd,$i,Io,ae,c,bo,We,Jr,PA,kA,Rd,NA,Co,BA,xA,Eo,Dd,Xr,vo,OA,ir,Pd,Wp,sr,Yr,_A,To,LA,O,$A,kd,Jp,wo,MA,FA,UA,Nd,Mi,Ro,Bd,or,Tt,QA,Zr,HA,xd,Xp,Yp,Do,Od,_d,wt,Zp,Fi,Ld,Po,en,em,Ui,$d,Md,Qi,tm,Fd,Ud,Qd,Hd,ko,rm,nm,GA,im,Gd,Hi,sm,om,No,tn,Bo,xo,Oo,Vd,am,qd,_o,VA,ar,qA,jd,rn,zd,jA,Kd,cm,Gi,nn,Lo,Vi,Je,zA,dm,lm,cr,Wd,Jd,Xd,qi,ji,zi,KA,WA,Rt,$o,JA,sn,um,Mo,XA,gm,pm,mm,YA,fm,hm,ZA,i,ey,Ki,Fo,Uo}from"./chunk-qgtydqpj.js";import{n}from"./chunk-9w5ncn9s.js";import{Re,gt,jn}from"./chunk-03eny26f.js";import{o}from"./chunk-1t3rjvf9.js";import{Te,Os,_s,Cg,Ac,yc,Ls,Sc,dt,re,lt,pe,T,we,Mn,Ic,Ue,bc,Un,Qn,Hn,Qt,Ht,Gt,Gn,vr,Cc,Tr,wr,ut,Vn,vc,Vt,Rr,qn,wc,Rg,Dg,Rc,Dr}from"./chunk-a92gvctb.js";import{pt,he,Ge,Pg,qt,Pc,kc,jt,H,zn,zt,Kt,Kn,Us,Qs,Pr,kr,Wn,Nr,Hs,Gs,Vs,qs,ie,js,zs,Ks,Ws,Ae,Js,Xs,Ys,N,Nc,Jn,Bc,ye,Br}from"./chunk-q4408fwg.js";import{ne}from"./chunk-tngsyawj.js";import{kg,xc,Ng,De,Oc,Xn,Bg,_c,xg,Og,Mh,Zn,eo,M,_r,ei,ti,Lr,Mr,ri,to,ni,ii,si,oi,ci,Fr,Se,Mc,ft,Fc,Ur,Hc,Ve,se,qe,je,At,ui,gi,Pe,St,ke,mi,fi,hi,Ai,yi,Si,Ii,Qr,F,io,op,Yc,Ci,Ei,vi,Ti,id,oo,sd,er,Ri,ao,co,od,Di,ad}from"./chunk-157bgr0x.js";import{uo,po,mo,B,Ne}from"./chunk-pah2r8a0.js";import{Jl,na,ss,os,ia,Xl,Yl,as,sa,oa,eu,tu,aa}from"./chunk-eva9hz6q.js";import{pc,_n,Ln,Ds,Ps,ks,Ns,mc,fc}from"./chunk-7mpbjr6c.js";import{hc}from"./chunk-hk1frmnn.js";import{Dc,Qe,I}from"./chunk-r49ynkag.js";import{He}from"./chunk-3ca6cb1s.js";import{b}from"./chunk-q8vvwmka.js";import{oe,Pi,lo,cd,ki,Ip}from"./chunk-nkx9pn64.js";import{Gr,Be}from"./chunk-axcxfz8p.js";import{A}from"./chunk-0kemzwpg.js";import{Yd,on,Zd,el,tl,Wi,Am,an}from"./chunk-qqn369pf.js";import{BS,nt}from"./chunk-83fy36fn.js";var Gh="https://api.machines.dev/v1";class $s extends Error{status;path;constructor(u,p,h){super(u);this.status=p;this.path=h;this.name="FlyApiError"}}function Qc(u){let p=u.ip.includes(":");if(p&&u.ip.startsWith("fdaa:"))return"private_v6";if(u.shared)return"shared_v4";return p?"v6":"v4"}class fp{token;fetch;constructor(u){if(!u.token)throw Error("Fly.io needs an API token: set FLY_API_TOKEN (`fly tokens create deploy` makes one scoped to an app).");this.token=u.token,this.fetch=u.fetch??fetch}async rest(u,p,h={}){let y=new URL(`https://api.machines.dev/v1${p}`);for(let[L,z]of Object.entries(h.query??{}))y.searchParams.set(L,z);let R=await this.fetch(y,{method:u,headers:{Authorization:`Bearer ${this.token}`,...h.body!==void 0?{"Content-Type":"application/json"}:{},...h.headers},body:h.body===void 0?void 0:JSON.stringify(h.body)});if(R.status===404&&h.notFound==="null")return null;let v=await R.text(),P=v?hp(v):void 0;if(!R.ok){let L=typeof P==="object"&&P&&"error"in P?String(P.error):v||R.statusText;throw new $s(`Fly.io ${u} ${p} failed (${R.status}): ${L}`,R.status,p)}return P}getApp(u){return this.rest("GET",`/apps/${encodeURIComponent(u)}`,{notFound:"null"})}createApp(u,p){return this.rest("POST","/apps",{body:{app_name:u,org_slug:p}})}async listMachines(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines`)??[]}createMachine(u,p){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines`,{body:p})}updateMachine(u,p,h,y){return this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}`,{body:h,headers:{"fly-machine-lease-nonce":y}})}async acquireLease(u,p,h=120){let R=(await this.rest("POST",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}/lease`,{body:{ttl:h}})).data?.nonce;if(!R)throw new $s(`Fly.io gave no lease nonce for Machine ${p}`,200,`/machines/${p}/lease`);return R}async releaseLease(u,p,h){await this.rest("DELETE",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}/lease`,{headers:{"fly-machine-lease-nonce":h}})}async waitForState(u,p,h,y={}){await this.rest("GET",`/apps/${encodeURIComponent(u)}/machines/${encodeURIComponent(p)}/wait`,{query:{state:h,timeout:String(y.timeoutSeconds??60),...y.instanceId?{instance_id:y.instanceId}:{}}})}async listVolumes(u){return await this.rest("GET",`/apps/${encodeURIComponent(u)}/volumes`)??[]}createVolume(u,p){return this.rest("POST",`/apps/${encodeURIComponent(u)}/volumes`,{body:{...p,encrypted:!0}})}async setSecrets(u,p){return(await this.rest("POST",`/apps/${encodeURIComponent(u)}/secrets`,{body:{values:p}})).version}async listIpAssignments(u){return(await this.rest("GET",`/apps/${encodeURIComponent(u)}/ip_assignments`)).ips??[]}async assignIp(u,p){let h=await this.rest("POST",`/apps/${encodeURIComponent(u)}/ip_assignments`,{body:{type:p}});if(!h.ip)throw new $s(`Fly.io assigned no ${p} address to ${u}`,200,`/apps/${u}/ip_assignments`);return{ip:h.ip,shared:h.shared??p==="shared_v4",region:h.region}}async requestCertificate(u,p){return this.rest("POST",`/apps/${encodeURIComponent(u)}/certificates/acme`,{body:{hostname:p}})}}function hp(u){try{return JSON.parse(u)}catch{return}}var Lc="ts-cloud-role";function qh(u,p){let h=u.fly??{},y=h.app??`${u.project.slug}-${p.environment}`;if(!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(y))throw Error(`"${y}" is not a valid Fly app name: lowercase letters, digits and dashes, 3 to 63 characters.`);let R=h.internalPort??3000,v=h.count??1;if(!Number.isInteger(v)||v<1)throw Error(`fly.count must be a whole number of at least 1, got ${v}.`);return{app:y,org:h.org??"personal",image:p.image,regions:h.regions?.length?h.regions:["iad"],count:v,internalPort:R,healthPath:h.healthPath??"/",vm:{cpuKind:h.vm?.cpuKind??"shared",cpus:h.vm?.cpus??1,memoryMb:h.vm?.memoryMb??512},...h.volume?{volume:{name:h.volume.name??"data",sizeGb:h.volume.sizeGb,path:h.volume.path}}:{},autoStop:h.autoStop??!1,env:{...p.env,PORT:String(R)},secrets:p.secrets??{},hostnames:h.hostnames??[],release:p.release}}function yp(u){return{image:u.image,env:u.env,guest:{cpu_kind:u.vm.cpuKind,cpus:u.vm.cpus,memory_mb:u.vm.memoryMb},services:[{protocol:"tcp",internal_port:u.internalPort,ports:[{port:80,handlers:["http"],force_https:!0},{port:443,handlers:["tls","http"]}],autostop:u.autoStop?"stop":"off",autostart:!0,...u.autoStop?{min_machines_running:0}:{},checks:[{type:"http",method:"GET",path:u.healthPath,interval:"15s",timeout:"5s",grace_period:"10s"}]}],restart:{policy:"on-failure",max_retries:10},metadata:{[Lc]:"app","ts-cloud-release":u.release}}}async function Zh(u,p,h=()=>{}){let y=!1;if(!await u.getApp(p.app))h(`Creating Fly app ${p.app} in ${p.org}`),await u.createApp(p.app,p.org),y=!0;let R;if(Object.keys(p.secrets).length>0)R=await u.setSecrets(p.app,p.secrets),h(`Set ${Object.keys(p.secrets).length} secret(s) (version ${R})`);let v=await u.listIpAssignments(p.app),P=new Set(v.map(Qc));if(!P.has("v6"))v.push(await u.assignIp(p.app,"v6")),h("Assigned a dedicated IPv6");if(!P.has("v4")&&!P.has("shared_v4"))v.push(await u.assignIp(p.app,"shared_v4")),h("Assigned a shared IPv4");let L=yp(p),z=(await u.listMachines(p.app)).filter((Me)=>{let ze=Me.config?.metadata??{};if(ze[Lc])return ze[Lc]==="app";return!ze.fly_process_group||ze.fly_process_group==="app"}),fe=p.volume?await u.listVolumes(p.app):[],me=[],bt=[],It=new Set;for(let Me of p.regions){let ze=z.filter((j)=>j.region===Me).sort((j,yt)=>j.id.localeCompare(yt.id));for(let j=0;j<p.count;j++){let yt=ze[j];if(yt){It.add(yt.id),await Cp(u,p.app,yt,L,R),bt.push(yt.id),h(`Updated ${yt.id} (${Me}) to ${p.image}`);continue}let G=p.volume?[{volume:(await Sp(u,p,Me,fe)).id,path:p.volume.path}]:void 0,ht=await u.createMachine(p.app,{region:Me,name:`${p.app}-${Me}-${j+1}`,config:{...L,...G?{mounts:G}:{}},...R!==void 0?{min_secrets_version:R}:{}});await u.waitForState(p.app,ht.id,"started",{instanceId:ht.instance_id}),me.push(ht.id),h(`Created ${ht.id} in ${Me}`)}}let mt=[];for(let Me of p.hostnames)mt.push(await u.requestCertificate(p.app,Me));return{app:p.app,url:`https://${p.app}.fly.dev`,createdApp:y,created:me,updated:bt,untouched:z.filter((Me)=>!It.has(Me.id)).map((Me)=>Me.id),ips:v,certificates:mt}}async function Cp(u,p,h,y,R){let v=await u.acquireLease(p,h.id);try{let P=await u.updateMachine(p,h.id,{config:{...y,...h.config?.mounts?.length?{mounts:h.config.mounts}:{}},...R!==void 0?{min_secrets_version:R}:{}},v);await u.waitForState(p,h.id,"started",{instanceId:P.instance_id})}finally{await u.releaseLease(p,h.id,v)}}async function Sp(u,p,h,y){let R=y.find((P)=>P.region===h&&P.name===p.volume.name&&!P.attached_machine_id);if(R)return R.attached_machine_id="pending",R;let v=await u.createVolume(p.app,{name:p.volume.name,region:h,size_gb:p.volume.sizeGb});return y.push({...v,attached_machine_id:"pending"}),v}import{createHmac as Zl,createSign as bp,timingSafeEqual as Ap}from"node:crypto";function bi(u){let p=u instanceof Date?u.getTime():u;if(!Number.isFinite(p))throw TypeError("Media access timestamp must be finite");return Math.floor(p/1000)}function Zu(u){return Buffer.from(u).toString("base64").replaceAll("+","-").replaceAll("=","_").replaceAll("/","~")}function Tp(u){return Buffer.from(u).toString("base64url")}function Yu(u,p=!1){if(!u||/[\r\n]/.test(u))throw TypeError("Media resource is invalid");let h=p?u.replaceAll("*","wildcard"):u,y=new URL(h);if(!["http:","https:"].includes(y.protocol))throw TypeError("Media resource must use HTTP or HTTPS");if(!p&&u.includes("*"))throw TypeError("Canned policies cannot contain wildcards")}function Xu(u,p){let h=bp("RSA-SHA1");return h.update(u),h.end(),Zu(h.sign(p))}function ed(u){Yu(u.resource,!0);let h={DateLessThan:{"AWS:EpochTime":bi(u.expiresAt)}};if(u.activeAt!==void 0)h.DateGreaterThan={"AWS:EpochTime":bi(u.activeAt)};if(u.ipAddress)h.IpAddress={"AWS:SourceIp":u.ipAddress};return JSON.stringify({Statement:[{Resource:u.resource,Condition:h}]})}function xS(u,p,h){Yu(u);let y=bi(p),R=u.includes("?")?"&":"?",v=ed({resource:u,expiresAt:p}),P=Xu(v,h.privateKey);return`${u}${R}Expires=${y}&Signature=${encodeURIComponent(P)}&Key-Pair-Id=${encodeURIComponent(h.keyPairId)}`}function WS(u,p){let h=ed(u);return{"CloudFront-Key-Pair-Id":p.keyPairId,"CloudFront-Policy":Zu(Buffer.from(h)),"CloudFront-Signature":Xu(h,p.privateKey)}}function zS(u){if(!u.resource||/[\r\n]/.test(u.resource))throw TypeError("Media resource is invalid");let p=Tp(Buffer.from(JSON.stringify({resource:u.resource,expiresAt:bi(u.expiresAt),...u.keyId?{keyId:u.keyId}:{},...u.audience?{audience:u.audience}:{}}))),h=Zl("sha256",u.secret).update(p).digest("base64url");return`${p}.${h}`}function jS(u,p){let[h,y,R]=u.split(".");if(!h||!y||R)return null;let v=Zl("sha256",p.secret).update(h).digest(),P;try{P=Buffer.from(y,"base64url")}catch{return null}if(v.length!==P.length||!Ap(v,P))return null;try{let L=JSON.parse(Buffer.from(h,"base64url").toString("utf8")),z=bi(p.now??Date.now());if(!L.resource||!Number.isSafeInteger(L.expiresAt)||L.expiresAt<=z)return null;if(p.resource&&L.resource!==p.resource)return null;if(p.audience&&L.audience!==p.audience)return null;return L}catch{return null}}function KS(u,p=!1){let h=new URL(u,"https://media.invalid").pathname.toLowerCase(),y=/\.(?:m3u8|mpd|vtt|json)$/.test(h),R=/\.(?:key|license)$/.test(h)||h.includes("/keys/")||h.includes("/licenses/");return{"Accept-Ranges":"bytes","Cache-Control":p&&(y||R)?"private, no-store":y?"public, max-age=5, s-maxage=30, stale-while-revalidate=30":"public, max-age=31536000, immutable","Cross-Origin-Resource-Policy":"cross-origin","X-Content-Type-Options":"nosniff"}}function qS(u){if(!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(u.bucket))throw TypeError("Media bucket is invalid");if(!/^[a-z0-9-]+$/.test(u.region))throw TypeError("Media bucket region is invalid");let p=u.prefix?`/${u.prefix.replace(/^\/+|\/+$/g,"")}`:"",h=u.protected??!1,y="public, max-age=31536000, immutable",R=h?"private, no-store":"public, max-age=5, s-maxage=30, stale-while-revalidate=30";return{originDomain:`${u.bucket}.s3.${u.region}.amazonaws.com`,originPath:p,domain:u.domain,trustedKeyGroupIds:[...new Set(u.trustedKeyGroupIds??[])],behaviors:[{pathPattern:"*.m3u8",cacheControl:R,compress:!0,signed:h},{pathPattern:"*.mpd",cacheControl:R,compress:!0,signed:h},{pathPattern:"*.vtt",cacheControl:R,compress:!0,signed:h},{pathPattern:"*",cacheControl:y,compress:!1,signed:h}],responseHeaders:{"Access-Control-Allow-Headers":"Range, If-Range","Access-Control-Allow-Methods":"GET, HEAD, OPTIONS","Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":"Accept-Ranges, Content-Length, Content-Range, ETag","X-Content-Type-Options":"nosniff"}}}class vp{builder;config;environment;mergedConfig;serverEipLogicalIds=new Map;storageFailoverReplicas=[];constructor(u){this.config=u.config,this.environment=u.environment,this.builder=new al(`${this.config.project.name} - ${this.environment}`),this.mergedConfig=this.mergeEnvironmentConfig()}mergeEnvironmentConfig(){let p=this.config.environments[this.environment]?.infrastructure;if(!p)return this.config;return{...this.config,infrastructure:{...this.config.infrastructure,...p,compute:{...this.config.infrastructure?.compute,...p.compute},storage:{...this.config.infrastructure?.storage,...p.storage},functions:{...this.config.infrastructure?.functions,...p.functions},servers:{...this.config.infrastructure?.servers,...p.servers},databases:{...this.config.infrastructure?.databases,...p.databases},cdn:{...this.config.infrastructure?.cdn,...p.cdn},sftp:p.sftp??this.config.infrastructure?.sftp,queues:{...this.config.infrastructure?.queues,...p.queues},redirects:{...this.config.infrastructure?.redirects,...p.redirects},realtime:{...this.config.infrastructure?.realtime,...p.realtime},cache:{...this.config.infrastructure?.cache,...p.cache},fileSystem:{...this.config.infrastructure?.fileSystem,...p.fileSystem},email:{...this.config.infrastructure?.email,...p.email},search:{...this.config.infrastructure?.search,...p.search},ai:{...this.config.infrastructure?.ai,...p.ai}}}}shouldDeploy(u){if(u.environments&&!u.environments.includes(this.environment))return!1;if(u.requiresFeatures){let p=this.config.features||{};if(!u.requiresFeatures.every((y)=>p[y]===!0))return!1}if(u.regions){let p=this.config.environments[this.environment]?.region||this.config.project.region;if(!u.regions.includes(p))return!1}if(u.condition&&typeof u.condition==="function")return u.condition(this.config,this.environment);return!0}resolveApiOriginPort(){let u=this.mergedConfig.infrastructure?.api?.port??this.mergedConfig.ports?.api,p=Number(u||3008);return Number.isFinite(p)&&p>0?p:3008}defaultComputeCachePathPatterns(){return["/api/*","/auth/*","/publisher/api/*","/publisher/*","/publish","/publish/*","/analytics/*","/packages/*","/npm/*","/zig/*","/php/*","/commits/*","/health","/dashboard/*","/search","/login","/logout","/signup","/account","/account/*"]}shouldRouteStorageBucketToCompute(u,p){return u==="public"||p.routeCompute===!0}storageBucketName(u,p,h){return this.mergedConfig.infrastructure?.storage?.[h]?.bucket??`${u}-${p}-${h}`}fileSystemLogicalId(u,p,h){return t(r({slug:`${u}-${h}`,environment:p,resourceType:"efs"}))}resolveSftpStorage(u,p,h){let y=u.storage;if(y?.type==="efs"&&y.fileSystem){if(!this.mergedConfig.infrastructure?.fileSystem?.[y.fileSystem])throw Error(`sftp: storage.fileSystem "${y.fileSystem}" is not defined in infrastructure.fileSystem`);return{type:"efs",fileSystemId:{Ref:this.fileSystemLogicalId(p,h,y.fileSystem)},posixProfile:y.posixProfile}}if(y?.type==="s3"&&y.storageBucket){if(!this.mergedConfig.infrastructure?.storage?.[y.storageBucket])throw Error(`sftp: storage.storageBucket "${y.storageBucket}" is not defined in infrastructure.storage`);return{type:"s3",bucket:this.storageBucketName(p,h,y.storageBucket)}}return}resolveComputeCachePathPatterns(u){if(u&&u.length>0)return u;return this.defaultComputeCachePathPatterns()}createComputeCacheBehavior(u,p){return{PathPattern:u,TargetOriginId:p,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",OriginRequestPolicyId:"b689b0a8-53d0-40ab-baf2-68738e2966ac"}}appendComputeAppOrigin(u,p,h,y,R,v){let P=this.serverEipLogicalIds.get("app"),L=this.serverEipLogicalIds.get("appInstance");if(!P)return;let z=`EC2-${y}-${R}-api`,fe=this.mergedConfig.infrastructure?.servers?.app?.region||this.mergedConfig.project?.region||"us-east-1",me=fe==="us-east-1"?".compute-1.amazonaws.com":`.${fe}.compute.amazonaws.com`,bt={"Fn::Join":["",["ec2-",{"Fn::Join":["-",{"Fn::Split":[".",{Ref:P}]}]},me]]},It=this.resolveApiOriginPort();if(u.push({Id:z,DomainName:bt,CustomOriginConfig:{HTTPPort:It,HTTPSPort:443,OriginProtocolPolicy:"http-only",OriginSSLProtocols:["TLSv1.2"]}}),h.push(P),L)h.push(L);for(let mt of v)p.push(this.createComputeCacheBehavior(mt,z))}buildCaddyfile(u){let p=u.filter(([,R])=>typeof R.domain==="string"&&R.domain&&typeof R.port==="number");if(p.length===0)return;let h=new Map;for(let[,R]of p){let v=h.get(R.domain)??[];v.push({port:R.port,path:R.path}),h.set(R.domain,v)}let y=[];for(let[R,v]of h){let L=[...v].sort((z,fe)=>{let me=!z.path||z.path==="/",bt=!fe.path||fe.path==="/";if(me&&!bt)return 1;if(!me&&bt)return-1;return(fe.path?.length??0)-(z.path?.length??0)}).map((z)=>{let fe=!z.path||z.path==="/",me=`reverse_proxy localhost:${z.port}`;return fe?`  handle {
     ${me}
   }`:`  handle ${z.path} {
     ${me}
@@ -10,8 +10,8 @@ ${L.join(`
 `)}normalizeMountPath(u){let p=u?.mountPath||u?.path;if(!p||p==="/")return;let h=`/${p}`.replace(/\/+/g,"/").replace(/\/$/,"");return h==="/"?void 0:h}storageBucketLogicalId(u,p,h){return`${u}-${p}-s3-${h}`.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((y)=>y.charAt(0).toUpperCase()+y.slice(1)).join("")}pathMountRewriteFunctionCode(u,p="directory"){return`function handler(event) { var request = event.request; var prefix = ${JSON.stringify(u)}; var rewriteStyle = ${JSON.stringify(p)}; var uri = request.uri; if (uri === prefix) { uri = '/'; } else if (uri.indexOf(prefix + '/') === 0) { uri = uri.substring(prefix.length); } if (uri === '' || uri === '/') { request.uri = '/index.html'; return request; } if (uri.endsWith('/')) { request.uri = uri + 'index.html'; return request; } var lastSegment = uri.substring(uri.lastIndexOf('/') + 1); if (lastSegment.indexOf('.') === -1) { request.uri = rewriteStyle === 'flat' ? uri + '.html' : uri + '/index.html'; return request; } request.uri = uri; return request; }`}generate(){let u=this.mergedConfig.project.slug,p=this.environment,h=!!(this.mergedConfig.infrastructure?.functions&&Object.keys(this.mergedConfig.infrastructure.functions).length>0||this.mergedConfig.infrastructure?.api),y=!!(this.mergedConfig.infrastructure?.servers&&Object.keys(this.mergedConfig.infrastructure.servers).length>0),R=!!this.mergedConfig.infrastructure?.compute;if(!!((this.mergedConfig.mode||"server")==="serverless"&&this.mergedConfig.infrastructure?.containers&&Object.keys(this.mergedConfig.infrastructure.containers).length>0))this.generateNetworkInfrastructure(u,p),this.generateContainerInfrastructure(u,p);if(h)this.generateServerless(u,p);if(y)this.generateServer(u,p);if(R)this.generateComputeApp(u,p);if(this.mergedConfig.infrastructure?.jumpBox)this.generateJumpBox(u,p);if(this.storageFailoverReplicas=[],this.generateSharedInfrastructure(u,p),this.storageFailoverReplicas.length>0)this.builder.addMetadata(ul,this.storageFailoverReplicas);if(this.config.tags)this.applyGlobalTags(this.config.tags);return this}getStorageFailoverReplicas(){return[...this.storageFailoverReplicas]}applyGlobalTags(u){}generateNetworkInfrastructure(u,p){if(this.builder.hasResource("VPC"))return;let y=this.mergedConfig.infrastructure?.network?.cidr||"10.0.0.0/16",{vpc:R,logicalId:v}=S.createVpc({slug:u,environment:p,cidr:y,enableDnsHostnames:!0,enableDnsSupport:!0});this.builder.addResource("VPC",R);let P=`${u}${p}IGW`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(P,{Type:"AWS::EC2::InternetGateway",Properties:{Tags:[{Key:"Name",Value:`${u}-${p}-igw`},{Key:"Environment",Value:p}]}});let L=`${u}${p}IGWAttach`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(L,{Type:"AWS::EC2::VPCGatewayAttachment",Properties:{VpcId:{Ref:"VPC"},InternetGatewayId:{Ref:P}}});let z=`${u}${p}PublicRT`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(z,{Type:"AWS::EC2::RouteTable",Properties:{VpcId:{Ref:"VPC"},Tags:[{Key:"Name",Value:`${u}-${p}-public-rt`},{Key:"Environment",Value:p}]}}),this.builder.addResource(`${u}${p}PublicRoute`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::EC2::Route",Properties:{RouteTableId:{Ref:z},DestinationCidrBlock:"0.0.0.0/0",GatewayId:{Ref:P}},DependsOn:L});let fe=this.mergedConfig.environments[p]?.region||this.mergedConfig.project.region||"us-east-1",me=["a","b"];for(let bt=0;bt<2;bt++){let It=`PublicSubnet${bt+1}`;this.builder.addResource(It,{Type:"AWS::EC2::Subnet",Properties:{VpcId:{Ref:"VPC"},CidrBlock:`10.0.${bt}.0/24`,AvailabilityZone:`${fe}${me[bt]}`,MapPublicIpOnLaunch:!0,Tags:[{Key:"Name",Value:`${u}-${p}-public-${me[bt]}`},{Key:"Environment",Value:p}]}}),this.builder.addResource(`${It}RTAssoc`,{Type:"AWS::EC2::SubnetRouteTableAssociation",Properties:{SubnetId:{Ref:It},RouteTableId:{Ref:z}}})}}generateContainerInfrastructure(u,p){let h=this.mergedConfig.infrastructure?.containers;if(!h)return;let y=this.mergedConfig.infrastructure?.loadBalancer,R=this.mergedConfig.infrastructure?.ssl,v=this.mergedConfig.infrastructure?.dns,P;if(R?.enabled&&R.domains?.length)if(R.certificateArn);else{let me=R.domains[0],bt=R.domains.slice(1).map((Me)=>{if(Me.includes(".")&&Me.endsWith(me))return Me.replace(`.${me}`,"");return Me}),{certificate:It,logicalId:mt}=E.createCertificate({domain:me,subdomains:bt,slug:u,environment:p,validationMethod:"DNS",hostedZoneId:v?.hostedZoneId});P=mt,this.builder.addResource(mt,It)}let L="ECSCluster";this.builder.addResource(L,{Type:"AWS::ECS::Cluster",Properties:{ClusterName:`${u}-${p}`,ClusterSettings:[{Name:"containerInsights",Value:"enabled"}],Tags:[{Key:"Name",Value:`${u}-${p}`},{Key:"Environment",Value:p}]}});let z=`${u}${p}ALBSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(z,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ALB security group for ${u}-${p}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:80,ToPort:80,CidrIp:"0.0.0.0/0",Description:"HTTP"},{IpProtocol:"tcp",FromPort:443,ToPort:443,CidrIp:"0.0.0.0/0",Description:"HTTPS"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${u}-${p}-alb-sg`},{Key:"Environment",Value:p}]}});let fe=`${u}${p}ECSSecurityGroup`.replace(/[^a-zA-Z0-9]/g,"");for(let[me,bt]of Object.entries(h)){let It=bt.port||3000;this.builder.addResource(fe,{Type:"AWS::EC2::SecurityGroup",Properties:{GroupDescription:`ECS tasks security group for ${u}-${p}`,VpcId:{Ref:"VPC"},SecurityGroupIngress:[{IpProtocol:"tcp",FromPort:It,ToPort:It,SourceSecurityGroupId:{Ref:z},Description:"Allow traffic from ALB"}],SecurityGroupEgress:[{IpProtocol:"-1",CidrIp:"0.0.0.0/0",Description:"Allow all outbound"}],Tags:[{Key:"Name",Value:`${u}-${p}-ecs-sg`},{Key:"Environment",Value:p}]}});let mt=`${u}${p}TaskExecRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(mt,{Type:"AWS::IAM::Role",Properties:{RoleName:`${u}-${p}-ecs-exec-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"],Policies:[{PolicyName:"ECRPullPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"}]}}]}});let Me=`${u}${p}TaskRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Me,{Type:"AWS::IAM::Role",Properties:{RoleName:`${u}-${p}-ecs-task-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"ecs-tasks.amazonaws.com"},Action:"sts:AssumeRole"}]},Policies:[{PolicyName:"TaskPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:"*"},{Effect:"Allow",Action:["s3:GetObject","s3:PutObject","s3:ListBucket"],Resource:"*"}]}}]}});let ze=`${u}${p}${me}LogGroup`.replace(/[^a-zA-Z0-9]/g,""),j=`/ecs/${u}-${p}-${me}`;this.builder.addResource(ze,{Type:"AWS::Logs::LogGroup",Properties:{LogGroupName:j,RetentionInDays:30}});let yt=`${u}${p}${me}TaskDef`.replace(/[^a-zA-Z0-9]/g,""),G=String(bt.cpu||512),ht=String(bt.memory||1024);this.builder.addResource(yt,{Type:"AWS::ECS::TaskDefinition",Properties:{Family:`${u}-${p}-${me}`,NetworkMode:"awsvpc",RequiresCompatibilities:["FARGATE"],Cpu:G,Memory:ht,ExecutionRoleArn:{"Fn::GetAtt":[mt,"Arn"]},TaskRoleArn:{"Fn::GetAtt":[Me,"Arn"]},ContainerDefinitions:[{Name:me,Image:{"Fn::Sub":`\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/${u}:latest`},Essential:!0,PortMappings:[{ContainerPort:It,Protocol:"tcp"}],LogConfiguration:{LogDriver:"awslogs",Options:{"awslogs-group":j,"awslogs-region":{Ref:"AWS::Region"},"awslogs-stream-prefix":me}},HealthCheck:{Command:["CMD-SHELL",`curl -f http://localhost:${It}${bt.healthCheck||"/health"} || exit 1`],Interval:30,Timeout:5,Retries:3,StartPeriod:60}}],Tags:[{Key:"Name",Value:`${u}-${p}-${me}`},{Key:"Environment",Value:p}]},DependsOn:[mt,Me,ze]});let Ct=`${u}${p}ALB`.replace(/[^a-zA-Z0-9]/g,"");if(y?.enabled!==!1){this.builder.addResource(Ct,{Type:"AWS::ElasticLoadBalancingV2::LoadBalancer",Properties:{Name:`${u}-${p}-alb`,Scheme:"internet-facing",Type:"application",Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],SecurityGroups:[{Ref:z}],Tags:[{Key:"Name",Value:`${u}-${p}-alb`},{Key:"Environment",Value:p}]}});let Ft=`${u}${p}TargetGroup`.replace(/[^a-zA-Z0-9]/g,""),Wt=y?.healthCheck?.path||bt.healthCheck||"/health";this.builder.addResource(Ft,{Type:"AWS::ElasticLoadBalancingV2::TargetGroup",Properties:{Name:`${u}-${p}-tg`,Port:It,Protocol:"HTTP",VpcId:{Ref:"VPC"},TargetType:"ip",HealthCheckPath:Wt,HealthCheckIntervalSeconds:y?.healthCheck?.interval||30,HealthyThresholdCount:y?.healthCheck?.healthyThreshold||2,UnhealthyThresholdCount:y?.healthCheck?.unhealthyThreshold||5,HealthCheckTimeoutSeconds:10,Tags:[{Key:"Name",Value:`${u}-${p}-tg`},{Key:"Environment",Value:p}]}});let Zt=`${u}${p}HTTPListener`.replace(/[^a-zA-Z0-9]/g,"");if(R?.enabled&&R?.redirectHttp)this.builder.addResource(Zt,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ct},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"redirect",RedirectConfig:{Protocol:"HTTPS",Port:"443",StatusCode:"HTTP_301"}}]}});else this.builder.addResource(Zt,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ct},Port:80,Protocol:"HTTP",DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Ft}}]}});if(R?.enabled){let Yt=R.certificateArn||(P?{Ref:P}:void 0);if(Yt){let tr=`${u}${p}HTTPSListener`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(tr,{Type:"AWS::ElasticLoadBalancingV2::Listener",Properties:{LoadBalancerArn:{Ref:Ct},Port:443,Protocol:"HTTPS",Certificates:[{CertificateArn:Yt}],DefaultActions:[{Type:"forward",TargetGroupArn:{Ref:Ft}}],SslPolicy:"ELBSecurityPolicy-TLS13-1-2-2021-06"}})}}let Jt=`${u}${p}${me}Service`.replace(/[^a-zA-Z0-9]/g,""),Xt=bt.desiredCount||1;this.builder.addResource(Jt,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${u}-${p}-${me}`,Cluster:{Ref:L},TaskDefinition:{Ref:yt},DesiredCount:Xt,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:fe}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},LoadBalancers:[{ContainerName:me,ContainerPort:It,TargetGroupArn:{Ref:Ft}}],HealthCheckGracePeriodSeconds:120,Tags:[{Key:"Name",Value:`${u}-${p}-${me}`},{Key:"Environment",Value:p}]},DependsOn:[yt,Zt,Ft]});let Er=bt.autoScaling;if(Er){let Yt=`${u}${p}${me}ScalableTarget`.replace(/[^a-zA-Z0-9]/g,"");if(this.builder.addResource(Yt,{Type:"AWS::ApplicationAutoScaling::ScalableTarget",Properties:{MaxCapacity:Er.max||10,MinCapacity:Er.min||1,ResourceId:{"Fn::Sub":`service/\${${L}}/${u}-${p}-${me}`},ScalableDimension:"ecs:service:DesiredCount",ServiceNamespace:"ecs",RoleARN:{"Fn::Sub":"arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService"}},DependsOn:Jt}),Er.targetCpuUtilization)this.builder.addResource(`${u}${p}${me}CPUScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${u}-${p}-${me}-cpu-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Yt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageCPUUtilization"},TargetValue:Er.targetCpuUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}});if(Er.targetMemoryUtilization)this.builder.addResource(`${u}${p}${me}MemoryScaling`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::ApplicationAutoScaling::ScalingPolicy",Properties:{PolicyName:`${u}-${p}-${me}-memory-scaling`,PolicyType:"TargetTrackingScaling",ScalingTargetId:{Ref:Yt},TargetTrackingScalingPolicyConfiguration:{PredefinedMetricSpecification:{PredefinedMetricType:"ECSServiceAverageMemoryUtilization"},TargetValue:Er.targetMemoryUtilization,ScaleInCooldown:300,ScaleOutCooldown:60}}})}if(v?.domain&&v?.hostedZoneId)this.builder.addResource(`${u}${p}ApiDnsRecord`.replace(/[^a-zA-Z0-9]/g,""),{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:v.hostedZoneId,Name:`api.${v.domain}`,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[Ct,"DNSName"]},HostedZoneId:{"Fn::GetAtt":[Ct,"CanonicalHostedZoneID"]}}}});this.builder.addOutput("ECSClusterArn",{Description:"ECS Cluster ARN",Value:{"Fn::GetAtt":[L,"Arn"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-cluster-arn"}}}),this.builder.addOutput("ECSServiceName",{Description:"ECS Service Name",Value:`${u}-${p}-${me}`,Export:{Name:{"Fn::Sub":"${AWS::StackName}-ecs-service-name"}}}),this.builder.addOutput("LoadBalancerDNS",{Description:"Application Load Balancer DNS Name",Value:{"Fn::GetAtt":[Ct,"DNSName"]},Export:{Name:{"Fn::Sub":"${AWS::StackName}-alb-dns"}}})}else{let Ft=`${u}${p}${me}Service`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ft,{Type:"AWS::ECS::Service",Properties:{ServiceName:`${u}-${p}-${me}`,Cluster:{Ref:L},TaskDefinition:{Ref:yt},DesiredCount:bt.desiredCount||1,LaunchType:"FARGATE",NetworkConfiguration:{AwsvpcConfiguration:{AssignPublicIp:"ENABLED",SecurityGroups:[{Ref:fe}],Subnets:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]}},Tags:[{Key:"Name",Value:`${u}-${p}-${me}`},{Key:"Environment",Value:p}]},DependsOn:[yt]})}break}}generateServerless(u,p){if(this.mergedConfig.infrastructure?.functions)for(let[h,y]of Object.entries(this.mergedConfig.infrastructure.functions)){if(!this.shouldDeploy(y))continue;let{role:R,logicalId:v}=de.createRole({slug:u,environment:p,roleName:`${u}-${p}-${h}-role`,servicePrincipal:"lambda.amazonaws.com",managedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]});this.builder.addResource(v,R);let{lambdaFunction:P,logicalId:L}=a.createLambdaFunction({slug:u,environment:p,functionName:`${u}-${p}-${h}`,handler:y.handler||"index.handler",runtime:y.runtime||"nodejs20.x",code:{zipFile:y.code||"export const handler = async () => ({ statusCode: 200 });"},role:v,timeout:y.timeout,memorySize:y.memorySize});this.builder.addResource(L,P)}if(this.mergedConfig.infrastructure?.api){let{restApi:h,logicalId:y}=ml.createRestApi({slug:u,environment:p,apiName:`${u}-${p}-api`});this.builder.addResource(y,h)}}generateServer(u,p){if(!this.mergedConfig.infrastructure?.servers)return;let h=this.mergedConfig.infrastructure.servers,y=this.mergedConfig.infrastructure?.compute,R=this.mergedConfig.infrastructure?.ssl;if(Object.values(h).some((P)=>!P.privateNetwork||P.privateNetwork==="create"))this.generateNetworkInfrastructure(u,p);for(let[P,L]of Object.entries(h)){let z=L.instanceType||L.size||y?.size,me=(z?a.InstanceSize.specs[z]:void 0)?.instanceType||z||"t3.micro",bt=L.type||"app",It=L.userData||L.startupScript;if(!It)It=a.UserData.generateAppServerScript({runtime:"bun",runtimeVersion:L.bunVersion||"latest",webServer:"none",domain:L.domain,enableSsl:!!R?.enabled,sslEmail:R?.letsEncrypt?.email,installRedis:bt==="cache",installDatabaseClients:!!L.database});let mt=L.privateNetwork&&L.privateNetwork!=="create"?L.privateNetwork:{Ref:"VPC"},Me=L.subnet||{Ref:"PublicSubnet1"},j=!!this.mergedConfig.infrastructure?.email?.server?.enabled,yt=[22,80,443,this.resolveApiOriginPort()];if(j)yt.push(25,465,587,143,993);let G=a.createServerModeStack({slug:`${u}-${P}`,environment:p,vpcId:mt,subnetId:Me,instanceType:me,keyName:L.keyName||`${u}-${p}`,domain:L.domain,userData:It,volumeSize:L.diskSize||20,imageId:L.image,allowedPorts:yt});for(let[ht,Ct]of Object.entries(G.resources))this.builder.addResource(ht,Ct);this.serverEipLogicalIds.set(P,G.outputs.eipLogicalId),this.serverEipLogicalIds.set(`${P}Instance`,G.outputs.instanceLogicalId),this.builder.addOutput(`${P}InstanceId`,{Value:{Ref:G.outputs.instanceLogicalId},Description:`Instance ID for ${P} server`}),this.builder.addOutput(`${P}PublicIp`,{Value:{Ref:G.outputs.eipLogicalId},Description:`Public IP for ${P} server`})}}generateComputeApp(u,p){let h=this.mergedConfig.infrastructure?.compute;if(!h)return;let y=this.mergedConfig.sites||{},R=Object.entries(y),P=this.mergedConfig.infrastructure?.dns?.domain,L=this.mergedConfig.infrastructure?.database,z=h.size,me=(z?a.InstanceSize.specs[z]:void 0)?.instanceType||z||"t3.micro";if(!this.builder.hasResource("VPC"))this.generateNetworkInfrastructure(u,p);let bt=this.buildCaddyfile(R),It=a.UserData.generateBunAppScript({runtime:h.runtime||"bun",runtimeVersion:h.runtimeVersion||"latest",systemPackages:h.systemPackages,database:L,caddyfile:bt}),mt=eo(h.appUpdates),Me=mt.length>0?`${It}
