@stacksjs/ts-cloud 0.16.66 → 0.16.67

package/dist/bin/chunk-shxqbkrz.js

@@ -0,0 +1 @@
+import{Xp,pn,fo,ae,Qp,Ic,Nd,Ts,Yp,Zp,em,Pc,ho,Es,Dc,mn,Er,tm,wi,rm,kc,xd,_d,ws,Nc,xc,wr,yo,Ar,_c,As,Ai,Od,bo,Oc,$c,So,$d,Lc,Mc,Uc,Fc,Rs,Ld,Md,nm,Ud,Bc,vo,Fd,Bd,Is,jt,Ps,Ds,ks,jc,jd,Vc,Ns,im,vt,om,zc,Vt,Hc,sm,Gc,Vd,am,ee,zd,xs,cm,Co,Ri,Ii,_s,Hd,Gd,lm,Os,$s}from"./chunk-qjh516ah.js";import"./chunk-f4v7nm9a.js";import"./chunk-dbtm1j98.js";import"./chunk-yc1n2h5w.js";export{Is as AnomalyConfigStore,Hd as AwsSpendTransport,Gd as ComputeSpendTransport,ws as CounterTracker,kc as DEFAULT_METER_MAPPINGS,Pc as DEFAULT_PRICE_BOOK,yo as DEFAULT_THRESHOLDS,jt as DETECTABLE_SIGNALS,fo as ENFORCEMENT_ACTIONS,So as ENFORCEMENT_DESCRIPTIONS,ae as ENFORCEMENT_SEVERITY,jd as FOCUS_VERSION,pn as METERS,Xp as METER_KEYS,Qp as MICRO_CENTS,Od as MIN_PROJECTION_CONFIDENCE,Vd as RecordingSpendTransport,Fd as SENSITIVITY_THRESHOLDS,Ii as SPEND_CYCLE_SECONDS,zc as SPEND_GATE_SETTING,cm as SPEND_LEASE_SETTING,Ds as SignalSource,Hc as SpendCapError,Vt as SpendGate,Co as SpendLoopLease,xs as SpendNotificationRouter,Ri as SpendRunner,vt as SpendService,Ar as SpendStore,am as URGENT_SPEND_EVENTS,$d as USER_VISIBLE_ACTIONS,xc as aggregateDeltas,vo as anomalyOptionsForSignal,sm as assertSpendAllows,Er as budgetWindow,lm as compositeSpendTransport,Gc as createEnforcementHandlers,Ud as detectAnomalies,Bc as detectLatestAnomaly,Oc as evaluateBudget,nm as ewma,xd as findMapping,Nd as findPriceEntry,ee as formatCents,Ai as formatTimeToExhaustion,bo as governingLimitCents,Os as handleSpendRequest,wi as hourBucket,rm as hourBucketsBetween,Fc as isOperationAllowed,ho as isValidTimeZone,jc as lookbackHoursForSignal,Rs as median,Ld as medianAbsoluteDeviation,$c as mergeDecisions,em as mergePriceBooks,Nc as meterTelemetry,ks as optionsForSignal,As as percentOfLimit,Lc as planEnforcement,tm as previousBudgetWindow,Ts as priceUsage,Yp as priceUsageLines,_c as projectSpend,Md as robustZScore,Zp as roundCents,Bd as routeMatches,Mc as runEnforcement,wr as scopeKey,Ps as signalDefinition,zd as spendNotificationText,$s as spendOpenApiPaths,_s as startSpendLoop,im as streamFocusJsonl,Uc as strongestActiveAction,Ic as tieredMicroCents,Ns as toFocusJsonl,Vc as toFocusRecords,_d as usageDeltaKey,mn as utcInstantOfLocal,om as zeroFill,Dc as zoneOffsetMs,Es as zonedParts};

package/dist/bin/chunk-sz45s7mw.js

@@ -0,0 +1 @@
+import{Sm,vm,la,rl,da,ua,Tn,Ve,R,pa,nl,H,Fr,A,nu,ne,Br,ma,Ko,le,B,Jo,iu,ou,su,au,l,o,Cm,Tm,T,ga,fa,ha,Em,wm,$e,ya,Ui,cu,Am,Rm,ze,Pt,ba,il,ol,Im,sl,al,cl,Xo,Sa,ot,Qo,En,Fi,wn,He,lu,Yo,Zo,va,Ca,Ta,Ea,wa,Aa,Ae,j,du,uu,ll,b,M,st,N,dl,Dt,ye,Jt,Pm,ul,Re,es,Ge,Xt,Bi,Ie,ts,Le,pu,ji,Pe,De,ie,Vi,X,Qt,kt,ke,t,An,Dm,pl,Ra,km,Nm,xm,_m,Ia,Om,$m,Lm,Mm,Um,Fm,Bm,jm,Vm,zm,Hm,Gm,mu,gu,fu,hu,yu,bu,Su,Yt,ml,gl,jr,zi,qm,fl,Wm,Km,Rn,Jm,Xm,Qm,Ym,Zm,eg,vu,Cu,Tu,Eu,wu,Hi,tg,In,Au,hl,Ru,Pa,be,Iu,Pu,Nt,rs,Zt,Du,yl,ku,Nu,xu,bl,Se,rg,ng,ig,og,_u,sg,Ne,ag,cg,lg,Da,ka,Ou,Sl,vl,dg,ug,pg,mg,gg,$u,Na,fg,hg,yg,bg,Sg,Lu,Mu,vg,Cg,Tg,Eg,wg,Ag,Rg,Uu,Ig,Cl,xa,Pg,Dg,kg,Ng,Tl,El,wl,xg,_a,Fu,Bu,ju,Vu,Oa,zu,_g,Og,$g,Lg,Mg,Ug,Fg,Hu,Gu,qu,Wu,Al,Bg,jg,Vg,zg,Hg,Gg,qg,Wg,Kg,Ku,Ju,Xu,Qu,Jg,Xg,Rl,Qg,Il,Pl,Dl,kl,Yg,Zg,ef,tf,at,Gi,rf,nf,of,sf,af,cf,lf,df,Yu,uf,pf,Nl,xl,mf,gf,Zu,ff,hf,yf,bf,Sf,vf,Cf,Tf,Ef,wf,Af,Rf,If,Pf,Df,kf,Nf,xf,_f,Of,$f,$a,ep,La,tp,Ma,rp,Ua,np,Fa,ip,Vr,op,Ba,sp,qi,ap,ja,cp,Va,lp,_l,Lf,Ol,Mf,za,dp,zr,up,$l,Uf,Ha,pp,Ll,Ff,Ml,Bf,Ul,jf,Ga,mp,Fl,Vf,Bl,zf,jl,Hf,Vl,Gf,qa,gp,Wa,fp,zl,qf,Hl,Wf,Gl,Kf,ql,Jf,Wl,Xf,Kl,Qf,Ka,hp,Jl,Yf,Xl,Zf,Ql,eh,Yl,th,Zl,rh,ed,nh,td,rd,nd,id,od,ih,sd,oh,ad,sh,cd,ah,xt,ld,yp,ns,Ja,Pn,bp,Wi,er,Xa,Qa,Sp,vp,Ya,dd,Za,ud,ch,lh,ec,tc,rc,pd,Ki,md,gd,is,nc,ic,fd,Cp,Tp,Ep,dh,hd,yd,uh,wp,bd,Ap,Rp,Ip,ph,Sd,Dn,oc,vd,mh,Pp,os,ss,sc,Cd,gh,ac,Dp,Td,fh,Ed,hh,wd,yh}from"./chunk-dbtm1j98.js";import{cc,Y,lc,as,kp,_t,Np,xp,kn,_p,Op,$p,Lp,Mp}from"./chunk-yc1n2h5w.js";export{ja as ABTestManager,Ge as AI,ku as AWSAPIError,Ma as AWSConfigManager,Dm as AWS_PSEUDO_PARAMETERS,at as AWS_REGIONS,ts as ApiGateway,An as Arn,ie as AssetHasher,Pe as Auth,$a as BackupManager,ad as BatchProcessingManager,Ba as BlueGreenManager,Ql as BounceComplaintHandler,Vl as BuildOptimizationManager,He as CDN,tc as CHAIN_HEADER,ba as CLOUDFRONT_FAILOVER_STATUS_CODES,hf as COMMON_CROSS_ACCOUNT_ROLES,Bi as Cache,qi as CanaryManager,Fl as CertificateManager,Nt as CloudError,pl as CloudFormationBuilder,Ru as CloudFormationClient,Pu as CloudFrontClient,Ua as CloudTrailManager,Qu as CommandHistory,ke as Communication,b as Compute,rs as ConfigurationError,qa as ContainerRegistryManager,Zt as CredentialError,Il as CrossRegionReferenceManager,gu as DASHBOARD_ENTRY,fu as DASHBOARD_PORT_BASE,hu as DASHBOARD_PORT_SPAN,mu as DASHBOARD_STATE_DIR,il as DEFAULT_FAILOVER_STATUS_CODES,Ki as DEFAULT_RECURSION_LIMITS,Ne as DEFAULT_SERVICE_LIMITS,la as DEFAULT_STATE_DIR,lu as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,ec as DEPTH_HEADER,sd as DLQMonitoringManager,Ae as DNS,Jl as DNSSECManager,Xt as Database,Ml as DatabaseUserManager,Se as DebugLogger,cu as DependencyGraph,De as Deployment,Du as DeploymentError,La as DisasterRecoveryManager,N as Email,td as EmailAdvanced,Yl as EmailAnalyticsManager,rd as EmailHandlers,ed as EmailTemplateManager,Nu as ErrorCodes,Zo as FAILOVER_REPLICA_POLICY_SID,od as FIFOQueueManager,Da as FileCache,st as FileSystem,t as Fn,Pl as GlobalResourceManager,Fa as GuardDutyManager,$u as HashCache,Td as HealthCheckManager,jl as ImageScanningManager,Jt as JobLoader,vd as LARAVEL_SERVERLESS_BUILD_STEPS,Gl as LambdaConcurrencyManager,Kl as LambdaDLQManager,ql as LambdaDestinationsManager,zl as LambdaLayersManager,Wl as LambdaVPCManager,Hl as LambdaVersionsManager,za as LogsManager,bp as MANAGED_NODE_VERSIONS,ml as MANAGEMENT_DASHBOARD_SITE_PREFIX,Le as Messaging,Ol as MetricsManager,$l as MigrationManager,Tl as MockCloudFormation,wl as MockDynamoDB,El as MockS3,ji as Monitoring,Nl as MultiAccountManager,Rl as MultiRegionManager,Gu as MultiStepProgress,M as Network,Ed as NetworkSecurityManager,al as ORIGIN_CONNECTION_ATTEMPTS,cl as ORIGIN_CONNECTION_TIMEOUT,ol as ORIGIN_GROUP_ALLOWED_METHODS,Im as ORIGIN_GROUP_ID_SUFFIX,sl as ORIGIN_GROUP_SELECTION_CRITERIA,xl as OrganizationManager,Pp as PHP_DEFAULT_EXCLUDES,Sp as PHP_LAYER_EXTENSIONS,X as ParameterStore,Ll as PerformanceManager,Ie as Permissions,Dt as Phone,nd as PhoneAdvanced,dl as PhoneHandlers,_a as PreviewEnvironmentManager,Oa as PreviewNotificationService,Hu as ProgressBar,Va as ProgressiveDeploymentManager,au as Pseudo,ye as Queue,cd as QueueManagementManager,Sm as QueuePresets,Zu as RECOMMENDED_ACCOUNT_STRUCTURES,ff as RECOMMENDED_SCPS,Ku as REPL,Xu as REPLCommandBuilder,Ju as REPLContext,Lu as RateLimiter,vm as RealtimePresets,is as RecursionGuard,kt as Redirects,Dl as RegionPairManager,Pt as Registry,Ha as ReplicaManager,wd as ResourceManagementManager,Xl as Route53ResolverManager,Ka as Route53RoutingManager,Pa as S3Client,be as S3Error,Re as SMS,rl as STATE_DIR_ENV_VAR,Yo as STORAGE_FAILOVER_METADATA_KEY,Qt as Search,Vi as Secrets,Ga as SecretsManager,Ul as SecretsRotationManager,j as Security,Vr as SecurityHubManager,Bl as SecurityScanningManager,Zl as SenderReputationManager,Wa as ServiceMeshManager,es as Sftp,id as SmsAdvanced,ul as SmsHandlers,qu as