 ${mt.join(`
 `)}
-`:It,ze=R.map(([,Wt])=>Wt.port).filter((Wt)=>typeof Wt==="number"&&![80,443].includes(Wt)),j=this.resolveApiOriginPort(),yt=`${u}${p}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),G=`${u}-${p}-deploy`;this.builder.addResource(yt,{Type:"AWS::S3::Bucket",Properties:{BucketName:G,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:u},{Key:"Environment",Value:p},{Key:"ManagedBy",Value:"ts-cloud"}]}});let ht=a.createServerModeStack({slug:`${u}-app`,environment:p,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:me,keyName:h.allowSsh?`${u}-${p}`:void 0,domain:P,userData:Me,volumeSize:h.disk?.size||20,imageId:h.image,allowedPorts:[...h.allowSsh?[22]:[],80,443,j,...ze]}),Ct=ht.resources[ht.outputs.instanceLogicalId];if(Ct?.Properties){let Wt=Ct.Properties.Tags||[];Ct.Properties.Tags=[...Wt,{Key:"Project",Value:u},{Key:"Environment",Value:p},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let Ft=ht.resources[ht.outputs.roleLogicalId];if(Ft?.Properties)Ft.Properties.Policies=Ft.Properties.Policies||[],Ft.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${G}`,`arn:aws:s3:::${G}/*`]}]}});for(let[Wt,Zt]of Object.entries(ht.resources))this.builder.addResource(Wt,Zt);this.builder.addOutput("deployBucketName",{Value:{Ref:yt},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:ht.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:ht.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",ht.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",ht.outputs.instanceLogicalId)}jumpBoxFileSystemId(u,p,h){let y=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof h==="string")return y.includes(h)?{Ref:this.fileSystemLogicalId(u,p,h)}:h;if(y.length===1)return{Ref:this.fileSystemLogicalId(u,p,y[0])};throw Error(y.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${y.length} (${y.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(u,p){let h=this.mergedConfig.infrastructure?.jumpBox;if(!h)return;let y=h===!0?{}:h;if(y.enabled===!1)return;this.generateNetworkInfrastructure(u,p);let R=y.size||"micro",P=a.InstanceSize.specs[R]?.instanceType||R||"t3.micro",L=a.createJumpBox({slug:u,environment:p,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:y.keyName,instanceType:P,allowedCidrs:y.allowedCidrs,mountEfs:y.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(u,p,y.mountEfs),mountPath:y.mountPath||"/mnt/efs"}:void 0,databaseTools:y.databaseTools});for(let[z,fe]of Object.entries(L.resources))this.builder.addResource(z,fe);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:L.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(u,p){let h=this.mergedConfig.infrastructure?.ssl,y=this.mergedConfig.infrastructure?.dns,R=y?.domain,v=y?.hostedZoneId,P=[],L,z;if(h?.certificateArn)z=h.certificateArn;else if(h?.enabled&&R&&v){let ze=h.domains||[R],j=ze[0],yt=ze.slice(1).map((Ct)=>{if(Ct.includes(".")&&Ct.endsWith(j))return Ct.replace(`.${j}`,"");return Ct}),{certificate:G,logicalId:ht}=E.createCertificate({domain:j,subdomains:yt,slug:u,environment:p,validationMethod:"DNS",hostedZoneId:v});L=ht,this.builder.addResource(ht,G)}if(this.mergedConfig.infrastructure?.storage){let ze=Object.entries(this.mergedConfig.infrastructure.storage).some(([,G])=>G.website),j;if(ze&&(L||z))j=`${u}${p}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(j,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${u}-${p}-s3-oac`,Description:`OAC for ${u} ${p} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let yt=Object.entries(this.mergedConfig.infrastructure.storage).map(([G,ht])=>({name:G,config:ht,mountPath:this.normalizeMountPath(ht),rewriteStyle:ht.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(u,p,G)})).filter((G)=>G.name!=="public"&&G.config.website&&G.mountPath);for(let[G,ht]of Object.entries(this.mergedConfig.infrastructure.storage)){let Ct=!!(ht.website&&j),Ft=this.storageBucketName(u,p,G),{bucket:Wt,logicalId:Zt}=xe.createBucket({slug:u,name:G,environment:p,bucketName:Ft,versioning:ht.versioning,encryption:ht.encryption,public:Ct?!1:ht.public}),Jt=this.normalizeMountPath(ht),Xt;if(ht.failover){let Yt=`infrastructure.storage.${G}`;if(!Ct||!R||Jt&&G!=="public")throw Error(`${Yt}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(Xt=vm({failover:ht.failover,primaryBucket:Ft,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:Yt}),Xt.replicate&&Wt.Properties){let tr=`${Zt}FailoverReplicationRole`;this.builder.addResource(tr,wm({primaryBucket:Ft,replicaBucket:Xt.replicaBucket}));let xr=Wt.Properties;xr.VersioningConfiguration={Status:"Enabled"},xr.ReplicationConfiguration=Rm({replicaBucket:Xt.replicaBucket,roleArn:{"Fn::GetAtt":[tr,"Arn"]}})}}if(Ct&&Wt.Properties)Wt.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(Zt,Wt),ht.website){let Yt=typeof ht.website==="object"?ht.website:{},tr=xe.enableWebsiteHosting(Wt,Yt.indexDocument||"index.html",Yt.errorDocument);this.builder.addResource(Zt,tr)}let Er=this.normalizeMountPath(ht);if(Ct&&j&&R&&!(Er&&G!=="public")){let Yt=`${u}${p}${G}CDN`.replace(/[^a-zA-Z0-9]/g,""),tr=[];if(ht.aliases&&ht.aliases.length>0)tr.push(...ht.aliases);else if(G==="public"){if(tr.push(R),h?.domains?.includes(`www.${R}`))tr.push(`www.${R}`)}else if(G==="docs")tr.push(`docs.${R}`);else if(G==="blog")tr.push(`blog.${R}`);let xr=typeof ht.website==="object"?ht.website:{},jr=ht.spa===!0,Vr=xr.errorDocument||(jr?"index.html":"404.html"),Or=[];if(jr)Or.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else Or.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${Vr}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${Vr}`,ErrorCachingMinTTL:300});let qr=z&&tr.length>0?{AcmCertificateArn:z,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:L&&tr.length>0?{AcmCertificateArn:{Ref:L},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Bn=`S3-${u}-${p}-${G}`,Ya=this.mergedConfig.project.region||"us-east-1",Yn;if(!jr)Yn=`${u}${p}${G}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Yn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${u}-${p}-${G}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${u} ${p} ${G} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
-else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let pi=[{Id:Bn,DomainName:{"Fn::Sub":`\${${Zt}}.s3.${Ya}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:j}}],go=[],Tc=[];if(this.shouldRouteStorageBucketToCompute(G,ht)){this.appendComputeAppOrigin(pi,go,Tc,u,p,this.resolveComputeCachePathPatterns(ht.computeRoutes));for(let $r of yt){let Cs=`S3-${u}-${p}-${$r.name}`,Ec=`${u}${p}${$r.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ec,{Type:"AWS::CloudFront::Function",Properties:{Name:`${u}-${p}-${$r.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${u} ${p} ${$r.name} at ${$r.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode($r.mountPath,$r.rewriteStyle)}}),pi.push({Id:Cs,DomainName:{"Fn::Sub":`\${${$r.logicalId}}.s3.${Ya}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:j}}),Tc.push($r.logicalId,Ec);for(let gp of[$r.mountPath,`${$r.mountPath}/*`])go.push({PathPattern:gp,TargetOriginId:Cs,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Ec,"FunctionARN"]}}]})}}let fo,Xc=Bn;if(Xt){let $r=`${Bn}-failover`;Object.assign(pi[0],Xt.primaryConnection),pi.push({Id:$r,DomainName:Tm(Xt.replicaBucket,Xt.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:j}}),fo=ln({primaryOriginId:Bn,secondaryOriginId:$r,statusCodes:Xt.statusCodes}),Xc=fo.Items[0].Id}let $c={Type:"AWS::CloudFront::Distribution",DependsOn:[Zt,j,...Yn?[Yn]:[],...Tc],Properties:{DistributionConfig:{Enabled:!0,Comment:`${u} ${p} ${G} site`,DefaultRootObject:"index.html",Origins:pi,...fo?{OriginGroups:fo}:{},DefaultCacheBehavior:{TargetOriginId:Xc,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...Yn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Yn,"FunctionARN"]}}]}:{}},...go.length>0?{CacheBehaviors:go}:{},...tr.length>0?{Aliases:tr}:{},ViewerCertificate:qr,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:Or}}};if(L)$c.DependsOn.push(L);if(Xt)Pt($c.Properties.DistributionConfig,`infrastructure.storage.${G}`),this.storageFailoverReplicas.push({name:G,primaryBucket:Ft,primaryRegion:Ya,replicaBucket:Xt.replicaBucket,replicaRegion:Xt.replicaRegion,replicate:Xt.replicate,distributionArnOutput:`${G}CloudFrontDistributionArn`}),this.builder.addOutput(`${G}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${Yt}}`},Description:`CloudFront distribution ARN for ${G} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${G}FailoverBucketName`,{Value:Xt.replicaBucket,Description:`Failover replica bucket for ${G} (${Xt.replicaRegion}), outside this stack`});this.builder.addResource(Yt,$c);let mp=`${Zt}CloudFrontPolicy`;if(this.builder.addResource(mp,{Type:"AWS::S3::BucketPolicy",DependsOn:[Zt,Yt],Properties:{Bucket:{Ref:Zt},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Zt}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Yt}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(G,ht))for(let $r of yt){let Cs=`${$r.logicalId}CloudFrontPolicy`;this.builder.addResource(Cs,{Type:"AWS::S3::BucketPolicy",DependsOn:[$r.logicalId,Yt],Properties:{Bucket:{Ref:$r.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${$r.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Yt}}`}}}}]}}})}if(tr.length>0)P.push({name:G,bucketLogicalId:Zt,distLogicalId:Yt,oacLogicalId:j,aliases:tr});this.builder.addOutput(`${G}CloudFrontDomain`,{Value:{"Fn::GetAtt":[Yt,"DomainName"]},Description:`CloudFront domain for ${G}`}),this.builder.addOutput(`${G}CloudFrontDistributionId`,{Value:{Ref:Yt},Description:`CloudFront distribution ID for ${G}`})}if(this.builder.addOutput(`${G}BucketName`,{Value:{Ref:Zt},Description:`S3 bucket name for ${G}`}),G==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:Zt},Description:"Frontend S3 bucket name"});if(G==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:Zt},Description:"Documentation S3 bucket name"});if(G==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:Zt},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let ze=this.mergedConfig.infrastructure.sftp,j=pl.create({...ze,storage:this.resolveSftpStorage(ze,u,p)??ze.storage,slug:u,environment:p});for(let[yt,G]of Object.entries(j.resources))this.builder.addResource(yt,G);this.builder.addOutput("SftpServerId",{Value:{Ref:j.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${j.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:j.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(v&&P.length>0)for(let{name:ze,distLogicalId:j,aliases:yt}of P)for(let G of yt){let ht=G.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${ht}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[j],Properties:{HostedZoneId:v,Name:G,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[j,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${ht}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[j],Properties:{HostedZoneId:v,Name:G,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[j,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.databases))if(j.engine==="dynamodb"){let{table:yt,logicalId:G}=lr.createTable({slug:u,environment:p,tableName:`${u}-${p}-${ze}`,partitionKey:j.partitionKey||{name:"id",type:"S"},sortKey:j.sortKey});this.builder.addResource(G,yt)}else if(j.engine==="postgres"){let{dbInstance:yt,logicalId:G}=lr.createPostgres({slug:u,environment:p,dbInstanceIdentifier:`${u}-${p}-${ze}`,masterUsername:j.username||"admin",masterUserPassword:j.password||"changeme123",allocatedStorage:j.storage||20,dbInstanceClass:j.instanceClass||"db.t3.micro"});this.builder.addResource(G,yt)}else if(j.engine==="mysql"){let{dbInstance:yt,logicalId:G}=lr.createMysql({slug:u,environment:p,dbInstanceIdentifier:`${u}-${p}-${ze}`,masterUsername:j.username||"admin",masterUserPassword:j.password||"changeme123",allocatedStorage:j.storage||20,dbInstanceClass:j.instanceClass||"db.t3.micro"});this.builder.addResource(G,yt)}}if(this.mergedConfig.infrastructure?.cdn)for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!j.origin)continue;let yt=typeof j.customDomain==="string"?j.customDomain:j.customDomain?.domain||j.domain,G=typeof j.customDomain==="object"?j.customDomain?.certificateArn:j.certificateArn,ht=G||z,Ct=`${u}${p}${ze}CDN`.replace(/[^a-zA-Z0-9]/g,""),Ft=`S3-${u}-${p}-${ze}-cdn`,Wt=[{Id:Ft,DomainName:j.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:j.originShield?{Enabled:!0,OriginShieldRegion:j.originShieldRegion||this.mergedConfig.environments[p]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...ce(j,`infrastructure.cdn.${ze}`)}],Zt=[],Jt=[],Xt=["GET","HEAD","OPTIONS"],Er=Ft,Yt;if(j.failoverOrigin){Dt(Xt,`the default cache behavior of infrastructure.cdn.${ze}`);let Vr=`${Ft}-failover`,Or=typeof j.failoverOrigin==="string"?{domain:j.failoverOrigin}:j.failoverOrigin;if(!Or.domain)throw Error(`infrastructure.cdn.${ze}.failoverOrigin.domain is required`);if(Or.domain===j.origin)throw Error(`infrastructure.cdn.${ze}: failoverOrigin must differ from origin (both are ${j.origin})`);Wt.push({Id:Vr,DomainName:Or.domain,OriginPath:Or.originPath||"",...Ho(Or.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...ce(Or,`infrastructure.cdn.${ze}.failoverOrigin`)}),Yt=ln({primaryOriginId:Ft,secondaryOriginId:Vr,statusCodes:j.failoverStatusCodes}),Er=Yt.Items[0].Id}else if(j.failoverStatusCodes)throw Error(`infrastructure.cdn.${ze}: failoverStatusCodes needs failoverOrigin to fail over to`);if(j.routeCompute)this.appendComputeAppOrigin(Wt,Zt,Jt,u,p,this.resolveComputeCachePathPatterns(j.computeRoutes));let tr=ht&&yt?{AcmCertificateArn:L&&!G?{Ref:L}:ht,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},xr=[...Jt];if(L&&!G&&yt)xr.push(L);let jr={Type:"AWS::CloudFront::Distribution",...xr.length>0?{DependsOn:xr}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${u} ${p} ${ze} CDN`,DefaultRootObject:"index.html",Origins:Wt,...Yt?{OriginGroups:Yt}:{},DefaultCacheBehavior:{TargetOriginId:Er,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:Xt,CachedMethods:["GET","HEAD","OPTIONS"],Compress:j.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...Zt.length>0?{CacheBehaviors:Zt}:{},...yt&&ht?{Aliases:[yt]}:{},ViewerCertificate:tr,PriceClass:"PriceClass_100",HttpVersion:j.http3?"http2and3":"http2"}}};if(Pt(jr.Properties.DistributionConfig,`infrastructure.cdn.${ze}`),this.builder.addResource(Ct,jr),v&&yt&&ht){let Vr=yt.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Vr}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ct,...L&&!G?[L]:[]],Properties:{HostedZoneId:v,Name:yt,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Ct,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(j))continue;let{queue:yt,logicalId:G}=J.createQueue({slug:u,environment:p,name:`${u}-${p}-${ze}`,fifo:j.fifo,visibilityTimeout:j.visibilityTimeout,messageRetentionPeriod:j.messageRetentionPeriod,delaySeconds:j.delaySeconds,maxMessageSize:j.maxMessageSize,receiveMessageWaitTime:j.receiveMessageWaitTime,contentBasedDeduplication:j.contentBasedDeduplication,encrypted:j.encrypted,kmsKeyId:j.kmsKeyId});this.builder.addResource(G,yt);let ht;if(j.deadLetterQueue){let{deadLetterQueue:Ct,updatedSourceQueue:Ft,deadLetterLogicalId:Wt}=J.createDeadLetterQueue(G,{slug:u,environment:p,maxReceiveCount:j.maxReceiveCount});ht=Wt,this.builder.addResource(Wt,Ct);let Jt=this.builder.getResources()[G];if(Jt?.Properties)Jt.Properties.RedrivePolicy=Ft.Properties?.RedrivePolicy}if(j.trigger){let Ct=j.trigger,Ft=`${u}${p}${Ct.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Wt={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[G,"Arn"]},FunctionName:{Ref:Ft},BatchSize:Ct.batchSize||10,MaximumBatchingWindowInSeconds:Ct.batchWindow||0,Enabled:!0,...Ct.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Ct.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Ct.maxConcurrency}},...Ct.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Ct.filterPattern)}]}}},DependsOn:[G,Ft]};this.builder.addResource(`${G}Trigger`,Wt)}if(j.alarms?.enabled){let Ct=j.alarms,Ft=Ct.notificationTopicArn;if(!Ft&&Ct.notificationEmails?.length){let Jt=`${G}AlarmTopic`;this.builder.addResource(Jt,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${u}-${p}-${ze}-alarms`,DisplayName:`${ze} Queue Alarms`}}),Ct.notificationEmails.forEach((Xt,Er)=>{this.builder.addResource(`${Jt}Sub${Er}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Jt},Protocol:"email",Endpoint:Xt}})}),Ft={Ref:Jt}}let Wt=Ct.queueDepthThreshold||1000;this.builder.addResource(`${G}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-${ze}-queue-depth`,AlarmDescription:`Queue ${ze} depth exceeds ${Wt} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Wt,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[G,"QueueName"]}}],...Ft&&{AlarmActions:[Ft],OKActions:[Ft]}}});let Zt=Ct.messageAgeThreshold||3600;if(this.builder.addResource(`${G}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-${ze}-message-age`,AlarmDescription:`Queue ${ze} oldest message exceeds ${Zt} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:Zt,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[G,"QueueName"]}}],...Ft&&{AlarmActions:[Ft],OKActions:[Ft]}}}),ht&&Ct.dlqAlarm!==!1)this.builder.addResource(`${ht}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-${ze}-dlq-messages`,AlarmDescription:`Dead letter queue for ${ze} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ht,"QueueName"]}}],...Ft&&{AlarmActions:[Ft]}}})}if(j.subscribe){let Ct=j.subscribe,Ft=Ct.topicArn;if(!Ft&&Ct.topicName)Ft={Ref:Ct.topicName};if(Ft){this.builder.addResource(`${G}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:G}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[G,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":Ft}}}]}}});let Wt={TopicArn:Ft,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[G,"Arn"]},RawMessageDelivery:Ct.rawMessageDelivery||!1};if(Ct.filterPolicy)Wt.FilterPolicy=Ct.filterPolicy,Wt.FilterPolicyScope=Ct.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${G}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Wt,DependsOn:`${G}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(u,p);else this.generateRealtimeResources(u,p);let fe=this.mergedConfig.infrastructure?.redirects;if(fe){let ze=fe.target||this.mergedConfig.infrastructure?.dns?.domain||"",j=fe.protocol||"https";if(fe.domains?.length&&ze)for(let yt of fe.domains){let{bucket:G,bucketPolicy:ht,logicalId:Ct,policyLogicalId:Ft}=Nt.createDomainRedirectBucket({slug:u,environment:p,sourceDomain:yt,targetDomain:ze,protocol:j});this.builder.addResource(Ct,G),this.builder.addResource(Ft,ht)}if(fe.paths&&Object.keys(fe.paths).length>0){let yt=Nt.fromMapping(fe.paths,{statusCode:fe.statusCode||301}),{function:G,logicalId:ht}=Nt.createPathRedirectFunction({slug:u,environment:p,rules:yt});this.builder.addResource(ht,G)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:yt,logicalId:G}=qo.createAlarm({slug:u,environment:p,alarmName:`${u}-${p}-${ze}`,metricName:j.metricName||"Errors",namespace:j.namespace||"AWS/Lambda",threshold:j.threshold||1,comparisonOperator:j.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(G,yt)}let me=this.mergedConfig.infrastructure?.cache;if(me){let ze=me.type||"redis";if(ze==="redis"){this.generateNetworkInfrastructure(u,p);let j=me.redis||{},{replicationGroup:yt,subnetGroup:G,logicalId:ht,subnetGroupId:Ct}=Vo.createRedis({slug:u,environment:p,nodeType:j.nodeType||me.nodeType||"cache.t3.micro",engineVersion:j.engineVersion||"7.1",port:j.port||6379,numCacheClusters:j.numCacheNodes||2,automaticFailover:j.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:j.snapshotRetentionLimit||7,snapshotWindow:j.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(ht,yt),G&&Ct)this.builder.addResource(Ct,G);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[ht,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[ht,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(ze==="memcached"){this.generateNetworkInfrastructure(u,p);let j=me.elasticache||{},{cluster:yt,subnetGroup:G,logicalId:ht,subnetGroupId:Ct}=Vo.createMemcached({slug:u,environment:p,nodeType:j.nodeType||me.nodeType||"cache.t3.micro",engineVersion:j.engineVersion||"1.6.22",numCacheNodes:j.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(ht,yt),G&&Ct)this.builder.addResource(Ct,G);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[ht,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let bt=this.mergedConfig.infrastructure?.email;if(bt){let ze=bt.domain||this.mergedConfig.infrastructure?.dns?.domain;if(ze){let{emailIdentity:j,logicalId:yt}=f.verifyDomain({domain:ze,slug:u,environment:p,enableDkim:bt.enableDkim!==!1,dkimKeyLength:bt.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(yt,j),bt.configurationSet!==!1){let{configurationSet:Ct,logicalId:Ft}=f.createConfigurationSet({slug:u,environment:p});this.builder.addResource(Ft,Ct)}let G=bt.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(G){if(bt.enableDkim!==!1)for(let Jt=1;Jt<=3;Jt++){let Xt=`DkimRecord${Jt}${ze.replace(/\./g,"")}`;this.builder.addResource(Xt,{Type:"AWS::Route53::RecordSet",DependsOn:[yt],Properties:{HostedZoneId:G,Name:{"Fn::GetAtt":[yt,`DkimDNSTokenName${Jt}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[yt,`DkimDNSTokenValue${Jt}`]}]}})}let{record:Ct,logicalId:Ft}=f.createSpfRecord(ze,G);this.builder.addResource(Ft,Ct);let{record:Wt,logicalId:Zt}=f.createDmarcRecord(ze,G,{policy:"none",reportingEmail:bt.dmarcReportingEmail||`dmarc-reports@${ze}`});this.builder.addResource(Zt,Wt)}this.builder.addOutput("EmailDomain",{Value:ze,Description:"SES verified email domain"});let ht=bt.server;if(ht?.enabled&&G){let Ct=this.mergedConfig.environments[p]?.region||this.mergedConfig.project.region||"us-east-1",Ft=`${u}-${p}-email`,{role:Wt,policy:Zt,roleLogicalId:Jt,policyLogicalId:Xt}=f.createEmailLambdaRole({slug:u,environment:p,s3BucketArn:`arn:aws:s3:::${Ft}`,sesIdentityArn:`arn:aws:ses:${Ct}:*:identity/${ze}`});this.builder.addResource(Jt,Wt),this.builder.addResource(Xt,Zt);let{function:Er,permission:Yt,logicalId:tr,permissionLogicalId:xr}=f.createInboundEmailLambda({slug:u,environment:p,roleArn:{"Fn::GetAtt":[Jt,"Arn"]},s3BucketName:Ft,organizedPrefix:"mailboxes/"});this.builder.addResource(tr,Er),this.builder.addResource(xr,Yt);let jr=f.createInboundEmailSetup({slug:u,environment:p,domain:ze,s3BucketName:Ft,s3KeyPrefix:"inbox/",region:Ct,hostedZoneId:G,lambdaFunctionArn:{"Fn::GetAtt":[tr,"Arn"]}});for(let[Or,qr]of Object.entries(jr.resources)){if(qr.Type==="AWS::SES::ReceiptRule")qr.DependsOn=[xr,tr];this.builder.addResource(Or,qr)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:tr},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:Ft,Description:"S3 bucket for email storage"});let Vr=this.serverEipLogicalIds.get("app");if(Vr&&G){let qr=`${ht?.subdomain||"mail"}.${ze}`,Bn=qr.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Bn}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:G,Name:qr,Type:"A",TTL:"300",ResourceRecords:[{Ref:Vr}]}})}this.builder.addOutput("MailHost",{Value:`mail.${ze}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let It=this.mergedConfig.infrastructure?.search;if(It){let ze=It.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(ze)this.generateNetworkInfrastructure(u,p);let{domain:j,logicalId:yt}=ur.createDomain({slug:u,environment:p,engineVersion:It.engineVersion||"OpenSearch_2.11",instanceType:It.instanceType||"t3.small.search",instanceCount:It.instanceCount||1,volumeSize:It.volumeSize||10,volumeType:It.volumeType||"gp3",dedicatedMaster:It.dedicatedMaster||!1,dedicatedMasterType:It.dedicatedMasterType,dedicatedMasterCount:It.dedicatedMasterCount||3,multiAz:It.multiAz||!1,encryption:It.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:It.advancedSecurity,autoTune:It.autoTune!==!1,vpc:ze});this.builder.addResource(yt,j),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[yt,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[yt,"Arn"]},Description:"OpenSearch domain ARN"})}let mt=this.mergedConfig.infrastructure?.fileSystem;if(mt&&Object.keys(mt).length>0){this.generateNetworkInfrastructure(u,p);for(let[ze,j]of Object.entries(mt)){let{fileSystem:yt,logicalId:G}=Ze.createFileSystem({slug:`${u}-${ze}`,environment:p,encrypted:j.encrypted!==!1,performanceMode:j.performanceMode||"generalPurpose",throughputMode:j.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(G,yt);let{securityGroup:ht,logicalId:Ct}=Ze.createEfsSecurityGroup({slug:`${u}-${ze}`,environment:p,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Ct,ht);let{mountTargets:Ft,logicalIds:Wt}=Ze.createMultiAzMountTargets(G,{slug:`${u}-${ze}`,environment:p,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Ct}});for(let Zt=0;Zt<Ft.length;Zt++)this.builder.addResource(Wt[Zt],Ft[Zt]);this.builder.addOutput(`${ze}FileSystemId`,{Value:{Ref:G},Description:`EFS file system ID for ${ze}`})}}let Me=this.mergedConfig.infrastructure?.ai;if(Me){let ze=Me.service||"ecs",j=Me.models||["*"],yt=Me.allowStreaming!==!1,G;if(ze==="ecs")G=Oe.enableBedrockForEcs({slug:u,environment:p,models:j,allowStreaming:yt});else if(ze==="ec2")G=Oe.enableBedrockForEc2({slug:u,environment:p,models:j,allowStreaming:yt});else if(ze==="lambda")G=Oe.enableBedrockForLambda({slug:u,environment:p,models:j,allowStreaming:yt});else G=Oe.createBedrockRole(ze,{slug:u,environment:p,models:j,allowStreaming:yt});if(this.builder.addResource(G.logicalId,G.role),Me.allowAsync){let{policy:ht,logicalId:Ct}=Oe.createBedrockPolicy({slug:u,environment:p,models:j,allowStreaming:yt,allowAsync:!0});this.builder.addResource(Ct,ht)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[G.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(u,p){let h=this.mergedConfig.infrastructure?.realtime;if(!h)return;let y=h.name||`${u}-${p}-realtime`,R=h.scaling||{},v=h.storage||{type:"dynamodb"},P=R.handlerMemory||256,L=R.handlerTimeout||30,z=`${u}${p}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),fe=`${u}${p}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(v.type==="dynamodb"){let Wt=v.dynamodb||{},Zt=Wt.billingMode||"PAY_PER_REQUEST";this.builder.addResource(z,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${u}-${p}-realtime-connections`,BillingMode:Zt,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}},...Wt.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${u}-${p}-realtime-connections`},{Key:"Environment",Value:p}]}}),this.builder.addResource(fe,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${u}-${p}-realtime-channels`,BillingMode:Zt,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}},Tags:[{Key:"Name",Value:`${u}-${p}-realtime-channels`},{Key:"Environment",Value:p}]}})}let me=`${u}${p}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(me,{Type:"AWS::IAM::Role",Properties:{RoleName:`${u}-${p}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[z,"Arn"]},{"Fn::Sub":`\${${z}.Arn}/index/*`},{"Fn::GetAtt":[fe,"Arn"]},{"Fn::Sub":`\${${fe}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let bt=`${u}${p}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),It=`${u}${p}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),mt=`${u}${p}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(bt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${u}-${p}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[me,"Arn"]},MemorySize:P,Timeout:L,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:z},CHANNELS_TABLE:{Ref:fe},ENVIRONMENT:p}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[me,z]}),this.builder.addResource(It,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${u}-${p}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[me,"Arn"]},MemorySize:P,Timeout:L,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:z},CHANNELS_TABLE:{Ref:fe},ENVIRONMENT:p}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[me,z,fe]}),this.builder.addResource(mt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${u}-${p}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[me,"Arn"]},MemorySize:P,Timeout:L,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:z},CHANNELS_TABLE:{Ref:fe},ENVIRONMENT:p}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[me,z,fe]});let Me=`${u}${p}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Me,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:y,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:y,Environment:p}}});let ze=`${bt}Permission`,j=`${It}Permission`,yt=`${mt}Permission`;this.builder.addResource(ze,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:bt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Me}}/*/$connect`}}}),this.builder.addResource(j,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:It},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Me}}/*/$disconnect`}}}),this.builder.addResource(yt,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:mt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Me}}/*/$default`}}});let G=`${Me}ConnectInteg`,ht=`${Me}DisconnectInteg`,Ct=`${Me}MessageInteg`;this.builder.addResource(G,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Me},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${bt}.Arn}/invocations`}}}),this.builder.addResource(ht,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Me},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${It}.Arn}/invocations`}}}),this.builder.addResource(Ct,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Me},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${mt}.Arn}/invocations`}}}),this.builder.addResource(`${Me}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Me},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${G}}`}}}),this.builder.addResource(`${Me}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Me},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${ht}}`}}}),this.builder.addResource(`${Me}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Me},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Ct}}`}}});let Ft=`${Me}Stage`;if(this.builder.addResource(Ft,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:Me},StageName:p,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:R.messagesPerSecond||1000,ThrottlingRateLimit:R.messagesPerSecond||1000}}}),h.monitoring?.enabled){let Wt=h.monitoring,Zt=Wt.notificationTopicArn;if(!Zt&&Wt.notificationEmails?.length){let Jt=`${Me}AlarmTopic`;this.builder.addResource(Jt,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${u}-${p}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Wt.notificationEmails.forEach((Xt,Er)=>{this.builder.addResource(`${Jt}Sub${Er}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Jt},Protocol:"email",Endpoint:Xt}})}),Zt={Ref:Jt}}if(Wt.connectionThreshold)this.builder.addResource(`${Me}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Wt.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Wt.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Me}}],...Zt&&{AlarmActions:[Zt]}}});if(Wt.errorThreshold)this.builder.addResource(`${Me}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Wt.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Wt.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Me}}],...Zt&&{AlarmActions:[Zt]}}})}this.builder.addOutput(`${Me}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${Me}}.execute-api.\${AWS::Region}.amazonaws.com/${p}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${Me}Id`,{Description:"WebSocket API ID",Value:{Ref:Me},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
+`:It,ze=R.map(([,Wt])=>Wt.port).filter((Wt)=>typeof Wt==="number"&&![80,443].includes(Wt)),j=this.resolveApiOriginPort(),yt=`${u}${p}DeployBucket`.replace(/[^a-zA-Z0-9]/g,""),G=`${u}-${p}-deploy`;this.builder.addResource(yt,{Type:"AWS::S3::Bucket",Properties:{BucketName:G,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!0,IgnorePublicAcls:!0,RestrictPublicBuckets:!0},LifecycleConfiguration:{Rules:[{Id:"expire-old-releases",Status:"Enabled",ExpirationInDays:7,Prefix:"releases/"}]},Tags:[{Key:"Project",Value:u},{Key:"Environment",Value:p},{Key:"ManagedBy",Value:"ts-cloud"}]}});let ht=a.createServerModeStack({slug:`${u}-app`,environment:p,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},instanceType:me,keyName:h.allowSsh?`${u}-${p}`:void 0,domain:P,userData:Me,volumeSize:h.disk?.size||20,imageId:h.image,allowedPorts:[...h.allowSsh?[22]:[],80,443,j,...ze]}),Ct=ht.resources[ht.outputs.instanceLogicalId];if(Ct?.Properties){let Wt=Ct.Properties.Tags||[];Ct.Properties.Tags=[...Wt,{Key:"Project",Value:u},{Key:"Environment",Value:p},{Key:"Role",Value:"app"},{Key:"ManagedBy",Value:"ts-cloud"}]}let Ft=ht.resources[ht.outputs.roleLogicalId];if(Ft?.Properties)Ft.Properties.Policies=Ft.Properties.Policies||[],Ft.Properties.Policies.push({PolicyName:"DeployBucketRead",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["s3:GetObject","s3:ListBucket"],Resource:[`arn:aws:s3:::${G}`,`arn:aws:s3:::${G}/*`]}]}});for(let[Wt,Zt]of Object.entries(ht.resources))this.builder.addResource(Wt,Zt);this.builder.addOutput("deployBucketName",{Value:{Ref:yt},Description:"S3 bucket where release tarballs are uploaded"}),this.builder.addOutput("appInstanceId",{Value:{Ref:ht.outputs.instanceLogicalId},Description:"EC2 instance ID for the app server"}),this.builder.addOutput("appPublicIp",{Value:{Ref:ht.outputs.eipLogicalId},Description:"Public IP for the app server"}),this.serverEipLogicalIds.set("app",ht.outputs.eipLogicalId),this.serverEipLogicalIds.set("appInstance",ht.outputs.instanceLogicalId)}jumpBoxFileSystemId(u,p,h){let y=Object.keys(this.mergedConfig.infrastructure?.fileSystem??{});if(typeof h==="string")return y.includes(h)?{Ref:this.fileSystemLogicalId(u,p,h)}:h;if(y.length===1)return{Ref:this.fileSystemLogicalId(u,p,y[0])};throw Error(y.length===0?"infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares no file system. Declare one, or set mountEfs to an EFS id.":`infrastructure.jumpBox.mountEfs is true, but infrastructure.fileSystem declares ${y.length} (${y.join(", ")}). Set mountEfs to the name of the one to mount.`)}generateJumpBox(u,p){let h=this.mergedConfig.infrastructure?.jumpBox;if(!h)return;let y=h===!0?{}:h;if(y.enabled===!1)return;this.generateNetworkInfrastructure(u,p);let R=y.size||"micro",P=a.InstanceSize.specs[R]?.instanceType||R||"t3.micro",L=a.createJumpBox({slug:u,environment:p,vpcId:{Ref:"VPC"},subnetId:{Ref:"PublicSubnet1"},keyName:y.keyName,instanceType:P,allowedCidrs:y.allowedCidrs,mountEfs:y.mountEfs?{fileSystemId:this.jumpBoxFileSystemId(u,p,y.mountEfs),mountPath:y.mountPath||"/mnt/efs"}:void 0,databaseTools:y.databaseTools});for(let[z,fe]of Object.entries(L.resources))this.builder.addResource(z,fe);this.builder.addOutput("JumpBoxInstanceId",{Value:{Ref:L.instanceLogicalId},Description:"The ID of the JumpBox EC2 instance (use with SSM Session Manager or SSH)"})}generateSharedInfrastructure(u,p){let h=this.mergedConfig.infrastructure?.ssl,y=this.mergedConfig.infrastructure?.dns,R=y?.domain,v=y?.hostedZoneId,P=[],L,z;if(h?.certificateArn)z=h.certificateArn;else if(h?.enabled&&R&&v){let ze=h.domains||[R],j=ze[0],yt=ze.slice(1).map((Ct)=>{if(Ct.includes(".")&&Ct.endsWith(j))return Ct.replace(`.${j}`,"");return Ct}),{certificate:G,logicalId:ht}=E.createCertificate({domain:j,subdomains:yt,slug:u,environment:p,validationMethod:"DNS",hostedZoneId:v});L=ht,this.builder.addResource(ht,G)}if(this.mergedConfig.infrastructure?.storage){let ze=Object.entries(this.mergedConfig.infrastructure.storage).some(([,G])=>G.website),j;if(ze&&(L||z))j=`${u}${p}CloudFrontOAC`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(j,{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`${u}-${p}-s3-oac`,Description:`OAC for ${u} ${p} S3 website buckets`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}});let yt=Object.entries(this.mergedConfig.infrastructure.storage).map(([G,ht])=>({name:G,config:ht,mountPath:this.normalizeMountPath(ht),rewriteStyle:ht.pathRewriteStyle||"directory",logicalId:this.storageBucketLogicalId(u,p,G)})).filter((G)=>G.name!=="public"&&G.config.website&&G.mountPath);for(let[G,ht]of Object.entries(this.mergedConfig.infrastructure.storage)){let Ct=!!(ht.website&&j),Ft=this.storageBucketName(u,p,G),{bucket:Wt,logicalId:Zt}=xe.createBucket({slug:u,name:G,environment:p,bucketName:Ft,versioning:ht.versioning,encryption:ht.encryption,public:Ct?!1:ht.public}),Jt=this.normalizeMountPath(ht),Xt;if(ht.failover){let Yt=`infrastructure.storage.${G}`;if(!Ct||!R||Jt&&G!=="public")throw Error(`${Yt}.failover needs this bucket to be served by its own CloudFront distribution: a website bucket (website: true), not mounted under the path of another site, with infrastructure.dns.domain set and SSL configured (infrastructure.ssl.certificateArn, or ssl.enabled with dns.hostedZoneId).`);if(Xt=Tm({failover:ht.failover,primaryBucket:Ft,primaryRegion:this.mergedConfig.project.region||"us-east-1",where:Yt}),Xt.replicate&&Wt.Properties){let tr=`${Zt}FailoverReplicationRole`;this.builder.addResource(tr,Rm({primaryBucket:Ft,replicaBucket:Xt.replicaBucket}));let xr=Wt.Properties;xr.VersioningConfiguration={Status:"Enabled"},xr.ReplicationConfiguration=Dm({replicaBucket:Xt.replicaBucket,roleArn:{"Fn::GetAtt":[tr,"Arn"]}})}}if(Ct&&Wt.Properties)Wt.Properties.PublicAccessBlockConfiguration={BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1};if(this.builder.addResource(Zt,Wt),ht.website){let Yt=typeof ht.website==="object"?ht.website:{},tr=xe.enableWebsiteHosting(Wt,Yt.indexDocument||"index.html",Yt.errorDocument);this.builder.addResource(Zt,tr)}let Er=this.normalizeMountPath(ht);if(Ct&&j&&R&&!(Er&&G!=="public")){let Yt=`${u}${p}${G}CDN`.replace(/[^a-zA-Z0-9]/g,""),tr=[];if(ht.aliases&&ht.aliases.length>0)tr.push(...ht.aliases);else if(G==="public"){if(tr.push(R),h?.domains?.includes(`www.${R}`))tr.push(`www.${R}`)}else if(G==="docs")tr.push(`docs.${R}`);else if(G==="blog")tr.push(`blog.${R}`);let xr=typeof ht.website==="object"?ht.website:{},jr=ht.spa===!0,Vr=xr.errorDocument||(jr?"index.html":"404.html"),Or=[];if(jr)Or.push({ErrorCode:403,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:200,ResponsePagePath:"/index.html",ErrorCachingMinTTL:300});else Or.push({ErrorCode:403,ResponseCode:404,ResponsePagePath:`/${Vr}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${Vr}`,ErrorCachingMinTTL:300});let qr=z&&tr.length>0?{AcmCertificateArn:z,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:L&&tr.length>0?{AcmCertificateArn:{Ref:L},SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},Bn=`S3-${u}-${p}-${G}`,Ya=this.mergedConfig.project.region||"us-east-1",Yn;if(!jr)Yn=`${u}${p}${G}UrlRewrite`.replace(/[^a-zA-Z0-9]/g,""),this.builder.addResource(Yn,{Type:"AWS::CloudFront::Function",Properties:{Name:`${u}-${p}-${G}-url-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`URL rewrite for ${u} ${p} ${G} - appends .html to extensionless paths`,Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) { var request = event.request; var uri = request.uri; if (uri.endsWith('/')) { request.uri += 'index.html'; }
+else if (!uri.includes('.')) { request.uri += '.html'; } return request; }`}});let pi=[{Id:Bn,DomainName:{"Fn::Sub":`\${${Zt}}.s3.${Ya}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:j}}],go=[],Tc=[];if(this.shouldRouteStorageBucketToCompute(G,ht)){this.appendComputeAppOrigin(pi,go,Tc,u,p,this.resolveComputeCachePathPatterns(ht.computeRoutes));for(let $r of yt){let Cs=`S3-${u}-${p}-${$r.name}`,Ec=`${u}${p}${$r.name}PathMountRewrite`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Ec,{Type:"AWS::CloudFront::Function",Properties:{Name:`${u}-${p}-${$r.name}-path-mount-rewrite`,AutoPublish:!0,FunctionConfig:{Comment:`Path mount rewrite for ${u} ${p} ${$r.name} at ${$r.mountPath}`,Runtime:"cloudfront-js-2.0"},FunctionCode:this.pathMountRewriteFunctionCode($r.mountPath,$r.rewriteStyle)}}),pi.push({Id:Cs,DomainName:{"Fn::Sub":`\${${$r.logicalId}}.s3.${Ya}.amazonaws.com`},OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:j}}),Tc.push($r.logicalId,Ec);for(let gp of[$r.mountPath,`${$r.mountPath}/*`])go.push({PathPattern:gp,TargetOriginId:Cs,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"4135ea2d-6df8-44a3-9df3-4b5a84be39ad",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Ec,"FunctionARN"]}}]})}}let fo,Xc=Bn;if(Xt){let $r=`${Bn}-failover`;Object.assign(pi[0],Xt.primaryConnection),pi.push({Id:$r,DomainName:wm(Xt.replicaBucket,Xt.replicaRegion),OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{Ref:j}}),fo=ln({primaryOriginId:Bn,secondaryOriginId:$r,statusCodes:Xt.statusCodes}),Xc=fo.Items[0].Id}let $c={Type:"AWS::CloudFront::Distribution",DependsOn:[Zt,j,...Yn?[Yn]:[],...Tc],Properties:{DistributionConfig:{Enabled:!0,Comment:`${u} ${p} ${G} site`,DefaultRootObject:"index.html",Origins:pi,...fo?{OriginGroups:fo}:{},DefaultCacheBehavior:{TargetOriginId:Xc,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD","OPTIONS"],CachedMethods:["GET","HEAD","OPTIONS"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",...Yn?{FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":[Yn,"FunctionARN"]}}]}:{}},...go.length>0?{CacheBehaviors:go}:{},...tr.length>0?{Aliases:tr}:{},ViewerCertificate:qr,PriceClass:"PriceClass_100",HttpVersion:"http2and3",IPV6Enabled:!0,CustomErrorResponses:Or}}};if(L)$c.DependsOn.push(L);if(Xt)Pt($c.Properties.DistributionConfig,`infrastructure.storage.${G}`),this.storageFailoverReplicas.push({name:G,primaryBucket:Ft,primaryRegion:Ya,replicaBucket:Xt.replicaBucket,replicaRegion:Xt.replicaRegion,replicate:Xt.replicate,distributionArnOutput:`${G}CloudFrontDistributionArn`}),this.builder.addOutput(`${G}CloudFrontDistributionArn`,{Value:{"Fn::Sub":`arn:\${AWS::Partition}:cloudfront::\${AWS::AccountId}:distribution/\${${Yt}}`},Description:`CloudFront distribution ARN for ${G} (scopes the bucket policy of the failover replica)`}),this.builder.addOutput(`${G}FailoverBucketName`,{Value:Xt.replicaBucket,Description:`Failover replica bucket for ${G} (${Xt.replicaRegion}), outside this stack`});this.builder.addResource(Yt,$c);let mp=`${Zt}CloudFrontPolicy`;if(this.builder.addResource(mp,{Type:"AWS::S3::BucketPolicy",DependsOn:[Zt,Yt],Properties:{Bucket:{Ref:Zt},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${Zt}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Yt}}`}}}}]}}}),this.shouldRouteStorageBucketToCompute(G,ht))for(let $r of yt){let Cs=`${$r.logicalId}CloudFrontPolicy`;this.builder.addResource(Cs,{Type:"AWS::S3::BucketPolicy",DependsOn:[$r.logicalId,Yt],Properties:{Bucket:{Ref:$r.logicalId},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":`arn:aws:s3:::\${${$r.logicalId}}/*`},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":`arn:aws:cloudfront::\${AWS::AccountId}:distribution/\${${Yt}}`}}}}]}}})}if(tr.length>0)P.push({name:G,bucketLogicalId:Zt,distLogicalId:Yt,oacLogicalId:j,aliases:tr});this.builder.addOutput(`${G}CloudFrontDomain`,{Value:{"Fn::GetAtt":[Yt,"DomainName"]},Description:`CloudFront domain for ${G}`}),this.builder.addOutput(`${G}CloudFrontDistributionId`,{Value:{Ref:Yt},Description:`CloudFront distribution ID for ${G}`})}if(this.builder.addOutput(`${G}BucketName`,{Value:{Ref:Zt},Description:`S3 bucket name for ${G}`}),G==="public")this.builder.addOutput("FrontendBucketName",{Value:{Ref:Zt},Description:"Frontend S3 bucket name"});if(G==="docs")this.builder.addOutput("DocsBucketName",{Value:{Ref:Zt},Description:"Documentation S3 bucket name"});if(G==="blog")this.builder.addOutput("BlogBucketName",{Value:{Ref:Zt},Description:"Blog S3 bucket name"})}}if(this.mergedConfig.infrastructure?.sftp){let ze=this.mergedConfig.infrastructure.sftp,j=pl.create({...ze,storage:this.resolveSftpStorage(ze,u,p)??ze.storage,slug:u,environment:p});for(let[yt,G]of Object.entries(j.resources))this.builder.addResource(yt,G);this.builder.addOutput("SftpServerId",{Value:{Ref:j.serverLogicalId},Description:"AWS Transfer Family SFTP server ID"}),this.builder.addOutput("SftpEndpoint",{Value:{"Fn::Sub":`\${${j.serverLogicalId}}.server.transfer.\${AWS::Region}.amazonaws.com`},Description:"AWS Transfer Family SFTP endpoint"}),this.builder.addOutput("SftpStorageDomain",{Value:j.domain,Description:"Storage backing the SFTP server (EFS or S3)"})}if(v&&P.length>0)for(let{name:ze,distLogicalId:j,aliases:yt}of P)for(let G of yt){let ht=G.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${ht}ARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[j],Properties:{HostedZoneId:v,Name:G,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":[j,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}}),this.builder.addResource(`${ht}AAAARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[j],Properties:{HostedZoneId:v,Name:G,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":[j,"DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}})}if(this.mergedConfig.infrastructure?.databases){for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.databases))if(j.engine==="dynamodb"){let{table:yt,logicalId:G}=lr.createTable({slug:u,environment:p,tableName:`${u}-${p}-${ze}`,partitionKey:j.partitionKey||{name:"id",type:"S"},sortKey:j.sortKey});this.builder.addResource(G,yt)}else if(j.engine==="postgres"){let{dbInstance:yt,logicalId:G}=lr.createPostgres({slug:u,environment:p,dbInstanceIdentifier:`${u}-${p}-${ze}`,masterUsername:j.username||"admin",masterUserPassword:j.password||"changeme123",allocatedStorage:j.storage||20,dbInstanceClass:j.instanceClass||"db.t3.micro"});this.builder.addResource(G,yt)}else if(j.engine==="mysql"){let{dbInstance:yt,logicalId:G}=lr.createMysql({slug:u,environment:p,dbInstanceIdentifier:`${u}-${p}-${ze}`,masterUsername:j.username||"admin",masterUserPassword:j.password||"changeme123",allocatedStorage:j.storage||20,dbInstanceClass:j.instanceClass||"db.t3.micro"});this.builder.addResource(G,yt)}}if(this.mergedConfig.infrastructure?.cdn)for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.cdn)){if(!j.origin)continue;let yt=typeof j.customDomain==="string"?j.customDomain:j.customDomain?.domain||j.domain,G=typeof j.customDomain==="object"?j.customDomain?.certificateArn:j.certificateArn,ht=G||z,Ct=`${u}${p}${ze}CDN`.replace(/[^a-zA-Z0-9]/g,""),Ft=`S3-${u}-${p}-${ze}-cdn`,Wt=[{Id:Ft,DomainName:j.origin,OriginPath:"",S3OriginConfig:{OriginAccessIdentity:""},OriginShield:j.originShield?{Enabled:!0,OriginShieldRegion:j.originShieldRegion||this.mergedConfig.environments[p]?.region||this.mergedConfig.project.region||"us-east-1"}:{Enabled:!1},...ce(j,`infrastructure.cdn.${ze}`)}],Zt=[],Jt=[],Xt=["GET","HEAD","OPTIONS"],Er=Ft,Yt;if(j.failoverOrigin){Dt(Xt,`the default cache behavior of infrastructure.cdn.${ze}`);let Vr=`${Ft}-failover`,Or=typeof j.failoverOrigin==="string"?{domain:j.failoverOrigin}:j.failoverOrigin;if(!Or.domain)throw Error(`infrastructure.cdn.${ze}.failoverOrigin.domain is required`);if(Or.domain===j.origin)throw Error(`infrastructure.cdn.${ze}: failoverOrigin must differ from origin (both are ${j.origin})`);Wt.push({Id:Vr,DomainName:Or.domain,OriginPath:Or.originPath||"",...Ho(Or.domain)?{S3OriginConfig:{OriginAccessIdentity:""}}:{CustomOriginConfig:{HTTPPort:80,HTTPSPort:443,OriginProtocolPolicy:"https-only"}},OriginShield:{Enabled:!1},...ce(Or,`infrastructure.cdn.${ze}.failoverOrigin`)}),Yt=ln({primaryOriginId:Ft,secondaryOriginId:Vr,statusCodes:j.failoverStatusCodes}),Er=Yt.Items[0].Id}else if(j.failoverStatusCodes)throw Error(`infrastructure.cdn.${ze}: failoverStatusCodes needs failoverOrigin to fail over to`);if(j.routeCompute)this.appendComputeAppOrigin(Wt,Zt,Jt,u,p,this.resolveComputeCachePathPatterns(j.computeRoutes));let tr=ht&&yt?{AcmCertificateArn:L&&!G?{Ref:L}:ht,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"}:{CloudFrontDefaultCertificate:!0},xr=[...Jt];if(L&&!G&&yt)xr.push(L);let jr={Type:"AWS::CloudFront::Distribution",...xr.length>0?{DependsOn:xr}:{},Properties:{DistributionConfig:{Enabled:!0,Comment:`${u} ${p} ${ze} CDN`,DefaultRootObject:"index.html",Origins:Wt,...Yt?{OriginGroups:Yt}:{},DefaultCacheBehavior:{TargetOriginId:Er,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:Xt,CachedMethods:["GET","HEAD","OPTIONS"],Compress:j.compress!==!1,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6"},...Zt.length>0?{CacheBehaviors:Zt}:{},...yt&&ht?{Aliases:[yt]}:{},ViewerCertificate:tr,PriceClass:"PriceClass_100",HttpVersion:j.http3?"http2and3":"http2"}}};if(Pt(jr.Properties.DistributionConfig,`infrastructure.cdn.${ze}`),this.builder.addResource(Ct,jr),v&&yt&&ht){let Vr=yt.replace(/\./g,"").replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Vr}CdnARecord`,{Type:"AWS::Route53::RecordSet",DependsOn:[Ct,...L&&!G?[L]:[]],Properties:{HostedZoneId:v,Name:yt,Type:"A",AliasTarget:{HostedZoneId:"Z2FDTNDATAQYW2",DNSName:{"Fn::GetAtt":[Ct,"DomainName"]}}}})}}if(this.mergedConfig.infrastructure?.queues)for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.queues)){if(!this.shouldDeploy(j))continue;let{queue:yt,logicalId:G}=J.createQueue({slug:u,environment:p,name:`${u}-${p}-${ze}`,fifo:j.fifo,visibilityTimeout:j.visibilityTimeout,messageRetentionPeriod:j.messageRetentionPeriod,delaySeconds:j.delaySeconds,maxMessageSize:j.maxMessageSize,receiveMessageWaitTime:j.receiveMessageWaitTime,contentBasedDeduplication:j.contentBasedDeduplication,encrypted:j.encrypted,kmsKeyId:j.kmsKeyId});this.builder.addResource(G,yt);let ht;if(j.deadLetterQueue){let{deadLetterQueue:Ct,updatedSourceQueue:Ft,deadLetterLogicalId:Wt}=J.createDeadLetterQueue(G,{slug:u,environment:p,maxReceiveCount:j.maxReceiveCount});ht=Wt,this.builder.addResource(Wt,Ct);let Jt=this.builder.getResources()[G];if(Jt?.Properties)Jt.Properties.RedrivePolicy=Ft.Properties?.RedrivePolicy}if(j.trigger){let Ct=j.trigger,Ft=`${u}${p}${Ct.functionName}`.replace(/[^a-zA-Z0-9]/g,""),Wt={Type:"AWS::Lambda::EventSourceMapping",Properties:{EventSourceArn:{"Fn::GetAtt":[G,"Arn"]},FunctionName:{Ref:Ft},BatchSize:Ct.batchSize||10,MaximumBatchingWindowInSeconds:Ct.batchWindow||0,Enabled:!0,...Ct.reportBatchItemFailures!==!1&&{FunctionResponseTypes:["ReportBatchItemFailures"]},...Ct.maxConcurrency&&{ScalingConfig:{MaximumConcurrency:Ct.maxConcurrency}},...Ct.filterPattern&&{FilterCriteria:{Filters:[{Pattern:JSON.stringify(Ct.filterPattern)}]}}},DependsOn:[G,Ft]};this.builder.addResource(`${G}Trigger`,Wt)}if(j.alarms?.enabled){let Ct=j.alarms,Ft=Ct.notificationTopicArn;if(!Ft&&Ct.notificationEmails?.length){let Jt=`${G}AlarmTopic`;this.builder.addResource(Jt,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${u}-${p}-${ze}-alarms`,DisplayName:`${ze} Queue Alarms`}}),Ct.notificationEmails.forEach((Xt,Er)=>{this.builder.addResource(`${Jt}Sub${Er}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Jt},Protocol:"email",Endpoint:Xt}})}),Ft={Ref:Jt}}let Wt=Ct.queueDepthThreshold||1000;this.builder.addResource(`${G}DepthAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-${ze}-queue-depth`,AlarmDescription:`Queue ${ze} depth exceeds ${Wt} messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Average",Period:300,EvaluationPeriods:2,Threshold:Wt,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[G,"QueueName"]}}],...Ft&&{AlarmActions:[Ft],OKActions:[Ft]}}});let Zt=Ct.messageAgeThreshold||3600;if(this.builder.addResource(`${G}AgeAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-${ze}-message-age`,AlarmDescription:`Queue ${ze} oldest message exceeds ${Zt} seconds`,MetricName:"ApproximateAgeOfOldestMessage",Namespace:"AWS/SQS",Statistic:"Maximum",Period:300,EvaluationPeriods:2,Threshold:Zt,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[G,"QueueName"]}}],...Ft&&{AlarmActions:[Ft],OKActions:[Ft]}}}),ht&&Ct.dlqAlarm!==!1)this.builder.addResource(`${ht}Alarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-${ze}-dlq-messages`,AlarmDescription:`Dead letter queue for ${ze} has messages`,MetricName:"ApproximateNumberOfMessagesVisible",Namespace:"AWS/SQS",Statistic:"Sum",Period:300,EvaluationPeriods:1,Threshold:0,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"QueueName",Value:{"Fn::GetAtt":[ht,"QueueName"]}}],...Ft&&{AlarmActions:[Ft]}}})}if(j.subscribe){let Ct=j.subscribe,Ft=Ct.topicArn;if(!Ft&&Ct.topicName)Ft={Ref:Ct.topicName};if(Ft){this.builder.addResource(`${G}SnsPolicy`,{Type:"AWS::SQS::QueuePolicy",Properties:{Queues:[{Ref:G}],PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"sns.amazonaws.com"},Action:"sqs:SendMessage",Resource:{"Fn::GetAtt":[G,"Arn"]},Condition:{ArnEquals:{"aws:SourceArn":Ft}}}]}}});let Wt={TopicArn:Ft,Protocol:"sqs",Endpoint:{"Fn::GetAtt":[G,"Arn"]},RawMessageDelivery:Ct.rawMessageDelivery||!1};if(Ct.filterPolicy)Wt.FilterPolicy=Ct.filterPolicy,Wt.FilterPolicyScope=Ct.filterPolicyScope||"MessageAttributes";this.builder.addResource(`${G}SnsSub`,{Type:"AWS::SNS::Subscription",Properties:Wt,DependsOn:`${G}SnsPolicy`})}}}if(this.mergedConfig.infrastructure?.realtime?.enabled)if((this.mergedConfig.infrastructure.realtime.mode||"serverless")==="server")this.generateRealtimeServerResources(u,p);else this.generateRealtimeResources(u,p);let fe=this.mergedConfig.infrastructure?.redirects;if(fe){let ze=fe.target||this.mergedConfig.infrastructure?.dns?.domain||"",j=fe.protocol||"https";if(fe.domains?.length&&ze)for(let yt of fe.domains){let{bucket:G,bucketPolicy:ht,logicalId:Ct,policyLogicalId:Ft}=Nt.createDomainRedirectBucket({slug:u,environment:p,sourceDomain:yt,targetDomain:ze,protocol:j});this.builder.addResource(Ct,G),this.builder.addResource(Ft,ht)}if(fe.paths&&Object.keys(fe.paths).length>0){let yt=Nt.fromMapping(fe.paths,{statusCode:fe.statusCode||301}),{function:G,logicalId:ht}=Nt.createPathRedirectFunction({slug:u,environment:p,rules:yt});this.builder.addResource(ht,G)}}if(this.mergedConfig.infrastructure?.monitoring?.alarms)for(let[ze,j]of Object.entries(this.mergedConfig.infrastructure.monitoring.alarms)){let{alarm:yt,logicalId:G}=qo.createAlarm({slug:u,environment:p,alarmName:`${u}-${p}-${ze}`,metricName:j.metricName||"Errors",namespace:j.namespace||"AWS/Lambda",threshold:j.threshold||1,comparisonOperator:j.comparisonOperator||"GreaterThanThreshold"});this.builder.addResource(G,yt)}let me=this.mergedConfig.infrastructure?.cache;if(me){let ze=me.type||"redis";if(ze==="redis"){this.generateNetworkInfrastructure(u,p);let j=me.redis||{},{replicationGroup:yt,subnetGroup:G,logicalId:ht,subnetGroupId:Ct}=Vo.createRedis({slug:u,environment:p,nodeType:j.nodeType||me.nodeType||"cache.t3.micro",engineVersion:j.engineVersion||"7.1",port:j.port||6379,numCacheClusters:j.numCacheNodes||2,automaticFailover:j.automaticFailoverEnabled!==!1,atRestEncryption:!0,transitEncryption:!0,snapshotRetentionDays:j.snapshotRetentionLimit||7,snapshotWindow:j.snapshotWindow,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(ht,yt),G&&Ct)this.builder.addResource(Ct,G);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[ht,"PrimaryEndPoint.Address"]},Description:"Redis primary endpoint address"}),this.builder.addOutput("CachePort",{Value:{"Fn::GetAtt":[ht,"PrimaryEndPoint.Port"]},Description:"Redis primary endpoint port"})}else if(ze==="memcached"){this.generateNetworkInfrastructure(u,p);let j=me.elasticache||{},{cluster:yt,subnetGroup:G,logicalId:ht,subnetGroupId:Ct}=Vo.createMemcached({slug:u,environment:p,nodeType:j.nodeType||me.nodeType||"cache.t3.micro",engineVersion:j.engineVersion||"1.6.22",numCacheNodes:j.numCacheNodes||2,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}]});if(this.builder.addResource(ht,yt),G&&Ct)this.builder.addResource(Ct,G);this.builder.addOutput("CacheEndpoint",{Value:{"Fn::GetAtt":[ht,"ConfigurationEndpoint.Address"]},Description:"Memcached configuration endpoint address"})}}let bt=this.mergedConfig.infrastructure?.email;if(bt){let ze=bt.domain||this.mergedConfig.infrastructure?.dns?.domain;if(ze){let{emailIdentity:j,logicalId:yt}=f.verifyDomain({domain:ze,slug:u,environment:p,enableDkim:bt.enableDkim!==!1,dkimKeyLength:bt.dkimKeyLength||"RSA_2048_BIT"});if(this.builder.addResource(yt,j),bt.configurationSet!==!1){let{configurationSet:Ct,logicalId:Ft}=f.createConfigurationSet({slug:u,environment:p});this.builder.addResource(Ft,Ct)}let G=bt.hostedZoneId||this.mergedConfig.infrastructure?.dns?.hostedZoneId;if(G){if(bt.enableDkim!==!1)for(let Jt=1;Jt<=3;Jt++){let Xt=`DkimRecord${Jt}${ze.replace(/\./g,"")}`;this.builder.addResource(Xt,{Type:"AWS::Route53::RecordSet",DependsOn:[yt],Properties:{HostedZoneId:G,Name:{"Fn::GetAtt":[yt,`DkimDNSTokenName${Jt}`]},Type:"CNAME",TTL:1800,ResourceRecords:[{"Fn::GetAtt":[yt,`DkimDNSTokenValue${Jt}`]}]}})}let{record:Ct,logicalId:Ft}=f.createSpfRecord(ze,G);this.builder.addResource(Ft,Ct);let{record:Wt,logicalId:Zt}=f.createDmarcRecord(ze,G,{policy:"none",reportingEmail:bt.dmarcReportingEmail||`dmarc-reports@${ze}`});this.builder.addResource(Zt,Wt)}this.builder.addOutput("EmailDomain",{Value:ze,Description:"SES verified email domain"});let ht=bt.server;if(ht?.enabled&&G){let Ct=this.mergedConfig.environments[p]?.region||this.mergedConfig.project.region||"us-east-1",Ft=`${u}-${p}-email`,{role:Wt,policy:Zt,roleLogicalId:Jt,policyLogicalId:Xt}=f.createEmailLambdaRole({slug:u,environment:p,s3BucketArn:`arn:aws:s3:::${Ft}`,sesIdentityArn:`arn:aws:ses:${Ct}:*:identity/${ze}`});this.builder.addResource(Jt,Wt),this.builder.addResource(Xt,Zt);let{function:Er,permission:Yt,logicalId:tr,permissionLogicalId:xr}=f.createInboundEmailLambda({slug:u,environment:p,roleArn:{"Fn::GetAtt":[Jt,"Arn"]},s3BucketName:Ft,organizedPrefix:"mailboxes/"});this.builder.addResource(tr,Er),this.builder.addResource(xr,Yt);let jr=f.createInboundEmailSetup({slug:u,environment:p,domain:ze,s3BucketName:Ft,s3KeyPrefix:"inbox/",region:Ct,hostedZoneId:G,lambdaFunctionArn:{"Fn::GetAtt":[tr,"Arn"]}});for(let[Or,qr]of Object.entries(jr.resources)){if(qr.Type==="AWS::SES::ReceiptRule")qr.DependsOn=[xr,tr];this.builder.addResource(Or,qr)}this.builder.addOutput("InboundEmailLambda",{Value:{Ref:tr},Description:"Inbound email processing Lambda function"}),this.builder.addOutput("EmailBucket",{Value:Ft,Description:"S3 bucket for email storage"});let Vr=this.serverEipLogicalIds.get("app");if(Vr&&G){let qr=`${ht?.subdomain||"mail"}.${ze}`,Bn=qr.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(`${Bn}ARecord`,{Type:"AWS::Route53::RecordSet",Properties:{HostedZoneId:G,Name:qr,Type:"A",TTL:"300",ResourceRecords:[{Ref:Vr}]}})}this.builder.addOutput("MailHost",{Value:`mail.${ze}`,Description:"Mail server hostname for SMTP/IMAP clients"})}}}let It=this.mergedConfig.infrastructure?.search;if(It){let ze=It.vpc?{subnetIds:[{Ref:"PublicSubnet1"}],securityGroupIds:[]}:void 0;if(ze)this.generateNetworkInfrastructure(u,p);let{domain:j,logicalId:yt}=ur.createDomain({slug:u,environment:p,engineVersion:It.engineVersion||"OpenSearch_2.11",instanceType:It.instanceType||"t3.small.search",instanceCount:It.instanceCount||1,volumeSize:It.volumeSize||10,volumeType:It.volumeType||"gp3",dedicatedMaster:It.dedicatedMaster||!1,dedicatedMasterType:It.dedicatedMasterType,dedicatedMasterCount:It.dedicatedMasterCount||3,multiAz:It.multiAz||!1,encryption:It.encryption||{atRest:!0,nodeToNode:!0},advancedSecurity:It.advancedSecurity,autoTune:It.autoTune!==!1,vpc:ze});this.builder.addResource(yt,j),this.builder.addOutput("SearchDomainEndpoint",{Value:{"Fn::GetAtt":[yt,"DomainEndpoint"]},Description:"OpenSearch domain endpoint"}),this.builder.addOutput("SearchDomainArn",{Value:{"Fn::GetAtt":[yt,"Arn"]},Description:"OpenSearch domain ARN"})}let mt=this.mergedConfig.infrastructure?.fileSystem;if(mt&&Object.keys(mt).length>0){this.generateNetworkInfrastructure(u,p);for(let[ze,j]of Object.entries(mt)){let{fileSystem:yt,logicalId:G}=Ze.createFileSystem({slug:`${u}-${ze}`,environment:p,encrypted:j.encrypted!==!1,performanceMode:j.performanceMode||"generalPurpose",throughputMode:j.throughputMode||"bursting",enableBackup:!0});this.builder.addResource(G,yt);let{securityGroup:ht,logicalId:Ct}=Ze.createEfsSecurityGroup({slug:`${u}-${ze}`,environment:p,vpcId:{Ref:"VPC"},sourceCidrBlocks:["10.0.0.0/16"]});this.builder.addResource(Ct,ht);let{mountTargets:Ft,logicalIds:Wt}=Ze.createMultiAzMountTargets(G,{slug:`${u}-${ze}`,environment:p,subnetIds:[{Ref:"PublicSubnet1"},{Ref:"PublicSubnet2"}],securityGroupId:{Ref:Ct}});for(let Zt=0;Zt<Ft.length;Zt++)this.builder.addResource(Wt[Zt],Ft[Zt]);this.builder.addOutput(`${ze}FileSystemId`,{Value:{Ref:G},Description:`EFS file system ID for ${ze}`})}}let Me=this.mergedConfig.infrastructure?.ai;if(Me){let ze=Me.service||"ecs",j=Me.models||["*"],yt=Me.allowStreaming!