Spinner,kl as StackDependencyManager,Pm as StacksIntegration,Cd as StaticSiteManager,ze as Storage,ac as StorageAdvancedManager,zr as SyntheticsManager,rc as TRACE_HEADER,Wu as TaskList,Jo as TemplateBuilder,ka as TemplateCache,yl as ValidationError,pu as Workflow,_l as XRayManager,cp as abTestManager,ll as amazonLinuxImageId,uu as amazonLinuxImageParameter,Am as analyzeStackDiff,Ja as artifactKey,En as assertOriginGroupMethods,Hg as autocomplete,rp as awsConfigManager,ep as backupManager,fg as batch,sh as batchProcessingManager,sp as blueGreenManager,eh as bounceComplaintHandler,lh as buildBunRuntimeLayerZip,Ra as buildCloudFormationTemplate,wa as buildFailoverReplicaPolicyStatement,ma as buildMailEnv,ch as buildNodeRuntimeLayerZip,Gf as buildOptimizationManager,Sa as buildOriginGroup,Qo as buildOriginGroups,mh as buildPhpRuntimeLayerZip,Ea as buildReplicationConfiguration,Ta as buildReplicationRole,ap as canaryManager,wg as categorizeChanges,Vf as certificateManager,og as checkIAMPermissions,hd as checkInvocation,ag as checkServiceQuotas,Mu as chunk,Op as clearSigningKeyCache,Uu as cloudConfigSchema,np as cloudTrailManager,ss as collectPhpAppEntries,Wm as composePresets,Qa as composeServerlessAppTemplate,gp as containerRegistryManager,$m as createApiBackendPreset,Ip as createCliHandler,tg as createCredentialProvider,Gm as createDashboardSite,Bm as createDataPipelinePreset,bl as createError,Ia as createExistingStaticFullStackPreset,Om as createFullStackAppPreset,ph as createHandlers,Ap as createHttpHandler,Mm as createJamstackPreset,zm as createLaravelPreset,jm as createMLApiPreset,Um as createMicroservicesPreset,xg as createMockAWS,Nm as createNodeJsServerPreset,xm as createNodeJsServerlessPreset,Km as createPreset,as as createPresignedUrl,kp as createPresignedUrlAsync,Rp as createQueueHandler,Fm as createRealtimeAppPreset,Iu as createS3Client,Hm as createServerlessLaravelPreset,_m as createServerlessNodePreset,km as createStaticSitePreset,Vm as createTraditionalWebAppPreset,Lm as createWordPressPreset,xt as createZip,Yg as crossRegionReferenceManager,Bf as databaseUserManager,Cl as defaultLocalConfig,Fr as deploymentCoexistenceError,yu as deriveManagementDashboardPort,nl as detectDeploymentTargets,ng as detectMisconfigurations,cc as detectServiceRegion,Cg as diffTemplates,oh as dlqMonitoringManager,Yf as dnssecManager,tp as drManager,th as emailAnalyticsManager,nh as emailTemplateManager,wp as eventToRequest,fl as extendPreset,ih as fifoQueueManager,gg as findChangedFiles,vf as formatAccountStructure,Lg as formatBytes,Rm as formatDiff,Mg as formatDuration,qg as formatFlagSuggestions,Jg as formatHistory,Xg as formatHistoryStats,Fg as formatKeyValue,Ug as formatList,$g as formatProgressBar,Yu as formatRegion,uf as formatRegionList,Bg as formatSuggestion,_g as formatTable,Og as formatTree,Tu as fromEC2Metadata,Eu as fromECSMetadata,vu as fromEnvironment,Cu as fromSharedCredentials,wu as fromWebIdentity,pd as functionFingerprint,Za as generateAppImageDockerfile,Of as generateApprovalConfig,ld as generateBootstrap,ju as generateCleanupWorkflow,Vu as generateCostReportWorkflow,bf as generateCrossAccountRoleCF,Nf as generateDeploymentConfig,Rf as generateDeploymentPipeline,Cf as generateDeploymentWorkflow,o as generateLogicalId,kf as generateManualPipeline,Af as generateMatrixWorkflow,xf as generateMultiEnvConfig,If as generateMultiEnvPipeline,Tf as generateMultiEnvWorkflow,Ef as generatePRPreviewWorkflow,$f as generateParallelConfig,Sd as generatePhpFpmConfig,dd as generatePhpLayerDockerfile,Pf as generatePreviewPipeline,Bu as generatePreviewWorkflow,l as generateResourceName,_f as generateScheduledConfig,Df as generateScheduledPipeline,wf as generateScheduledWorkflow,hl as getAccountId,rf as getAllRegions,cf as getClosestRegion,Wg as getCommandUsage,Vg as getContextualHelp,Hi as getCredentials,Ag as getDeploymentStrategy,Rg as getDiffStats,Tg as getDiffSummary,xu as getErrorDetails,xa as getLocalConfig,kg as getLocalCredentials,Dg as getLocalEndpoint,Ng as getLocalEnvVars,cg as getQuotaUsageSummary,yf as getRecommendedStructure,Gi as getRegion,pf as getRegionStats,of as getRegionsByCompliance,nf as getRegionsByLocation,sf as getRegionsByPricingTier,_u as getRequiredPermissions,$p as getSigningKeyCacheSize,Cm as getTimestamp,Zg as globalResourceManager,ip as guardDutyManager,Yt as hasManagementDashboardSite,dg as hashBuffer,ug as hashDirectory,Sl as hashFile,pg as hashManifest,vl as hashString,fh as healthCheckManager,Hf as imageScanningManager,gd as inspectInvocation,Tp as installRecursionFetch,fd as invocationContext,du as isArmInstanceType,jg as isLikelyTypo,Pg as isLocalDevelopment,jr as isManagementDashboardSiteName,Lp as isNodeCryptoAvailable,Fi as isS3RestEndpoint,ua as isStateDirConfigured,pa as isStatePath,af as isValidRegion,Mp as isWebCryptoAvailable,Kf as lambdaConcurrencyManager,Qf as lambdaDLQManager,Jf as lambdaDestinationsManager,qf as lambdaLayersManager,Xf as lambdaVPCManager,Wf as lambdaVersionsManager,oc as laravelServerlessEnvDefaults,dp as logsManager,nu as mailEnabled,Br as mailFirewallPorts,Ko as mailWebmailSites,_t as makeAWSRequest,xp as makeAWSRequestAsync,Np as makeAWSRequestOnce,gl as managementDashboardSiteName,Rn as mergeInfrastructure,Mf as metricsManager,Uf as migrationManager,mf as multiAccountManager,Qg as multiRegionManager,hh as networkSecurityManager,gf as organizationManager,sc as packagePhpApp,Pn as packageServerlessApp,Na as parallel,hg as parallelMap,yg as parallelWithRetry,md as parseChain,_p as parseJSONResponse,kn as parseXMLResponse,Ff as performanceManager,Ya as phpLayerBuildStage,vp as phpLayerPackages,Dn as phpRuntimeLayerAssets,Fu as previewManager,zu as previewNotifications,vg as processInChunks,lp as progressiveDeploymentManager,nc as propagationHeaders,ah as queueManagementManager,mg as quickHash,ic as recursionBlockedResponse,ef as regionPairManager,pp as replicaManager,Eg as requiresReplacement,dh as resetRecursionRuntime,uh as resolveApp,A as resolveAppDatabase,B as resolveCloudProvider,In as resolveCredentials,bu as resolveDashboardDomain,Su as resolveDashboardDomains,wm as resolveDeployBucketName,H as resolveDeploymentMode,Xo as resolveFailoverStatusCodes,le as resolveMailProxy,ne as resolveMailService,qm as resolveManagementDashboardSite,zi as resolveManagementDashboardSites,ot as resolveOriginConnection,T as resolveProjectStackName,Xa as resolveQueueNames,er as resolveQueues,Cp as resolveRecursionConfig,Au as resolveRegion,$e as resolveServerlessAppStackName,ya as resolveServerlessArtifactBucketName,Ui as resolveServerlessAssetBucketName,Wi as resolveServerlessRuntime,ha as resolveSiteBucketName,fa as resolveSiteResourceName,ga as resolveSiteStackName,R as resolveStatePath,Em as resolveStorageBucketName,va as resolveStorageFailover,yh as resourceManagementManager,bd as responseToResult,Zf as route53ResolverManager,hp as route53RoutingManager,yp as runBuildHooks,os as runPhpBuildHooks,Ca as s3RegionalDomain,Tm as sanitizeName,zg as searchCommands,mp as secretsManager,jf as secretsRotationManager,op as securityHubManager,zf as securityScanningManager,rh as senderReputationManager,bg as sequence,fp as serviceMeshManager,da as setStateDir,ns as sha256,Ep as sharedRecursionGuard,ud as sharedRuntimeLoop,Y as signRequest,lc as signRequestAsync,tf as stackDependencyManager,Tn as stateDir,Ve as statePath,gh as staticSiteManager,Dp as storageAdvancedManager,Aa as storageFailoverReplicasFromTemplate,Al as suggestCommand,Gg as suggestFlags,sg as suggestIAMPolicy,lg as suggestQuotaIncrease,df as suggestRegionPairs,lf as suggestRegions,up as syntheticsManager,Ou as templateCache,Sf as validateAccountStructure,Ig as validateAgainstSchema,Kg as validateCommand,rg as validateConfiguration,ig as validateCredentials,wn as validateOriginGroups,su as validateResourceLimits,iu as validateTemplate,ou as validateTemplateSize,Zm as withCDN,Ym as withCache,Qm as withDatabase,yd as withInvocation,Jm as withMonitoring,eg as withQueue,Xm as withSecurity,Sg as withTimeout,Lf as xrayManager};