==!1,G;if(ze==="ecs")G=Oe.enableBedrockForEcs({slug:u,environment:p,models:j,allowStreaming:yt});else if(ze==="ec2")G=Oe.enableBedrockForEc2({slug:u,environment:p,models:j,allowStreaming:yt});else if(ze==="lambda")G=Oe.enableBedrockForLambda({slug:u,environment:p,models:j,allowStreaming:yt});else G=Oe.createBedrockRole(ze,{slug:u,environment:p,models:j,allowStreaming:yt});if(this.builder.addResource(G.logicalId,G.role),Me.allowAsync){let{policy:ht,logicalId:Ct}=Oe.createBedrockPolicy({slug:u,environment:p,models:j,allowStreaming:yt,allowAsync:!0});this.builder.addResource(Ct,ht)}this.builder.addOutput("BedrockRoleArn",{Value:{"Fn::GetAtt":[G.logicalId,"Arn"]},Description:"IAM role ARN with Bedrock permissions"})}}generateRealtimeResources(u,p){let h=this.mergedConfig.infrastructure?.realtime;if(!h)return;let y=h.name||`${u}-${p}-realtime`,R=h.scaling||{},v=h.storage||{type:"dynamodb"},P=R.handlerMemory||256,L=R.handlerTimeout||30,z=`${u}${p}RealtimeConnections`.replace(/[^a-zA-Z0-9]/g,""),fe=`${u}${p}RealtimeChannels`.replace(/[^a-zA-Z0-9]/g,"");if(v.type==="dynamodb"){let Wt=v.dynamodb||{},Zt=Wt.billingMode||"PAY_PER_REQUEST";this.builder.addResource(z,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${u}-${p}-realtime-connections`,BillingMode:Zt,AttributeDefinitions:[{AttributeName:"connectionId",AttributeType:"S"},{AttributeName:"userId",AttributeType:"S"}],KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],GlobalSecondaryIndexes:[{IndexName:"userId-index",KeySchema:[{AttributeName:"userId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}},...Wt.pointInTimeRecovery&&{PointInTimeRecoverySpecification:{PointInTimeRecoveryEnabled:!0}},Tags:[{Key:"Name",Value:`${u}-${p}-realtime-connections`},{Key:"Environment",Value:p}]}}),this.builder.addResource(fe,{Type:"AWS::DynamoDB::Table",Properties:{TableName:`${u}-${p}-realtime-channels`,BillingMode:Zt,AttributeDefinitions:[{AttributeName:"channel",AttributeType:"S"},{AttributeName:"connectionId",AttributeType:"S"}],KeySchema:[{AttributeName:"channel",KeyType:"HASH"},{AttributeName:"connectionId",KeyType:"RANGE"}],GlobalSecondaryIndexes:[{IndexName:"connectionId-index",KeySchema:[{AttributeName:"connectionId",KeyType:"HASH"}],Projection:{ProjectionType:"ALL"},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}}}],TimeToLiveSpecification:{AttributeName:"ttl",Enabled:!0},...Zt==="PROVISIONED"&&{ProvisionedThroughput:{ReadCapacityUnits:Wt.readCapacity||5,WriteCapacityUnits:Wt.writeCapacity||5}},Tags:[{Key:"Name",Value:`${u}-${p}-realtime-channels`},{Key:"Environment",Value:p}]}})}let me=`${u}${p}RealtimeRole`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(me,{Type:"AWS::IAM::Role",Properties:{RoleName:`${u}-${p}-realtime-handler-role`,AssumeRolePolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]},ManagedPolicyArns:["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],Policies:[{PolicyName:"RealtimeHandlerPolicy",PolicyDocument:{Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["dynamodb:GetItem","dynamodb:PutItem","dynamodb:DeleteItem","dynamodb:Query","dynamodb:Scan","dynamodb:UpdateItem"],Resource:[{"Fn::GetAtt":[z,"Arn"]},{"Fn::Sub":`\${${z}.Arn}/index/*`},{"Fn::GetAtt":[fe,"Arn"]},{"Fn::Sub":`\${${fe}.Arn}/index/*`}]},{Effect:"Allow",Action:"execute-api:ManageConnections",Resource:{"Fn::Sub":"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*"}}]}}]}});let bt=`${u}${p}RealtimeConnect`.replace(/[^a-zA-Z0-9]/g,""),It=`${u}${p}RealtimeDisconnect`.replace(/[^a-zA-Z0-9]/g,""),mt=`${u}${p}RealtimeMessage`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(bt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${u}-${p}-realtime-connect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[me,"Arn"]},MemorySize:P,Timeout:L,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:z},CHANNELS_TABLE:{Ref:fe},ENVIRONMENT:p}},Code:{ZipFile:this.generateConnectHandlerCode()}},DependsOn:[me,z]}),this.builder.addResource(It,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${u}-${p}-realtime-disconnect`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[me,"Arn"]},MemorySize:P,Timeout:L,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:z},CHANNELS_TABLE:{Ref:fe},ENVIRONMENT:p}},Code:{ZipFile:this.generateDisconnectHandlerCode()}},DependsOn:[me,z,fe]}),this.builder.addResource(mt,{Type:"AWS::Lambda::Function",Properties:{FunctionName:`${u}-${p}-realtime-message`,Runtime:"nodejs20.x",Handler:"index.handler",Role:{"Fn::GetAtt":[me,"Arn"]},MemorySize:P,Timeout:L,Environment:{Variables:{CONNECTIONS_TABLE:{Ref:z},CHANNELS_TABLE:{Ref:fe},ENVIRONMENT:p}},Code:{ZipFile:this.generateMessageHandlerCode()}},DependsOn:[me,z,fe]});let Me=`${u}${p}RealtimeApi`.replace(/[^a-zA-Z0-9]/g,"");this.builder.addResource(Me,{Type:"AWS::ApiGatewayV2::Api",Properties:{Name:y,ProtocolType:"WEBSOCKET",RouteSelectionExpression:"$request.body.action",Tags:{Name:y,Environment:p}}});let ze=`${bt}Permission`,j=`${It}Permission`,yt=`${mt}Permission`;this.builder.addResource(ze,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:bt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Me}}/*/$connect`}}}),this.builder.addResource(j,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:It},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Me}}/*/$disconnect`}}}),this.builder.addResource(yt,{Type:"AWS::Lambda::Permission",Properties:{FunctionName:{Ref:mt},Action:"lambda:InvokeFunction",Principal:"apigateway.amazonaws.com",SourceArn:{"Fn::Sub":`arn:aws:execute-api:\${AWS::Region}:\${AWS::AccountId}:\${${Me}}/*/$default`}}});let G=`${Me}ConnectInteg`,ht=`${Me}DisconnectInteg`,Ct=`${Me}MessageInteg`;this.builder.addResource(G,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Me},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${bt}.Arn}/invocations`}}}),this.builder.addResource(ht,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Me},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${It}.Arn}/invocations`}}}),this.builder.addResource(Ct,{Type:"AWS::ApiGatewayV2::Integration",Properties:{ApiId:{Ref:Me},IntegrationType:"AWS_PROXY",IntegrationUri:{"Fn::Sub":`arn:aws:apigateway:\${AWS::Region}:lambda:path/2015-03-31/functions/\${${mt}.Arn}/invocations`}}}),this.builder.addResource(`${Me}ConnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Me},RouteKey:"$connect",AuthorizationType:"NONE",Target:{"Fn::Sub":`integrations/\${${G}}`}}}),this.builder.addResource(`${Me}DisconnectRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Me},RouteKey:"$disconnect",Target:{"Fn::Sub":`integrations/\${${ht}}`}}}),this.builder.addResource(`${Me}DefaultRoute`,{Type:"AWS::ApiGatewayV2::Route",Properties:{ApiId:{Ref:Me},RouteKey:"$default",Target:{"Fn::Sub":`integrations/\${${Ct}}`}}});let Ft=`${Me}Stage`;if(this.builder.addResource(Ft,{Type:"AWS::ApiGatewayV2::Stage",Properties:{ApiId:{Ref:Me},StageName:p,AutoDeploy:!0,DefaultRouteSettings:{ThrottlingBurstLimit:R.messagesPerSecond||1000,ThrottlingRateLimit:R.messagesPerSecond||1000}}}),h.monitoring?.enabled){let Wt=h.monitoring,Zt=Wt.notificationTopicArn;if(!Zt&&Wt.notificationEmails?.length){let Jt=`${Me}AlarmTopic`;this.builder.addResource(Jt,{Type:"AWS::SNS::Topic",Properties:{TopicName:`${u}-${p}-realtime-alarms`,DisplayName:"Realtime WebSocket Alarms"}}),Wt.notificationEmails.forEach((Xt,Er)=>{this.builder.addResource(`${Jt}Sub${Er}`,{Type:"AWS::SNS::Subscription",Properties:{TopicArn:{Ref:Jt},Protocol:"email",Endpoint:Xt}})}),Zt={Ref:Jt}}if(Wt.connectionThreshold)this.builder.addResource(`${Me}ConnectionAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-realtime-connections`,AlarmDescription:`WebSocket connections exceed ${Wt.connectionThreshold}`,MetricName:"ConnectCount",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:300,EvaluationPeriods:2,Threshold:Wt.connectionThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Me}}],...Zt&&{AlarmActions:[Zt]}}});if(Wt.errorThreshold)this.builder.addResource(`${Me}ErrorAlarm`,{Type:"AWS::CloudWatch::Alarm",Properties:{AlarmName:`${u}-${p}-realtime-errors`,AlarmDescription:`WebSocket errors exceed ${Wt.errorThreshold}/min`,MetricName:"ExecutionError",Namespace:"AWS/ApiGateway",Statistic:"Sum",Period:60,EvaluationPeriods:3,Threshold:Wt.errorThreshold,ComparisonOperator:"GreaterThanThreshold",Dimensions:[{Name:"ApiId",Value:{Ref:Me}}],...Zt&&{AlarmActions:[Zt]}}})}this.builder.addOutput(`${Me}Endpoint`,{Description:"WebSocket API endpoint URL",Value:{"Fn::Sub":`wss://\${${Me}}.execute-api.\${AWS::Region}.amazonaws.com/${p}`},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-endpoint"}}}),this.builder.addOutput(`${Me}Id`,{Description:"WebSocket API ID",Value:{Ref:Me},Export:{Name:{"Fn::Sub":"${AWS::StackName}-realtime-api-id"}}})}generateConnectHandlerCode(){return`
 const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
 const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
 
@@ -219,7 +219,7 @@ ${p.loadManagement?.enabled?`
   },
 `:""}
 } satisfies BroadcastConfig
-`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function eg(u){let p=[],h=[];if(!u.AWSTemplateFormatVersion)p.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(u.AWSTemplateFormatVersion!=="2010-09-09")h.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!u.Resources||Object.keys(u.Resources).length===0)p.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[y,R]of Object.entries(u.Resources))tg(y,R,p,h);if(u.Resources){let y=sg(u.Resources);if(y.length>0)p.push({path:"Resources",message:`Circular dependencies detected: ${y.join(" -> ")}`,severity:"error"})}if(u.Parameters)for(let[y,R]of Object.entries(u.Parameters))ng(y,R,p,h);if(u.Outputs)for(let[y,R]of Object.entries(u.Outputs))ig(y,R,p,h);return{valid:p.length===0,errors:p,warnings:h}}function tg(u,p,h,y){if(!p.Type)h.push({path:`Resources.${u}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(u))y.push({path:`Resources.${u}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(p.Type&&!p.Type.startsWith("AWS::")&&!p.Type.startsWith("Custom::"))h.push({path:`Resources.${u}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(p.Properties){for(let[R,v]of Object.entries(p.Properties))if(v===void 0||v===null)y.push({path:`Resources.${u}.Properties.${R}`,message:"Property has undefined or null value",severity:"warning"})}if(p.DependsOn){if(typeof p.DependsOn==="string"){if(p.DependsOn===u)h.push({path:`Resources.${u}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(p.DependsOn)){if(p.DependsOn.includes(u))h.push({path:`Resources.${u}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function ng(u,p,h,y){if(!p.Type)h.push({path:`Parameters.${u}.Type`,message:"Parameter Type is required",severity:"error"});let R=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(p.Type&&!R.includes(p.Type)&&!p.Type.startsWith("AWS::"))y.push({path:`Parameters.${u}.Type`,message:`Uncommon parameter type: ${p.Type}`,severity:"warning"});if(p.NoEcho&&p.Default)y.push({path:`Parameters.${u}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function ig(u,p,h,y){if(!p.Value)h.push({path:`Outputs.${u}.Value`,message:"Output Value is required",severity:"error"})}function sg(u){let p={};for(let[P,L]of Object.entries(u)){if(p[P]=[],L.DependsOn){if(typeof L.DependsOn==="string")p[P].push(L.DependsOn);else if(Array.isArray(L.DependsOn))p[P].push(...L.DependsOn)}let z=Wc(L);p[P].push(...z)}let h=new Set,y=new Set,R=[];function v(P,L){h.add(P),y.add(P),L.push(P);let z=p[P]||[];for(let fe of z)if(!h.has(fe)){if(v(fe,L))return!0}else if(y.has(fe)){let me=L.indexOf(fe);return R.push(...L.slice(me),fe),!0}return L.pop(),y.delete(P),!1}for(let P of Object.keys(p))if(!h.has(P)){if(v(P,[]))return R}return[]}function Wc(u,p=[]){if(typeof u!=="object"||u===null)return p;if(Array.isArray(u)){for(let h of u)Wc(h,p);return p}if(u.Ref&&typeof u.Ref==="string"&&!u.Ref.startsWith("AWS::"))p.push(u.Ref);if(u["Fn::GetAtt"]){let h=u["Fn::GetAtt"];if(Array.isArray(h)&&h.length>0)p.push(h[0])}for(let h of Object.values(u))Wc(h,p);return p}function ug(u){let p=[],h=[],y=new TextEncoder().encode(u).length,R=51200,v=460800;if(y>51200)if(y>460800)p.push({path:"template",message:`Template size (${y} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else h.push({path:"template",message:`Template size (${y} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:p.length===0,errors:p,warnings:h}}function gg(u){let p=[],h=[],y=u.Resources?Object.keys(u.Resources).length:0,R=u.Parameters?Object.keys(u.Parameters).length:0,v=u.Outputs?Object.keys(u.Outputs).length:0;if(y>500)p.push({path:"Resources",message:`Template has ${y} resources, exceeding the limit of 500`,severity:"error"});else if(y>200)h.push({path:"Resources",message:`Template has ${y} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(R>200)p.push({path:"Parameters",message:`Template has ${R} parameters, exceeding the limit of 200`,severity:"error"});if(v>200)p.push({path:"Outputs",message:`Template has ${v} outputs, exceeding the limit of 200`,severity:"error"});return{valid:p.length===0,errors:p,warnings:h}}function cR(u){let{domains:p,email:h,staging:y=!1,challengeType:R="http-01",certPath:v="/etc/letsencrypt/live",autoRenew:P=!0}=u,L=p[0],z=p.map((me)=>`-d ${me}`).join(" "),fe=y?"--staging":"";if(R==="http-01")return bg({domains:p,email:h,staging:y,certPath:v,autoRenew:P,domainFlags:z,stagingFlag:fe,primaryDomain:L});else{let me=u.dnsProvider?.provider||(u.hostedZoneId?"route53":void 0);return Tg({domains:p,email:h,staging:y,certPath:v,autoRenew:P,domainFlags:z,stagingFlag:fe,primaryDomain:L,hostedZoneId:u.hostedZoneId,dnsProvider:u.dnsProvider,dnsProviderType:me})}}function bg(u){let{email:p,certPath:h,autoRenew:y,domainFlags:R,stagingFlag:v,primaryDomain:P}=u;return`
+`}toYAML(){return this.builder.toYAML()}toJSON(){return this.builder.toJSON()}getBuilder(){return this.builder}}function Ep(u){let p=[],h=[];if(!u.AWSTemplateFormatVersion)p.push({path:"AWSTemplateFormatVersion",message:"AWSTemplateFormatVersion is required",severity:"error"});else if(u.AWSTemplateFormatVersion!=="2010-09-09")h.push({path:"AWSTemplateFormatVersion",message:'AWSTemplateFormatVersion should be "2010-09-09"',severity:"warning"});if(!u.Resources||Object.keys(u.Resources).length===0)p.push({path:"Resources",message:"At least one resource is required",severity:"error"});else for(let[y,R]of Object.entries(u.Resources))eg(y,R,p,h);if(u.Resources){let y=ig(u.Resources);if(y.length>0)p.push({path:"Resources",message:`Circular dependencies detected: ${y.join(" -> ")}`,severity:"error"})}if(u.Parameters)for(let[y,R]of Object.entries(u.Parameters))tg(y,R,p,h);if(u.Outputs)for(let[y,R]of Object.entries(u.Outputs))ng(y,R,p,h);return{valid:p.length===0,errors:p,warnings:h}}function eg(u,p,h,y){if(!p.Type)h.push({path:`Resources.${u}.Type`,message:"Resource Type is required",severity:"error"});if(!/^[a-zA-Z0-9]+$/.test(u))y.push({path:`Resources.${u}`,message:"Logical ID should only contain alphanumeric characters",severity:"warning"});if(p.Type&&!p.Type.startsWith("AWS::")&&!p.Type.startsWith("Custom::"))h.push({path:`Resources.${u}.Type`,message:'Resource Type must start with "AWS::" or "Custom::"',severity:"error"});if(p.Properties){for(let[R,v]of Object.entries(p.Properties))if(v===void 0||v===null)y.push({path:`Resources.${u}.Properties.${R}`,message:"Property has undefined or null value",severity:"warning"})}if(p.DependsOn){if(typeof p.DependsOn==="string"){if(p.DependsOn===u)h.push({path:`Resources.${u}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}else if(Array.isArray(p.DependsOn)){if(p.DependsOn.includes(u))h.push({path:`Resources.${u}.DependsOn`,message:"Resource cannot depend on itself",severity:"error"})}}}function tg(u,p,h,y){if(!p.Type)h.push({path:`Parameters.${u}.Type`,message:"Parameter Type is required",severity:"error"});let R=["String","Number","List<Number>","CommaDelimitedList","AWS::SSM::Parameter::Value<String>"];if(p.Type&&!R.includes(p.Type)&&!p.Type.startsWith("AWS::"))y.push({path:`Parameters.${u}.Type`,message:`Uncommon parameter type: ${p.Type}`,severity:"warning"});if(p.NoEcho&&p.Default)y.push({path:`Parameters.${u}`,message:"NoEcho parameters should not have default values",severity:"warning"})}function ng(u,p,h,y){if(!p.Value)h.push({path:`Outputs.${u}.Value`,message:"Output Value is required",severity:"error"})}function ig(u){let p={};for(let[P,L]of Object.entries(u)){if(p[P]=[],L.DependsOn){if(typeof L.DependsOn==="string")p[P].push(L.DependsOn);else if(Array.isArray(L.DependsOn))p[P].push(...L.DependsOn)}let z=Wc(L);p[P].push(...z)}let h=new Set,y=new Set,R=[];function v(P,L){h.add(P),y.add(P),L.push(P);let z=p[P]||[];for(let fe of z)if(!h.has(fe)){if(v(fe,L))return!0}else if(y.has(fe)){let me=L.indexOf(fe);return R.push(...L.slice(me),fe),!0}return L.pop(),y.delete(P),!1}for(let P of Object.keys(p))if(!h.has(P)){if(v(P,[]))return R}return[]}function Wc(u,p=[]){if(typeof u!=="object"||u===null)return p;if(Array.isArray(u)){for(let h of u)Wc(h,p);return p}if(u.Ref&&typeof u.Ref==="string"&&!u.Ref.startsWith("AWS::"))p.push(u.Ref);if(u["Fn::GetAtt"]){let h=u["Fn::GetAtt"];if(Array.isArray(h)&&h.length>0)p.push(h[0])}for(let h of Object.values(u))Wc(h,p);return p}function sg(u){let p=[],h=[],y=new TextEncoder().encode(u).length,R=51200,v=460800;if(y>51200)if(y>460800)p.push({path:"template",message:`Template size (${y} bytes) exceeds maximum allowed size of 460800 bytes`,severity:"error"});else h.push({path:"template",message:`Template size (${y} bytes) exceeds direct upload limit (51200 bytes). You must upload to S3 first.`,severity:"warning"});return{valid:p.length===0,errors:p,warnings:h}}function ug(u){let p=[],h=[],y=u.Resources?Object.keys(u.Resources).length:0,R=u.Parameters?Object.keys(u.Parameters).length:0,v=u.Outputs?Object.keys(u.Outputs).length:0;if(y>500)p.push({path:"Resources",message:`Template has ${y} resources, exceeding the limit of 500`,severity:"error"});else if(y>200)h.push({path:"Resources",message:`Template has ${y} resources. Consider using nested stacks for better organization.`,severity:"warning"});if(R>200)p.push({path:"Parameters",message:`Template has ${R} parameters, exceeding the limit of 200`,severity:"error"});if(v>200)p.push({path:"Outputs",message:`Template has ${v} outputs, exceeding the limit of 200`,severity:"error"});return{valid:p.length===0,errors:p,warnings:h}}function lR(u){let{domains:p,email:h,staging:y=!1,challengeType:R="http-01",certPath:v="/etc/letsencrypt/live",autoRenew:P=!0}=u,L=p[0],z=p.map((me)=>`-d ${me}`).join(" "),fe=y?"--staging":"";if(R==="http-01")return gg({domains:p,email:h,staging:y,certPath:v,autoRenew:P,domainFlags:z,stagingFlag:fe,primaryDomain:L});else{let me=u.dnsProvider?.provider||(u.hostedZoneId?"route53":void 0);return bg({domains:p,email:h,staging:y,certPath:v,autoRenew:P,domainFlags:z,stagingFlag:fe,primaryDomain:L,hostedZoneId:u.hostedZoneId,dnsProvider:u.dnsProvider,dnsProviderType:me})}}function gg(u){let{email:p,certPath:h,autoRenew:y,domainFlags:R,stagingFlag:v,primaryDomain:P}=u;return`
 # ==========================================
 # Let's Encrypt Certificate Setup (HTTP-01)
 # ==========================================
@@ -257,7 +257,7 @@ ${y?Vc(P):"# Auto-renewal disabled"}
 
 # Restart the application
 systemctl start stacks
-`}function Tg(u){let{email:p,certPath:h,autoRenew:y,domainFlags:R,stagingFlag:v,primaryDomain:P,hostedZoneId:L,dnsProvider:z,dnsProviderType:fe}=u;if(fe==="route53"||L){if(!L)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
+`}function bg(u){let{email:p,certPath:h,autoRenew:y,domainFlags:R,stagingFlag:v,primaryDomain:P,hostedZoneId:L,dnsProvider:z,dnsProviderType:fe}=u;if(fe==="route53"||L){if(!L)throw Error("hostedZoneId is required for DNS-01 challenge with Route53");return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via Route53)
 # ==========================================
@@ -289,7 +289,7 @@ else
 fi
 
 ${y?Vc(P):"# Auto-renewal disabled"}
-`}if(!z)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let me=z.provider.toUpperCase(),bt=$g(z);return`
+`}if(!z)throw Error("dnsProvider configuration is required for DNS-01 challenge with external DNS providers");let me=z.provider.toUpperCase(),bt=Tg(z);return`
 # ==========================================
 # Let's Encrypt Certificate Setup (DNS-01 via ${me})
 # ==========================================
@@ -312,7 +312,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${wg(z)}
+${$g(z)}
 
 # Wait for DNS propagation
 echo "Waiting 60 seconds for DNS propagation..."
@@ -331,7 +331,7 @@ DOMAIN="$CERTBOT_DOMAIN"
 VALIDATION="$CERTBOT_VALIDATION"
 RECORD_NAME="_acme-challenge.$DOMAIN"
 
-${Ig(z)}
+${wg(z)}
 CLEANUPHOOK
 
 chmod +x /etc/letsencrypt/hooks/cleanup-hook.sh
@@ -363,7 +363,7 @@ else
 fi
 
 ${y?Vc(P):"# Auto-renewal disabled"}
-`}function $g(u){switch(u.provider){case"porkbun":return`
+`}function Tg(u){switch(u.provider){case"porkbun":return`
 # Porkbun API credentials
 export PORKBUN_API_KEY="${u.apiKey}"
 export PORKBUN_SECRET_KEY="${u.secretKey}"
@@ -374,7 +374,7 @@ export GODADDY_API_SECRET="${u.apiSecret}"
 export GODADDY_ENV="${u.environment||"production"}"
 `;case"route53":return`
 # Route53 uses IAM role credentials
-`;default:return""}}function wg(u){switch(u.provider){case"porkbun":return`
+`;default:return""}}function $g(u){switch(u.provider){case"porkbun":return`
 # Extract root domain (last two parts)
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -418,7 +418,7 @@ curl -s -X PATCH "$API_URL/v1/domains/$ROOT_DOMAIN/records" \\
     "data": "'"$VALIDATION"'",
     "ttl": 600
   }]'
-`;default:return'echo "Unsupported DNS provider"'}}function Ig(u){switch(u.provider){case"porkbun":return`
+`;default:return'echo "Unsupported DNS provider"'}}function wg(u){switch(u.provider){case"porkbun":return`
 # Extract root domain, and the challenge's subdomain the way the auth hook did
 ROOT_DOMAIN=$(echo "$DOMAIN" | awk -F. '{print $(NF-1)"."$NF}')
 SUBDOMAIN="_acme-challenge"
@@ -515,7 +515,7 @@ systemctl enable certbot-renewal.timer
 systemctl start certbot-renewal.timer
 
 echo "Certificate auto-renewal configured"
-`}function lR(u){let{httpPort:p=80,httpsPort:h=443,certPath:y="/etc/ssl/stacks",redirectHttp:R=!0}=u;return`
+`}function uR(u){let{httpPort:p=80,httpsPort:h=443,certPath:y="/etc/ssl/stacks",redirectHttp:R=!0}=u;return`
 // HTTPS Server with Let's Encrypt certificates
 import { existsSync } from 'node:fs'
 
@@ -601,5 +601,5 @@ async function handleRequest(request: Request): Promise<Response> {
   // Implement your request handling here
   return new Response('Hello from Stacks!')
 }
-`}async function vg(u,p,h){let y=`_acme-challenge.${p}`;if(await Lg(u,p,y,h))return;let R=await u.createRecord(p,{name:y,type:"TXT",content:h,ttl:60});if(!R.success)throw Error(`Failed to create DNS challenge record: ${R.message}`)}async function Eg(u,p,h){let y=await u.deleteRecord(p,{name:`_acme-challenge.${p}`,type:"TXT",content:h});if(!y.success)console.warn(`Failed to delete DNS challenge record: ${y.message}`)}async function Lg(u,p,h,y){try{let R=await u.listRecords(p,"TXT"),v=h.replace(/\.$/,"").toLowerCase();return(R.records??[]).some((P)=>P.name.replace(/\.$/,"").toLowerCase()===v&&P.content.replace(/^"|"$/g,"")===y)}catch{return!1}}function td(u){let{hostedZoneId:p,dnsProvider:h,region:y="us-east-1"}=u;if(h)return N(h);if(p)return new ie(y,p);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function uR(u){await vg(td(u),u.domain,u.challengeValue)}async function dR(u){await Eg(td(u),u.domain,u.challengeValue)}function pR(u){try{let{execSync:p}=nt("node:child_process"),h=p(`openssl x509 -checkend 2592000 -noout -in ${u}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as rd,createSign as Fg,generateKeyPairSync as nd}from"node:crypto";var ld={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class _g{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(u){this.directoryUrl=u.staging?ld.staging:ld.production,this.email=u.email,this.accountKey=u.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:u}=nd("ec",{namedCurve:"P-256"});return u.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let u=await fetch(this.directoryUrl);if(!u.ok)throw Error(`Failed to fetch ACME directory: ${u.status}`);return this.directory=await u.json(),this.directory}async getNonce(){if(this.nonce){let y=this.nonce;return this.nonce=null,y}let u=await this.getDirectory(),h=(await fetch(u.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!h)throw Error("Failed to get nonce from ACME server");return h}getJwk(){let u=this.accountKey.split(`
-`).filter((v)=>!v.startsWith("-----")).join(""),p=Buffer.from(u,"base64"),h=p.length-65,y=p.subarray(h+1,h+33),R=p.subarray(h+33,h+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(y),y:this.base64UrlEncode(R)}}getJwkThumbprint(){let u=this.getJwk(),p=JSON.stringify({crv:u.crv,kty:u.kty,x:u.x,y:u.y}),h=rd("sha256").update(p).digest();return this.base64UrlEncode(h)}base64UrlEncode(u){return(typeof u==="string"?Buffer.from(u):u).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(u,p){let h=await this.getNonce(),y=this.getJwk(),R={alg:"ES256",nonce:h,url:u};if(this.accountUrl)R.kid=this.accountUrl;else R.jwk=y;let v=this.base64UrlEncode(JSON.stringify(R)),P=p===""?"":this.base64UrlEncode(JSON.stringify(p)),L=`${v}.${P}`,z=Fg("SHA256");z.update(L);let fe=z.sign(this.accountKey),me=fe.subarray(4,4+fe[3]),bt=4+fe[3]+2,It=fe.subarray(bt,bt+fe[bt-1]),mt=Buffer.alloc(32),Me=Buffer.alloc(32);me.copy(mt,32-me.length),It.copy(Me,32-It.length);let ze=Buffer.concat([mt,Me]);return JSON.stringify({protected:v,payload:P,signature:this.base64UrlEncode(ze)})}async acmeRequest(u,p){let h=await this.signPayload(u,p),y=await fetch(u,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:h}),R=y.headers.get("replay-nonce");if(R)this.nonce=R;let v,P=y.headers.get("content-type");if(P?.includes("application/json")||P?.includes("application/problem+json"))v=await y.json();else v=await y.text();if(!y.ok)throw Error(`ACME request failed: ${JSON.stringify(v)}`);return{body:v,headers:y.headers}}async registerAccount(){let u=await this.getDirectory(),{body:p,headers:h}=await this.acmeRequest(u.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),y=h.get("location");if(!y)throw Error("No account URL returned");return this.accountUrl=y,y}async createOrder(u){if(!this.accountUrl)await this.registerAccount();let p=await this.getDirectory(),{body:h,headers:y}=await this.acmeRequest(p.newOrder,{identifiers:u.map((v)=>({type:"dns",value:v}))}),R=y.get("location");if(!R)throw Error("No order URL returned");return{orderUrl:R,authorizations:h.authorizations,finalize:h.finalize}}async getAuthorization(u){let{body:p}=await this.acmeRequest(u,""),h=p.identifier.value,y=this.getJwkThumbprint(),R=p.challenges.filter((v)=>v.type==="http-01"||v.type==="dns-01").map((v)=>{let P=`${v.token}.${y}`;if(v.type==="http-01")return{type:"http-01",token:v.token,keyAuthorization:P,identifier:`/.well-known/acme-challenge/${v.token}`};else{let L=this.base64UrlEncode(rd("sha256").update(P).digest());return{type:"dns-01",token:v.token,keyAuthorization:P,identifier:`_acme-challenge.${h}`,dnsValue:L}}});return{domain:h,challenges:R}}async respondToChallenge(u){await this.acmeRequest(u,{})}async waitForAuthorization(u,p=30){for(let h=0;h<p;h++){let{body:y}=await this.acmeRequest(u,"");if(y.status==="valid")return;if(y.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(y)}`);await new Promise((R)=>setTimeout(R,2000))}throw Error("Authorization timed out")}generateCsr(u){let{privateKey:p}=nd("rsa",{modulusLength:2048}),h=p.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(u,p),privateKey:h}}createSimpleCsr(u,p){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(u,p){let{csr:h,privateKey:y}=this.generateCsr(p),{body:R}=await this.acmeRequest(u,{csr:this.base64UrlEncode(Buffer.from(h,"base64"))}),v=R.certificate;if(!v)throw Error("Certificate not immediately available - polling not implemented");let L=await(await fetch(v)).text(),z=L.split(/(?=-----BEGIN CERTIFICATE-----)/g),fe=z[0],me=z.slice(1).join("");return{certificate:fe,privateKey:y,chain:me,fullchain:L,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var Hr=(u)=>u===void 0?void 0:u?"on":"off";function zc(u){let p={ssl:u.ssl,always_use_https:Hr(u.alwaysUseHttps),automatic_https_rewrites:Hr(u.automaticHttpsRewrites),min_tls_version:u.minTlsVersion,tls_1_3:Hr(u.tls13),brotli:Hr(u.brotli),http3:Hr(u.http3),"0rtt":Hr(u.zeroRtt),early_hints:Hr(u.earlyHints),browser_cache_ttl:u.browserCacheTtl,always_online:Hr(u.alwaysOnline),websockets:Hr(u.websockets),email_obfuscation:Hr(u.emailObfuscation)};if(u.hsts)p.security_header={strict_transport_security:{enabled:u.hsts.enabled,max_age:u.hsts.maxAge??31536000,include_subdomains:u.hsts.includeSubdomains??!1,preload:u.hsts.preload??!1,nosniff:u.hsts.noSniff??!0}};for(let h of Object.keys(p))if(p[h]===void 0)delete p[h];return{...p,...u.raw??{}}}var wi={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as Mg}from"node:tls";async function Uc(u){let{address:p,serverName:h,port:y=443,timeoutMs:R=5000}=u;return new Promise((v)=>{let P=!1,L=(fe)=>{if(P)return;P=!0;try{z.destroy()}catch{}v(fe)},z=Mg({host:p,port:y,servername:h,rejectUnauthorized:!1,timeout:R});z.once("secureConnect",()=>{if(z.authorized){L({reachable:!0,trusted:!0});return}L({reachable:!0,trusted:!1,reason:z.authorizationError?String(z.authorizationError):"origin certificate is not trusted for this hostname"})}),z.once("timeout",()=>{L({reachable:!1,trusted:!1,reason:`no TLS handshake within ${R}ms`})}),z.once("error",(fe)=>{L({reachable:!1,trusted:!1,reason:fe.message})})})}function Wg(u,p){let h=p.replace(/\.$/,"").toLowerCase();return u.some((y)=>{let R=y.replace(/\.$/,"").toLowerCase();if(R===h)return!0;if(!R.startsWith("*."))return!1;let v=R.slice(2);if(!h.endsWith(`.${v}`))return!1;return!h.slice(0,h.length-v.length-1).includes(".")})}async function Vg(u){let{provider:p,zone:h,hosts:y,ipv4:R,ipv6:v,proxied:P=!0,settings:L=wi,cache:z,originGuard:fe,purge:me=!0,ttl:bt=300,skipOriginProbe:It=!1,skipEdgeCertificateCheck:mt=!1}=u,Me={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(y.length===0)return Me;let ze=[],j=P&&!mt?await p.listEdgeCertificateHosts(h):null;for(let G of y){let ht=P;if(ht&&j&&!Wg(j,G)){ht=!1;let Ft=j.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${j.join(", ")})`;Me.deferredProxy.push({host:G,reason:Ft}),Me.warnings.push(`${G}: publishing DNS-only — ${Ft}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(ht&&!It){let Ft=await Uc({address:R,serverName:G});if(!Ft.trusted){ht=!1;let Wt=Ft.reason||"origin is not serving a trusted certificate";Me.deferredProxy.push({host:G,reason:Wt}),Me.warnings.push(`${G}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Wt}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(ht)ze.push(G);let Ct=[{type:"A",content:R}];if(v&&Xn(G))Ct.push({type:"AAAA",content:v});for(let{type:Ft,content:Wt}of Ct){let Zt=await p.upsertRecord(h,{name:G,type:Ft,content:Wt,ttl:bt,proxied:ht});if(Zt.success)Me.records.push({host:G,type:Ft,content:Wt,proxied:ht});else Me.warnings.push(`${G} ${Ft} → ${Wt} failed: ${Zt.message||"unknown provider error"}`)}}if(ze.length===0){if(P)Me.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return Me}try{let G=zc(L),ht=await p.applyZoneSettings(h,G);Me.settingsChanged=ht.changed;for(let Ct of ht.failed)Me.warnings.push(`zone setting '${Ct.id}' could not be applied: ${Ct.error}`)}catch(G){Me.warnings.push(`zone settings could not be read: ${G instanceof Error?G.message:String(G)}`)}let yt=Pc(ze,z);if(yt.length>0){let G=await p.putManagedPhaseRules(h,"http_request_cache_settings",yt);if(G.success)Me.cacheRules=yt.length;else Me.warnings.push(`cache rules could not be written: ${G.message}`)}if(fe){let G=kc(ze,fe.header,fe.value);if(G.length>0){let ht=await p.putManagedPhaseRules(h,"http_request_late_transform",G);if(ht.success)Me.originGuard=!0;else Me.warnings.push(`origin guard header could not be written: ${ht.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(me){if(Me.purged=await p.purgeCache(h,{hosts:ze}),!Me.purged)Me.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return Me}var zg=(u)=>process.env[u];function ud(u,p){let h=u.replace(/\.$/,"").toLowerCase();if(p){let y=p.replace(/\.$/,"").toLowerCase();if(h===y||h.endsWith(`.${y}`))return y}return h.split(".").slice(-2).join(".")}function Hg(u,p={}){let h=p.env??zg,y=u.infrastructure?.compute?.proxy?.cdn,R=[];if(!y||y.provider!=="cloudflare")return{plan:null,errors:R};if(y.originDomain)R.push(`compute.proxy.cdn.originDomain (${y.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let v=h("CLOUDFLARE_API_TOKEN");if(!v)return R.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:R};let P=u.sites??{},L=y.frontedHosts?.length?[...new Set(y.frontedHosts.map((It)=>It.toLowerCase()))]:mo(P,{autoWww:u.infrastructure?.compute?.proxy?.autoWww!==!1});if(L.length===0)return R.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:R};let z=u.infrastructure?.dns?.domain,fe=new Set(L.map((It)=>ud(It,z)));if(fe.size>1)return R.push(`Fronted hosts span more than one zone (${[...fe].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:R};let me=y.cloudflare??{},bt=y.secret?{header:y.secretHeader??"X-Origin-Verify",value:y.secret}:void 0;return{plan:{zone:[...fe][0],hosts:L,apiToken:v,zoneId:me.zoneId??h("CLOUDFLARE_ZONE_ID"),accountId:me.accountId??h("CLOUDFLARE_ACCOUNT_ID"),proxied:me.proxied!==!1,settings:me.settings??wi,cache:me.cache,originGuard:bt,purge:me.purgeOnDeploy!==!1,skipOriginProbe:me.skipOriginProbe===!0},errors:R}}var Ug=26214400;var Gg=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class dd{name="cloudflare-pages";apiToken;accountId;constructor(u){if(!u.apiToken)throw Error("Cloudflare Pages needs an API token");if(!u.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=u.apiToken,this.accountId=u.accountId}async request(u,p,h){return vs(u,`/accounts/${this.accountId}${p}`,`Bearer ${this.apiToken}`,h)}async getProject(u){try{return await this.request("GET",`/pages/projects/${u}`)}catch(p){if(p instanceof Error&&/\b8000007\b|not found/i.test(p.message))return null;throw p}}async ensureProject(u,p="main"){let h=await this.getProject(u);if(h)return h;return this.request("POST","/pages/projects",{name:u,production_branch:p})}async uploadToken(u){return(await this.request("GET",`/pages/projects/${u}/upload-token`)).jwt}async missingHashes(u,p){let h=await vs("POST","/pages/assets/check-missing",`Bearer ${u}`,{hashes:p});return new Set(h)}async upsertHashes(u,p){await vs("POST","/pages/assets/upsert-hashes",`Bearer ${u}`,{hashes:p})}async uploadBatch(u,p){let h=p.map((y)=>({key:y.hash,value:y.base64,metadata:{contentType:Kg(y.extension)},base64:!0}));await vs("POST","/pages/assets/upload",`Bearer ${u}`,h)}async createDeployment(u,p,h){let y={};for(let v of p)y[v.path]=v.hash;let R=new FormData;if(R.append("manifest",JSON.stringify(y)),h)R.append("branch",h);return this.request("POST",`/pages/projects/${u}/deployments`,R)}async deployDirectory(u){let p=await gd(u.directory);if(p.length===0)throw Error(`No files to deploy in ${u.directory}`);let h=await this.uploadToken(u.project),y=await this.missingHashes(h,p.map((z)=>z.hash)),R=p.filter((z)=>y.has(z.hash)),v=[];for(let z=0;z<R.length;z+=100)v.push(R.slice(z,z+100));let P=0;for(let z=0;z<v.length;z+=4){let fe=v.slice(z,z+4);await Promise.all(fe.map((me)=>this.uploadBatch(h,me))),P+=fe.reduce((me,bt)=>me+bt.length,0),u.onProgress?.(P,R.length)}return await this.upsertHashes(h,p.map((z)=>z.hash)),{deployment:await this.createDeployment(u.project,p,u.branch),total:p.length,uploaded:R.length,uploadedBytes:R.reduce((z,fe)=>z+fe.size,0)}}async listCustomDomains(u){return(await this.request("GET",`/pages/projects/${u}/domains`)).map((h)=>h.name)}async attachCustomDomain(u,p){if((await this.listCustomDomains(u)).includes(p))return!1;return await this.request("POST",`/pages/projects/${u}/domains`,{name:p}),!0}}function jg(u,p){return{type:"CNAME",name:u,value:p.endsWith(".pages.dev")?p:`${p}.pages.dev`,ttl:1,proxied:!0}}async function pd(u,p){let{blake3:h}=await import("./chunk-gj4hj95p.js").then((m)=>NS(m.default,1));return(await h(u+p)).slice(0,32)}async function gd(u){let{readdir:p}=await import("node:fs/promises"),{join:h,relative:y,sep:R}=await import("node:path"),v=[];async function P(L){let z=await p(L,{withFileTypes:!0});for(let fe of z){let me=h(L,fe.name);if(fe.isDirectory()){await P(me);continue}if(!fe.isFile())continue;let bt=`/${y(u,me).split(R).join("/")}`;if(Gg.has(bt))continue;let It=await Bun.file(me).bytes();if(It.byteLength>26214400)throw Error(`${bt} is ${It.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let mt=Buffer.from(It).toString("base64"),Me=fe.name.lastIndexOf("."),ze=Me>0?fe.name.slice(Me+1):"";v.push({path:bt,hash:await pd(mt,ze),base64:mt,extension:ze,size:It.byteLength})}}return await P(u),v.sort((L,z)=>L.path.localeCompare(z.path)),v}function Kg(u){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[u.toLowerCase()]||"application/octet-stream"}async function vs(u,p,h,y){let R={Authorization:h},v;if(y instanceof FormData)v=y;else if(y!==void 0)R["Content-Type"]="application/json",v=JSON.stringify(y);let P=await fetch(`https://api.cloudflare.com/client/v4${p}`,{method:u,headers:R,body:v}),L=await P.text(),z;try{z=JSON.parse(L)}catch{throw Error(`Cloudflare Pages API returned ${P.status} with a non-JSON body: ${L.slice(0,200)}`)}if(!z.success){let fe=(z.errors??[]).map((me)=>`${me.code}: ${me.message}`).join(", ");throw Error(`Cloudflare Pages API error (${P.status}): ${fe||L.slice(0,200)}`)}return z.result}import{createHash as qg}from"node:crypto";var tp="https://api.cloudflare.com/client/v4",rp=10042,Zg=10006,Jg=10059;class Fn extends Error{status;errors;constructor(u,p,h=[]){super(u);this.name="R2ApiError",this.status=p,this.errors=h}hasCode(u){return this.errors.some((p)=>p.code===u)}}class hn extends Fn{accountId;constructor(u,p,h=[]){super(`R2 is not enabled on Cloudflare account ${u}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,p,h);this.name="R2NotEnabledError",this.accountId=u}}class ai{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(u){if(!u.apiToken)throw Error("Cloudflare R2 needs an API token");if(!u.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=u.apiToken,this.accountId=u.accountId,this.fetchImpl=u.fetch??((p,h)=>fetch(p,h))}async requestEnvelope(u,p,h,y={}){let R={Authorization:`Bearer ${this.apiToken}`};if(h!==void 0)R["Content-Type"]="application/json";if(y.jurisdiction&&y.jurisdiction!=="default")R["cf-r2-jurisdiction"]=y.jurisdiction;let v=await this.fetchImpl(`${tp}/accounts/${this.accountId}/r2${p}`,{method:u,headers:R,body:h===void 0?void 0:JSON.stringify(h)}),P=await v.text(),L;try{L=JSON.parse(P)}catch{throw new Fn(`Cloudflare R2 API returned ${v.status} with a non-JSON body: ${P.slice(0,200)}`,v.status)}if(!L.success){let z=L.errors??[];if(z.some((me)=>me.code===rp))throw new hn(this.accountId,v.status,z);let fe=z.map((me)=>`${me.code}: ${me.message}`).join(", ");throw new Fn(`Cloudflare R2 API error (${v.status}) on ${u} ${p}: ${fe||P.slice(0,200)}`,v.status,z)}return L}async request(u,p,h,y){return(await this.requestEnvelope(u,p,h,y)).result}bucketPath(u){return`/buckets/${encodeURIComponent(u)}`}async listBuckets(u={}){let p=[],h;do{let y=new URLSearchParams({per_page:"1000"});if(h)y.set("cursor",h);let R=await this.requestEnvelope("GET",`/buckets?${y}`,void 0,u),v=R.result?.buckets??[];p.push(...v),h=v.length>0?R.result_info?.cursor||void 0:void 0}while(h);return p}async getBucket(u,p={}){try{return await this.request("GET",this.bucketPath(u),void 0,p)}catch(h){if(h instanceof hn)throw h;if(h instanceof Fn&&(h.hasCode(Zg)||h.status===404))return null;throw h}}async ensureBucket(u,p={}){let h={jurisdiction:p.jurisdiction},y=await this.getBucket(u,h);if(y)return{bucket:y,created:!1};let R={name:u};if(p.locationHint)R.locationHint=p.locationHint;let v=await this.request("POST","/buckets",R,h);return{bucket:{...v,name:v?.name||u},created:!0}}async getCors(u,p={}){try{return(await this.request("GET",`${this.bucketPath(u)}/cors`,void 0,p))?.rules??[]}catch(h){if(h instanceof Fn&&!(h instanceof hn)&&(h.hasCode(Jg)||h.status===404))return[];throw h}}async putCors(u,p,h={}){if(p.length===0){await this.request("DELETE",`${this.bucketPath(u)}/cors`,void 0,h);return}await this.request("PUT",`${this.bucketPath(u)}/cors`,{rules:p},h)}async ensureCors(u,p,h={}){let y=await this.getCors(u,h);if(xs(y,p))return!1;return await this.putCors(u,p,h),!0}async getLifecycle(u,p={}){return(await this.request("GET",`${this.bucketPath(u)}/lifecycle`,void 0,p))?.rules??[]}async putLifecycle(u,p,h={}){await this.request("PUT",`${this.bucketPath(u)}/lifecycle`,{rules:p},h)}async ensureLifecycle(u,p,h={}){let y=await this.getLifecycle(u,h);if(Fs(y,p))return!1;return await this.putLifecycle(u,p,h),!0}async listCustomDomains(u,p={}){return(await this.request("GET",`${this.bucketPath(u)}/domains/custom`,void 0,p))?.domains??[]}async attachCustomDomain(u,p,h={}){return this.request("POST",`${this.bucketPath(u)}/domains/custom`,{domain:p.domain,zoneId:p.zoneId,enabled:p.enabled??!0,minTLS:p.minTLS??"1.2"},h)}async updateCustomDomain(u,p,h,y={}){return this.request("PUT",`${this.bucketPath(u)}/domains/custom/${encodeURIComponent(p)}`,h,y)}async ensureCustomDomain(u,p,h={},y){let R=p.minTLS??"1.2",P=(y??await this.listCustomDomains(u,h)).find((fe)=>fe.domain.toLowerCase()===p.domain.toLowerCase());if(!P){let fe=await this.attachCustomDomain(u,{...p,minTLS:R,enabled:!0},h);return{action:"attached",domain:{...fe,domain:fe?.domain||p.domain}}}let L=P.minTLS??"1.0";if(P.enabled&&L===R)return{action:"unchanged",domain:P};let z=await this.updateCustomDomain(u,P.domain,{enabled:!0,minTLS:R},h);return{action:"updated",domain:{...P,...z}}}async getManagedDomain(u,p={}){return this.request("GET",`${this.bucketPath(u)}/domains/managed`,void 0,p)}async setManagedDomain(u,p,h={}){let y=await this.getManagedDomain(u,h);if(y?.enabled===p)return{changed:!1,domain:y};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(u)}/domains/managed`,{enabled:p},h)}}}function np(u){return`https://${u}.r2.cloudflarestorage.com`}async function Yg(u){let{apiToken:p,accountId:h}=u;if(!p)throw Error("r2S3Credentials needs an API token");if(!h)throw Error("r2S3Credentials needs an account id");let y=u.fetch??((P,L)=>fetch(P,L)),R=[],v;for(let P of[`/accounts/${h}/tokens/verify`,"/user/tokens/verify"]){let L=await y(`${tp}${P}`,{method:"GET",headers:{Authorization:`Bearer ${p}`}}),z=await L.json().catch(()=>null);if(L.ok&&z?.success&&z.result?.id){v=z.result.id;break}let fe=z?.errors?.map((me)=>`${me.code}: ${me.message}`).join(", ");R.push(`${P} -> ${L.status}${fe?` (${fe})`:""}`)}if(!v)throw Error(`Could not verify the Cloudflare API token to derive R2 credentials: ${R.join("; ")}`);return{accessKeyId:v,secretAccessKey:qg("sha256").update(p).digest("hex"),endpoint:np(h),region:"auto"}}function Ni(u){if(Array.isArray(u))return`[${u.map(Ni).join(",")}]`;if(u&&typeof u==="object")return`{${Object.entries(u).filter(([,h])=>h!==void 0).sort(([h],[y])=>h.localeCompare(y)).map(([h,y])=>`${JSON.stringify(h)}:${Ni(y)}`).join(",")}}`;return JSON.stringify(u)}function ep(u,p){let h=(y)=>y&&y.length>0?[...y].map(String).sort():void 0;return{id:p?u.id:void 0,allowed:{origins:h(u.allowed?.origins),methods:h(u.allowed?.methods?.map((y)=>y.toUpperCase())),headers:h(u.allowed?.headers?.map((y)=>y.toLowerCase()))},exposeHeaders:h(u.exposeHeaders?.map((y)=>y.toLowerCase())),maxAgeSeconds:u.maxAgeSeconds}}function xs(u,p){if(u.length!==p.length)return!1;return p.every((h,y)=>{let R=h.id!==void 0;return Ni(ep(u[y],R))===Ni(ep(h,R))})}function Fs(u,p){if(u.length!==p.length)return!1;let h=(y)=>Ni([...y].map((R)=>({...R,storageClassTransitions:R.storageClassTransitions?.length?R.storageClassTransitions:void 0})).sort((R,v)=>R.id.localeCompare(v.id)));return h(u)===h(p)}var Xg="r2 cache",Qg=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function fh(u,p={}){let h=p.log??(()=>{}),y={buckets:[],warnings:[]},R=u.infrastructure?.r2??u.r2,v=Object.entries(R?.buckets??{});if(v.length===0)return h("R2: no buckets declared, skipping."),y;if(!p.apiToken||!p.accountId){let me=[!p.apiToken&&"CLOUDFLARE_API_TOKEN",!p.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),bt=`R2: ${v.length} bucket(s) declared but ${me} is not set, skipping.`;return h(bt),y.warnings.push(bt),y}let P=p.dryRun===!0,L=new ai({apiToken:p.apiToken,accountId:p.accountId,fetch:p.fetch}),z=new H(p.apiToken,{zoneId:p.zoneId,accountId:p.accountId}),fe=new Map;for(let[me,bt]of v){let It=bt?.name;if(!It||!Qg.test(It)){y.warnings.push(`R2: bucket '${me}' has an invalid name '${It??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}h(`R2: ${P?"checking":"reconciling"} bucket ${It}...`);let mt={name:It,changes:[],domains:[]};if(y.buckets.push(mt),await hh(bt,{r2:L,cloudflare:z,dryRun:P,summary:mt,warnings:y.warnings,claimed:fe,log:h}),mt.changes.length===0)h(`R2: ${It} is in sync.`);else for(let Me of mt.changes)h(`R2: ${It}: ${Me}`)}return y}async function hh(u,p){let{r2:h,dryRun:y,summary:R,warnings:v}=p,P=u.name,L={jurisdiction:u.jurisdiction},z=(mt,Me)=>{let ze=y?Me&&`would ${Me}`:mt;if(ze)R.changes.push(ze)},fe;if(y)fe=await h.getBucket(P,L)!==null;else{let{created:mt}=await h.ensureBucket(P,{locationHint:u.locationHint,jurisdiction:u.jurisdiction});if(fe=!0,mt)z("created","")}if(!fe)z("","create bucket");let me=Sh(u.customDomains);await ro(p,`cors on ${P}`,async()=>{if(!u.cors)return;if(!fe){z("cors updated","set cors");return}let mt=await h.getCors(P,L);if(xs(mt,u.cors))return;if(!y)await h.putCors(P,u.cors,L);z(u.cors.length===0?"cors removed":"cors updated",u.cors.length===0?"remove cors":"update cors")}),await ro(p,`lifecycle on ${P}`,async()=>{if(!u.lifecycle)return;let mt=u.lifecycle.map(ap);if(fe){let Me=await h.getLifecycle(P,L);if(Fs(Me,mt))return}if(!y)await h.putLifecycle(P,mt,L);z("lifecycle updated","update lifecycle")}),await ro(p,`r2.dev URL on ${P}`,async()=>{let mt=u.publicDevUrl===!0;if(!fe){if(mt)z("r2.dev URL enabled","enable r2.dev URL");return}if((await h.getManagedDomain(P,L))?.enabled===mt)return;if(!y)await h.setManagedDomain(P,mt,L);z(mt?"r2.dev URL enabled":"r2.dev URL disabled",mt?"enable r2.dev URL":"disable r2.dev URL")});let bt=[];if(me.length>0&&fe)try{bt=await h.listCustomDomains(P,L)}catch(mt){if(mt instanceof hn)throw mt;v.push(`R2: could not list custom domains on ${P}: ${Kc(mt)}`)}let It=new Map;for(let{domain:mt,minTLS:Me}of me){let ze=p.claimed.get(mt);if(ze&&ze!==P){v.push(`R2: ${mt} is declared on both ${ze} and ${P}; leaving it on ${ze}.`);continue}p.claimed.set(mt,P);let j=bt.find((G)=>G.domain.toLowerCase()===mt),yt=Me??"1.2";if(j&&j.enabled&&(j.minTLS??"1.0")===yt){if(R.domains.push({domain:mt,status:jc(j)}),j.zoneId)It.set(mt,j.zoneId);continue}await ro(p,`custom domain ${mt} on ${P}`,async()=>{if(j){if(!y)await h.updateCustomDomain(P,j.domain,{enabled:!0,minTLS:yt},L);if(z(`custom domain ${mt} updated`,`update custom domain ${mt}`),R.domains.push({domain:mt,status:jc({...j,enabled:!0})}),j.zoneId)It.set(mt,j.zoneId);return}let G=await p.cloudflare.zoneIdFor(mt);if(It.set(mt,G),!y)await h.ensureCustomDomain(P,{domain:mt,zoneId:G,minTLS:yt},L,bt);z(`custom domain ${mt} attached`,`attach custom domain ${mt}`),R.domains.push({domain:mt,status:y?"not attached":"pending"})},()=>R.domains.push({domain:mt,status:"error"}))}if(u.cache&&me.length>0)await yh(u,me.map((mt)=>mt.domain).filter((mt)=>p.claimed.get(mt)===P),It,p,z)}async function yh(u,p,h,y,R){let v=ip(u.cache);if(!v||p.length===0)return;let P=new Map;for(let L of p){let z=h.get(L);if(!z)try{z=await y.cloudflare.zoneIdFor(L)}catch(fe){y.warnings.push(`R2: could not resolve the zone for ${L}, cache rule skipped: ${Kc(fe)}`);continue}P.set(z,[...P.get(z)??[],L])}for(let L of P.values()){let z={action:"set_cache_settings",description:`${jt} ${Xg}`,expression:`(${qt(L)})`,enabled:!0,action_parameters:v};await ro(y,`cache rule for ${L.join(", ")}`,async()=>{let fe=await y.cloudflare.getPhaseRules(L[0],"http_request_cache_settings");if(sp(fe,z))return;if(!y.dryRun){let me=await y.cloudflare.putManagedPhaseRules(L[0],"http_request_cache_settings",[z]);if(!me.success)throw Error(me.message||"cache rule write failed")}R(`cache rule updated for ${L.join(", ")}`,`update cache rule for ${L.join(", ")}`)})}}function ip(u){if(u.edgeTtl===void 0&&u.browserTtl===void 0)return null;let p={cache:!0};if(u.edgeTtl!==void 0)p.edge_ttl={mode:"override_origin",default:u.edgeTtl};if(u.browserTtl!==void 0)p.browser_ttl={mode:"override_origin",default:u.browserTtl};return p}function sp(u,p){let h=zt(p.expression),y=zn(p.expression),R=(L)=>(L.description||"").startsWith(jt),v=(L)=>L.action===p.action&&L.description===p.description&&(L.enabled??!0)===(p.enabled??!0)&&zn(L.expression)===y&&Ms(L.action_parameters)===Ms(p.action_parameters),P=!1;for(let L of u){if(!R(L))continue;let z=zt(L.expression);if(!h.some((me)=>z.includes(me)))continue;if(v(L)&&h.every((me)=>z.includes(me))&&!P){P=!0;continue}return!1}return P}function ap(u){let p={id:u.id,enabled:u.enabled??!0,conditions:{prefix:u.prefix??""}};if(u.expireAfterDays!==void 0)p.deleteObjectsTransition={condition:{type:"Age",maxAge:Gc(u.expireAfterDays)}};else if(u.expireOn!==void 0)p.deleteObjectsTransition={condition:{type:"Date",date:u.expireOn}};if(u.abortMultipartUploadsAfterDays!==void 0)p.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:Gc(u.abortMultipartUploadsAfterDays)}};if(u.infrequentAccessAfterDays!==void 0)p.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:Gc(u.infrequentAccessAfterDays)}}];return p}function Gc(u){return Math.round(u*86400)}function Sh(u){let p=new Set,h=[];for(let y of u??[]){let R=typeof y==="string"?{domain:y}:y,v=R.domain?.trim().replace(/\.$/,"").toLowerCase();if(!v||p.has(v))continue;p.add(v),h.push({domain:v,minTLS:R.minTLS})}return h}function jc(u){if(!u.enabled)return"disabled";let p=u.status?.ownership,h=u.status?.ssl;if(p==="active"&&h==="active")return"active";for(let y of[p,h])if(y==="error"||y==="blocked"||y==="deactivated")return y;return"pending"}async function ro(u,p,h,y){try{await h()}catch(R){if(R instanceof hn)throw R;u.warnings.push(`R2: ${p} failed: ${Kc(R)}`),y?.()}}function Kc(u){return u instanceof Error?u.message:String(u)}function Ms(u){if(Array.isArray(u))return`[${u.map(Ms).join(",")}]`;if(u&&typeof u==="object")return`{${Object.entries(u).filter(([,h])=>h!==void 0).sort(([h],[y])=>h.localeCompare(y)).map(([h,y])=>`${JSON.stringify(h)}:${Ms(y)}`).join(",")}}`;return JSON.stringify(u)}import{basename as Ih,extname as Dh}from"node:path";import{createHash as Rh}from"node:crypto";var bh="https://api.cloudflare.com/client/v4",$n="TS_CLOUD_CONTENT_HASH",no="2025-09-01",Zc="application/javascript+module",Ah=10007,Th=[1e4,9109];class li extends Error{status;errors;constructor(u,p,h=[]){super(u);this.name="WorkersApiError",this.status=p,this.errors=h}hasCode(u){return this.errors.some((p)=>p.code===u)}}class Bs extends li{permission;constructor(u,p,h,y=[]){super(`The Cloudflare API token is missing the "${u}" permission (${p}). Edit the token in the Cloudflare dashboard (My Profile, API Tokens), add it, then re-run the deploy.`,h,y);this.name="WorkersPermissionError",this.permission=u}}class Zs{name="cloudflare-workers";apiToken;accountId;fetchImpl;constructor(u){if(!u.apiToken)throw Error("Cloudflare Workers needs an API token");if(!u.accountId)throw Error("Cloudflare Workers needs an account id");this.apiToken=u.apiToken,this.accountId=u.accountId,this.fetchImpl=u.fetch??((p,h)=>fetch(p,h))}async request(u,p,h){let y={Authorization:`Bearer ${this.apiToken}`},R;if(h instanceof FormData)R=h;else if(h!==void 0)y["Content-Type"]="application/json",R=JSON.stringify(h);let v=await this.fetchImpl(`${bh}/accounts/${this.accountId}/workers${p}`,{method:u,headers:y,body:R}),P=await v.text(),L;try{L=JSON.parse(P)}catch{throw new li(`Cloudflare Workers API returned ${v.status} with a non-JSON body: ${P.slice(0,200)}`,v.status)}if(!L.success){let z=L.errors??[],fe=z.map((me)=>`${me.code}: ${me.message}`).join(", ");if(Ph(v.status,z))throw new Bs(wh(p),`${u} ${p} -> ${v.status}${fe?`, ${fe}`:""}`,v.status,z);throw new li(`Cloudflare Workers API error (${v.status}) on ${u} ${p}: ${fe||P.slice(0,200)}`,v.status,z)}return L.result}scriptPath(u){return`/scripts/${encodeURIComponent(u)}`}async getSettings(u){try{return await this.request("GET",`${this.scriptPath(u)}/settings`)}catch(p){if(p instanceof Bs)throw p;if(p instanceof li&&(p.hasCode(Ah)||p.status===404))return null;throw p}}async getScript(u){return this.getSettings(u)}async uploadModuleScript(u,p){return this.request("PUT",this.scriptPath(u),lp(p))}async ensureModuleScript(u,p){let h=so(p),y=await this.getSettings(u);if(y&&Ja(y,p,h))return{action:"unchanged",hash:h};return await this.uploadModuleScript(u,up(p,h)),{action:y?"updated":"created",hash:h}}async listCustomDomains(u={}){let p=new URLSearchParams;if(u.service)p.set("service",u.service);if(u.hostname)p.set("hostname",u.hostname);if(u.zoneId)p.set("zone_id",u.zoneId);let h=p.toString(),y=h?`?${h}`:"";return await this.request("GET",`/domains${y}`)??[]}async attachCustomDomain(u,p){let h={hostname:u,service:p.service,environment:p.environment??"production"};if(p.zoneId)h.zone_id=p.zoneId;return this.request("PUT","/domains",h)}async detachCustomDomain(u){await this.request("DELETE",`/domains/${encodeURIComponent(u)}`)}async ensureCustomDomain(u,p,h){let R=(h??await this.listCustomDomains({hostname:u})).find((P)=>P.hostname.toLowerCase()===u.toLowerCase());if(R&&R.service===p.service)return{action:"unchanged",domain:R};if(R)throw Error(`${u} is attached to the Worker '${R.service}'. Detach it there first (Workers & Pages, ${R.service}, Settings, Domains & Routes); ts-cloud does not move it.`);let v=await this.attachCustomDomain(u,p);return{action:"attached",domain:{...v,hostname:v?.hostname||u}}}}function Ph(u,p){if(p.some((h)=>Th.includes(h.code)))return!0;return(u===401||u===403)&&p.length===0}function wh(u){if(u.startsWith("/domains"))return"Workers Routes: Edit (zone, for Workers custom domains) and Workers Scripts: Edit (account)";return"Workers Scripts: Edit (account)"}function lp(u){if(!u.modules.some((y)=>y.name===u.mainModule))throw Error(`Worker main module '${u.mainModule}' is not one of the uploaded modules`);let p={main_module:u.mainModule,bindings:u.bindings??[],compatibility_date:u.compatibilityDate??no,compatibility_flags:u.compatibilityFlags??[],keep_bindings:["secret_text"]},h=new FormData;h.append("metadata",JSON.stringify(p));for(let y of u.modules)h.append(y.name,new Blob([y.content],{type:y.type}),y.name);return h}function so(u){let p={mainModule:u.mainModule,modules:[...u.modules].sort((h,y)=>h.name.localeCompare(y.name)).map((h)=>({name:h.name,type:h.type,sha256:cp(h.content)})),bindings:[...u.bindings??[]].filter((h)=>h.name!==$n).sort((h,y)=>h.name.localeCompare(y.name)),compatibilityDate:u.compatibilityDate??no,compatibilityFlags:[...u.compatibilityFlags??[]].sort()};return cp(qc(p))}function up(u,p=so(u)){return{...u,bindings:[...(u.bindings??[]).filter((h)=>h.name!==$n),{type:"plain_text",name:$n,text:p}]}}function Ja(u,p,h){let y=u.bindings??[],R=y.find((v)=>v.name===$n&&v.type==="plain_text");if(!R||R.text!==h)return!1;return(p.bindings??[]).every((v)=>{let P=y.find((z)=>z.name===v.name);if(!P||P.type!==v.type)return!1;let L=v.type==="r2_bucket"?"bucket_name":v.type==="plain_text"?"text":void 0;return!L||P[L]===v[L]})}function cp(u){return Rh("sha256").update(u).digest("hex")}function qc(u){if(Array.isArray(u))return`[${u.map(qc).join(",")}]`;if(u&&typeof u==="object")return`{${Object.entries(u).filter(([,h])=>h!==void 0).sort(([h],[y])=>h.localeCompare(y)).map(([h,y])=>`${JSON.stringify(h)}:${qc(y)}`).join(",")}}`;return JSON.stringify(u)}async function Jc(u){if(!await Bun.file(u).exists())throw Error(`Worker entry not found: ${u}`);let p;try{p=await Bun.build({entrypoints:[u],target:"browser",format:"esm",minify:!0,external:["cloudflare:*"]})}catch(R){throw Error(`Bundling Worker ${u} failed: ${kh(R)}`)}if(!p.success)throw Error(`Bundling Worker ${u} failed: ${p.logs.map((R)=>String(R.message??R)).join("; ")}`);if(p.outputs.length!==1)throw Error(`Bundling Worker ${u} produced ${p.outputs.length} files (${p.outputs.map((R)=>R.path).join(", ")}); a Worker is uploaded as a single module, so remove the dynamic imports or asset imports that split it.`);let h=p.outputs[0];if(h.kind!=="entry-point")throw Error(`Bundling Worker ${u} produced a ${h.kind} instead of an entry module`);let y=await h.text();return{name:`${Ih(u,Dh(u))}.js`,content:y,type:Zc,size:new TextEncoder().encode(y).byteLength}}function kh(u){if(u instanceof AggregateError&&u.errors.length>0)return u.errors.map((p)=>p instanceof Error?p.message:String(p?.message??p)).join("; ");return u instanceof Error?u.message:String(u)}import{isAbsolute as Oh,resolve as Nh}from"node:path";var xh="https://api.cloudflare.com/client/v4",Lh=/^[a-z0-9][a-z0-9_-]{0,62}$/;async function Fh(u,p={}){let h=p.log??(()=>{}),y={workers:[],warnings:[]},R=Object.entries(u.infrastructure?.workers??u.workers??{});if(R.length===0)return h("Workers: none declared, skipping."),y;if(!p.apiToken||!p.accountId){let L=[!p.apiToken&&"CLOUDFLARE_API_TOKEN",!p.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),z=`Workers: ${R.length} Worker(s) declared but ${L} is not set, skipping.`;return h(z),y.warnings.push(z),y}let v=u.infrastructure?.r2??u.r2,P={workers:new Zs({apiToken:p.apiToken,accountId:p.accountId,fetch:p.fetch}),r2:new ai({apiToken:p.apiToken,accountId:p.accountId,fetch:p.fetch}),cloudflare:new H(p.apiToken,{zoneId:p.zoneId,accountId:p.accountId}),apiToken:p.apiToken,fetch:p.fetch??((L,z)=>fetch(L,z)),projectRoot:p.projectRoot??process.cwd(),dryRun:p.dryRun===!0,warnings:y.warnings,log:h,r2ConfigDomains:zh(v),r2Buckets:v,claimed:new Map};for(let[L,z]of R){let fe=z?.name;if(!fe||!Lh.test(fe)){y.warnings.push(`Workers: '${L}' has an invalid name '${fe??""}' (1-63 chars: lowercase letters, digits, '-' and '_'), skipping.`);continue}if(!z.entry){y.warnings.push(`Workers: ${fe} has no entry, skipping.`);continue}h(`Workers: ${P.dryRun?"checking":"reconciling"} ${fe}...`);let me={name:fe,changes:[],domains:[]};y.workers.push(me),await _h(z,me,P);for(let bt of me.changes)h(`Workers: ${fe}: ${bt}`)}return y}async function _h(u,p,h){let y=u.name,R=Oh(u.entry)?u.entry:Nh(h.projectRoot,u.entry),v;try{v=await Jc(R)}catch(L){throw Error(`Worker ${y}: ${di(L)}`)}p.changes.push(`bundled ${Uh(v.size)}`);let P={mainModule:v.name,modules:[{name:v.name,content:v.content,type:v.type}],bindings:dp(u,h),compatibilityDate:u.compatibilityDate??no,compatibilityFlags:u.compatibilityFlags??[]};if(h.dryRun){let L=await h.workers.getSettings(y);p.changes.push(L&&Ja(L,P,so(P))?"unchanged":"would upload")}else{let{action:L}=await h.workers.ensureModuleScript(y,P);p.changes.push(L==="unchanged"?"unchanged":"uploaded")}for(let L of Hh(u.customDomains))await Mh(y,L,p,h)}async function Mh(u,p,h,y){let R=(mt)=>{h.domains.push({domain:p,status:mt})},v=(mt)=>{y.warnings.push(`Workers: ${mt}`),R("conflict")},P=y.claimed.get(p);if(P&&P!==u){v(`${p} is declared on both ${P} and ${u}; leaving it on ${P}.`);return}y.claimed.set(p,u);let L=y.r2ConfigDomains.get(p);if(L){v(`${p} is also declared as a custom domain of the R2 bucket '${L}' (r2.buckets). A hostname serves either a bucket or a Worker. Remove it from the bucket's customDomains and detach it in the dashboard (R2, ${L}, Settings, Custom Domains) first; to serve the bucket through the Worker, bind it with bindings.r2Buckets instead.`);return}let z=await Bh(y);if(z===null){R("error");return}let fe=z.find((mt)=>mt.hostname.toLowerCase()===p);if(fe?.service===u){R("active");return}if(fe){v(`${p} is attached to the Worker '${fe.service}'. Detach it there first (Workers & Pages, ${fe.service}, Settings, Domains & Routes); it is not moved automatically.`);return}let me=(await Wh(y))?.get(p);if(me){v(`${p} is attached to the R2 bucket '${me}' as a custom domain. Detach it first (R2, ${me}, Settings, Custom Domains, then re-run the deploy); it is not detached automatically. To serve the bucket through the Worker, bind it with bindings.r2Buckets.`);return}let bt;try{bt=await y.cloudflare.zoneIdFor(p)}catch(mt){y.warnings.push(`Workers: could not resolve the zone for ${p}, not attached: ${di(mt)}`),R("error");return}let It=await Vh(y,bt,p);if(It.length>0){let mt=It.map((Me)=>`${Me.type} ${Me.content}`).join(", ");v(`${p} already has a DNS record (${mt}). A Worker custom domain creates its own record, so Cloudflare will not attach over it. Delete the record first (DNS, Records), then re-run the deploy; it is not deleted automatically.`);return}if(y.dryRun){h.changes.push(`would attach custom domain ${p}`),R("not attached");return}try{await y.workers.ensureCustomDomain(p,{service:u,zoneId:bt},z),h.changes.push(`custom domain ${p} attached`),z.push({id:"",hostname:p,service:u,zone_id:bt}),R("pending")}catch(mt){y.warnings.push(`Workers: custom domain ${p} on ${u} failed: ${di(mt)}`),R("error")}}async function Bh(u){if(u.attached!==void 0)return u.attached;try{u.attached=await u.workers.listCustomDomains()}catch(p){u.warnings.push(`Workers: could not list Worker custom domains, none attached: ${di(p)}`),u.attached=null}return u.attached}async function Wh(u){if(u.r2AccountDomains!==void 0)return u.r2AccountDomains;let p=new Map;try{let h=(await u.r2.listBuckets()).map((y)=>({name:y.name}));for(let y of Object.values(u.r2Buckets?.buckets??{}))if(y.jurisdiction&&y.jurisdiction!=="default")h.push({name:y.name,jurisdiction:y.jurisdiction});for(let y of h){let R=await u.r2.listCustomDomains(y.name,{jurisdiction:y.jurisdiction}).catch(()=>[]);for(let v of R)p.set(v.domain.toLowerCase(),y.name)}u.r2AccountDomains=p}catch(h){u.log(`Workers: could not check R2 custom domains (${di(h)}); relying on the DNS check.`),u.r2AccountDomains=null}return u.r2AccountDomains}async function Vh(u,p,h){try{let y=await u.fetch(`${xh}/zones/${p}/dns_records?name=${encodeURIComponent(h)}&per_page=100`,{method:"GET",headers:{Authorization:`Bearer ${u.apiToken}`}}),R=await y.json();if(!R?.success)throw Error(`HTTP ${y.status}`);return(R.result??[]).filter((v)=>v.name?.toLowerCase()===h).map((v)=>({type:v.type??"?",content:v.content??""}))}catch(y){return u.log(`Workers: could not read DNS records for ${h} (${di(y)}); attaching anyway.`),[]}}function dp(u,p){let h=[],y=new Set,R=(P)=>{if(P===$n)return p.warnings.push(`Workers: ${u.name}: binding name ${$n} is reserved for ts-cloud, ignored.`),!1;if(y.has(P))return p.warnings.push(`Workers: ${u.name}: binding ${P} is declared twice; the first one wins.`),!1;return y.add(P),!0},v=new Map;for(let P of Object.values(p.r2Buckets?.buckets??{}))if(P.jurisdiction&&P.jurisdiction!=="default")v.set(P.name,P.jurisdiction);for(let[P,L]of Object.entries(u.bindings?.r2Buckets??{})){if(!R(P))continue;let z=v.get(L);h.push(z?{type:"r2_bucket",name:P,bucket_name:L,jurisdiction:z}:{type:"r2_bucket",name:P,bucket_name:L})}for(let[P,L]of Object.entries(u.bindings?.vars??{}))if(R(P))h.push({type:"plain_text",name:P,text:String(L)});return h}function zh(u){let p=new Map;for(let h of Object.values(u?.buckets??{}))for(let y of h?.customDomains??[]){let R=pp(typeof y==="string"?y:y.domain);if(R)p.set(R,h.name)}return p}function Hh(u){return[...new Set((u??[]).map(pp).filter(Boolean))]}function pp(u){return(u??"").trim().replace(/\.