package/dist/bin/chunk-va3yvvs0.js

@@ -0,0 +1 @@
+import{v}from"./chunk-7pxqdq44.js";import"./chunk-kwfbth5c.js";export{v as CloudFormationClient};

package/dist/bin/{chunk-8bgfn8ek.js → chunk-vcs8wtay.js}

@@ -1,5 +1,5 @@
-import{Li,p}from"./chunk-qpvydcfm.js";import{Hr}from"./chunk-j9yq3b4d.js";import*as c from"node:crypto";import{readFileSync as B}from"node:fs";import{readdir as L}from"node:fs/promises";import{join as z}from"node:path";function Rt(e){if(e){let i=D(e);if(!i)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return i}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return D(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function D(e){let{existsSync:t,readFileSync:s}=Hr("node:fs"),{homedir:i}=Hr("node:os"),{join:n}=Hr("node:path"),r=process.env.AWS_SHARED_CREDENTIALS_FILE||n(i(),".aws","credentials");if(!t(r))return null;let o=s(r,"utf-8"),a=null,l,d,y;for(let u of o.split(`
-`)){let h=u.trim();if(!h||h.startsWith("#")||h.startsWith(";"))continue;let m=h.match(/^\[([^\]]+)\]$/);if(m){if(a===e&&l&&d)return{accessKeyId:l,secretAccessKey:d,sessionToken:y};a=m[1],l=void 0,d=void 0,y=void 0;continue}if(a===e){let[b,...S]=h.split("="),f=S.join("=").trim();switch(b.trim().toLowerCase()){case"aws_access_key_id":l=f;break;case"aws_secret_access_key":d=f;break;case"aws_session_token":y=f;break}}}if(a===e&&l&&d)return{accessKeyId:l,secretAccessKey:d,sessionToken:y};return null}function U(e){let{buffer:t,byteOffset:s,byteLength:i}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+i);let n=new ArrayBuffer(i);return new Uint8Array(n).set(new Uint8Array(e)),n}function j(e,t){let s=e?.[t]??e;if(s===null||typeof s!=="object"||Array.isArray(s))return s;let i={...s};return delete i["@_xmlns"],i}class g{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let i=typeof e==="string"?s:e,n=typeof e==="string"?e:e.region??"us-east-1",r=typeof e==="string"?t:e.profile,o=i?.endpoint?Li({region:n,path:"/",endpoint:i.endpoint}):void 0;this.region=n,this.explicitProfile=r,this.endpoint=o?.host,this.endpointProtocol=o?.protocol??"https",this.forcePathStyle=i?.forcePathStyle,this.explicitCredentials=i?.credentials,this.client=new p(i?.credentials,{profile:r,endpoint:i?.endpoint,forcePathStyle:i?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=Rt(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],i=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(i){let n=Array.isArray(i)?i:[i];for(let r of n)t.push({Name:r.Name,CreationDate:r.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let i;if(this.region!=="us-east-1"&&!this.endpoint)i=`<?xml version="1.0" encoding="UTF-8"?>
+import{Mi,p}from"./chunk-kwfbth5c.js";import{Hr}from"./chunk-j9yq3b4d.js";import*as c from"node:crypto";import{readFileSync as B}from"node:fs";import{readdir as L}from"node:fs/promises";import{join as z}from"node:path";function Rt(e){if(e){let i=D(e);if(!i)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return i}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return D(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function D(e){let{existsSync:t,readFileSync:s}=Hr("node:fs"),{homedir:i}=Hr("node:os"),{join:n}=Hr("node:path"),r=process.env.AWS_SHARED_CREDENTIALS_FILE||n(i(),".aws","credentials");if(!t(r))return null;let o=s(r,"utf-8"),a=null,l,d,y;for(let u of o.split(`
+`)){let h=u.trim();if(!h||h.startsWith("#")||h.startsWith(";"))continue;let m=h.match(/^\[([^\]]+)\]$/);if(m){if(a===e&&l&&d)return{accessKeyId:l,secretAccessKey:d,sessionToken:y};a=m[1],l=void 0,d=void 0,y=void 0;continue}if(a===e){let[b,...S]=h.split("="),f=S.join("=").trim();switch(b.trim().toLowerCase()){case"aws_access_key_id":l=f;break;case"aws_secret_access_key":d=f;break;case"aws_session_token":y=f;break}}}if(a===e&&l&&d)return{accessKeyId:l,secretAccessKey:d,sessionToken:y};return null}function U(e){let{buffer:t,byteOffset:s,byteLength:i}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+i);let n=new ArrayBuffer(i);return new Uint8Array(n).set(new Uint8Array(e)),n}function j(e,t){let s=e?.[t]??e;if(s===null||typeof s!=="object"||Array.isArray(s))return s;let i={...s};return delete i["@_xmlns"],i}class g{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let i=typeof e==="string"?s:e,n=typeof e==="string"?e:e.region??"us-east-1",r=typeof e==="string"?t:e.profile,o=i?.endpoint?Mi({region:n,path:"/",endpoint:i.endpoint}):void 0;this.region=n,this.explicitProfile=r,this.endpoint=o?.host,this.endpointProtocol=o?.protocol??"https",this.forcePathStyle=i?.forcePathStyle,this.explicitCredentials=i?.credentials,this.client=new p(i?.credentials,{profile:r,endpoint:i?.endpoint,forcePathStyle:i?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=Rt(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],i=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(i){let n=Array.isArray(i)?i:[i];for(let r of n)t.push({Name:r.Name,CreationDate:r.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let i;if(this.region!=="us-east-1"&&!this.endpoint)i=`<?xml version="1.0" encoding="UTF-8"?>
 <CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
   <LocationConstraint>${this.region}</LocationConstraint>
 </CreateBucketConfiguration>`,s["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,headers:s,body:i})}async deleteBucket(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`})}async emptyAndDeleteBucket(e){let t=!0;while(t){let s=await this.listAllObjects({bucket:e});if(s.length===0){t=!1;break}let i=s.map((n)=>n.Key);for(let n=0;n<i.length;n+=1000){let r=i.slice(n,n+1000);await this.deleteObjects(e,r)}}await this.deleteBucket(e)}async listAllObjects(e){let t=[],s;do{let i={"list-type":"2","max-keys":"1000"};if(e.prefix)i.prefix=e.prefix;if(s)i["continuation-token"]=s;let n=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`,queryParams:i}),r=n?.ListBucketResult??n,o=r?.Contents;if(o){let l=Array.isArray(o)?o:[o];for(let d of l)t.push({Key:d.Key,LastModified:d.LastModified||"",Size:Number.parseInt(d.Size||"0"),ETag:d.ETag})}let a=r?.IsTruncated;s=a==="true"||a===!0?r?.NextContinuationToken:void 0}while(s);return t}async list(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`}),s=[],n=(t?.ListBucketResult??t)?.Contents;if(n){let r=Array.isArray(n)?n:[n];for(let o of r){if(e.prefix&&!o.Key?.startsWith(e.prefix))continue;if(s.push({Key:o.Key||"",LastModified:o.LastModified||"",Size:Number.parseInt(o.Size||"0"),ETag:o.ETag}),e.maxKeys&&s.length>=e.maxKeys)break}}return s}async putObject(e){let t={};if(e.acl)t["x-amz-acl"]=e.acl;if(e.cacheControl)t["Cache-Control"]=e.cacheControl;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[n,r]of Object.entries(e.metadata))t[`x-amz-meta-${n}`]=r;let s=e.key.split("/").map((n)=>encodeURIComponent(n)).join("/"),i=e.body instanceof Uint8Array&&!Buffer.isBuffer(e.body)?Buffer.from(e.body):e.body;if(Buffer.isBuffer(i)||i instanceof Uint8Array){let n=Buffer.isBuffer(i)?i:Buffer.from(i),{accessKeyId:r,secretAccessKey:o,sessionToken:a}=this.getCredentials(),l=this.s3VirtualHost(e.bucket),d=this.objectPath(e.bucket,s),y=this.objectUrl(e.bucket,s),u=new Date,h=u.toISOString().replace(/[:-]|\.\d{3}/g,""),m=u.toISOString().slice(0,10).replace(/-/g,""),b=c.createHash("sha256").update(n).digest("hex"),S={host:l,"x-amz-date":h,"x-amz-content-sha256":b,...t};if(a)S["x-amz-security-token"]=a;let f=Object.keys(S).sort().map((P)=>`${P.toLowerCase()}:${S[P].trim()}