$/,"").toLowerCase()}function Uh(u){if(u<1024)return`${u} B`;if(u<1048576)return`${(u/1024).toFixed(1)} KB`;return`${(u/1024/1024).toFixed(1)} MB`}function di(u){return u instanceof Error?u.message:String(u)}export{Pl as ABTestManager,ye as ACMClient,Br as ACMDnsValidator,ld as ACME_DIRECTORIES,Oe as AI,uu as API_IDEMPOTENCY_TTL_MS,du as API_TOKEN_DEFAULT_TTL_MS,lu as API_TOKEN_MAX_TTL_MS,ms as API_VERSION,Ie as AUTHORIZATION_CAPABILITIES,su as AUTH_ACTION_TOKEN_TTL_MS,ou as AUTH_MFA_CHALLENGE_TTL_MS,au as AUTH_OIDC_TRANSACTION_TTL_MS,it as AUTH_SESSION_ABSOLUTE_TTL_MS,iu as AUTH_SESSION_IDLE_TTL_MS,Cy as AWSAPIError,n as AWSClient,A as AWSCloudFormationClient,I as AWSCloudFrontClient,Tl as AWSConfigManager,WI as AWS_PSEUDO_PARAMETERS,_e as AWS_REGIONS,_g as AcmeClient,nn as AlertEvaluator,Gi as AlertStore,No as AnomalyConfigStore,ml as ApiGateway,i as ApiServiceError,vc as ApplicationAutoScalingClient,un as Arn,_ as AssetHasher,Y as Auth,ds as AuthenticationStore,Ki as AutomationApiService,ls as AutomationIdentityStore,Ba as AwsAuroraDataAdapter,$a as AwsAuroraTransport,tc as AwsDatabaseBackupSource,_r as AwsDriver,xa as AwsElastiCacheDataAdapter,Ma as AwsElastiCacheTransport,Yf as AwsIamCapabilityScanner,oc as AwsInfrastructureBackupSource,Na as AwsRdsDataAdapter,La as AwsRdsTransport,uh as AwsRegionalDriver,cc as AwsSecretsManagerConfigurationBackend,mm as AwsSpendTransport,dc as AwsSsmConfigurationBackend,Ts as BackupCoordinator,El as BackupManager,Za as BackupStore,Rf as BatchProcessingManager,Hn as BedrockClient,Qn as BedrockRuntimeClient,yu as BitbucketSourceAdapter,Dl as BlueGreenManager,Af as BounceComplaintHandler,cf as BuildOptimizationManager,Uu as BunDockerRuntime,hg as BunDockerVolumeRuntime,fg as BunFilesystemArchiveRuntime,Ce as CDN,Jo as CHAIN_HEADER,jt as CLOUDFLARE_MANAGED_RULE_PREFIX,dl as CLOUDFRONT_FAILOVER_STATUS_CODES,_C as COMMON_CROSS_ACCOUNT_ROLES,$n as CONTENT_HASH_BINDING,Ke as CONTROL_PLANE_SCHEMA_VERSION,Vo as Cache,rs as CanaryManager,sf as CertificateManager,xA as CloudBlockVolumeDriver,io as CloudDriverFactory,tt as CloudError,Nm as CloudFormationBuilder,A as CloudFormationClient,I as CloudFrontClient,wl as CloudTrailManager,we as CloudWatchLogsClient,dd as CloudflarePagesProvider,H as CloudflareProvider,Gy as CommandHistory,ee as Communication,Yr as ComposeApplicationService,sr as ComposeApplicationStore,Qt as ComprehendClient,a as Compute,fm as ComputeSpendTransport,zo as ConfigurationError,uc as ConfigurationService,ac as ConfigurationStore,Mn as ConnectClient,_a as ContainerDataAdapter,Ol as ContainerRegistryManager,sc as ControlPlaneBackupSource,Wa as ControlPlaneCleanupDriver,Li as ControlPlaneStore,Do as CounterTracker,Bt as CredentialError,jm as CrossRegionReferenceManager,cy as DASHBOARD_ENTRY,dy as DASHBOARD_PORT_BASE,ly as DASHBOARD_PORT_SPAN,ay as DASHBOARD_STATE_DIR,sa as DEFAULT_ATTACK_MODE_HOURS,no as DEFAULT_COMPATIBILITY_DATE,Yd as DEFAULT_DDOS_THRESHOLDS,Sm as DEFAULT_FAILOVER_STATUS_CODES,xd as DEFAULT_METER_MAPPINGS,Nd as DEFAULT_PRICE_BOOK,mn as DEFAULT_RECURSION_LIMITS,uo as DEFAULT_RPX_CERTS_DIR,te as DEFAULT_SERVICE_LIMITS,rl as DEFAULT_STATE_DIR,Pg as DEFAULT_STATIC_ASSET_EXTENSIONS,ny as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,jA as DEFAULT_TELEMETRY_POLICY,Yp as DEFAULT_THRESHOLDS,DA as DEPLOYMENT_QUEUE_KINDS,Wo as DEPTH_HEADER,tn as DETECTABLE_SIGNALS,_u as DIAGNOSTIC_PRESETS,wf as DLQMonitoringManager,W as DNS,ff as DNSSECManager,ys as DataServiceLifecycle,ka as DataServiceStore,lr as Database,rf as DatabaseUserManager,q as DebugLogger,ry as DependencyGraph,Z as Deployment,by as DeploymentError,vl as DisasterRecoveryManager,Jn as DnsProviderFactory,Sr as DockerDataTransport,va as DockerDiscoveryAdapter,Xr as DockerNamedVolumeDriver,ic as DockerVolumeBackupSource,c as DurableOperationQueue,bo as DurableQueueWorker,Ue as DynamoDBClient,Gr as EC2Client,He as ECRClient,dt as ECSClient,Dr as EFSClient,Ic as ELBv2Client,_A as ENFORCEMENT_ACTIONS,Qi as ENFORCEMENT_DESCRIPTIONS,O as ENFORCEMENT_SEVERITY,wp as ENVIRONMENT_LABEL,xu as EcsRuntimeAdapter,ia as EdgeRateLimiter,ut as ElastiCacheClient,f as Email,bf as EmailAdvanced,yf as EmailAnalyticsManager,jn as EmailClient,Cf as EmailHandlers,If as EmailTemplateManager,Fa as EncryptedDataSecretStore,Ey as ErrorCodes,wr as EventBridgeClient,ch as EventBridgeJobAdapter,lc as ExternalConfigurationBackend,Go as FAILOVER_REPLICA_POLICY_SID,Tf as FIFOQueueManager,Gh as FLY_MACHINES_API,om as FOCUS_VERSION,Al as FileCache,Ze as FileSystem,rc as FilesystemBackupSource,Qa as FleetService,Ua as FleetStore,$s as FlyApiError,fp as FlyClient,e as Fn,Su as GiteaSourceAdapter,hu as GithubSourceAdapter,Au as GitlabSourceAdapter,zm as GlobalResourceManager,Ge as GoDaddyProvider,Rl as GuardDutyManager,Et as HOST_SITES_DIR,Ry as HashCache,Ff as HealthCheckManager,Je as HealthCheckRunner,Ur as HetznerClient,Pe as HetznerDriver,Re as IAMClient,Oc as IPV6_EXCLUDED_HOST_LABELS,af as ImageScanningManager,Ep as InfrastructureGenerator,Id as InvalidOperationTransitionError,kt as JobLoader,dh as JobProviderReconciler,Da as JobService,Pa as JobStore,Tr as KendraClient,$f as LARAVEL_SERVERLESS_BUILD_STEPS,T as LambdaClient,uf as LambdaConcurrencyManager,mf as LambdaDLQManager,gf as LambdaDestinationsManager,df as LambdaLayersManager,Ou as LambdaRuntimeAdapter,pf as LambdaVPCManager,lf as LambdaVersionsManager,xn as LocalEncryptedConfigurationBackend,nc as LogicalDatabaseBackupSource,Nl as LogsManager,lS as MANAGED_NODE_VERSIONS,id as MANAGEMENT_DASHBOARD_SITE,Bm as MANAGEMENT_DASHBOARD_SITE_PREFIX,as as MAX_CONTROL_HOURS,bd as MAX_CONTROL_PLANE_ERROR_BYTES,zp as MAX_CONTROL_PLANE_JSON_BYTES,To as METERS,OA as METER_KEYS,LA as MICRO_CENTS,Zp as MIN_PROJECTION_CONFIDENCE,Og as MTA_STS_PORT,Ka as MaintenanceService,za as MaintenanceStore,le as Messaging,Zm as MetricsManager,ef as MigrationManager,Qm as MockCloudFormation,Gm as MockDynamoDB,Hm as MockS3,qo as Monitoring,Jm as MultiAccountManager,qm as MultiRegionManager,$y as MultiStepProgress,S as Network,Uf as NetworkSecurityManager,Vi as NotificationRouter,Cm as ORIGIN_CONNECTION_ATTEMPTS,Em as ORIGIN_CONNECTION_TIMEOUT,Im as ORIGIN_GROUP_ALLOWED_METHODS,jI as ORIGIN_GROUP_ID_SUFFIX,bm as ORIGIN_GROUP_SELECTION_CRITERIA,bc as OpenSearchClient,vt as OptimisticConcurrencyError,Xm as OrganizationManager,Ug as PAGES_MAX_FILE_BYTES,IS as PHP_DEFAULT_EXCLUDES,uS as PHP_LAYER_EXTENSIONS,Tp as PROJECT_LABEL,pt as PROXIABLE_RECORD_TYPES,D as ParameterStore,tf as PerformanceManager,de as Permissions,Cc as PersonalizeClient,et as Phone,Ef as PhoneAdvanced,Pm as PhoneHandlers,Ga as PlacementService,Ha as PlacementStore,Gn as PollyClient,he as PorkbunProvider,Cn as PreDeployScanner,bl as PreviewEnvironmentManager,Jr as PreviewEnvironmentService,We as PreviewEnvironmentStore,Cl as PreviewNotificationService,Ly as ProgressBar,kl as ProgressiveDeploymentManager,oa as ProtectionControlStore,ty as Pseudo,J as Queue,$i as QueueCancellationError,Df as QueueManagementManager,_I as QueuePresets,Io as QueueTimeoutError,Fn as R2ApiError,hn as R2NotEnabledError,ai as R2Provider,rp as R2_NOT_ENABLED_ERROR_CODE,Jl as RATE_LIMIT_KEY_SEPARATOR,ne as RDSClient,qy as RECOMMENDED_ACCOUNT_STRUCTURES,OC as RECOMMENDED_SCPS,Kf as RELEASE_QUEUE_KINDS,Uy as REPL,Hy as REPLCommandBuilder,Qy as REPLContext,Rp as ROLE_LABEL,Dy as RateLimiter,LI as RealtimePresets,am as RecordingSpendTransport,is as RecursionGuard,Nt as Redirects,Km as RegionPairManager,qa as RegionService,Va as RegionStore,Ye as Registry,Ht as RekognitionClient,xt as ReleaseService,fa as ReleaseStore,lh as RemoteBuildService,Bl as ReplicaManager,Qf as ResourceManagementManager,ae as RetryableOperationError,b as Route53Client,Sc as Route53DomainsClient,ie as Route53Provider,hf as Route53ResolverManager,Ll as Route53RoutingManager,ve as RuntimeOperationService,wa as RuntimeStreamRegistry,ec as S3BackupDestinationAdapter,o as S3Client,V as S3Error,Cu as SECRET_PATTERNS,im as SENSITIVITY_THRESHOLDS,gt as SESClient,X as SMS,lt as SNSClient,pm as SPEND_CYCLE_SECONDS,jd as SPEND_GATE_SETTING,JA as SPEND_LEASE_SETTING,pe as SQSClient,ke as SSH_BOOTSTRAP_VERSION,hi as SSH_PREFLIGHT_SCRIPT,Be as SSMClient,Am as STATE_DIR_ENV_VAR,wi as STATIC_SITE_ZONE_SETTINGS,ul as STORAGE_FAILOVER_METADATA_KEY,Te as STSClient,Vn as SchedulerClient,ur as Search,En as SecretFindingScanner,Yi as Secrets,xl as SecretsManager,re as SecretsManagerClient,nf as SecretsRotationManager,E as Security,mr as SecurityHubManager,bn as SecurityPostureStore,Ot as SecurityScannerRunner,of as SecurityScanningManager,Sf as SenderReputationManager,ah as ServerCronJobAdapter,Oa as ServerDataAdapter,vo as ServerPathVolumeDriver,_l as ServiceMeshManager,pl as Sftp,xo as SignalSource,vf as SmsAdvanced,Vt as SmsClient,km as SmsHandlers,Rc as SmsVoiceClient,ha as SourceConnectionStore,Ar as SourceProviderError,zd as SpendCapError,rn as SpendGate,um as SpendLoopLease,Mo as SpendNotificationRouter,gm as SpendRunner,ar as SpendService,Fi as SpendStore,My as Spinner,Qr as SshDriver,wn as SshFleetDriver,Wm as StackDependencyManager,KI as StacksIntegration,Mf as StaticSiteManager,xe as Storage,zl as StorageAdvancedManager,qn as SupportClient,fr as SyntheticsManager,Qu as SystemFleetSshTransport,St as SystemSshTransport,Ta as SystemdDiscoveryAdapter,Xo as TRACE_HEADER,Fy as TaskList,Rt as TelemetryStore,al as TemplateBuilder,yl as TemplateCache,Gt as TextractClient,Un as TranscribeClient,vr as TranslateClient,mh as TransportDisasterRecoveryDriver,ph as TransportPlatformMaintenanceDriver,Ss as TransportRemoteBuildDriver,Ca as TrivyImageScanner,ma as TsCloudApiError,gu as TsCloudClient,WA as URGENT_SPEND_EVENTS,em as USER_VISIBLE_ACTIONS,ja as UnavailableRegionalDriver,Ae as UnifiedDnsValidator,Ao as UnsupportedSchemaVersionError,Lm as ValidationError,Rr as VoiceClient,Eo as VolumeService,ir as VolumeStore,Zc as WORKER_MODULE_TYPE,li as WorkersApiError,Bs as WorkersPermissionError,Zs as WorkersProvider,oy as Workflow,Ym as XRayManager,eS as abTestManager,pu as activateImmutableRelease,vg as addDns01ChallengeRecord,Dn as addSiteToCloudConfig,Lt as ageSeconds,_d as aggregateDeltas,Vp as allocateSitePorts,Dm as amazonLinuxImageId,sy as amazonLinuxImageParameter,VI as analyzeStackDiff,Hi as anomalyOptionsForSignal,aa as applyControlsToDdos,tu as applyControlsToRateLimits,Vs as applyDeclaredZoneSettings,gi as applyHetznerVolumes,an as applyMitigationFactor,dA as applyPlan,Ks as applyZoneMigration,$l as artifactKey,Dt as assertOriginGroupMethods,us as assertReleaseStrategy,qA as assertSpendAllows,mA as attachConflicts,fA as attachIsViable,pA as attachPreconditions,Ru as attachProvenanceToRelease,Ea as attachSbomToRelease,Tu as attachVulnerabilitySummary,jf as authEncryptionKeyFile,x as authorizeOrganization,sh as authorizeRuntimePath,lC as autocomplete,Ky as awsConfigManager,pg as backupCredentialStatus,jy as backupManager,_b as batch,TE as batchProcessingManager,ga as beginOidcAuthorization,Yy as blueGreenManager,SE as bounceComplaintHandler,Tt as budgetWindow,hc as buildAndPushServerlessImage,DE as buildBunRuntimeLayerZip,bA as buildCertificatePackScript,yA as buildCertificateStateScript,CA as buildCertificateUnpackScript,fl as buildCloudFormationTemplate,Yc as buildCloudInitFirstBoot,Td as buildComposeLogsCommand,xI as buildComposeRuntimeCommand,OI as buildComposeScaleCommand,wd as buildComposeShellCommand,ti as buildComputeStorageInstallScript,Lr as buildComputeStorageSiteScript,Qp as buildDrainSourceScript,eA as buildDrainedSiteScanScript,gl as buildFailoverReplicaPolicyStatement,br as buildFunctionEnv,Up as buildHealthGateScript,ni as buildHostCleanupDeployScript,to as buildHostCleanupInstallScript,ri as buildHostCleanupScript,Oi as buildHostSitePortsScript,Ji as buildMailEnv,ao as buildManagementDashboardArtifact,KS as buildMediaCdnPlan,xg as buildMtaStsPolicy,$h as buildMtaStsServer,RE as buildNodeRuntimeLayerZip,lE as buildOptimizationManager,ll as buildOriginGroup,ln as buildOriginGroups,kc as buildOriginGuardRule,xp as buildPauseWorkersScript,BE as buildPhpRuntimeLayerZip,Rm as buildReplicationConfiguration,wm as buildReplicationRole,$p as buildRestoreScript,B as buildRpxConfig,Ne as buildRpxFragmentRefreshScript,uA as buildSetHostnameScript,si as buildSiteDeployScript,Lp as buildSnapshotScript,Hp as buildSourceStateScript,ci as buildSshArgs,mi as buildSshBootstrapScript,Pc as buildStaticSiteCacheRules,oi as buildStaticSiteDeployScript,Mp as buildTargetStateScript,lp as buildUploadForm,Op as buildWorkersStateScript,Jc as bundleWorker,Pu as bytes,ip as cacheRuleParameters,Zy as canaryManager,Rn as canonicalJson,_t as capabilities,Ir as capacity,Vb as categorizeChanges,aE as certificateManager,IA as certificatesMatch,Tb as checkIAMPermissions,xf as checkInvocation,Rb as checkServiceQuotas,Py as chunk,dR as cleanupDns01Challenge,RS as clearSigningKeyCache,ya as cloneSourceBinding,ky as cloudConfigSchema,op as cloudDrivers,Wy as cloudTrailManager,gd as collectAssets,ta as collectPhpAppEntries,kg as collectServerDnsDomains,Kp as completeComposeVolumeDeletion,pa as completeOidcAuthorization,pb as composePresets,So as composeProjectName,Fl as composeServerlessAppTemplate,YA as compositeSpendTransport,Ut as compressBackup,OS as config,Dc as configOrigins,Mu as connectionGuidance,oS as containerRegistryManager,wA as controlPlaneDatabaseFile,yd as controlPlaneMigrations,tb as createApiBackendPreset,ba as createApiV1Handler,GS as createAsgBuildDriver,mg as createBackupQueueHandlers,SS as createCliHandler,F as createCloudDriver,ed as createCloudFrontPolicy,bb as createCredentialProvider,ub as createDashboardSite,ob as createDataPipelinePreset,Fu as createDataServiceQueueHandlers,Rd as createDeploymentQueueHandlers,N as createDnsProvider,HS as createEcsBuildDriver,Kd as createEnforcementHandlers,$m as createError,hl as createExistingStaticFullStackPreset,Hu as createFleetQueueHandlers,eb as createFullStackAppPreset,Xs as createGoDaddyValidator,NE as createHandlers,AS as createHttpHandler,nb as createJamstackPreset,$u as createJobQueueHandlers,db as createLaravelPreset,ab as createMLApiPreset,Wu as createMaintenanceQueueHandlers,VS as createMediaAccessToken,ib as createMicroservicesPreset,Yb as createMockAWS,XI as createNodeJsServerPreset,YI as createNodeJsServerlessPreset,Ls as createObjectStorageClient,Js as createPorkbunValidator,mb as createPreset,ra as createPresignedUrl,CS as createPresignedUrlAsync,yS as createQueueHandler,sb as createRealtimeAppPreset,Vu as createRegionQueueHandlers,wu as createReleaseProvenance,fu as createReleaseQueueHandlers,US as createRemoteBuildQueueHandlers,Ys as createRoute53Validator,ih as createRuntimeAdapters,Iy as createS3Client,QS as createServerBuildDriver,lb as createServerlessLaravelPreset,ZI as createServerlessNodePreset,Dg as createSmsInfrastructure,ot as createSourceAdapter,JI as createStaticSitePreset,cb as createTraditionalWebAppPreset,Dd as createVolumeQueueHandlers,rb as createWordPressPreset,rt as createZip,yC as crossRegionReferenceManager,On as dashboardActions,oo as dashboardCredentialsFile,Tn as dataServiceCapabilities,sE as databaseUserManager,nu as decodeBase32,Fe as decompressBackup,vh as decryptBackup,ca as defaultConfig,Um as defaultLocalConfig,Yl as defaultRateLimitRules,Nr as delegateZone,Hs as delegateZoneFromConfig,dg as deleteFailoverReplicaBuckets,mc as deleteStaticSite,od as deployAllComputeSites,Xa as deployServerlessApp,lg as deploySite,co as deploySiteRelease,Ps as deployStaticSite,fc as deployStaticSiteFull,_n as deployStaticSiteWithExternalDns,Ln as deployStaticSiteWithExternalDnsFull,Zh as deployToFly,ol as deploymentCoexistenceError,uy as deriveManagementDashboardPort,Gs as describeDelegation,eu as describePosture,qs as describeZoneSettings,oh as desiredJobProviderState,nm as detectAnomalies,ym as detectDeploymentTargets,Nc as detectDnsProvider,Gd as detectLatestAnomaly,Eb as detectMisconfigurations,Kl as detectServiceRegion,Ed as diffCompose,Qb as diffTemplates,Aa as discoverGitRefs,ua as discoverOidcProvider,ku as discoverRuntimeInventory,vE as dlqMonitoringManager,Bc as dnsProviders,AE as dnssecManager,th as dockerWorkloads,Is as documentDigest,jc as domainStatus,zy as drManager,qe as driverStatePath,Nu as ecsWorkloads,nr as effectiveCapabilities,IE as emailAnalyticsManager,CE as emailTemplateManager,cs as encodeBase32,Eh as encryptBackup,Du as ensureDefaultSecurityPolicies,og as ensureFailoverReplicaBuckets,Ei as ensureFirewall,Ri as ensureManagementDashboard,vi as ensureServer,Ci as ensureSshKey,oe as escapeSecLang,$d as evaluateBudget,yi as evaluatePreflight,$o as evaluateTelemetryAlertRules,Lu as eventBridgeScheduleInput,hS as eventToRequest,HA as ewma,Cd as exportCompose,js as exportRoute53Zone,Om as extendPreset,EE as fifoQueueManager,Ob as findChangedFiles,Jp as findMapping,Wp as findPriceEntry,qh as flyDeployOptions,Qc as flyIpType,yp as flyMachineConfig,FC as formatAccountStructure,hA as formatAttachPlan,rC as formatBytes,sn as formatCents,qI as formatDiff,rA as formatDrainedSiteRefusal,nC as formatDuration,gC as formatFlagSuggestions,fC as formatHistory,hC as formatHistoryStats,oA as formatInventory,sC as formatKeyValue,iC as formatList,cA as formatPlan,Ii as formatPreflightFindings,tC as formatProgressBar,Vy as formatRegion,kC as formatRegionList,Xf as formatScanResults,oC as formatSuggestion,Zb as formatTable,en as formatTimeToExhaustion,eC as formatTree,hy as fromEC2Metadata,Ay as fromECSMetadata,my as fromEnvironment,fy as fromSharedCredentials,yy as fromWebIdentity,Hl as functionFingerprint,mo as gatewayHostnames,Ql as generateAppImageDockerfile,ZC as generateApprovalConfig,Pf as generateBootstrap,xy as generateCleanupWorkflow,Oy as generateCostReportWorkflow,$C as generateCrossAccountRoleCF,Eu as generateCycloneDxSbom,JC as generateDeploymentConfig,qC as generateDeploymentPipeline,UC as generateDeploymentWorkflow,pc as generateExternalDnsStaticSiteTemplate,lR as generateHttpsServerCode,vu as generateImageSbom,cR as generateLetsEncryptUserData,t as generateLogicalId,WC as generateManualPipeline,VC as generateMatrixWorkflow,XC as generateMultiEnvConfig,jC as generateMultiEnvPipeline,QC as generateMultiEnvWorkflow,HC as generatePRPreviewWorkflow,eE as generateParallelConfig,Lf as generatePhpFpmConfig,kf as generatePhpLayerDockerfile,zC as generatePreviewPipeline,By as generatePreviewWorkflow,r as generateResourceName,YC as generateScheduledConfig,KC as generateScheduledPipeline,GC as generateScheduledWorkflow,Ds as generateStaticSiteTemplate,M as generateUbuntuAppCloudInit,_m as getAccountId,CC as getAllRegions,RC as getClosestRegion,pC as getCommandUsage,RA as getComposeTemplate,Gf as getConfig,cC as getContextualHelp,es as getCredentials,qb as getDeploymentStrategy,jb as getDiffStats,Hb as getDiffSummary,vy as getErrorDetails,Il as getLocalConfig,Jb as getLocalCredentials,Wb as getLocalEndpoint,Xb as getLocalEnvVars,Db as getQuotaUsageSummary,LC as getRecommendedStructure,ts as getRegion,NC as getRegionStats,vC as getRegionsByCompliance,EC as getRegionsByLocation,TC as getRegionsByPricingTier,Ty as getRequiredPermissions,DS as getSigningKeyCacheSize,Rg as getSmsInfrastructureStatus,$I as getTimestamp,na as globMatches,lo as globToRegex,SC as globalResourceManager,Ui as governingLimitCents,ag as grantFailoverReplicaAccess,Jy as guardDutyManager,Fo as handleSpendRequest,po as hasAutoWwwVariant,gr as hasManagementDashboardSite,Ad as hasProxyUpstream,kb as hashBuffer,Nb as hashDirectory,Mm as hashFile,Bb as hashManifest,Fm as hashString,OE as healthCheckManager,Xn as hostAcceptsIpv6,qt as hostCondition,da as hotp,Zr as hourBucket,QA as hourBucketsBetween,dE as imageScanningManager,Es as infraEnvFromOutputs,Vl as inspectInvocation,mS as installRecursionFetch,Ns as invalidateCache,Bf as invocationContext,iy as isArmInstanceType,aC as isLikelyTypo,Zn as isLocalDatabase,Kb as isLocalDevelopment,pr as isManagementDashboardSiteName,Pr as isNameserverRegistrar,PS as isNodeCryptoAvailable,Hd as isOperationAllowed,Lo as isQuietHours,Ho as isS3RestEndpoint,Pi as isSafePattern,il as isStateDirConfigured,sl as isStatePath,on as isValidCidr,wC as isValidRegion,Mi as isValidTimeZone,kS as isWebCryptoAvailable,kr as isZoneHost,vn as jobProviderCapability,_s as keyMatchesFilters,pE as lambdaConcurrencyManager,hE as lambdaDLQManager,mE as lambdaDestinationsManager,uE as lambdaLayersManager,fE as lambdaVPCManager,gE as lambdaVersionsManager,Bu as lambdaWorkloads,ql as laravelServerlessEnvDefaults,Wr as listComposeTemplates,ps as listSourceReferences,ru as loadCloudConfig,cr as loadTelemetryPolicy,rS as logsManager,Vd as lookbackHoursForSignal,ey as mailEnabled,Xe as mailFirewallPorts,dn as mailWebmailSites,gh as maintenanceWindowOpen,Hf as makeAWSRequest,vS as makeAWSRequestAsync,ES as makeAWSRequestOnce,sp as managedRuleInSync,xm as managementDashboardSiteName,qu as manifestDigest,An as matchTotpCounter,jS as mediaObjectHeaders,ko as median,tm as medianAbsoluteDeviation,Md as mergeDecisions,gn as mergeInfrastructure,FA as mergePriceBooks,Od as meterTelemetry,rE as metricsManager,Cg as migrateObjectStorage,nE as migrationManager,BC as multiAccountManager,AC as multiRegionManager,pR as needsRenewal,_E as networkSecurityManager,$t as nextScheduleRuns,De as normalizePublicIpv6,Le as normalizeRuntimeStatus,at as normalizeScheduleExpression,Wf as normalizeSourceEvent,Ve as normalizeSshPublicKey,cm as normalizeTelemetryPolicy,xi as occupiedHostPorts,Ia as openApiDocument,Oo as optionsForSignal,xC as organizationManager,jl as packagePhpApp,pn as packageServerlessApp,pd as pagesAssetHash,jg as pagesDnsRecord,Sl as parallel,Lb as parallelMap,$b as parallelWithRetry,SA as parseCertificateState,Gl as parseChain,Kr as parseCompose,NI as parseComposeCatalog,eh as parseDockerInspect,Ag as parseDotenv,tA as parseDrainedSites,_i as parseHostSiteFragments,wS as parseJSONResponse,Ai as parsePreflightFacts,Gp as parseSourceDrained,rh as parseSystemdRecords,Fp as parseTargetReady,hd as parseUpstreamPort,_p as parseWorkersPaused,TS as parseXMLResponse,ji as pathTemplate,md as pendingSteps,Po as percentOfLimit,iE as performanceManager,Ul as phpLayerBuildStage,gS as phpLayerPackages,fn as phpRuntimeLayerAssets,BI as planComposeTemplateUpgrade,Fd as planEnforcement,ui as planHetznerVolumes,Np as planIsDestructive,hm as planMitigation,lA as planServerRename,EA as planSiteMove,zs as planZoneMigration,Kt as policyTag,Si as preflightFailed,Ny as previewManager,_y as previewNotifications,Mt as previewSchedule,UA as previousBudgetWindow,wo as priceUsage,$A as priceUsageLines,iA as probeHostRoutes,Uc as probeOriginTls,Ub as processInChunks,Iu as processSourceWebhook,hs as productionChangeReview,tS as progressiveDeploymentManager,Ld as projectSpend,Yo as propagationHeaders,Ac as providerEndpoint,ju as publicKeyFingerprint,Kn as qualifyName,wE as queueManagementManager,xb as quickHash,np as r2Endpoint,Yg as r2S3Credentials,Xl as rateLimitHeaders,os as rateLimitKey,je as readDriverState,sA as reconcile,Bg as reconcileAddressRecords,Vg as reconcileCloudflareCdn,Fh as reconcileCloudflareWorkers,Qs as reconcileDeclaredRecords,FS as reconcileJobObservation,fh as reconcileR2Buckets,In as reconcileSourceWebhook,fs as recordDashboardHostPosture,LS as recordPreDeploySecretScan,$S as recordSkippedSecretScan,Zo as recursionBlockedResponse,$e as redactRuntimeConfig,Xd as redactTelemetryText,qi as redactTelemetryValue,kn as redeployServerlessApp,IC as regionPairManager,Sn as releaseStrategyCapabilities,zf as releaseTrafficPlan,Di as reloadRpxGateway,Os as remapKey,Ng as removeAddressRecords,Eg as removeDns01ChallengeRecord,Pn as removeSiteFromCloudConfig,bu as removeSourceWebhook,xc as removeStaleServerAddressRecords,vd as renderComposeTemplate,Wi as renderDdosInstallScript,tl as renderNftablesRuleset,As as renderServerCron,el as renderSysctlFile,cd as renderWafConfig,ki as renderWafInstallScript,ad as renewRpxCertificates,iS as replicaManager,ZA as requestHash,Gb as requiresReplacement,PE as resetRecursionRuntime,kE as resolveApp,g as resolveAppDatabase,gA as resolveAttachTarget,st as resolveAuthEncryptionKey,be as resolveCloudProvider,Hg as resolveCloudflareCdnPlan,ei as resolveComputeVolumes,jo as resolveCredentials,Rs as resolveDashboardAction,sd as resolveDashboardAuth,gy as resolveDashboardDomain,py as resolveDashboardDomains,Us as resolveDeclaredRecords,GI as resolveDeployBucketName,K as resolveDeploymentMode,ii as resolveExecStart,Qo as resolveFailoverStatusCodes,Hc as resolveHetznerApiToken,Mr as resolveHostCleanupConfig,w as resolveMailProxy,C as resolveMailService,gb as resolveManagementDashboardSite,Zi as resolveManagementDashboardSites,yc as resolveObjectStorage,ce as resolveOriginConnection,aA as resolvePlan,m as resolveProjectStackName,zr as resolveProxyUpstreams,Ml as resolveQueueNames,PA as resolveQueuedDeploymentCommand,hr as resolveQueues,pS as resolveRecursionConfig,Sy as resolveRegion,ge as resolveRuntimeInventory,dr as resolveServerlessAppStackName,cl as resolveServerlessArtifactBucketName,Xi as resolveServerlessAssetBucketName,ns as resolveServerlessRuntime,QI as resolveSiteBucketName,ho as resolveSiteDeployTarget,d as resolveSiteKind,UI as resolveSiteResourceName,FI as resolveSiteStackName,fi as resolveSshSettings,l as resolveStatePath,HI as resolveStorageBucketName,vm as resolveStorageFailover,er as resolveUiSource,ud as resolveZoneApex,LE as resourceManagementManager,_f as responseToResult,rm as robustZScore,rr as roleCapabilities,mu as rollbackImmutableRelease,Nn as rollbackServerlessApp,MA as roundCents,yE as route53ResolverManager,cS as route53RoutingManager,sm as routeMatches,Dp as routesFromFragments,ss as ruleMatches,dS as runBuildHooks,Ud as runEnforcement,ea as runPhpBuildHooks,ct as runRemoteCommand,Ee as runtimeId,Qe as s3OriginBucket,Tm as s3RegionalDomain,xs as sameCorsRules,Fs as sameLifecycleRules,Wn as sameNameservers,ws as sanitizeCloudConfig,s as sanitizeControlPlaneValue,MI as sanitizeName,cu as sanitizeOidcReturnPath,Wd as saveTelemetryPolicy,Jf as scanForSecrets,Sd as scopeContains,wt as scopeKey,Mc as scpUpload,dC as searchCommands,yo as searchControlPlane,sS as secretsManager,oE as secretsRotationManager,MS as secureContainerRelease,Xy as securityHubManager,cE as securityScanningManager,ue as securityScope,cg as seedFailoverReplicas,yn as sendAuthenticationEmail,bE as senderReputationManager,Mb as sequence,yg as serializeDotenv,Ti as serverPublicIpv4,aS as serviceMeshManager,rg as setAttachToInCloudConfig,Cr as setMaintenance,bs as setSitePropertyInCloudConfig,nl as setStateDir,uR as setupDns01Challenge,wc as setupSmsInfrastructure,Ko as sha256,fS as sharedRecursionGuard,Nf as sharedRuntimeLoop,jp as shipsARelease,WS as signCloudFrontCookies,BS as signCloudFrontUrl,k as signRequest,Wl as signRequestAsync,Bo as signalDefinition,U as siteInstallBase,Bi as siteMoveArchivePath,AA as siteMoveCertArchivePath,fd as siteUnitGlob,lm as spendNotificationText,Uo as spendOpenApiPaths,Fr as sshExec,Se as sshExecOrThrow,bC as stackDependencyManager,gc as startLocalDashboardServer,XA as startSpendLoop,cn as stateDir,Q as statePath,xE as staticSiteManager,bS as storageAdvancedManager,zI as storageFailoverReplicasFromTemplate,GA as streamFocusJsonl,Qd as strongestActiveAction,Vm as suggestCommand,uC as suggestFlags,wb as suggestIAMPolicy,Pb as suggestQuotaIncrease,PC as suggestRegionPairs,DC as suggestRegions,gs as syncSourceRepositories,Pd as synchronizeComposeVolumes,Sg as synchronizeConfiguredConfiguration,Ra as synchronizeConfiguredJobs,nS as syntheticsManager,Zd as sysctlHardening,nh as systemdWorkloads,KA as telemetryBucketLabel,zi as telemetryCursor,Jd as telemetryEstimatedMonthlyCost,zA as telemetryPercentile,dm as telemetryPolicyKey,wy as templateCache,Pp as tenantsOf,Sa as testSourceConnection,kd as tieredMicroCents,ap as toApiLifecycleRule,zc as toCloudflareZoneSettings,_o as toFocusJsonl,qd as toFocusRecords,nA as toInventoryServer,Vf as totp,la as totpUri,kp as unaccountedSites,Zf as unsupportedCapabilities,kA as unsupportedVolumeCapabilities,Ku as updateCompatibility,Ju as updateSiteInCloudConfig,ks as uploadStaticFiles,Xp as usageDeltaKey,or as utcInstantOfLocal,MC as validateAccountStructure,zb as validateAgainstSchema,BA as validateAttachment,Ch as validateBackupDestination,mC as validateCommand,Cb as validateConfiguration,vb as validateCredentials,qp as validateDeploymentConfig,NA as validateMountPath,Pt as validateOriginGroups,gg as validateResourceLimits,Bp as validateServerName,eg as validateTemplate,ug as validateTemplateSize,_c as verifyAddressRecord,_S as verifyArtifactSignature,zS as verifyMediaAccessToken,qf as verifyTotp,zu as verifyUpdateSignature,Ws as verifyZoneParity,Co as volumeCapabilities,Sp as wafEventTelemetry,Fc as waitForCloudInit,ft as waitForSsh,yr as webhookEndpoint,Sb as withCDN,yb as withCache,up as withContentHash,Ab as withDatabase,Of as withInvocation,fb as withMonitoring,Ib as withQueue,hb as withSecurity,Fb as withTimeout,dp as workerBindings,so as workerContentHash,Ja as workerInSync,se as wrapCloudInitUserData,At as writeDriverState,tE as xrayManager,Gu as zeroCapacity,VA as zeroFill,Bd as zoneOffsetMs,Ro as zonedParts};
+`}async function Ig(u,p,h){let y=`_acme-challenge.${p}`;if(await Eg(u,p,y,h))return;let R=await u.createRecord(p,{name:y,type:"TXT",content:h,ttl:60});if(!R.success)throw Error(`Failed to create DNS challenge record: ${R.message}`)}async function vg(u,p,h){let y=await u.deleteRecord(p,{name:`_acme-challenge.${p}`,type:"TXT",content:h});if(!y.success)console.warn(`Failed to delete DNS challenge record: ${y.message}`)}async function Eg(u,p,h,y){try{let R=await u.listRecords(p,"TXT"),v=h.replace(/\.$/,"").toLowerCase();return(R.records??[]).some((P)=>P.name.replace(/\.$/,"").toLowerCase()===v&&P.content.replace(/^"|"$/g,"")===y)}catch{return!1}}function td(u){let{hostedZoneId:p,dnsProvider:h,region:y="us-east-1"}=u;if(h)return N(h);if(p)return new ie(y,p);throw Error("Either dnsProvider or hostedZoneId must be provided")}async function dR(u){await Ig(td(u),u.domain,u.challengeValue)}async function pR(u){await vg(td(u),u.domain,u.challengeValue)}function mR(u){try{let{execSync:p}=nt("node:child_process"),h=p(`openssl x509 -checkend 2592000 -noout -in ${u}/cert.pem`,{encoding:"utf-8",stdio:["pipe","pipe","pipe"]});return!1}catch{return!0}}import{createHash as rd,createSign as Lg,generateKeyPairSync as nd}from"node:crypto";var ld={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"};class Fg{directoryUrl;email;accountKey;accountUrl=null;directory=null;nonce=null;constructor(u){this.directoryUrl=u.staging?ld.staging:ld.production,this.email=u.email,this.accountKey=u.accountKey||this.generateAccountKey()}generateAccountKey(){let{privateKey:u}=nd("ec",{namedCurve:"P-256"});return u.export({type:"pkcs8",format:"pem"})}async getDirectory(){if(this.directory)return this.directory;let u=await fetch(this.directoryUrl);if(!u.ok)throw Error(`Failed to fetch ACME directory: ${u.status}`);return this.directory=await u.json(),this.directory}async getNonce(){if(this.nonce){let y=this.nonce;return this.nonce=null,y}let u=await this.getDirectory(),h=(await fetch(u.newNonce,{method:"HEAD"})).headers.get("replay-nonce");if(!h)throw Error("Failed to get nonce from ACME server");return h}getJwk(){let u=this.accountKey.split(`
+`).filter((v)=>!v.startsWith("-----")).join(""),p=Buffer.from(u,"base64"),h=p.length-65,y=p.subarray(h+1,h+33),R=p.subarray(h+33,h+65);return{kty:"EC",crv:"P-256",x:this.base64UrlEncode(y),y:this.base64UrlEncode(R)}}getJwkThumbprint(){let u=this.getJwk(),p=JSON.stringify({crv:u.crv,kty:u.kty,x:u.x,y:u.y}),h=rd("sha256").update(p).digest();return this.base64UrlEncode(h)}base64UrlEncode(u){return(typeof u==="string"?Buffer.from(u):u).toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async signPayload(u,p){let h=await this.getNonce(),y=this.getJwk(),R={alg:"ES256",nonce:h,url:u};if(this.accountUrl)R.kid=this.accountUrl;else R.jwk=y;let v=this.base64UrlEncode(JSON.stringify(R)),P=p===""?"":this.base64UrlEncode(JSON.stringify(p)),L=`${v}.${P}`,z=Lg("SHA256");z.update(L);let fe=z.sign(this.accountKey),me=fe.subarray(4,4+fe[3]),bt=4+fe[3]+2,It=fe.subarray(bt,bt+fe[bt-1]),mt=Buffer.alloc(32),Me=Buffer.alloc(32);me.copy(mt,32-me.length),It.copy(Me,32-It.length);let ze=Buffer.concat([mt,Me]);return JSON.stringify({protected:v,payload:P,signature:this.base64UrlEncode(ze)})}async acmeRequest(u,p){let h=await this.signPayload(u,p),y=await fetch(u,{method:"POST",headers:{"Content-Type":"application/jose+json"},body:h}),R=y.headers.get("replay-nonce");if(R)this.nonce=R;let v,P=y.headers.get("content-type");if(P?.includes("application/json")||P?.includes("application/problem+json"))v=await y.json();else v=await y.text();if(!y.ok)throw Error(`ACME request failed: ${JSON.stringify(v)}`);return{body:v,headers:y.headers}}async registerAccount(){let u=await this.getDirectory(),{body:p,headers:h}=await this.acmeRequest(u.newAccount,{termsOfServiceAgreed:!0,contact:[`mailto:${this.email}`]}),y=h.get("location");if(!y)throw Error("No account URL returned");return this.accountUrl=y,y}async createOrder(u){if(!this.accountUrl)await this.registerAccount();let p=await this.getDirectory(),{body:h,headers:y}=await this.acmeRequest(p.newOrder,{identifiers:u.map((v)=>({type:"dns",value:v}))}),R=y.get("location");if(!R)throw Error("No order URL returned");return{orderUrl:R,authorizations:h.authorizations,finalize:h.finalize}}async getAuthorization(u){let{body:p}=await this.acmeRequest(u,""),h=p.identifier.value,y=this.getJwkThumbprint(),R=p.challenges.filter((v)=>v.type==="http-01"||v.type==="dns-01").map((v)=>{let P=`${v.token}.${y}`;if(v.type==="http-01")return{type:"http-01",token:v.token,keyAuthorization:P,identifier:`/.well-known/acme-challenge/${v.token}`};else{let L=this.base64UrlEncode(rd("sha256").update(P).digest());return{type:"dns-01",token:v.token,keyAuthorization:P,identifier:`_acme-challenge.${h}`,dnsValue:L}}});return{domain:h,challenges:R}}async respondToChallenge(u){await this.acmeRequest(u,{})}async waitForAuthorization(u,p=30){for(let h=0;h<p;h++){let{body:y}=await this.acmeRequest(u,"");if(y.status==="valid")return;if(y.status==="invalid")throw Error(`Authorization failed: ${JSON.stringify(y)}`);await new Promise((R)=>setTimeout(R,2000))}throw Error("Authorization timed out")}generateCsr(u){let{privateKey:p}=nd("rsa",{modulusLength:2048}),h=p.export({type:"pkcs8",format:"pem"});return{csr:this.createSimpleCsr(u,p),privateKey:h}}createSimpleCsr(u,p){throw Error("CSR generation requires additional implementation. Consider using the shell-based certbot approach instead.")}async finalizeOrder(u,p){let{csr:h,privateKey:y}=this.generateCsr(p),{body:R}=await this.acmeRequest(u,{csr:this.base64UrlEncode(Buffer.from(h,"base64"))}),v=R.certificate;if(!v)throw Error("Certificate not immediately available - polling not implemented");let L=await(await fetch(v)).text(),z=L.split(/(?=-----BEGIN CERTIFICATE-----)/g),fe=z[0],me=z.slice(1).join("");return{certificate:fe,privateKey:y,chain:me,fullchain:L,expiresAt:new Date(Date.now()+7776000000)}}getAccountKey(){return this.accountKey}}var Hr=(u)=>u===void 0?void 0:u?"on":"off";function zc(u){let p={ssl:u.ssl,always_use_https:Hr(u.alwaysUseHttps),automatic_https_rewrites:Hr(u.automaticHttpsRewrites),min_tls_version:u.minTlsVersion,tls_1_3:Hr(u.tls13),brotli:Hr(u.brotli),http3:Hr(u.http3),"0rtt":Hr(u.zeroRtt),early_hints:Hr(u.earlyHints),browser_cache_ttl:u.browserCacheTtl,always_online:Hr(u.alwaysOnline),websockets:Hr(u.websockets),email_obfuscation:Hr(u.emailObfuscation)};if(u.hsts)p.security_header={strict_transport_security:{enabled:u.hsts.enabled,max_age:u.hsts.maxAge??31536000,include_subdomains:u.hsts.includeSubdomains??!1,preload:u.hsts.preload??!1,nosniff:u.hsts.noSniff??!0}};for(let h of Object.keys(p))if(p[h]===void 0)delete p[h];return{...p,...u.raw??{}}}var wi={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as _g}from"node:tls";async function Uc(u){let{address:p,serverName:h,port:y=443,timeoutMs:R=5000}=u;return new Promise((v)=>{let P=!1,L=(fe)=>{if(P)return;P=!0;try{z.destroy()}catch{}v(fe)},z=_g({host:p,port:y,servername:h,rejectUnauthorized:!1,timeout:R});z.once("secureConnect",()=>{if(z.authorized){L({reachable:!0,trusted:!0});return}L({reachable:!0,trusted:!1,reason:z.authorizationError?String(z.authorizationError):"origin certificate is not trusted for this hostname"})}),z.once("timeout",()=>{L({reachable:!1,trusted:!1,reason:`no TLS handshake within ${R}ms`})}),z.once("error",(fe)=>{L({reachable:!1,trusted:!1,reason:fe.message})})})}function Mg(u,p){let h=p.replace(/\.$/,"").toLowerCase();return u.some((y)=>{let R=y.replace(/\.$/,"").toLowerCase();if(R===h)return!0;if(!R.startsWith("*."))return!1;let v=R.slice(2);if(!h.endsWith(`.${v}`))return!1;return!h.slice(0,h.length-v.length-1).includes(".")})}async function Wg(u){let{provider:p,zone:h,hosts:y,ipv4:R,ipv6:v,proxied:P=!0,settings:L=wi,cache:z,originGuard:fe,purge:me=!0,ttl:bt=300,skipOriginProbe:It=!1,skipEdgeCertificateCheck:mt=!1}=u,Me={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(y.length===0)return Me;let ze=[],j=P&&!mt?await p.listEdgeCertificateHosts(h):null;for(let G of y){let ht=P;if(ht&&j&&!Mg(j,G)){ht=!1;let Ft=j.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${j.join(", ")})`;Me.deferredProxy.push({host:G,reason:Ft}),Me.warnings.push(`${G}: publishing DNS-only — ${Ft}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(ht&&!It){let Ft=await Uc({address:R,serverName:G});if(!Ft.trusted){ht=!1;let Wt=Ft.reason||"origin is not serving a trusted certificate";Me.deferredProxy.push({host:G,reason:Wt}),Me.warnings.push(`${G}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Wt}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(ht)ze.push(G);let Ct=[{type:"A",content:R}];if(v&&Xn(G))Ct.push({type:"AAAA",content:v});for(let{type:Ft,content:Wt}of Ct){let Zt=await p.upsertRecord(h,{name:G,type:Ft,content:Wt,ttl:bt,proxied:ht});if(Zt.success)Me.records.push({host:G,type:Ft,content:Wt,proxied:ht});else Me.warnings.push(`${G} ${Ft} → ${Wt} failed: ${Zt.message||"unknown provider error"}`)}}if(ze.length===0){if(P)Me.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return Me}try{let G=zc(L),ht=await p.applyZoneSettings(h,G);Me.settingsChanged=ht.changed;for(let Ct of ht.failed)Me.warnings.push(`zone setting '${Ct.id}' could not be applied: ${Ct.error}`)}catch(G){Me.warnings.push(`zone settings could not be read: ${G instanceof Error?G.message:String(G)}`)}let yt=Pc(ze,z);if(yt.length>0){let G=await p.putManagedPhaseRules(h,"http_request_cache_settings",yt);if(G.success)Me.cacheRules=yt.length;else Me.warnings.push(`cache rules could not be written: ${G.message}`)}if(fe){let G=kc(ze,fe.header,fe.value);if(G.length>0){let ht=await p.putManagedPhaseRules(h,"http_request_late_transform",G);if(ht.success)Me.originGuard=!0;else Me.warnings.push(`origin guard header could not be written: ${ht.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(me){if(Me.purged=await p.purgeCache(h,{hosts:ze}),!Me.purged)Me.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return Me}var Vg=(u)=>process.env[u];function ud(u,p){let h=u.replace(/\.$/,"").toLowerCase();if(p){let y=p.replace(/\.$/,"").toLowerCase();if(h===y||h.endsWith(`.${y}`))return y}return h.split(".").slice(-2).join(".")}function zg(u,p={}){let h=p.env??Vg,y=u.infrastructure?.compute?.proxy?.cdn,R=[];if(!y||y.provider!=="cloudflare")return{plan:null,errors:R};if(y.originDomain)R.push(`compute.proxy.cdn.originDomain (${y.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let v=h("CLOUDFLARE_API_TOKEN");if(!v)return R.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:R};let P=u.sites??{},L=y.frontedHosts?.length?[...new Set(y.frontedHosts.map((It)=>It.toLowerCase()))]:mo(P,{autoWww:u.infrastructure?.compute?.proxy?.autoWww!==!1});if(L.length===0)return R.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:R};let z=u.infrastructure?.dns?.domain,fe=new Set(L.map((It)=>ud(It,z)));if(fe.size>1)return R.push(`Fronted hosts span more than one zone (${[...fe].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:R};let me=y.cloudflare??{},bt=y.secret?{header:y.secretHeader??"X-Origin-Verify",value:y.secret}:void 0;return{plan:{zone:[...fe][0],hosts:L,apiToken:v,zoneId:me.zoneId??h("CLOUDFLARE_ZONE_ID"),accountId:me.accountId??h("CLOUDFLARE_ACCOUNT_ID"),proxied:me.proxied!==!1,settings:me.settings??wi,cache:me.cache,originGuard:bt,purge:me.purgeOnDeploy!==!1,skipOriginProbe:me.skipOriginProbe===!0},errors:R}}var Hg=26214400;var Ug=new Set(["/_headers","/_redirects","/_routes.json","/_worker.js"]);class dd{name="cloudflare-pages";apiToken;accountId;constructor(u){if(!u.apiToken)throw Error("Cloudflare Pages needs an API token");if(!u.accountId)throw Error("Cloudflare Pages needs an account id");this.apiToken=u.apiToken,this.accountId=u.accountId}async request(u,p,h){return vs(u,`/accounts/${this.accountId}${p}`,`Bearer ${this.apiToken}`,h)}async getProject(u){try{return await this.request("GET",`/pages/projects/${u}`)}catch(p){if(p instanceof Error&&/\b8000007\b|not found/i.test(p.message))return null;throw p}}async ensureProject(u,p="main"){let h=await this.getProject(u);if(h)return h;return this.request("POST","/pages/projects",{name:u,production_branch:p})}async uploadToken(u){return(await this.request("GET",`/pages/projects/${u}/upload-token`)).jwt}async missingHashes(u,p){let h=await vs("POST","/pages/assets/check-missing",`Bearer ${u}`,{hashes:p});return new Set(h)}async upsertHashes(u,p){await vs("POST","/pages/assets/upsert-hashes",`Bearer ${u}`,{hashes:p})}async uploadBatch(u,p){let h=p.map((y)=>({key:y.hash,value:y.base64,metadata:{contentType:jg(y.extension)},base64:!0}));await vs("POST","/pages/assets/upload",`Bearer ${u}`,h)}async createDeployment(u,p,h){let y={};for(let v of p)y[v.path]=v.hash;let R=new FormData;if(R.append("manifest",JSON.stringify(y)),h)R.append("branch",h);return this.request("POST",`/pages/projects/${u}/deployments`,R)}async deployDirectory(u){let p=await gd(u.directory);if(p.length===0)throw Error(`No files to deploy in ${u.directory}`);let h=await this.uploadToken(u.project),y=await this.missingHashes(h,p.map((z)=>z.hash)),R=p.filter((z)=>y.has(z.hash)),v=[];for(let z=0;z<R.length;z+=100)v.push(R.slice(z,z+100));let P=0;for(let z=0;z<v.length;z+=4){let fe=v.slice(z,z+4);await Promise.all(fe.map((me)=>this.uploadBatch(h,me))),P+=fe.reduce((me,bt)=>me+bt.length,0),u.onProgress?.(P,R.length)}return await this.upsertHashes(h,p.map((z)=>z.hash)),{deployment:await this.createDeployment(u.project,p,u.branch),total:p.length,uploaded:R.length,uploadedBytes:R.reduce((z,fe)=>z+fe.size,0)}}async listCustomDomains(u){return(await this.request("GET",`/pages/projects/${u}/domains`)).map((h)=>h.name)}async attachCustomDomain(u,p){if((await this.listCustomDomains(u)).includes(p))return!1;return await this.request("POST",`/pages/projects/${u}/domains`,{name:p}),!0}}function Gg(u,p){return{type:"CNAME",name:u,value:p.endsWith(".pages.dev")?p:`${p}.pages.dev`,ttl:1,proxied:!0}}async function pd(u,p){let{blake3:h}=await import("./chunk-xd67tr7p.js").then((m)=>BS(m.default,1));return(await h(u+p)).slice(0,32)}async function gd(u){let{readdir:p}=await import("node:fs/promises"),{join:h,relative:y,sep:R}=await import("node:path"),v=[];async function P(L){let z=await p(L,{withFileTypes:!0});for(let fe of z){let me=h(L,fe.name);if(fe.isDirectory()){await P(me);continue}if(!fe.isFile())continue;let bt=`/${y(u,me).split(R).join("/")}`;if(Ug.has(bt))continue;let It=await Bun.file(me).bytes();if(It.byteLength>26214400)throw Error(`${bt} is ${It.byteLength} bytes, over the Cloudflare Pages limit of 26214400`);let mt=Buffer.from(It).toString("base64"),Me=fe.name.lastIndexOf("."),ze=Me>0?fe.name.slice(Me+1):"";v.push({path:bt,hash:await pd(mt,ze),base64:mt,extension:ze,size:It.byteLength})}}return await P(u),v.sort((L,z)=>L.path.localeCompare(z.path)),v}function jg(u){return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",mjs:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",map:"application/json; charset=utf-8",xml:"application/xml; charset=utf-8",txt:"text/plain; charset=utf-8",svg:"image/svg+xml",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",webp:"image/webp",avif:"image/avif",ico:"image/x-icon",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",otf:"font/otf",pdf:"application/pdf",webmanifest:"application/manifest+json"}[u.toLowerCase()]||"application/octet-stream"}async function vs(u,p,h,y){let R={Authorization:h},v;if(y instanceof FormData)v=y;else if(y!==void 0)R["Content-Type"]="application/json",v=JSON.stringify(y);let P=await fetch(`https://api.cloudflare.com/client/v4${p}`,{method:u,headers:R,body:v}),L=await P.text(),z;try{z=JSON.parse(L)}catch{throw Error(`Cloudflare Pages API returned ${P.status} with a non-JSON body: ${L.slice(0,200)}`)}if(!z.success){let fe=(z.errors??[]).map((me)=>`${me.code}: ${me.message}`).join(", ");throw Error(`Cloudflare Pages API error (${P.status}): ${fe||L.slice(0,200)}`)}return z.result}import{createHash as Kg}from"node:crypto";var tp="https://api.cloudflare.com/client/v4",rp=10042,qg=10006,Zg=10059;class Fn extends Error{status;errors;constructor(u,p,h=[]){super(u);this.name="R2ApiError",this.status=p,this.errors=h}hasCode(u){return this.errors.some((p)=>p.code===u)}}class hn extends Fn{accountId;constructor(u,p,h=[]){super(`R2 is not enabled on Cloudflare account ${u}. Enable it once in the Cloudflare dashboard (R2 Object Storage, then follow the prompt to activate it), then re-run the deploy.`,p,h);this.name="R2NotEnabledError",this.accountId=u}}class ai{name="cloudflare-r2";apiToken;accountId;fetchImpl;constructor(u){if(!u.apiToken)throw Error("Cloudflare R2 needs an API token");if(!u.accountId)throw Error("Cloudflare R2 needs an account id");this.apiToken=u.apiToken,this.accountId=u.accountId,this.fetchImpl=u.fetch??((p,h)=>fetch(p,h))}async requestEnvelope(u,p,h,y={}){let R={Authorization:`Bearer ${this.apiToken}`};if(h!==void 0)R["Content-Type"]="application/json";if(y.jurisdiction&&y.jurisdiction!=="default")R["cf-r2-jurisdiction"]=y.jurisdiction;let v=await this.fetchImpl(`${tp}/accounts/${this.accountId}/r2${p}`,{method:u,headers:R,body:h===void 0?void 0:JSON.stringify(h)}),P=await v.text(),L;try{L=JSON.parse(P)}catch{throw new Fn(`Cloudflare R2 API returned ${v.status} with a non-JSON body: ${P.slice(0,200)}`,v.status)}if(!L.success){let z=L.errors??[];if(z.some((me)=>me.code===rp))throw new hn(this.accountId,v.status,z);let fe=z.map((me)=>`${me.code}: ${me.message}`).join(", ");throw new Fn(`Cloudflare R2 API error (${v.status}) on ${u} ${p}: ${fe||P.slice(0,200)}`,v.status,z)}return L}async request(u,p,h,y){return(await this.requestEnvelope(u,p,h,y)).result}bucketPath(u){return`/buckets/${encodeURIComponent(u)}`}async listBuckets(u={}){let p=[],h;do{let y=new URLSearchParams({per_page:"1000"});if(h)y.set("cursor",h);let R=await this.requestEnvelope("GET",`/buckets?${y}`,void 0,u),v=R.result?.buckets??[];p.push(...v),h=v.length>0?R.result_info?.cursor||void 0:void 0}while(h);return p}async getBucket(u,p={}){try{return await this.request("GET",this.bucketPath(u),void 0,p)}catch(h){if(h instanceof hn)throw h;if(h instanceof Fn&&(h.hasCode(qg)||h.status===404))return null;throw h}}async ensureBucket(u,p={}){let h={jurisdiction:p.jurisdiction},y=await this.getBucket(u,h);if(y)return{bucket:y,created:!1};let R={name:u};if(p.locationHint)R.locationHint=p.locationHint;let v=await this.request("POST","/buckets",R,h);return{bucket:{...v,name:v?.name||u},created:!0}}async getCors(u,p={}){try{return(await this.request("GET",`${this.bucketPath(u)}/cors`,void 0,p))?.rules??[]}catch(h){if(h instanceof Fn&&!(h instanceof hn)&&(h.hasCode(Zg)||h.status===404))return[];throw h}}async putCors(u,p,h={}){if(p.length===0){await this.request("DELETE",`${this.bucketPath(u)}/cors`,void 0,h);return}await this.request("PUT",`${this.bucketPath(u)}/cors`,{rules:p},h)}async ensureCors(u,p,h={}){let y=await this.getCors(u,h);if(xs(y,p))return!1;return await this.putCors(u,p,h),!0}async getLifecycle(u,p={}){return(await this.request("GET",`${this.bucketPath(u)}/lifecycle`,void 0,p))?.rules??[]}async putLifecycle(u,p,h={}){await this.request("PUT",`${this.bucketPath(u)}/lifecycle`,{rules:p},h)}async ensureLifecycle(u,p,h={}){let y=await this.getLifecycle(u,h);if(Fs(y,p))return!1;return await this.putLifecycle(u,p,h),!0}async listCustomDomains(u,p={}){return(await this.request("GET",`${this.bucketPath(u)}/domains/custom`,void 0,p))?.domains??[]}async attachCustomDomain(u,p,h={}){return this.request("POST",`${this.bucketPath(u)}/domains/custom`,{domain:p.domain,zoneId:p.zoneId,enabled:p.enabled??!0,minTLS:p.minTLS??"1.2"},h)}async updateCustomDomain(u,p,h,y={}){return this.request("PUT",`${this.bucketPath(u)}/domains/custom/${encodeURIComponent(p)}`,h,y)}async ensureCustomDomain(u,p,h={},y){let R=p.minTLS??"1.2",P=(y??await this.listCustomDomains(u,h)).find((fe)=>fe.domain.toLowerCase()===p.domain.toLowerCase());if(!P){let fe=await this.attachCustomDomain(u,{...p,minTLS:R,enabled:!0},h);return{action:"attached",domain:{...fe,domain:fe?.domain||p.domain}}}let L=P.minTLS??"1.0";if(P.enabled&&L===R)return{action:"unchanged",domain:P};let z=await this.updateCustomDomain(u,P.domain,{enabled:!0,minTLS:R},h);return{action:"updated",domain:{...P,...z}}}async getManagedDomain(u,p={}){return this.request("GET",`${this.bucketPath(u)}/domains/managed`,void 0,p)}async setManagedDomain(u,p,h={}){let y=await this.getManagedDomain(u,h);if(y?.enabled===p)return{changed:!1,domain:y};return{changed:!0,domain:await this.request("PUT",`${this.bucketPath(u)}/domains/managed`,{enabled:p},h)}}}function np(u){return`https://${u}.r2.cloudflarestorage.com`}async function Jg(u){let{apiToken:p,accountId:h}=u;if(!p)throw Error("r2S3Credentials needs an API token");if(!h)throw Error("r2S3Credentials needs an account id");let y=u.fetch??((P,L)=>fetch(P,L)),R=[],v;for(let P of[`/accounts/${h}/tokens/verify`,"/user/tokens/verify"]){let L=await y(`${tp}${P}`,{method:"GET",headers:{Authorization:`Bearer ${p}`}}),z=await L.json().catch(()=>null);if(L.ok&&z?.success&&z.result?.id){v=z.result.id;break}let fe=z?.errors?.map((me)=>`${me.code}: ${me.message}`).join(", ");R.push(`${P} -> ${L.status}${fe?` (${fe})`:""}`)}if(!v)throw Error(`Could not verify the Cloudflare API token to derive R2 credentials: ${R.join("; ")}`);return{accessKeyId:v,secretAccessKey:Kg("sha256").update(p).digest("hex"),endpoint:np(h),region:"auto"}}function Ni(u){if(Array.isArray(u))return`[${u.map(Ni).join(",")}]`;if(u&&typeof u==="object")return`{${Object.entries(u).filter(([,h])=>h!==void 0).sort(([h],[y])=>h.localeCompare(y)).map(([h,y])=>`${JSON.stringify(h)}:${Ni(y)}`).join(",")}}`;return JSON.stringify(u)}function ep(u,p){let h=(y)=>y&&y.length>0?[...y].map(String).sort():void 0;return{id:p?u.id:void 0,allowed:{origins:h(u.allowed?.origins),methods:h(u.allowed?.methods?.map((y)=>y.toUpperCase())),headers:h(u.allowed?.headers?.map((y)=>y.toLowerCase()))},exposeHeaders:h(u.exposeHeaders?.map((y)=>y.toLowerCase())),maxAgeSeconds:u.maxAgeSeconds}}function xs(u,p){if(u.length!==p.length)return!1;return p.every((h,y)=>{let R=h.id!==void 0;return Ni(ep(u[y],R))===Ni(ep(h,R))})}function Fs(u,p){if(u.length!==p.length)return!1;let h=(y)=>Ni([...y].map((R)=>({...R,storageClassTransitions:R.storageClassTransitions?.length?R.storageClassTransitions:void 0})).sort((R,v)=>R.id.localeCompare(v.id)));return h(u)===h(p)}var Yg="r2 cache",Xg=/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;async function Qg(u,p={}){let h=p.log??(()=>{}),y={buckets:[],warnings:[]},R=u.infrastructure?.r2??u.r2,v=Object.entries(R?.buckets??{});if(v.length===0)return h("R2: no buckets declared, skipping."),y;if(!p.apiToken||!p.accountId){let me=[!p.apiToken&&"CLOUDFLARE_API_TOKEN",!p.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),bt=`R2: ${v.length} bucket(s) declared but ${me} is not set, skipping.`;return h(bt),y.warnings.push(bt),y}let P=p.dryRun===!0,L=new ai({apiToken:p.apiToken,accountId:p.accountId,fetch:p.fetch}),z=new H(p.apiToken,{zoneId:p.zoneId,accountId:p.accountId}),fe=new Map;for(let[me,bt]of v){let It=bt?.name;if(!It||!Xg.test(It)){y.warnings.push(`R2: bucket '${me}' has an invalid name '${It??""}' (3-63 chars: lowercase letters, digits, hyphens), skipping.`);continue}h(`R2: ${P?"checking":"reconciling"} bucket ${It}...`);let mt={name:It,changes:[],domains:[]};if(y.buckets.push(mt),await hh(bt,{r2:L,cloudflare:z,dryRun:P,summary:mt,warnings:y.warnings,claimed:fe,log:h}),mt.changes.length===0)h(`R2: ${It} is in sync.`);else for(let Me of mt.changes)h(`R2: ${It}: ${Me}`)}return y}async function hh(u,p){let{r2:h,dryRun:y,summary:R,warnings:v}=p,P=u.name,L={jurisdiction:u.jurisdiction},z=(mt,Me)=>{let ze=y?Me&&`would ${Me}`:mt;if(ze)R.changes.push(ze)},fe;if(y)fe=await h.getBucket(P,L)!==null;else{let{created:mt}=await h.ensureBucket(P,{locationHint:u.locationHint,jurisdiction:u.jurisdiction});if(fe=!0,mt)z("created","")}if(!fe)z("","create bucket");let me=Ch(u.customDomains);await ro(p,`cors on ${P}`,async()=>{if(!u.cors)return;if(!fe){z("cors updated","set cors");return}let mt=await h.getCors(P,L);if(xs(mt,u.cors))return;if(!y)await h.putCors(P,u.cors,L);z(u.cors.length===0?"cors removed":"cors updated",u.cors.length===0?"remove cors":"update cors")}),await ro(p,`lifecycle on ${P}`,async()=>{if(!u.lifecycle)return;let mt=u.lifecycle.map(ap);if(fe){let Me=await h.getLifecycle(P,L);if(Fs(Me,mt))return}if(!y)await h.putLifecycle(P,mt,L);z("lifecycle updated","update lifecycle")}),await ro(p,`r2.dev URL on ${P}`,async()=>{let mt=u.publicDevUrl===!0;if(!fe){if(mt)z("r2.dev URL enabled","enable r2.dev URL");return}if((await h.getManagedDomain(P,L))?.enabled===mt)return;if(!y)await h.setManagedDomain(P,mt,L);z(mt?"r2.dev URL enabled":"r2.dev URL disabled",mt?"enable r2.dev URL":"disable r2.dev URL")});let bt=[];if(me.length>0&&fe)try{bt=await h.listCustomDomains(P,L)}catch(mt){if(mt instanceof hn)throw mt;v.push(`R2: could not list custom domains on ${P}: ${Kc(mt)}`)}let It=new Map;for(let{domain:mt,minTLS:Me}of me){let ze=p.claimed.get(mt);if(ze&&ze!==P){v.push(`R2: ${mt} is declared on both ${ze} and ${P}; leaving it on ${ze}.`);continue}p.claimed.set(mt,P);let j=bt.find((G)=>G.domain.toLowerCase()===mt),yt=Me??"1.2";if(j&&j.enabled&&(j.minTLS??"1.0")===yt){if(R.domains.push({domain:mt,status:jc(j)}),j.zoneId)It.set(mt,j.zoneId);continue}await ro(p,`custom domain ${mt} on ${P}`,async()=>{if(j){if(!y)await h.updateCustomDomain(P,j.domain,{enabled:!0,minTLS:yt},L);if(z(`custom domain ${mt} updated`,`update custom domain ${mt}`),R.domains.push({domain:mt,status:jc({...j,enabled:!0})}),j.zoneId)It.set(mt,j.zoneId);return}let G=await p.cloudflare.zoneIdFor(mt);if(It.set(mt,G),!y)await h.ensureCustomDomain(P,{domain:mt,zoneId:G,minTLS:yt},L,bt);z(`custom domain ${mt} attached`,`attach custom domain ${mt}`),R.domains.push({domain:mt,status:y?"not attached":"pending"})},()=>R.domains.push({domain:mt,status:"error"}))}if(u.cache&&me.length>0)await yh(u,me.map((mt)=>mt.domain).filter((mt)=>p.claimed.get(mt)===P),It,p,z)}async function yh(u,p,h,y,R){let v=ip(u.cache);if(!v||p.length===0)return;let P=new Map;for(let L of p){let z=h.get(L);if(!z)try{z=await y.cloudflare.zoneIdFor(L)}catch(fe){y.warnings.push(`R2: could not resolve the zone for ${L}, cache rule skipped: ${Kc(fe)}`);continue}P.set(z,[...P.get(z)??[],L])}for(let L of P.values()){let z={action:"set_cache_settings",description:`${jt} ${Yg}`,expression:`(${qt(L)})`,enabled:!0,action_parameters:v};await ro(y,`cache rule for ${L.join(", ")}`,async()=>{let fe=await y.cloudflare.getPhaseRules(L[0],"http_request_cache_settings");if(sp(fe,z))return;if(!y.dryRun){let me=await y.cloudflare.putManagedPhaseRules(L[0],"http_request_cache_settings",[z]);if(!me.success)throw Error(me.message||"cache rule write failed")}R(`cache rule updated for ${L.join(", ")}`,`update cache rule for ${L.join(", ")}`)})}}function ip(u){if(u.edgeTtl===void 0&&u.browserTtl===void 0)return null;let p={cache:!0};if(u.edgeTtl!==void 0)p.edge_ttl={mode:"override_origin",default:u.edgeTtl};if(u.browserTtl!==void 0)p.browser_ttl={mode:"override_origin",default:u.browserTtl};return p}function sp(u,p){let h=zt(p.expression),y=zn(p.expression),R=(L)=>(L.description||"").startsWith(jt),v=(L)=>L.action===p.action&&L.description===p.description&&(L.enabled??!0)===(p.enabled??!0)&&zn(L.expression)===y&&Ms(L.action_parameters)===Ms(p.action_parameters),P=!1;for(let L of u){if(!R(L))continue;let z=zt(L.expression);if(!h.some((me)=>z.includes(me)))continue;if(v(L)&&h.every((me)=>z.includes(me))&&!P){P=!0;continue}return!1}return P}function ap(u){let p={id:u.id,enabled:u.enabled??!0,conditions:{prefix:u.prefix??""}};if(u.expireAfterDays!==void 0)p.deleteObjectsTransition={condition:{type:"Age",maxAge:Gc(u.expireAfterDays)}};else if(u.expireOn!==void 0)p.deleteObjectsTransition={condition:{type:"Date",date:u.expireOn}};if(u.abortMultipartUploadsAfterDays!==void 0)p.abortMultipartUploadsTransition={condition:{type:"Age",maxAge:Gc(u.abortMultipartUploadsAfterDays)}};if(u.infrequentAccessAfterDays!==void 0)p.storageClassTransitions=[{storageClass:"InfrequentAccess",condition:{type:"Age",maxAge:Gc(u.infrequentAccessAfterDays)}}];return p}function Gc(u){return Math.round(u*86400)}function Ch(u){let p=new Set,h=[];for(let y of u??[]){let R=typeof y==="string"?{domain:y}:y,v=R.domain?.trim().replace(/\.$/,"").toLowerCase();if(!v||p.has(v))continue;p.add(v),h.push({domain:v,minTLS:R.minTLS})}return h}function jc(u){if(!u.enabled)return"disabled";let p=u.status?.ownership,h=u.status?.ssl;if(p==="active"&&h==="active")return"active";for(let y of[p,h])if(y==="error"||y==="blocked"||y==="deactivated")return y;return"pending"}async function ro(u,p,h,y){try{await h()}catch(R){if(R instanceof hn)throw R;u.warnings.push(`R2: ${p} failed: ${Kc(R)}`),y?.()}}function Kc(u){return u instanceof Error?u.message:String(u)}function Ms(u){if(Array.isArray(u))return`[${u.map(Ms).join(",")}]`;if(u&&typeof u==="object")return`{${Object.entries(u).filter(([,h])=>h!==void 0).sort(([h],[y])=>h.localeCompare(y)).map(([h,y])=>`${JSON.stringify(h)}:${Ms(y)}`).join(",")}}`;return JSON.stringify(u)}import{basename as wh,extname as Ih}from"node:path";import{createHash as Sh}from"node:crypto";var Rh="https://api.cloudflare.com/client/v4",$n="TS_CLOUD_CONTENT_HASH",no="2025-09-01",Zc="application/javascript+module",bh=10007,Ah=[1e4,9109];class li extends Error{status;errors;constructor(u,p,h=[]){super(u);this.name="WorkersApiError",this.status=p,this.errors=h}hasCode(u){return this.errors.some((p)=>p.code===u)}}class Bs extends li{permission;constructor(u,p,h,y=[]){super(`The Cloudflare API token is missing the "${u}" permission (${p}). Edit the token in the Cloudflare dashboard (My Profile, API Tokens), add it, then re-run the deploy.`,h,y);this.name="WorkersPermissionError",this.permission=u}}class Zs{name="cloudflare-workers";apiToken;accountId;fetchImpl;constructor(u){if(!u.apiToken)throw Error("Cloudflare Workers needs an API token");if(!u.accountId)throw Error("Cloudflare Workers needs an account id");this.apiToken=u.apiToken,this.accountId=u.accountId,this.fetchImpl=u.fetch??((p,h)=>fetch(p,h))}async request(u,p,h){let y={Authorization:`Bearer ${this.apiToken}`},R;if(h instanceof FormData)R=h;else if(h!==void 0)y["Content-Type"]="application/json",R=JSON.stringify(h);let v=await this.fetchImpl(`${Rh}/accounts/${this.accountId}/workers${p}`,{method:u,headers:y,body:R}),P=await v.text(),L;try{L=JSON.parse(P)}catch{throw new li(`Cloudflare Workers API returned ${v.status} with a non-JSON body: ${P.slice(0,200)}`,v.status)}if(!L.success){let z=L.errors??[],fe=z.map((me)=>`${me.code}: ${me.message}`).join(", ");if(Ph(v.status,z))throw new Bs($h(p),`${u} ${p} -> ${v.status}${fe?`, ${fe}`:""}`,v.status,z);throw new li(`Cloudflare Workers API error (${v.status}) on ${u} ${p}: ${fe||P.slice(0,200)}`,v.status,z)}return L.result}scriptPath(u){return`/scripts/${encodeURIComponent(u)}`}async getSettings(u){try{return await this.request("GET",`${this.scriptPath(u)}/settings`)}catch(p){if(p instanceof Bs)throw p;if(p instanceof li&&(p.hasCode(bh)||p.status===404))return null;throw p}}async getScript(u){return this.getSettings(u)}async uploadModuleScript(u,p){return this.request("PUT",this.scriptPath(u),lp(p))}async ensureModuleScript(u,p){let h=so(p),y=await this.getSettings(u);if(y&&Ja(y,p,h))return{action:"unchanged",hash:h};return await this.uploadModuleScript(u,up(p,h)),{action:y?"updated":"created",hash:h}}async listCustomDomains(u={}){let p=new URLSearchParams;if(u.service)p.set("service",u.service);if(u.hostname)p.set("hostname",u.hostname);if(u.zoneId)p.set("zone_id",u.zoneId);let h=p.toString(),y=h?`?${h}`:"";return await this.request("GET",`/domains${y}`)??[]}async attachCustomDomain(u,p){let h={hostname:u,service:p.service,environment:p.environment??"production"};if(p.zoneId)h.zone_id=p.zoneId;return this.request("PUT","/domains",h)}async detachCustomDomain(u){await this.request("DELETE",`/domains/${encodeURIComponent(u)}`)}async ensureCustomDomain(u,p,h){let R=(h??await this.listCustomDomains({hostname:u})).find((P)=>P.hostname.toLowerCase()===u.toLowerCase());if(R&&R.service===p.service)return{action:"unchanged",domain:R};if(R)throw Error(`${u} is attached to the Worker '${R.service}'. Detach it there first (Workers & Pages, ${R.service}, Settings, Domains & Routes); ts-cloud does not move it.`);let v=await this.attachCustomDomain(u,p);return{action:"attached",domain:{...v,hostname:v?.hostname||u}}}}function Ph(u,p){if(p.some((h)=>Ah.includes(h.code)))return!0;return(u===401||u===403)&&p.length===0}function $h(u){if(u.startsWith("/domains"))return"Workers Routes: Edit (zone, for Workers custom domains) and Workers Scripts: Edit (account)";return"Workers Scripts: Edit (account)"}function lp(u){if(!u.modules.some((y)=>y.name===u.mainModule))throw Error(`Worker main module '${u.mainModule}' is not one of the uploaded modules`);let p={main_module:u.mainModule,bindings:u.bindings??[],compatibility_date:u.compatibilityDate??no,compatibility_flags:u.compatibilityFlags??[],keep_bindings:["secret_text"]},h=new FormData;h.append("metadata",JSON.stringify(p));for(let y of u.modules)h.append(y.name,new Blob([y.content],{type:y.type}),y.name);return h}function so(u){let p={mainModule:u.mainModule,modules:[...u.modules].sort((h,y)=>h.name.localeCompare(y.name)).map((h)=>({name:h.name,type:h.type,sha256:cp(h.content)})),bindings:[...u.bindings??[]].filter((h)=>h.name!==$n).sort((h,y)=>h.name.localeCompare(y.name)),compatibilityDate:u.compatibilityDate??no,compatibilityFlags:[...u.compatibilityFlags??[]].sort()};return cp(qc(p))}function up(u,p=so(u)){return{...u,bindings:[...(u.bindings??[]).filter((h)=>h.name!==$n),{type:"plain_text",name:$n,text:p}]}}function Ja(u,p,h){let y=u.bindings??[],R=y.find((v)=>v.name===$n&&v.type==="plain_text");if(!R||R.text!==h)return!1;return(p.bindings??[]).every((v)=>{let P=y.find((z)=>z.name===v.name);if(!P||P.type!==v.type)return!1;let L=v.type==="r2_bucket"?"bucket_name":v.type==="plain_text"?"text":void 0;return!L||P[L]===v[L]})}function cp(u){return Sh("sha256").update(u).digest("hex")}function qc(u){if(Array.isArray(u))return`[${u.map(qc).join(",")}]`;if(u&&typeof u==="object")return`{${Object.entries(u).filter(([,h])=>h!==void 0).sort(([h],[y])=>h.localeCompare(y)).map(([h,y])=>`${JSON.stringify(h)}:${qc(y)}`).join(",")}}`;return JSON.stringify(u)}async function Jc(u){if(!await Bun.file(u).exists())throw Error(`Worker entry not found: ${u}`);let p;try{p=await Bun.build({entrypoints:[u],target:"browser",format:"esm",minify:!0,external:["cloudflare:*"]})}catch(R){throw Error(`Bundling Worker ${u} failed: ${Dh(R)}`)}if(!p.success)throw Error(`Bundling Worker ${u} failed: ${p.logs.map((R)=>String(R.message??R)).join("; ")}`);if(p.outputs.length!==1)throw Error(`Bundling Worker ${u} produced ${p.outputs.length} files (${p.outputs.map((R)=>R.path).join(", ")}); a Worker is uploaded as a single module, so remove the dynamic imports or asset imports that split it.`);let h=p.outputs[0];if(h.kind!=="entry-point")throw Error(`Bundling Worker ${u} produced a ${h.kind} instead of an entry module`);let y=await h.text();return{name:`${wh(u,Ih(u))}.js`,content:y,type:Zc,size:new TextEncoder().encode(y).byteLength}}function Dh(u){if(u instanceof AggregateError&&u.errors.length>0)return u.errors.map((p)=>p instanceof Error?p.message:String(p?.message??p)).join("; ");return u instanceof Error?u.message:String(u)}import{isAbsolute as kh,resolve as Oh}from"node:path";var Nh="https://api.cloudflare.com/client/v4",xh=/^[a-z0-9][a-z0-9_-]{0,62}$/;async function Lh(u,p={}){let h=p.log??(()=>{}),y={workers:[],warnings:[]},R=Object.entries(u.infrastructure?.workers??u.workers??{});if(R.length===0)return h("Workers: none declared, skipping."),y;if(!p.apiToken||!p.accountId){let L=[!p.apiToken&&"CLOUDFLARE_API_TOKEN",!p.accountId&&"CLOUDFLARE_ACCOUNT_ID"].filter(Boolean).join(" and "),z=`Workers: ${R.length} Worker(s) declared but ${L} is not set, skipping.`;return h(z),y.warnings.push(z),y}let v=u.infrastructure?.r2??u.r2,P={workers:new Zs({apiToken:p.apiToken,accountId:p.accountId,fetch:p.fetch}),r2:new ai({apiToken:p.apiToken,accountId:p.accountId,fetch:p.fetch}),cloudflare:new H(p.apiToken,{zoneId:p.zoneId,accountId:p.accountId}),apiToken:p.apiToken,fetch:p.fetch??((L,z)=>fetch(L,z)),projectRoot:p.projectRoot??process.cwd(),dryRun:p.dryRun===!0,warnings:y.warnings,log:h,r2ConfigDomains:zh(v),r2Buckets:v,claimed:new Map};for(let[L,z]of R){let fe=z?.name;if(!fe||!xh.test(fe)){y.warnings.push(`Workers: '${L}' has an invalid name '${fe??""}' (1-63 chars: lowercase letters, digits, '-' and '_'), skipping.`);continue}if(!z.entry){y.warnings.push(`Workers: ${fe} has no entry, skipping.`);continue}h(`Workers: ${P.dryRun?"checking":"reconciling"} ${fe}...`);let me={name:fe,changes:[],domains:[]};y.workers.push(me),await Fh(z,me,P);for(let bt of me.changes)h(`Workers: ${fe}: ${bt}`)}return y}async function Fh(u,p,h){let y=u.name,R=kh(u.entry)?u.entry:Oh(h.projectRoot,u.entry),v;try{v=await Jc(R)}catch(L){throw Error(`Worker ${y}: ${di(L)}`)}p.changes.push(`bundled ${Uh(v.size)}`);let P={mainModule:v.name,modules:[{name:v.name,content:v.content,type:v.type}],bindings:dp(u,h),compatibilityDate:u.compatibilityDate??no,compatibilityFlags:u.compatibilityFlags??[]};if(h.dryRun){let L=await h.workers.getSettings(y);p.changes.push(L&&Ja(L,P,so(P))?"unchanged":"would upload")}else{let{action:L}=await h.workers.ensureModuleScript(y,P);p.changes.push(L==="unchanged"?"unchanged":"uploaded")}for(let L of Hh(u.customDomains))await _h(y,L,p,h)}async function _h(u,p,h,y){let R=(mt)=>{h.domains.push({domain:p,status:mt})},v=(mt)=>{y.warnings.push(`Workers: ${mt}`),R("conflict")},P=y.claimed.get(p);if(P&&P!==u){v(`${p} is declared on both ${P} and ${u}; leaving it on ${P}.`);return}y.claimed.set(p,u);let L=y.r2ConfigDomains.get(p);if(L){v(`${p} is also declared as a custom domain of the R2 bucket '${L}' (r2.buckets). A hostname serves either a bucket or a Worker. Remove it from the bucket's customDomains and detach it in the dashboard (R2, ${L}, Settings, Custom Domains) first; to serve the bucket through the Worker, bind it with bindings.r2Buckets instead.`);return}let z=await Bh(y);if(z===null){R("error");return}let fe=z.find((mt)=>mt.hostname.toLowerCase()===p);if(fe?.service===u){R("active");return}if(fe){v(`${p} is attached to the Worker '${fe.service}'. Detach it there first (Workers & Pages, ${fe.service}, Settings, Domains & Routes); it is not moved automatically.`);return}let me=(await Wh(y))?.get(p);if(me){v(`${p} is attached to the R2 bucket '${me}' as a custom domain. Detach it first (R2, ${me}, Settings, Custom Domains, then re-run the deploy); it is not detached automatically. To serve the bucket through the Worker, bind it with bindings.r2Buckets.`);return}let bt;try{bt=await y.cloudflare.zoneIdFor(p)}catch(mt){y.warnings.push(`Workers: could not resolve the zone for ${p}, not attached: ${di(mt)}`),R("error");return}let It=await Vh(y,bt,p);if(It.length>0){let mt=It.map((Me)=>`${Me.type} ${Me.content}`).join(", ");v(`${p} already has a DNS record (${mt}). A Worker custom domain creates its own record, so Cloudflare will not attach over it. Delete the record first (DNS, Records), then re-run the deploy; it is not deleted automatically.