package/dist/bin/{chunk-sbjzewvk.js → chunk-vf5w5aed.js}

@@ -1,9 +1,9 @@
-import{H,Fr}from"./chunk-v3j9wgmn.js";function J(e,t){return`/var/www/${e}-${t}`}var me=new Set(["laravel","php","statamic","wordpress"]);function ki(e){return e.type!=null&&me.has(e.type)}function Ks(e){let t=e.proxyTo;if(t==null)return[];return(Array.isArray(t)?t:[t]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function fe(e){return Ks(e).length>0}function te(e){if(e.deploy)return e.deploy;if(ki(e))return"server";if(e.start)return"server";return"bucket"}function w(e){if(e.redirect)return"redirect";if(fe(e))return"proxy";if(ki(e))return"server-php";if(te(e)==="bucket")return"bucket";return e.start?"server-app":"server-static"}function Mo(e){return e.infrastructure?.compute!=null||Boolean(e.cloud?.attachTo?.trim())}function Js(e,t={}){let r=[],n=[],o=e.sites||{},s=Mo(e),c=Fr(e);if(c)r.push(c);let p=new Map;for(let[l,i]of Object.entries(o)){if(!i)continue;let f=te(i),C=w(i);if(C==="redirect"){if(!i.domain)r.push(`Site '${l}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof i.redirect==="string"?i.redirect:i.redirect?.to))r.push(`Site '${l}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!s)r.push(`Site '${l}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let a=[];if(i.start)a.push("start");if(i.root)a.push("root");if(i.proxyTo)a.push("proxyTo");if(a.length>0)n.push(`Site '${l}' is a redirect site but also sets ${a.join(", ")}. These are ignored.`);continue}if(C==="proxy"){if(!i.domain)r.push(`Site '${l}' is a proxy site but has no \`domain\` to route from.`);if(!s)r.push(`Site '${l}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let u=[];if(i.start)u.push("start");if(i.root)u.push("root");if(typeof i.port==="number")u.push("port");if(i.build)u.push("build");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)n.push(`Site '${l}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${u.join(", ")} ${u.length===1?"is":"are"} ignored — remove ${u.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(f==="server"&&!i.start&&!i.root){r.push(`Site '${l}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(C==="server-php"){if(!s)r.push(`Site '${l}' is a PHP site (type:'${i.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!i.repository?.url)r.push(`Site '${l}' is a PHP site (type:'${i.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(C==="server-app"){if(!s)r.push(`Site '${l}' deploys to a server (deploy:'server'${i.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof i.port==="number"){let u=t.occupiedPorts?.get(i.port);if(u)r.push(`Site '${l}' wants port ${i.port}, which project '${u}' already serves on this box. Attached projects share one port namespace. Give '${l}' a free port, or let the attach allocate one.`);let a=p.get(i.port);if(a)r.push(`Sites '${a}' and '${l}' both use port ${i.port}. Server apps sharing a box must use distinct ports.`);else p.set(i.port,l)}}else if(C==="server-static"){if(!i.root)r.push(`Site '${l}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!s)r.push(`Site '${l}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!i.root)r.push(`Site '${l}' deploys to a bucket but has no \`root\` directory to upload.`);let u=[];if(i.start)u.push("start");if(typeof i.port==="number")u.push("port");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)n.push(`Site '${l}' deploys to a bucket but sets server-only field(s): ${u.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function Xs(e){let t=w(e);return t!=="bucket"&&t!=="redirect"&&t!=="proxy"}function qc(e){return w(e)==="bucket"}function Wc(e,t){if(H(e)==="serverless")return!0;let r=Object.entries(e.sites??{}).filter(([,o])=>o!=null),n=t?r.filter(([o])=>o===t):r;if(n.length===0)return!0;return!n.every(([,o])=>{let s=w(o);return s==="redirect"||s==="proxy"})}var L={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",mail:"github.com/mail-os/mail",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var D="/opt/pantry";function M(e){return`'${e.split("'").join("'\\''")}'`}function Et(e={}){let t=e.installDir??"/usr/local/bin",r=e.version?`export PANTRY_VERSION=${M(e.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"';return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system",`export PANTRY_INSTALL_DIR=${t}`,r,"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",`OS=$(uname -s | tr '[:upper:]' '[:lower:]'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-\${OS}-\${ARCH}.zip"; if [ "\${PANTRY_VERSION:-latest}" = latest ]; then REL='latest/download'; else REL="download/v\${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "\${TMP}/\${ZIP}" "https://github.com/pantry-pm/pantry/releases/\${REL}/\${ZIP}"; mkdir -p ${t}; unzip -o "\${TMP}/\${ZIP}" -d ${t}; chmod +x ${t}/pantry; rm -rf "\${TMP}"`,`export PATH="${t}:$PATH"`,"mkdir -p /opt/pantry"]}function wt(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function it(e){if(e.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(e)].map(M).join(" ")})`]}function Uo(e){return[...new Set(e)].flatMap((t)=>[`(cd /opt/pantry && pantry start ${M(t)})`,`(cd /opt/pantry && pantry enable ${M(t)})`])}var m="/etc/mail",T="mail-server",q="mail",F=`${D}/pantry/.bin`;function h(e){return`'${String(e).split("'").join("'\\''")}'`}function R(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function ge(e){return[e.version?`${L.mail}@${e.version}`:L.mail]}function Y(e,t){return`${m}/dkim/${t}.${e.dkim.selector}.pem`}function re(e){return`${e.storagePath}/smtp.db`}function Te(e){let t=["# Generated by ts-cloud. Edits are overwritten on the next deploy —","# change `services.mail` in the cloud config instead.","","[server]",`host = ${R(e.bindAddress)}`,`port = ${e.ports.smtp}`,`hostname = ${R(e.hostname)}`];if(e.domains.length>0)t.push(`local_domains = ${R(e.domains.join(", "))}`);if(e.mode==="catcher")t.push("catch_all = true");if(t.push(`max_message_size = ${e.maxMessageSize}`,"","[tls]",`enabled = ${e.tls.enabled}`),e.tls.certPath)t.push(`cert_path = ${R(e.tls.certPath)}`);if(e.tls.keyPath)t.push(`key_path = ${R(e.tls.keyPath)}`);if(t.push("","[auth]",`enabled = ${e.mode==="server"}`,"","[antispam]",`dnsbl = ${e.spam.dnsbl}`,`greylist = ${e.spam.greylist}`,`spam_filter = ${e.spam.enabled}`,`junk_score = ${e.spam.junkScore}`,`reject_score = ${e.spam.rejectScore}`,"","[dkim]",`rotation_enabled = ${e.dkim.enabled&&e.dkim.rotate}`,`rotation_interval_days = ${e.dkim.rotateIntervalDays}`,"","[acme]",`enabled = ${e.tls.acme}`),e.tls.acmeEmail)t.push(`email = ${R(e.tls.acmeEmail)}`);if(t.push("","[webhook]",`enabled = ${!!e.webhookUrl}`),e.webhookUrl)t.push(`url = ${R(e.webhookUrl)}`);return t.push(""),t.join(`
+import{H,Fr}from"./chunk-dbtm1j98.js";function J(e,t){return`/var/www/${e}-${t}`}var me=new Set(["laravel","php","statamic","wordpress"]);function ki(e){return e.type!=null&&me.has(e.type)}function Js(e){let t=e.proxyTo;if(t==null)return[];return(Array.isArray(t)?t:[t]).map((n)=>String(n).trim()).filter((n)=>n.length>0)}function fe(e){return Js(e).length>0}function te(e){if(e.deploy)return e.deploy;if(ki(e))return"server";if(e.start)return"server";return"bucket"}function w(e){if(e.redirect)return"redirect";if(fe(e))return"proxy";if(ki(e))return"server-php";if(te(e)==="bucket")return"bucket";return e.start?"server-app":"server-static"}function Uo(e){return e.infrastructure?.compute!=null||Boolean(e.cloud?.attachTo?.trim())}function Xs(e,t={}){let r=[],n=[],o=e.sites||{},s=Uo(e),c=Fr(e);if(c)r.push(c);let p=new Map;for(let[l,i]of Object.entries(o)){if(!i)continue;let f=te(i),C=w(i);if(C==="redirect"){if(!i.domain)r.push(`Site '${l}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof i.redirect==="string"?i.redirect:i.redirect?.to))r.push(`Site '${l}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!s)r.push(`Site '${l}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let a=[];if(i.start)a.push("start");if(i.root)a.push("root");if(i.proxyTo)a.push("proxyTo");if(a.length>0)n.push(`Site '${l}' is a redirect site but also sets ${a.join(", ")}. These are ignored.`);continue}if(C==="proxy"){if(!i.domain)r.push(`Site '${l}' is a proxy site but has no \`domain\` to route from.`);if(!s)r.push(`Site '${l}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let u=[];if(i.start)u.push("start");if(i.root)u.push("root");if(typeof i.port==="number")u.push("port");if(i.build)u.push("build");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)n.push(`Site '${l}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${u.join(", ")} ${u.length===1?"is":"are"} ignored — remove ${u.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(f==="server"&&!i.start&&!i.root){r.push(`Site '${l}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(C==="server-php"){if(!s)r.push(`Site '${l}' is a PHP site (type:'${i.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!i.repository?.url)r.push(`Site '${l}' is a PHP site (type:'${i.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(C==="server-app"){if(!s)r.push(`Site '${l}' deploys to a server (deploy:'server'${i.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof i.port==="number"){let u=t.occupiedPorts?.get(i.port);if(u)r.push(`Site '${l}' wants port ${i.port}, which project '${u}' already serves on this box. Attached projects share one port namespace. Give '${l}' a free port, or let the attach allocate one.`);let a=p.get(i.port);if(a)r.push(`Sites '${a}' and '${l}' both use port ${i.port}. Server apps sharing a box must use distinct ports.`);else p.set(i.port,l)}}else if(C==="server-static"){if(!i.root)r.push(`Site '${l}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!s)r.push(`Site '${l}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!i.root)r.push(`Site '${l}' deploys to a bucket but has no \`root\` directory to upload.`);let u=[];if(i.start)u.push("start");if(typeof i.port==="number")u.push("port");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)n.push(`Site '${l}' deploys to a bucket but sets server-only field(s): ${u.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:n}}function Qs(e){let t=w(e);return t!=="bucket"&&t!=="redirect"&&t!=="proxy"}function Wc(e){return w(e)==="bucket"}function Kc(e,t){if(H(e)==="serverless")return!0;let r=Object.entries(e.sites??{}).filter(([,o])=>o!=null),n=t?r.filter(([o])=>o===t):r;if(n.length===0)return!0;return!n.every(([,o])=>{let s=w(o);return s==="redirect"||s==="proxy"})}var L={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",mail:"github.com/mail-os/mail",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var D="/opt/pantry";function M(e){return`'${e.split("'").join("'\\''")}'`}function Et(e={}){let t=e.installDir??"/usr/local/bin",r=e.version?`export PANTRY_VERSION=${M(e.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"';return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system",`export PANTRY_INSTALL_DIR=${t}`,r,"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",`OS=$(uname -s | tr '[:upper:]' '[:lower:]'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-\${OS}-\${ARCH}.zip"; if [ "\${PANTRY_VERSION:-latest}" = latest ]; then REL='latest/download'; else REL="download/v\${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "\${TMP}/\${ZIP}" "https://github.com/pantry-pm/pantry/releases/\${REL}/\${ZIP}"; mkdir -p ${t}; unzip -o "\${TMP}/\${ZIP}" -d ${t}; chmod +x ${t}/pantry; rm -rf "\${TMP}"`,`export PATH="${t}:$PATH"`,"mkdir -p /opt/pantry"]}function wt(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function it(e){if(e.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(e)].map(M).join(" ")})`]}function Fo(e){return[...new Set(e)].flatMap((t)=>[`(cd /opt/pantry && pantry start ${M(t)})`,`(cd /opt/pantry && pantry enable ${M(t)})`])}var m="/etc/mail",T="mail-server",q="mail",F=`${D}/pantry/.bin`;function h(e){return`'${String(e).split("'").join("'\\''")}'`}function R(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function ge(e){return[e.version?`${L.mail}@${e.version}`:L.mail]}function Y(e,t){return`${m}/dkim/${t}.${e.dkim.selector}.pem`}function re(e){return`${e.storagePath}/smtp.db`}function Te(e){let t=["# Generated by ts-cloud. Edits are overwritten on the next deploy —","# change `services.mail` in the cloud config instead.","","[server]",`host = ${R(e.bindAddress)}`,`port = ${e.ports.smtp}`,`hostname = ${R(e.hostname)}`];if(e.domains.length>0)t.push(`local_domains = ${R(e.domains.join(", "))}`);if(e.mode==="catcher")t.push("catch_all = true");if(t.push(`max_message_size = ${e.maxMessageSize}`,"","[tls]",`enabled = ${e.tls.enabled}`),e.tls.certPath)t.push(`cert_path = ${R(e.tls.certPath)}`);if(e.tls.keyPath)t.push(`key_path = ${R(e.tls.keyPath)}`);if(t.push("","[auth]",`enabled = ${e.mode==="server"}`,"","[antispam]",`dnsbl = ${e.spam.dnsbl}`,`greylist = ${e.spam.greylist}`,`spam_filter = ${e.spam.enabled}`,`junk_score = ${e.spam.junkScore}`,`reject_score = ${e.spam.rejectScore}`,"","[dkim]",`rotation_enabled = ${e.dkim.enabled&&e.dkim.rotate}`,`rotation_interval_days = ${e.dkim.rotateIntervalDays}`,"","[acme]",`enabled = ${e.tls.acme}`),e.tls.acmeEmail)t.push(`email = ${R(e.tls.acmeEmail)}`);if(t.push("","[webhook]",`enabled = ${!!e.webhookUrl}`),e.webhookUrl)t.push(`url = ${R(e.webhookUrl)}`);return t.push(""),t.join(`