`);return}if(y.dryRun){h.changes.push(`would attach custom domain ${p}`),R("not attached");return}try{await y.workers.ensureCustomDomain(p,{service:u,zoneId:bt},z),h.changes.push(`custom domain ${p} attached`),z.push({id:"",hostname:p,service:u,zone_id:bt}),R("pending")}catch(mt){y.warnings.push(`Workers: custom domain ${p} on ${u} failed: ${di(mt)}`),R("error")}}async function Bh(u){if(u.attached!==void 0)return u.attached;try{u.attached=await u.workers.listCustomDomains()}catch(p){u.warnings.push(`Workers: could not list Worker custom domains, none attached: ${di(p)}`),u.attached=null}return u.attached}async function Wh(u){if(u.r2AccountDomains!==void 0)return u.r2AccountDomains;let p=new Map;try{let h=(await u.r2.listBuckets()).map((y)=>({name:y.name}));for(let y of Object.values(u.r2Buckets?.buckets??{}))if(y.jurisdiction&&y.jurisdiction!=="default")h.push({name:y.name,jurisdiction:y.jurisdiction});for(let y of h){let R=await u.r2.listCustomDomains(y.name,{jurisdiction:y.jurisdiction}).catch(()=>[]);for(let v of R)p.set(v.domain.toLowerCase(),y.name)}u.r2AccountDomains=p}catch(h){u.log(`Workers: could not check R2 custom domains (${di(h)}); relying on the DNS check.`),u.r2AccountDomains=null}return u.r2AccountDomains}async function Vh(u,p,h){try{let y=await u.fetch(`${Nh}/zones/${p}/dns_records?name=${encodeURIComponent(h)}&per_page=100`,{method:"GET",headers:{Authorization:`Bearer ${u.apiToken}`}}),R=await y.json();if(!R?.success)throw Error(`HTTP ${y.status}`);return(R.result??[]).filter((v)=>v.name?.toLowerCase()===h).map((v)=>({type:v.type??"?",content:v.content??""}))}catch(y){return u.log(`Workers: could not read DNS records for ${h} (${di(y)}); attaching anyway.`),[]}}function dp(u,p){let h=[],y=new Set,R=(P)=>{if(P===$n)return p.warnings.push(`Workers: ${u.name}: binding name ${$n} is reserved for ts-cloud, ignored.`),!1;if(y.has(P))return p.warnings.push(`Workers: ${u.name}: binding ${P} is declared twice; the first one wins.`),!1;return y.add(P),!0},v=new Map;for(let P of Object.values(p.r2Buckets?.buckets??{}))if(P.jurisdiction&&P.jurisdiction!=="default")v.set(P.name,P.jurisdiction);for(let[P,L]of Object.entries(u.bindings?.r2Buckets??{})){if(!R(P))continue;let z=v.get(L);h.push(z?{type:"r2_bucket",name:P,bucket_name:L,jurisdiction:z}:{type:"r2_bucket",name:P,bucket_name:L})}for(let[P,L]of Object.entries(u.bindings?.vars??{}))if(R(P))h.push({type:"plain_text",name:P,text:String(L)});return h}function zh(u){let p=new Map;for(let h of Object.values(u?.buckets??{}))for(let y of h?.customDomains??[]){let R=pp(typeof y==="string"?y:y.domain);if(R)p.set(R,h.name)}return p}function Hh(u){return[...new Set((u??[]).map(pp).filter(Boolean))]}function pp(u){return(u??"").trim().replace(/\.$/,"").toLowerCase()}function Uh(u){if(u<1024)return`${u} B`;if(u<1048576)return`${(u/1024).toFixed(1)} KB`;return`${(u/1024/1024).toFixed(1)} MB`}function di(u){return u instanceof Error?u.message:String(u)}export{Pl as ABTestManager,ye as ACMClient,Br as ACMDnsValidator,ld as ACME_DIRECTORIES,Oe as AI,uu as API_IDEMPOTENCY_TTL_MS,du as API_TOKEN_DEFAULT_TTL_MS,lu as API_TOKEN_MAX_TTL_MS,ms as API_VERSION,Ie as AUTHORIZATION_CAPABILITIES,su as AUTH_ACTION_TOKEN_TTL_MS,ou as AUTH_MFA_CHALLENGE_TTL_MS,au as AUTH_OIDC_TRANSACTION_TTL_MS,it as AUTH_SESSION_ABSOLUTE_TTL_MS,iu as AUTH_SESSION_IDLE_TTL_MS,Ey as AWSAPIError,n as AWSClient,A as AWSCloudFormationClient,I as AWSCloudFrontClient,Tl as AWSConfigManager,JI as AWS_PSEUDO_PARAMETERS,_e as AWS_REGIONS,Fg as AcmeClient,nn as AlertEvaluator,Gi as AlertStore,No as AnomalyConfigStore,ml as ApiGateway,i as ApiServiceError,vc as ApplicationAutoScalingClient,un as Arn,_ as AssetHasher,Y as Auth,ds as AuthenticationStore,Ki as AutomationApiService,ls as AutomationIdentityStore,Ba as AwsAuroraDataAdapter,$a as AwsAuroraTransport,tc as AwsDatabaseBackupSource,_r as AwsDriver,xa as AwsElastiCacheDataAdapter,Ma as AwsElastiCacheTransport,Zf as AwsIamCapabilityScanner,oc as AwsInfrastructureBackupSource,Na as AwsRdsDataAdapter,La as AwsRdsTransport,gh as AwsRegionalDriver,cc as AwsSecretsManagerConfigurationBackend,fm as AwsSpendTransport,dc as AwsSsmConfigurationBackend,Ts as BackupCoordinator,El as BackupManager,Za as BackupStore,Df as BatchProcessingManager,Hn as BedrockClient,Qn as BedrockRuntimeClient,yu as BitbucketSourceAdapter,Dl as BlueGreenManager,yf as BounceComplaintHandler,df as BuildOptimizationManager,Uu as BunDockerRuntime,hg as BunDockerVolumeRuntime,fg as BunFilesystemArchiveRuntime,Ce as CDN,Jo as CHAIN_HEADER,jt as CLOUDFLARE_MANAGED_RULE_PREFIX,dl as CLOUDFRONT_FAILOVER_STATUS_CODES,LC as COMMON_CROSS_ACCOUNT_ROLES,$n as CONTENT_HASH_BINDING,Ke as CONTROL_PLANE_SCHEMA_VERSION,Vo as Cache,rs as CanaryManager,of as CertificateManager,OA as CloudBlockVolumeDriver,io as CloudDriverFactory,tt as CloudError,Bm as CloudFormationBuilder,A as CloudFormationClient,I as CloudFrontClient,wl as CloudTrailManager,we as CloudWatchLogsClient,dd as CloudflarePagesProvider,H as CloudflareProvider,Vy as CommandHistory,ee as Communication,Yr as ComposeApplicationService,sr as ComposeApplicationStore,Qt as ComprehendClient,a as Compute,hm as ComputeSpendTransport,zo as ConfigurationError,uc as ConfigurationService,ac as ConfigurationStore,Mn as ConnectClient,_a as ContainerDataAdapter,Ol as ContainerRegistryManager,sc as ControlPlaneBackupSource,Wa as ControlPlaneCleanupDriver,Li as ControlPlaneStore,Do as CounterTracker,Bt as CredentialError,zm as CrossRegionReferenceManager,dy as DASHBOARD_ENTRY,ly as DASHBOARD_PORT_BASE,uy as DASHBOARD_PORT_SPAN,cy as DASHBOARD_STATE_DIR,sa as DEFAULT_ATTACK_MODE_HOURS,no as DEFAULT_COMPATIBILITY_DATE,Yd as DEFAULT_DDOS_THRESHOLDS,Im as DEFAULT_FAILOVER_STATUS_CODES,xd as DEFAULT_METER_MAPPINGS,Nd as DEFAULT_PRICE_BOOK,mn as DEFAULT_RECURSION_LIMITS,uo as DEFAULT_RPX_CERTS_DIR,te as DEFAULT_SERVICE_LIMITS,rl as DEFAULT_STATE_DIR,Pg as DEFAULT_STATIC_ASSET_EXTENSIONS,iy as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,zA as DEFAULT_TELEMETRY_POLICY,Zp as DEFAULT_THRESHOLDS,PA as DEPLOYMENT_QUEUE_KINDS,Wo as DEPTH_HEADER,tn as DETECTABLE_SIGNALS,_u as DIAGNOSTIC_PRESETS,Rf as DLQMonitoringManager,W as DNS,hf as DNSSECManager,ys as DataServiceLifecycle,ka as DataServiceStore,lr as Database,nf as DatabaseUserManager,q as DebugLogger,ny as DependencyGraph,Z as Deployment,Cy as DeploymentError,vl as DisasterRecoveryManager,Jn as DnsProviderFactory,Sr as DockerDataTransport,va as DockerDiscoveryAdapter,Xr as DockerNamedVolumeDriver,ic as DockerVolumeBackupSource,c as DurableOperationQueue,bo as DurableQueueWorker,Ue as DynamoDBClient,Gr as EC2Client,He as ECRClient,dt as ECSClient,Dr as EFSClient,Ic as ELBv2Client,LA as ENFORCEMENT_ACTIONS,Qi as ENFORCEMENT_DESCRIPTIONS,O as ENFORCEMENT_SEVERITY,Rp as ENVIRONMENT_LABEL,xu as EcsRuntimeAdapter,ia as EdgeRateLimiter,ut as ElastiCacheClient,f as Email,Cf as EmailAdvanced,Sf as EmailAnalyticsManager,jn as EmailClient,Ef as EmailHandlers,bf as EmailTemplateManager,Fa as EncryptedDataSecretStore,vy as ErrorCodes,wr as EventBridgeClient,dh as EventBridgeJobAdapter,lc as ExternalConfigurationBackend,Go as FAILOVER_REPLICA_POLICY_SID,wf as FIFOQueueManager,Gh as FLY_MACHINES_API,am as FOCUS_VERSION,Al as FileCache,Ze as FileSystem,rc as FilesystemBackupSource,Qa as FleetService,Ua as FleetStore,$s as FlyApiError,fp as FlyClient,e as Fn,Su as GiteaSourceAdapter,hu as GithubSourceAdapter,Au as GitlabSourceAdapter,Km as GlobalResourceManager,Ge as GoDaddyProvider,Rl as GuardDutyManager,Et as HOST_SITES_DIR,Dy as HashCache,Uf as HealthCheckManager,Je as HealthCheckRunner,Ur as HetznerClient,Pe as HetznerDriver,Re as IAMClient,Oc as IPV6_EXCLUDED_HOST_LABELS,cf as ImageScanningManager,vp as InfrastructureGenerator,Id as InvalidOperationTransitionError,kt as JobLoader,lh as JobProviderReconciler,Da as JobService,Pa as JobStore,Tr as KendraClient,Mf as LARAVEL_SERVERLESS_BUILD_STEPS,T as LambdaClient,gf as LambdaConcurrencyManager,ff as LambdaDLQManager,pf as LambdaDestinationsManager,lf as LambdaLayersManager,Ou as LambdaRuntimeAdapter,mf as LambdaVPCManager,uf as LambdaVersionsManager,xn as LocalEncryptedConfigurationBackend,nc as LogicalDatabaseBackupSource,Nl as LogsManager,uS as MANAGED_NODE_VERSIONS,id as MANAGEMENT_DASHBOARD_SITE,xm as MANAGEMENT_DASHBOARD_SITE_PREFIX,as as MAX_CONTROL_HOURS,bd as MAX_CONTROL_PLANE_ERROR_BYTES,Kp as MAX_CONTROL_PLANE_JSON_BYTES,To as METERS,_A as METER_KEYS,$A as MICRO_CENTS,em as MIN_PROJECTION_CONFIDENCE,Og as MTA_STS_PORT,Ka as MaintenanceService,za as MaintenanceStore,le as Messaging,ef as MetricsManager,tf as MigrationManager,Hm as MockCloudFormation,Vm as MockDynamoDB,Gm as MockS3,qo as Monitoring,Xm as MultiAccountManager,jm as MultiRegionManager,My as MultiStepProgress,S as Network,Qf as NetworkSecurityManager,Vi as NotificationRouter,Em as ORIGIN_CONNECTION_ATTEMPTS,vm as ORIGIN_CONNECTION_TIMEOUT,bm as ORIGIN_GROUP_ALLOWED_METHODS,zI as ORIGIN_GROUP_ID_SUFFIX,Cm as ORIGIN_GROUP_SELECTION_CRITERIA,bc as OpenSearchClient,vt as OptimisticConcurrencyError,Ym as OrganizationManager,Hg as PAGES_MAX_FILE_BYTES,bS as PHP_DEFAULT_EXCLUDES,gS as PHP_LAYER_EXTENSIONS,wp as PROJECT_LABEL,pt as PROXIABLE_RECORD_TYPES,D as ParameterStore,rf as PerformanceManager,de as Permissions,Cc as PersonalizeClient,et as Phone,vf as PhoneAdvanced,km as PhoneHandlers,Ga as PlacementService,Ha as PlacementStore,Gn as PollyClient,he as PorkbunProvider,Cn as PreDeployScanner,bl as PreviewEnvironmentManager,Jr as PreviewEnvironmentService,We as PreviewEnvironmentStore,Cl as PreviewNotificationService,$y as ProgressBar,kl as ProgressiveDeploymentManager,oa as ProtectionControlStore,ry as Pseudo,J as Queue,$i as QueueCancellationError,Pf as QueueManagementManager,LI as QueuePresets,Io as QueueTimeoutError,Fn as R2ApiError,hn as R2NotEnabledError,ai as R2Provider,rp as R2_NOT_ENABLED_ERROR_CODE,Jl as RATE_LIMIT_KEY_SEPARATOR,ne as RDSClient,jy as RECOMMENDED_ACCOUNT_STRUCTURES,_C as RECOMMENDED_SCPS,Wf as RELEASE_QUEUE_KINDS,Qy as REPL,Gy as REPLCommandBuilder,Hy as REPLContext,Dp as ROLE_LABEL,Py as RateLimiter,$I as RealtimePresets,cm as RecordingSpendTransport,is as RecursionGuard,Nt as Redirects,Wm as RegionPairManager,qa as RegionService,Va as RegionStore,Ye as Registry,Ht as RekognitionClient,xt as ReleaseService,fa as ReleaseStore,uh as RemoteBuildService,Bl as ReplicaManager,Hf as ResourceManagementManager,ae as RetryableOperationError,b as Route53Client,Sc as Route53DomainsClient,ie as Route53Provider,Af as Route53ResolverManager,Ll as Route53RoutingManager,ve as RuntimeOperationService,wa as RuntimeStreamRegistry,ec as S3BackupDestinationAdapter,o as S3Client,V as S3Error,Cu as SECRET_PATTERNS,sm as SENSITIVITY_THRESHOLDS,gt as SESClient,X as SMS,lt as SNSClient,mm as SPEND_CYCLE_SECONDS,jd as SPEND_GATE_SETTING,XA as SPEND_LEASE_SETTING,pe as SQSClient,ke as SSH_BOOTSTRAP_VERSION,hi as SSH_PREFLIGHT_SCRIPT,Be as SSMClient,ym as STATE_DIR_ENV_VAR,wi as STATIC_SITE_ZONE_SETTINGS,ul as STORAGE_FAILOVER_METADATA_KEY,Te as STSClient,Vn as SchedulerClient,ur as Search,En as SecretFindingScanner,Yi as Secrets,xl as SecretsManager,re as SecretsManagerClient,sf as SecretsRotationManager,E as Security,mr as SecurityHubManager,bn as SecurityPostureStore,Ot as SecurityScannerRunner,af as SecurityScanningManager,If as SenderReputationManager,ch as ServerCronJobAdapter,Oa as ServerDataAdapter,vo as ServerPathVolumeDriver,_l as ServiceMeshManager,pl as Sftp,xo as SignalSource,Tf as SmsAdvanced,Vt as SmsClient,Nm as SmsHandlers,Rc as SmsVoiceClient,ha as SourceConnectionStore,Ar as SourceProviderError,zd as SpendCapError,rn as SpendGate,gm as SpendLoopLease,Mo as SpendNotificationRouter,pm as SpendRunner,ar as SpendService,Fi as SpendStore,Fy as Spinner,Qr as SshDriver,wn as SshFleetDriver,Jm as StackDependencyManager,WI as StacksIntegration,Ff as StaticSiteManager,xe as Storage,zl as StorageAdvancedManager,qn as SupportClient,fr as SyntheticsManager,Qu as SystemFleetSshTransport,St as SystemSshTransport,Ta as SystemdDiscoveryAdapter,Xo as TRACE_HEADER,Uy as TaskList,Rt as TelemetryStore,al as TemplateBuilder,yl as TemplateCache,Gt as TextractClient,Un as TranscribeClient,vr as TranslateClient,fh as TransportDisasterRecoveryDriver,mh as TransportPlatformMaintenanceDriver,Ss as TransportRemoteBuildDriver,Ca as TrivyImageScanner,ma as TsCloudApiError,gu as TsCloudClient,JA as URGENT_SPEND_EVENTS,tm as USER_VISIBLE_ACTIONS,ja as UnavailableRegionalDriver,Ae as UnifiedDnsValidator,Ao as UnsupportedSchemaVersionError,$m as ValidationError,Rr as VoiceClient,Eo as VolumeService,ir as VolumeStore,Zc as WORKER_MODULE_TYPE,li as WorkersApiError,Bs as WorkersPermissionError,Zs as WorkersProvider,ay as Workflow,Zm as XRayManager,tS as abTestManager,pu as activateImmutableRelease,Ig as addDns01ChallengeRecord,Dn as addSiteToCloudConfig,Lt as ageSeconds,_d as aggregateDeltas,qp as allocateSitePorts,Pm as amazonLinuxImageId,oy as amazonLinuxImageParameter,qI as analyzeStackDiff,Hi as anomalyOptionsForSignal,aa as applyControlsToDdos,tu as applyControlsToRateLimits,Vs as applyDeclaredZoneSettings,gi as applyHetznerVolumes,an as applyMitigationFactor,lA as applyPlan,Ks as applyZoneMigration,$l as artifactKey,Dt as assertOriginGroupMethods,us as assertReleaseStrategy,jA as assertSpendAllows,fA as attachConflicts,hA as attachIsViable,mA as attachPreconditions,Ru as attachProvenanceToRelease,Ea as attachSbomToRelease,Tu as attachVulnerabilitySummary,zf as authEncryptionKeyFile,x as authorizeOrganization,oh as authorizeRuntimePath,uC as autocomplete,Wy as awsConfigManager,pg as backupCredentialStatus,zy as backupManager,Lb as batch,wE as batchProcessingManager,ga as beginOidcAuthorization,Zy as blueGreenManager,IE as bounceComplaintHandler,Tt as budgetWindow,hc as buildAndPushServerlessImage,PE as buildBunRuntimeLayerZip,CA as buildCertificatePackScript,SA as buildCertificateStateScript,EA as buildCertificateUnpackScript,fl as buildCloudFormationTemplate,Yc as buildCloudInitFirstBoot,Td as buildComposeLogsCommand,OI as buildComposeRuntimeCommand,_I as buildComposeScaleCommand,wd as buildComposeShellCommand,ti as buildComputeStorageInstallScript,Lr as buildComputeStorageSiteScript,Hp as buildDrainSourceScript,tA as buildDrainedSiteScanScript,gl as buildFailoverReplicaPolicyStatement,br as buildFunctionEnv,Qp as buildHealthGateScript,ni as buildHostCleanupDeployScript,to as buildHostCleanupInstallScript,ri as buildHostCleanupScript,Oi as buildHostSitePortsScript,Ji as buildMailEnv,ao as buildManagementDashboardArtifact,qS as buildMediaCdnPlan,xg as buildMtaStsPolicy,Mh as buildMtaStsServer,DE as buildNodeRuntimeLayerZip,uE as buildOptimizationManager,ll as buildOriginGroup,ln as buildOriginGroups,kc as buildOriginGuardRule,Op as buildPauseWorkersScript,xE as buildPhpRuntimeLayerZip,Dm as buildReplicationConfiguration,Rm as buildReplicationRole,Mp as buildRestoreScript,B as buildRpxConfig,Ne as buildRpxFragmentRefreshScript,gA as buildSetHostnameScript,si as buildSiteDeployScript,$p as buildSnapshotScript,Gp as buildSourceStateScript,ci as buildSshArgs,mi as buildSshBootstrapScript,Pc as buildStaticSiteCacheRules,oi as buildStaticSiteDeployScript,Fp as buildTargetStateScript,lp as buildUploadForm,_p as buildWorkersStateScript,Jc as bundleWorker,Pu as bytes,ip as cacheRuleParameters,eS as canaryManager,Rn as canonicalJson,_t as capabilities,Ir as capacity,qb as categorizeChanges,cE as certificateManager,bA as certificatesMatch,wb as checkIAMPermissions,Of as checkInvocation,Db as checkServiceQuotas,ky as chunk,pR as cleanupDns01Challenge,DS as clearSigningKeyCache,ya as cloneSourceBinding,Ny as cloudConfigSchema,op as cloudDrivers,Jy as cloudTrailManager,gd as collectAssets,ta as collectPhpAppEntries,kg as collectServerDnsDomains,Wp as completeComposeVolumeDeletion,pa as completeOidcAuthorization,mb as composePresets,So as composeProjectName,Fl as composeServerlessAppTemplate,ZA as compositeSpendTransport,Ut as compressBackup,_S as config,Dc as configOrigins,Mu as connectionGuidance,aS as containerRegistryManager,RA as controlPlaneDatabaseFile,yd as controlPlaneMigrations,rb as createApiBackendPreset,ba as createApiV1Handler,VS as createAsgBuildDriver,mg as createBackupQueueHandlers,IS as createCliHandler,F as createCloudDriver,ed as createCloudFrontPolicy,Cb as createCredentialProvider,gb as createDashboardSite,ab as createDataPipelinePreset,Fu as createDataServiceQueueHandlers,Rd as createDeploymentQueueHandlers,N as createDnsProvider,GS as createEcsBuildDriver,Kd as createEnforcementHandlers,Mm as createError,hl as createExistingStaticFullStackPreset,Hu as createFleetQueueHandlers,tb as createFullStackAppPreset,Xs as createGoDaddyValidator,BE as createHandlers,yS as createHttpHandler,ib as createJamstackPreset,$u as createJobQueueHandlers,lb as createLaravelPreset,cb as createMLApiPreset,Wu as createMaintenanceQueueHandlers,zS as createMediaAccessToken,sb as createMicroservicesPreset,Zb as createMockAWS,YI as createNodeJsServerPreset,ZI as createNodeJsServerlessPreset,Ls as createObjectStorageClient,Js as createPorkbunValidator,fb as createPreset,ra as createPresignedUrl,ES as createPresignedUrlAsync,SS as createQueueHandler,ob as createRealtimeAppPreset,Vu as createRegionQueueHandlers,wu as createReleaseProvenance,fu as createReleaseQueueHandlers,QS as createRemoteBuildQueueHandlers,Ys as createRoute53Validator,sh as createRuntimeAdapters,by as createS3Client,HS as createServerBuildDriver,ub as createServerlessLaravelPreset,eb as createServerlessNodePreset,Dg as createSmsInfrastructure,ot as createSourceAdapter,XI as createStaticSitePreset,db as createTraditionalWebAppPreset,Dd as createVolumeQueueHandlers,nb as createWordPressPreset,rt as createZip,SC as crossRegionReferenceManager,On as dashboardActions,oo as dashboardCredentialsFile,Tn as dataServiceCapabilities,oE as databaseUserManager,nu as decodeBase32,Fe as decompressBackup,Th as decryptBackup,ca as defaultConfig,Qm as defaultLocalConfig,Yl as defaultRateLimitRules,Nr as delegateZone,Hs as delegateZoneFromConfig,dg as deleteFailoverReplicaBuckets,mc as deleteStaticSite,od as deployAllComputeSites,Xa as deployServerlessApp,lg as deploySite,co as deploySiteRelease,Ps as deployStaticSite,fc as deployStaticSiteFull,_n as deployStaticSiteWithExternalDns,Ln as deployStaticSiteWithExternalDnsFull,Zh as deployToFly,ol as deploymentCoexistenceError,gy as deriveManagementDashboardPort,Gs as describeDelegation,eu as describePosture,qs as describeZoneSettings,ah as desiredJobProviderState,im as detectAnomalies,Sm as detectDeploymentTargets,Nc as detectDnsProvider,Gd as detectLatestAnomaly,vb as detectMisconfigurations,Kl as detectServiceRegion,Ed as diffCompose,Hb as diffTemplates,Aa as discoverGitRefs,ua as discoverOidcProvider,ku as discoverRuntimeInventory,TE as dlqMonitoringManager,Bc as dnsProviders,yE as dnssecManager,rh as dockerWorkloads,Is as documentDigest,jc as domainStatus,Ky as drManager,qe as driverStatePath,Nu as ecsWorkloads,nr as effectiveCapabilities,bE as emailAnalyticsManager,EE as emailTemplateManager,cs as encodeBase32,vh as encryptBackup,Du as ensureDefaultSecurityPolicies,og as ensureFailoverReplicaBuckets,Ei as ensureFirewall,Ri as ensureManagementDashboard,vi as ensureServer,Ci as ensureSshKey,oe as escapeSecLang,$d as evaluateBudget,yi as evaluatePreflight,$o as evaluateTelemetryAlertRules,Lu as eventBridgeScheduleInput,AS as eventToRequest,GA as ewma,Cd as exportCompose,js as exportRoute53Zone,_m as extendPreset,vE as fifoQueueManager,_b as findChangedFiles,Xp as findMapping,Jp as findPriceEntry,qh as flyDeployOptions,Qc as flyIpType,yp as flyMachineConfig,UC as formatAccountStructure,AA as formatAttachPlan,nC as formatBytes,sn as formatCents,jI as formatDiff,nA as formatDrainedSiteRefusal,iC as formatDuration,pC as formatFlagSuggestions,hC as formatHistory,AC as formatHistoryStats,aA as formatInventory,oC as formatKeyValue,sC as formatList,dA as formatPlan,Ii as formatPreflightFindings,rC as formatProgressBar,qy as formatRegion,NC as formatRegionList,Yf as formatScanResults,aC as formatSuggestion,eC as formatTable,en as formatTimeToExhaustion,tC as formatTree,Ay as fromEC2Metadata,yy as fromECSMetadata,fy as fromEnvironment,hy as fromSharedCredentials,Sy as fromWebIdentity,Hl as functionFingerprint,mo as gatewayHostnames,Ql as generateAppImageDockerfile,eE as generateApprovalConfig,kf as generateBootstrap,Oy as generateCleanupWorkflow,_y as generateCostReportWorkflow,MC as generateCrossAccountRoleCF,Eu as generateCycloneDxSbom,XC as generateDeploymentConfig,jC as generateDeploymentPipeline,QC as generateDeploymentWorkflow,pc as generateExternalDnsStaticSiteTemplate,uR as generateHttpsServerCode,vu as generateImageSbom,lR as generateLetsEncryptUserData,t as generateLogicalId,JC as generateManualPipeline,qC as generateMatrixWorkflow,YC as generateMultiEnvConfig,zC as generateMultiEnvPipeline,HC as generateMultiEnvWorkflow,GC as generatePRPreviewWorkflow,tE as generateParallelConfig,$f as generatePhpFpmConfig,Nf as generatePhpLayerDockerfile,KC as generatePreviewPipeline,xy as generatePreviewWorkflow,r as generateResourceName,ZC as generateScheduledConfig,WC as generateScheduledPipeline,VC as generateScheduledWorkflow,Ds as generateStaticSiteTemplate,M as generateUbuntuAppCloudInit,Lm as getAccountId,EC as getAllRegions,DC as getClosestRegion,mC as getCommandUsage,DA as getComposeTemplate,Vf as getConfig,dC as getContextualHelp,es as getCredentials,jb as getDeploymentStrategy,zb as getDiffStats,Gb as getDiffSummary,Ty as getErrorDetails,Il as getLocalConfig,Xb as getLocalCredentials,Jb as getLocalEndpoint,Yb as getLocalEnvVars,Pb as getQuotaUsageSummary,$C as getRecommendedStructure,ts as getRegion,BC as getRegionStats,TC as getRegionsByCompliance,vC as getRegionsByLocation,wC as getRegionsByPricingTier,wy as getRequiredPermissions,PS as getSigningKeyCacheSize,Rg as getSmsInfrastructureStatus,MI as getTimestamp,na as globMatches,lo as globToRegex,IC as globalResourceManager,Ui as governingLimitCents,ag as grantFailoverReplicaAccess,Xy as guardDutyManager,Fo as handleSpendRequest,po as hasAutoWwwVariant,gr as hasManagementDashboardSite,Ad as hasProxyUpstream,Nb as hashBuffer,Bb as hashDirectory,Fm as hashFile,xb as hashManifest,Um as hashString,_E as healthCheckManager,Xn as hostAcceptsIpv6,qt as hostCondition,da as hotp,Zr as hourBucket,HA as hourBucketsBetween,lE as imageScanningManager,Es as infraEnvFromOutputs,Vl as inspectInvocation,fS as installRecursionFetch,Ns as invalidateCache,xf as invocationContext,sy as isArmInstanceType,cC as isLikelyTypo,Zn as isLocalDatabase,Wb as isLocalDevelopment,pr as isManagementDashboardSiteName,Pr as isNameserverRegistrar,kS as isNodeCryptoAvailable,Hd as isOperationAllowed,Lo as isQuietHours,Ho as isS3RestEndpoint,Pi as isSafePattern,il as isStateDirConfigured,sl as isStatePath,on as isValidCidr,RC as isValidRegion,Mi as isValidTimeZone,NS as isWebCryptoAvailable,kr as isZoneHost,vn as jobProviderCapability,_s as keyMatchesFilters,mE as lambdaConcurrencyManager,AE as lambdaDLQManager,fE as lambdaDestinationsManager,gE as lambdaLayersManager,hE as lambdaVPCManager,pE as lambdaVersionsManager,Bu as lambdaWorkloads,ql as laravelServerlessEnvDefaults,Wr as listComposeTemplates,ps as listSourceReferences,ru as loadCloudConfig,cr as loadTelemetryPolicy,nS as logsManager,Vd as lookbackHoursForSignal,ty as mailEnabled,Xe as mailFirewallPorts,dn as mailWebmailSites,ph as maintenanceWindowOpen,Gf as makeAWSRequest,TS as makeAWSRequestAsync,vS as makeAWSRequestOnce,sp as managedRuleInSync,Om as managementDashboardSiteName,qu as manifestDigest,An as matchTotpCounter,KS as mediaObjectHeaders,ko as median,rm as medianAbsoluteDeviation,Md as mergeDecisions,gn as mergeInfrastructure,UA as mergePriceBooks,Od as meterTelemetry,nE as metricsManager,Cg as migrateObjectStorage,iE as migrationManager,xC as multiAccountManager,yC as multiRegionManager,mR as needsRenewal,LE as networkSecurityManager,$t as nextScheduleRuns,De as normalizePublicIpv6,Le as normalizeRuntimeStatus,at as normalizeScheduleExpression,Jf as normalizeSourceEvent,Ve as normalizeSshPublicKey,dm as normalizeTelemetryPolicy,xi as occupiedHostPorts,Ia as openApiDocument,Oo as optionsForSignal,OC as organizationManager,jl as packagePhpApp,pn as packageServerlessApp,pd as pagesAssetHash,Gg as pagesDnsRecord,Sl as parallel,$b as parallelMap,Mb as parallelWithRetry,IA as parseCertificateState,Gl as parseChain,Kr as parseCompose,BI as parseComposeCatalog,th as parseDockerInspect,Ag as parseDotenv,rA as parseDrainedSites,_i as parseHostSiteFragments,RS as parseJSONResponse,Ai as parsePreflightFacts,Vp as parseSourceDrained,nh as parseSystemdRecords,Up as parseTargetReady,hd as parseUpstreamPort,Lp as parseWorkersPaused,wS as parseXMLResponse,ji as pathTemplate,md as pendingSteps,Po as percentOfLimit,sE as performanceManager,Ul as phpLayerBuildStage,pS as phpLayerPackages,fn as phpRuntimeLayerAssets,xI as planComposeTemplateUpgrade,Fd as planEnforcement,ui as planHetznerVolumes,Bp as planIsDestructive,Am as planMitigation,uA as planServerRename,vA as planSiteMove,zs as planZoneMigration,Kt as policyTag,Si as preflightFailed,By as previewManager,Ly as previewNotifications,Mt as previewSchedule,QA as previousBudgetWindow,wo as priceUsage,MA as priceUsageLines,sA as probeHostRoutes,Uc as probeOriginTls,Qb as processInChunks,Iu as processSourceWebhook,hs as productionChangeReview,rS as progressiveDeploymentManager,Ld as projectSpend,Yo as propagationHeaders,Ac as providerEndpoint,ju as publicKeyFingerprint,Kn as qualifyName,RE as queueManagementManager,Ob as quickHash,np as r2Endpoint,Jg as r2S3Credentials,Xl as rateLimitHeaders,os as rateLimitKey,je as readDriverState,oA as reconcile,Bg as reconcileAddressRecords,Wg as reconcileCloudflareCdn,Lh as reconcileCloudflareWorkers,Qs as reconcileDeclaredRecords,US as reconcileJobObservation,Qg as reconcileR2Buckets,In as reconcileSourceWebhook,fs as recordDashboardHostPosture,$S as recordPreDeploySecretScan,MS as recordSkippedSecretScan,Zo as recursionBlockedResponse,$e as redactRuntimeConfig,Xd as redactTelemetryText,qi as redactTelemetryValue,kn as redeployServerlessApp,bC as regionPairManager,Sn as releaseStrategyCapabilities,Kf as releaseTrafficPlan,Di as reloadRpxGateway,Os as remapKey,Ng as removeAddressRecords,vg as removeDns01ChallengeRecord,Pn as removeSiteFromCloudConfig,bu as removeSourceWebhook,xc as removeStaleServerAddressRecords,vd as renderComposeTemplate,Wi as renderDdosInstallScript,tl as renderNftablesRuleset,As as renderServerCron,el as renderSysctlFile,cd as renderWafConfig,ki as renderWafInstallScript,ad as renewRpxCertificates,sS as replicaManager,ey as requestHash,Vb as requiresReplacement,kE as resetRecursionRuntime,NE as resolveApp,g as resolveAppDatabase,pA as resolveAttachTarget,st as resolveAuthEncryptionKey,be as resolveCloudProvider,zg as resolveCloudflareCdnPlan,ei as resolveComputeVolumes,jo as resolveCredentials,Rs as resolveDashboardAction,sd as resolveDashboardAuth,py as resolveDashboardDomain,my as resolveDashboardDomains,Us as resolveDeclaredRecords,VI as resolveDeployBucketName,K as resolveDeploymentMode,ii as resolveExecStart,Qo as resolveFailoverStatusCodes,Hc as resolveHetznerApiToken,Mr as resolveHostCleanupConfig,w as resolveMailProxy,C as resolveMailService,pb as resolveManagementDashboardSite,Zi as resolveManagementDashboardSites,yc as resolveObjectStorage,ce as resolveOriginConnection,cA as resolvePlan,m as resolveProjectStackName,zr as resolveProxyUpstreams,Ml as resolveQueueNames,kA as resolveQueuedDeploymentCommand,hr as resolveQueues,mS as resolveRecursionConfig,Iy as resolveRegion,ge as resolveRuntimeInventory,dr as resolveServerlessAppStackName,cl as resolveServerlessArtifactBucketName,Xi as resolveServerlessAssetBucketName,ns as resolveServerlessRuntime,HI as resolveSiteBucketName,ho as resolveSiteDeployTarget,d as resolveSiteKind,QI as resolveSiteResourceName,UI as resolveSiteStackName,fi as resolveSshSettings,l as resolveStatePath,GI as resolveStorageBucketName,Tm as resolveStorageFailover,er as resolveUiSource,ud as resolveZoneApex,$E as resourceManagementManager,Lf as responseToResult,nm as robustZScore,rr as roleCapabilities,mu as rollbackImmutableRelease,Nn as rollbackServerlessApp,FA as roundCents,SE as route53ResolverManager,dS as route53RoutingManager,om as routeMatches,Pp as routesFromFragments,ss as ruleMatches,lS as runBuildHooks,Ud as runEnforcement,ea as runPhpBuildHooks,ct as runRemoteCommand,Ee as runtimeId,Qe as s3OriginBucket,wm as s3RegionalDomain,xs as sameCorsRules,Fs as sameLifecycleRules,Wn as sameNameservers,ws as sanitizeCloudConfig,s as sanitizeControlPlaneValue,FI as sanitizeName,cu as sanitizeOidcReturnPath,Wd as saveTelemetryPolicy,Xf as scanForSecrets,Sd as scopeContains,wt as scopeKey,Mc as scpUpload,lC as searchCommands,yo as searchControlPlane,oS as secretsManager,aE as secretsRotationManager,FS as secureContainerRelease,Yy as securityHubManager,dE as securityScanningManager,ue as securityScope,cg as seedFailoverReplicas,yn as sendAuthenticationEmail,CE as senderReputationManager,Fb as sequence,yg as serializeDotenv,Ti as serverPublicIpv4,cS as serviceMeshManager,rg as setAttachToInCloudConfig,Cr as setMaintenance,bs as setSitePropertyInCloudConfig,nl as setStateDir,dR as setupDns01Challenge,wc as setupSmsInfrastructure,Ko as sha256,hS as sharedRecursionGuard,Bf as sharedRuntimeLoop,zp as shipsARelease,WS as signCloudFrontCookies,xS as signCloudFrontUrl,k as signRequest,Wl as signRequestAsync,Bo as signalDefinition,U as siteInstallBase,Bi as siteMoveArchivePath,yA as siteMoveCertArchivePath,fd as siteUnitGlob,um as spendNotificationText,Uo as spendOpenApiPaths,Fr as sshExec,Se as sshExecOrThrow,CC as stackDependencyManager,gc as startLocalDashboardServer,YA as startSpendLoop,cn as stateDir,Q as statePath,OE as staticSiteManager,CS as storageAdvancedManager,KI as storageFailoverReplicasFromTemplate,VA as streamFocusJsonl,Qd as strongestActiveAction,qm as suggestCommand,gC as suggestFlags,Rb as suggestIAMPolicy,kb as suggestQuotaIncrease,kC as suggestRegionPairs,PC as suggestRegions,gs as syncSourceRepositories,Pd as synchronizeComposeVolumes,Sg as synchronizeConfiguredConfiguration,Ra as synchronizeConfiguredJobs,iS as syntheticsManager,Zd as sysctlHardening,ih as systemdWorkloads,WA as telemetryBucketLabel,zi as telemetryCursor,Jd as telemetryEstimatedMonthlyCost,KA as telemetryPercentile,lm as telemetryPolicyKey,Ry as templateCache,kp as tenantsOf,Sa as testSourceConnection,kd as tieredMicroCents,ap as toApiLifecycleRule,zc as toCloudflareZoneSettings,_o as toFocusJsonl,qd as toFocusRecords,iA as toInventoryServer,qf as totp,la as totpUri,Np as unaccountedSites,eh as unsupportedCapabilities,NA as unsupportedVolumeCapabilities,Ku as updateCompatibility,Ju as updateSiteInCloudConfig,ks as uploadStaticFiles,Yp as usageDeltaKey,or as utcInstantOfLocal,FC as validateAccountStructure,Kb as validateAgainstSchema,xA as validateAttachment,Eh as validateBackupDestination,fC as validateCommand,Eb as validateConfiguration,Tb as validateCredentials,jp as validateDeploymentConfig,BA as validateMountPath,Pt as validateOriginGroups,ug as validateResourceLimits,xp as validateServerName,Ep as validateTemplate,sg as validateTemplateSize,_c as verifyAddressRecord,LS as verifyArtifactSignature,jS as verifyMediaAccessToken,jf as verifyTotp,zu as verifyUpdateSignature,Ws as verifyZoneParity,Co as volumeCapabilities,Ip as wafEventTelemetry,Fc as waitForCloudInit,ft as waitForSsh,yr as webhookEndpoint,Ib as withCDN,Sb as withCache,up as withContentHash,yb as withDatabase,_f as withInvocation,hb as withMonitoring,bb as withQueue,Ab as withSecurity,Ub as withTimeout,dp as workerBindings,so as workerContentHash,Ja as workerInSync,se as wrapCloudInitUserData,At as writeDriverState,rE as xrayManager,Gu as zeroCapacity,qA as zeroFill,Bd as zoneOffsetMs,Ro as zonedParts};