 `)}function he(e){let t=["# Generated by ts-cloud. See /etc/mail/config.toml for the rest.",`SMTP_DB_PATH=${re(e)}`,`SMTP_DELIVERY_METHOD=${e.delivery==="ses"?"ses":"direct"}`];if(e.delivery==="ses")t.push(`SMTP_SES_REGION=${e.sesRegion}`);if(e.ports.submission)t.push(`SUBMISSION_PORT=${e.ports.submission}`);if(e.ports.submissions)t.push(`SMTPS_PORT=${e.ports.submissions}`);if(e.ports.imap)t.push("IMAP_ENABLED=1",`IMAP_PORT=${e.ports.imap}`);if(e.webmail.enabled)t.push("SMTP_ENABLE_WEBMAIL=true",`SMTP_WEBMAIL_PORT=${e.webmail.port}`,`SMTP_WEBMAIL_TLS=${e.webmail.tls}`,`SMTP_WEBMAIL_SECURE_COOKIES=${e.webmail.secureCookies}`,`SMTP_WEBMAIL_ATTACHMENT_MAX_FILE=${e.webmail.attachmentMaxFileBytes}`,`SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL=${e.webmail.attachmentMaxTotalBytes}`,`SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT=${e.webmail.attachmentMaxCount}`,`SMTP_WEBMAIL_UNDO_SEND_SECONDS=${e.webmail.undoSendSeconds}`);if(e.tls.requireForAuth)t.push("SMTP_REQUIRE_TLS_FOR_AUTH=true");if(e.dkim.enabled&&e.domains.length>0){let[r,...n]=e.domains;if(t.push(`DKIM_DOMAIN=${r}`,`DKIM_SELECTOR=${e.dkim.selector}`,`DKIM_PRIVATE_KEY_PATH=${Y(e,r)}`),n.length>0){let o=n.map((s)=>`${s}:${e.dkim.selector}:${Y(e,s)}`);t.push(`DKIM_EXTRA_KEYS=${o.join(",")}`)}}return t.push(""),t.join(`
 `)}function Ee(e){let t=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps].some((r)=>typeof r==="number"&&r<1024);return["[Unit]","Description=Mail server (SMTP/IMAP + webmail)","After=network-online.target","Wants=network-online.target","","[Service]","Type=simple",`User=${T}`,`Group=${T}`,`WorkingDirectory=${e.storagePath}`,`EnvironmentFile=${m}/mail.env`,`Environment="PATH=${F}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"`,`ExecStart=${F}/mail serve --config ${m}/config.toml`,"Restart=always","RestartSec=5","LimitNOFILE=65536",...t?["AmbientCapabilities=CAP_NET_BIND_SERVICE","CapabilityBoundingSet=CAP_NET_BIND_SERVICE"]:[],"NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict","ProtectHome=true","ProtectKernelTunables=true","ProtectKernelModules=true","ProtectControlGroups=true",`ReadWritePaths=${e.storagePath} ${m}`,"","[Install]","WantedBy=multi-user.target",""].join(`
 `)}function ye(e){if(!e.dkim.enabled||e.domains.length===0)return[];let t=[`mkdir -p ${m}/dkim`];for(let r of e.domains){let n=Y(e,r);t.push(`if [ ! -f ${h(n)} ]; then openssl genrsa -out ${h(n)} 2048; fi`,`chmod 0600 ${h(n)}`,`echo "DKIM ${e.dkim.selector}._domainkey.${r} IN TXT v=DKIM1; k=rsa; p=$(openssl rsa -in ${h(n)} -pubout -outform PEM 2>/dev/null | grep -v '^-----' | tr -d '\\n')"`)}return t.push(`chown -R ${T}:${T} ${m}/dkim`),t}function ve(e){if(e.accounts.length===0)return[];let t=(r)=>`runuser -u ${T} -- env SMTP_DB_PATH="$TS_CLOUD_MAIL_DB" ${F}/mail user:local ${r}`;return e.accounts.flatMap((r)=>[t(`create ${h(r.address)} ${h(r.password)} ${h(r.address)}`),...r.passwordPolicy==="managed"?[t(`change-password ${h(r.address)} ${h(r.password)}`)]:[]])}function ne(e){if(!e.enabled)return[];return[...it(ge(e)),`id -u ${T} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin ${T}`,`mkdir -p ${e.storagePath} ${m}`,`chown -R ${T}:${T} ${e.storagePath}`,`TS_CLOUD_MAIL_DB="$(grep -sE '^SMTP_DB_PATH=' ${m}/mail.env | head -1 | cut -d= -f2- || true)"`,`[ -n "$TS_CLOUD_MAIL_DB" ] || TS_CLOUD_MAIL_DB=${h(re(e))}`,`cat > ${m}/config.toml <<'TS_CLOUD_MAIL_CONF_EOF'`,Te(e),"TS_CLOUD_MAIL_CONF_EOF",`cat > ${m}/mail.env <<'TS_CLOUD_MAIL_ENV_EOF'`,he(e),"TS_CLOUD_MAIL_ENV_EOF",`sed -i "s|^SMTP_DB_PATH=.*|SMTP_DB_PATH=$TS_CLOUD_MAIL_DB|" ${m}/mail.env`,`chmod 0640 ${m}/mail.env`,`chown root:${T} ${m}/mail.env`,...ye(e),`cat > /etc/systemd/system/${q}.service <<'TS_CLOUD_MAIL_UNIT_EOF'`,Ee(e),"TS_CLOUD_MAIL_UNIT_EOF","systemctl daemon-reload",`systemctl enable ${q}`,`systemctl restart ${q}`,...ve(e)]}var g=`${D}/pantry/.bin`,W=15306,K=15991,N=15999,se=16101,B=2379,E="/var/lib/vitess",X=100;function Ni(e){return e===!0||typeof e==="object"&&e!==null}function Ce(e){return typeof e==="object"&&e!==null?e:{}}function _(e){return`'${String(e).split("'").join("'\\''")}'`}function Re(e){let r=[e.version?`vitess.io@${e.version}`:"vitess.io"];if(e.mode!=="combo"&&!e.etcdEndpoint)r.push("etcd.io");return r.push("mysql.com@8.0.43"),r}var S="vitess",Pe=`${g}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,ce="/usr/local/lib/vitess",z=new Map;function j(e){return`${ce}/${e}.sh`}function b(e,t){return z.set(e,be(t)),`/bin/sh ${j(e)}`}function oe(){let e=[`mkdir -p ${ce}`];for(let[t,r]of z)e.push(`cat > ${j(t)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,r,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${j(t)}`);return e}function be(e){return["#!/bin/sh","set -e",`cd ${D}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${g}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${g}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${e.join(" ")}`].join(`
 `)}function A(e){let t=["[Unit]",`Description=${e.description}`,`After=network.target${e.after?.length?` ${e.after.join(" ")}`:""}`];if(e.requires?.length)t.push(`Requires=${e.requires.join(" ")}`);return t.push("","[Service]","Type=simple",`User=${S}`,`Group=${S}`,`Environment="PATH=${Pe}"`,`Environment="VTDATAROOT=${E}"`,...Object.entries(e.environment??{}).map(([r,n])=>`Environment="${r}=${n}"`),...(e.execStartPre??[]).map((r)=>`ExecStartPre=${r}`),`ExecStart=${e.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),t.join(`
-`)}function ie(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,t,"TS_CLOUD_VITESS_UNIT_EOF"]}function De(e){let t=e.cell??"zone1",r=e.vtgatePort??W,o=`${((e.keyspaces?.length)?e.keyspaces:[{name:"app"}]).map((s)=>{let c=(s.sharded?["-80","80-"]:["0"]).map((p)=>`shards:{name:"${p}"}`).join(" ");return`keyspaces:{name:"${s.name}" ${c}}`}).join(" ")} cells:"${t}"`;return A({description:"Vitess (vtcombo, single-process development stack)",execStart:b("vtcombo",[`${g}/vtcombo`,`--cell ${t}`,`--proto-topo ${_(o)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${K}`,`--grpc-port ${N}`])})}function Ae(){return A({description:"etcd (Vitess topology store)",execStart:b("etcd",[`${g}/etcd`,`--data-dir ${E}/etcd`,`--listen-client-urls http://127.0.0.1:${B}`,`--advertise-client-urls http://127.0.0.1:${B}`]),execStartPre:[`+/bin/mkdir -p ${E}/etcd`,`+/bin/chown ${S}:${S} ${E}/etcd`]})}function Q(e){return["--topo-implementation etcd2",`--topo-global-server-address ${e.etcdEndpoint??`http://127.0.0.1:${B}`}`,"--topo-global-root /vitess/global"]}function Oe(e){let t=!e.etcdEndpoint;return A({description:"Vitess vtctld (control plane)",after:t?["vitess-etcd.service"]:[],requires:t?["vitess-etcd.service"]:[],execStart:b("vtctld",[`${g}/vtctld`,...Q(e),`--cell ${e.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${N}`,`--port ${N+1}`])})}function Le(e,t,r){let n=e.cell??"zone1";return A({description:`Vitess vttablet (${t}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:b("vttablet",[`${g}/vttablet`,...Q(e),`--tablet-path ${n}-${String(X).padStart(10,"0")}`,`--init-keyspace ${t}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${_("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${se}`,`--grpc-port ${se+1}`,`--db-port ${e.mysqlPort??3306}`,`--mycnf-mysql-port ${e.mysqlPort??3306}`])})}function Ue(e){return A({description:"Vitess mysqlctld (managed mysqld)",execStart:b("mysqlctld",[`${g}/mysqlctld`,`--tablet-uid ${X}`,`--mysql-port ${e.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${E}`,`+/bin/chown ${S}:${S} ${E}`]})}var le="/etc/vitess/auth.json",U="/var/lib/vitess/vtgate-auth.sha256";function xe(e){let t=e.username??"vitess",r=e.password??"";return["mkdir -p /etc/vitess",'VTESS_AUTH_TMP="$(mktemp)"',`cat > "$VTESS_AUTH_TMP" <<'TS_CLOUD_VITESS_AUTH_EOF'`,JSON.stringify({[t]:[{Password:r,UserData:t}]}),"TS_CLOUD_VITESS_AUTH_EOF",`VTESS_VTGATE_AUTH_SHA="$(sha256sum "$VTESS_AUTH_TMP" | awk '{print $1}')"`,"VTESS_VTGATE_AUTH_CHANGED=1",`if [ -f ${U} ] && [ "$(cat ${U})" = "$VTESS_VTGATE_AUTH_SHA" ]; then VTESS_VTGATE_AUTH_CHANGED=0; fi`,`install -o ${S} -g ${S} -m 0600 "$VTESS_AUTH_TMP" ${le}`,'rm -f "$VTESS_AUTH_TMP"']}function Ie(e){let t=e.cell??"zone1";return A({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:b("vtgate",[`${g}/vtgate`,...Q(e),`--cell ${t}`,`--cells-to-watch ${t}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${_("grpc-vtgateservice")}`,`--mysql-server-port ${e.vtgatePort??W}`,`--mysql-server-bind-address ${e.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${le}`,`--port ${K}`,`--grpc-port ${K+1}`])})}function ke(e){let t=e.cell??"zone1",r=e.etcdEndpoint??`http://127.0.0.1:${B}`,n=`${g}/vtctldclient --server 127.0.0.1:${N}`,o=[`for i in $(seq 1 30); do ${n} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${n} GetCellInfoNames 2>/dev/null | grep -qx ${_(t)}; then`,`  ${n} AddCellInfo --root ${_(`/vitess/${t}`)} --server-address ${_(r)} ${_(t)}`,"fi"];for(let s of e.keyspaces??[]){let c=s.sharded?" --sharded":"";o.push(`if ! ${n} GetKeyspace ${_(s.name)} >/dev/null 2>&1; then`,`  ${n} CreateKeyspace${c} ${_(s.name)}`,"fi");let p=`${t}-${String(X).padStart(10,"0")}`;for(let l of s.sharded?["-80","80-"]:["0"]){let i=`${s.name}/${l}`;o.push("for i in $(seq 1 90); do",`  if ${n} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${n} PlannedReparentShard ${_(i)} --new-primary ${_(p)} >/dev/null 2>&1 && break`,`  ${n} InitShardPrimary --force ${_(i)} ${_(p)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${n} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${i}" >&2; exit 1`,"fi")}o.push(`${n} RebuildKeyspaceGraph ${_(s.name)} >/dev/null`)}return o}function ae(e){let t=e.vtgatePort??W;return["for i in $(seq 1 60); do",`  if (cd ${D} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${_(e.password??"")} ${g}/mysql -h 127.0.0.1 -P ${t} -u ${_(e.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${t}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${t}" >&2`,"exit 1"]}function Fo(e){if(!Ni(e))return[];let t=Ce(e),r=t.mode==="combo";z.clear();let n=['if [ "$(uname -m)" != "x86_64" ]; then','  echo "vitess: Vitess publishes only x86_64 release tarballs; this box is $(uname -m). Drop managedServices.vitess or use an x86_64 host." >&2',"  exit 1","fi",...it(Re(t)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${g}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${S} >/dev/null 2>&1 || useradd --system --home-dir ${E} --shell /usr/sbin/nologin ${S}`,`mkdir -p ${E}`,`chown -R ${S}:${S} ${E}`];if(r)return n.push(...ie("vitess-vtcombo",De(t)),...oe(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...ae(t)),n;n.push(...xe(t));let o=[];if(!t.etcdEndpoint)o.push(["vitess-etcd",Ae()]);o.push(["vitess-vtctld",Oe(t)],["vitess-mysqlctld",Ue(t)],["vitess-vtgate",Ie(t)]);for(let s of t.keyspaces??[])for(let c of s.sharded?["-80","80-"]:["0"])o.push([`vitess-vttablet-${s.name}-${c.replace(/-/g,"x")}`,Le(t,s.name,c)]);for(let[s,c]of o)n.push(...ie(s,c));n.push(...oe()),n.push("systemctl daemon-reload");for(let[s]of o)n.push(`systemctl enable --now ${s}.service`);return n.push(`if [ "$VTESS_VTGATE_AUTH_CHANGED" = 1 ]; then systemctl restart vitess-vtgate.service; printf '%s\\n' "$VTESS_VTGATE_AUTH_SHA" > ${U}; chown ${S}:${S} ${U}; chmod 0600 ${U}; fi`,...ke(t),...ae(t)),n}var Me=new Set(["singlestore","vitess"]);function xi(e){if(e?.engine&&Me.has(e.engine))return!1;return!e?.host||e.host==="127.0.0.1"||e.host==="localhost"}function xr(e,t="psql"){let r=e?.port??5432;if(xi(e))return`${t} -p ${r} -U postgres`;let n=e?.username||"postgres";return`${e?.password?`PGPASSWORD='${e.password.replace(/'/g,"'\\''")}' `:""}${t} -h ${e.host} -p ${r} -U ${n} -w`}function y(e){return e===!0||typeof e==="object"&&e!=null}function Ne(e){let t=[],r=[];if(y(e.mysql))t.push(typeof e.mysql==="object"&&e.mysql.version?`mysql.com@${e.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(y(e.mariadb))t.push(L.mariadb),r.push("mariadb");if(y(e.postgres))t.push("postgresql.org"),r.push("postgres");if(y(e.redis))t.push("redis.io"),r.push("redis");if(y(e.memcached))t.push("memcached.org"),r.push("memcached");if(y(e.meilisearch))t.push("meilisearch.com"),r.push("meilisearch");return{packages:t,services:r}}function Bo(e={},t={}){let r=Ne(e),n=Fo(e.vitess),o=t.mail?ne(t.mail):[];if(r.packages.length===0)return[...n,...o];return[...it(r.packages),...Uo(r.services),...n,...o]}function At(e,t={}){if(!e?.name)return[];if(!xi(e))return[];let r=e.name,n=e.username||r,o=e.password||"",s=y(t.postgres)||e.engine==="postgres",c=y(t.mariadb)||e.engine==="mariadb",p=y(t.mysql)||e.engine==="mysql";if(s&&!p&&!c){let a=(d)=>`"${d.replace(/"/g,'""')}"`,P=(d)=>`'${d.replace(/'/g,"''")}'`,O=(d,k)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${P(d)}) THEN`,`    CREATE ROLE ${a(d)} LOGIN PASSWORD ${P(k)};`,"  ELSE",`    ALTER ROLE ${a(d)} LOGIN PASSWORD ${P(k)};`,"  END IF;","END $$;"],x=(d)=>{let k=d.databases&&d.databases.length>0?d.databases:[r],V=[];for(let G of k)if(d.access==="readonly")V.push(`GRANT CONNECT ON DATABASE ${a(G)} TO ${a(d.username)};`,`\\connect ${a(G)}`,`GRANT USAGE ON SCHEMA public TO ${a(d.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${a(d.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${a(n)} IN SCHEMA public GRANT SELECT ON TABLES TO ${a(d.username)};`,"\\connect postgres");else V.push(`GRANT ALL PRIVILEGES ON DATABASE ${a(G)} TO ${a(d.username)};`);return V},I=e.users||[],Se=e.port??5432;return[wt(),`for i in $(seq 1 30); do pg_isready -p ${Se} -q && break; sleep 2; done`,`${xr(e)} <<'TS_CLOUD_PG_EOF'`,...O(n,o),`SELECT 'CREATE DATABASE ${a(r)} OWNER ${a(n)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${P(r)})\\gexec`,...I.flatMap((d)=>[...O(d.username,d.password),...x(d)]),"TS_CLOUD_PG_EOF",...Be(e)]}let l=c?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",i=(a)=>a.replace(/`/g,"``"),f=(a)=>a.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),C=(a)=>{let P=a.databases&&a.databases.length>0?a.databases:[r],O=a.access==="readonly"?"SELECT":"ALL PRIVILEGES",x=[`CREATE USER IF NOT EXISTS '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`CREATE USER IF NOT EXISTS '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`];for(let I of P)x.push(`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'%';`,`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'localhost';`);return x},u=e.users||[];return[wt(),`for i in $(seq 1 30); do mysqladmin --socket=${l} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${l} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${i(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...C({username:n,password:o}),...u.flatMap(C),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function Be(e){return[`${xr(e)} -tA <<'TS_CLOUD_PG_CAP_EOF' || true`,"\\set QUIET on","SELECT CASE WHEN used::float / NULLIF(cap, 0) >= 0.8","  THEN '[ts-cloud] postgres is at ' || used || '/' || cap || ' connections on this server.'","       || ' Raise max_connections (ALTER SYSTEM SET max_connections = ...; then restart) or'","       || ' set idle_session_timeout so abandoned pools are reclaimed.'","  ELSE NULL END","FROM (SELECT (SELECT count(*) FROM pg_stat_activity) AS used,","             (SELECT setting::int FROM pg_settings WHERE name = 'max_connections') AS cap) c","WHERE CASE WHEN used::float / NULLIF(cap, 0) >= 0.8 THEN true ELSE false END;","SELECT '[ts-cloud]   ' || coalesce(datname, '(background)') || ': ' || count(*) || ' connection(s), oldest idle ' ||","       coalesce(round(extract(epoch from max(now() - state_change)) / 60)::text || 'm', 'n/a')","FROM pg_stat_activity","WHERE (SELECT count(*)::float / NULLIF((SELECT setting::int FROM pg_settings WHERE name = 'max_connections'), 0) FROM pg_stat_activity) >= 0.8","GROUP BY datname ORDER BY count(*) DESC;","TS_CLOUD_PG_CAP_EOF"]}function Kc(e){if(!e?.name)return{};let t=e.engine==="singlestore",r=e.engine==="vitess",n=e.engine==="postgres"?"pgsql":t?"singlestore":r?"vitess":"mysql",o=e.port??(e.engine==="postgres"?5432:r?15306:3306),s={DB_CONNECTION:n,DB_HOST:e.host||"127.0.0.1",DB_PORT:String(o),DB_DATABASE:e.name};if(e.username)s.DB_USERNAME=e.username;if(e.password)s.DB_PASSWORD=e.password;if((t||r)&&e.ssl!==!1)s.DB_SSL="true";return s}var Z="/var/backups/ts-cloud",we="/etc/ts-cloud/backups.config.ts",pe="/etc/cron.d/ts-cloud-backups",hn="/usr/local/bin/ts-cloud-backup.sh";function Ve(e){if(!e.name)return null;let t=e.host||"127.0.0.1",r=e.engine==="postgres",n=r?"postgresql":"mysql",o=e.port??(r?5432:3306),s=(c)=>c.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${n}',`,`    name: '${s(e.name)}',`,"    connection: {",`      hostname: '${s(t)}',`,`      port: ${o},`,`      database: '${s(e.name)}',`,`      username: '${s(e.username||e.name)}',`,`      password: '${s(e.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
+`)}function ie(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,t,"TS_CLOUD_VITESS_UNIT_EOF"]}function De(e){let t=e.cell??"zone1",r=e.vtgatePort??W,o=`${((e.keyspaces?.length)?e.keyspaces:[{name:"app"}]).map((s)=>{let c=(s.sharded?["-80","80-"]:["0"]).map((p)=>`shards:{name:"${p}"}`).join(" ");return`keyspaces:{name:"${s.name}" ${c}}`}).join(" ")} cells:"${t}"`;return A({description:"Vitess (vtcombo, single-process development stack)",execStart:b("vtcombo",[`${g}/vtcombo`,`--cell ${t}`,`--proto-topo ${_(o)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${K}`,`--grpc-port ${N}`])})}function Ae(){return A({description:"etcd (Vitess topology store)",execStart:b("etcd",[`${g}/etcd`,`--data-dir ${E}/etcd`,`--listen-client-urls http://127.0.0.1:${B}`,`--advertise-client-urls http://127.0.0.1:${B}`]),execStartPre:[`+/bin/mkdir -p ${E}/etcd`,`+/bin/chown ${S}:${S} ${E}/etcd`]})}function Q(e){return["--topo-implementation etcd2",`--topo-global-server-address ${e.etcdEndpoint??`http://127.0.0.1:${B}`}`,"--topo-global-root /vitess/global"]}function Oe(e){let t=!e.etcdEndpoint;return A({description:"Vitess vtctld (control plane)",after:t?["vitess-etcd.service"]:[],requires:t?["vitess-etcd.service"]:[],execStart:b("vtctld",[`${g}/vtctld`,...Q(e),`--cell ${e.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${N}`,`--port ${N+1}`])})}function Le(e,t,r){let n=e.cell??"zone1";return A({description:`Vitess vttablet (${t}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:b("vttablet",[`${g}/vttablet`,...Q(e),`--tablet-path ${n}-${String(X).padStart(10,"0")}`,`--init-keyspace ${t}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${_("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${se}`,`--grpc-port ${se+1}`,`--db-port ${e.mysqlPort??3306}`,`--mycnf-mysql-port ${e.mysqlPort??3306}`])})}function Ue(e){return A({description:"Vitess mysqlctld (managed mysqld)",execStart:b("mysqlctld",[`${g}/mysqlctld`,`--tablet-uid ${X}`,`--mysql-port ${e.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${E}`,`+/bin/chown ${S}:${S} ${E}`]})}var le="/etc/vitess/auth.json",U="/var/lib/vitess/vtgate-auth.sha256";function xe(e){let t=e.username??"vitess",r=e.password??"";return["mkdir -p /etc/vitess",'VTESS_AUTH_TMP="$(mktemp)"',`cat > "$VTESS_AUTH_TMP" <<'TS_CLOUD_VITESS_AUTH_EOF'`,JSON.stringify({[t]:[{Password:r,UserData:t}]}),"TS_CLOUD_VITESS_AUTH_EOF",`VTESS_VTGATE_AUTH_SHA="$(sha256sum "$VTESS_AUTH_TMP" | awk '{print $1}')"`,"VTESS_VTGATE_AUTH_CHANGED=1",`if [ -f ${U} ] && [ "$(cat ${U})" = "$VTESS_VTGATE_AUTH_SHA" ]; then VTESS_VTGATE_AUTH_CHANGED=0; fi`,`install -o ${S} -g ${S} -m 0600 "$VTESS_AUTH_TMP" ${le}`,'rm -f "$VTESS_AUTH_TMP"']}function Ie(e){let t=e.cell??"zone1";return A({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:b("vtgate",[`${g}/vtgate`,...Q(e),`--cell ${t}`,`--cells-to-watch ${t}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${_("grpc-vtgateservice")}`,`--mysql-server-port ${e.vtgatePort??W}`,`--mysql-server-bind-address ${e.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${le}`,`--port ${K}`,`--grpc-port ${K+1}`])})}function ke(e){let t=e.cell??"zone1",r=e.etcdEndpoint??`http://127.0.0.1:${B}`,n=`${g}/vtctldclient --server 127.0.0.1:${N}`,o=[`for i in $(seq 1 30); do ${n} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${n} GetCellInfoNames 2>/dev/null | grep -qx ${_(t)}; then`,`  ${n} AddCellInfo --root ${_(`/vitess/${t}`)} --server-address ${_(r)} ${_(t)}`,"fi"];for(let s of e.keyspaces??[]){let c=s.sharded?" --sharded":"";o.push(`if ! ${n} GetKeyspace ${_(s.name)} >/dev/null 2>&1; then`,`  ${n} CreateKeyspace${c} ${_(s.name)}`,"fi");let p=`${t}-${String(X).padStart(10,"0")}`;for(let l of s.sharded?["-80","80-"]:["0"]){let i=`${s.name}/${l}`;o.push("for i in $(seq 1 90); do",`  if ${n} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${n} PlannedReparentShard ${_(i)} --new-primary ${_(p)} >/dev/null 2>&1 && break`,`  ${n} InitShardPrimary --force ${_(i)} ${_(p)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${n} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${i}" >&2; exit 1`,"fi")}o.push(`${n} RebuildKeyspaceGraph ${_(s.name)} >/dev/null`)}return o}function ae(e){let t=e.vtgatePort??W;return["for i in $(seq 1 60); do",`  if (cd ${D} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${_(e.password??"")} ${g}/mysql -h 127.0.0.1 -P ${t} -u ${_(e.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${t}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${t}" >&2`,"exit 1"]}function Bo(e){if(!Ni(e))return[];let t=Ce(e),r=t.mode==="combo";z.clear();let n=['if [ "$(uname -m)" != "x86_64" ]; then','  echo "vitess: Vitess publishes only x86_64 release tarballs; this box is $(uname -m). Drop managedServices.vitess or use an x86_64 host." >&2',"  exit 1","fi",...it(Re(t)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${g}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${S} >/dev/null 2>&1 || useradd --system --home-dir ${E} --shell /usr/sbin/nologin ${S}`,`mkdir -p ${E}`,`chown -R ${S}:${S} ${E}`];if(r)return n.push(...ie("vitess-vtcombo",De(t)),...oe(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...ae(t)),n;n.push(...xe(t));let o=[];if(!t.etcdEndpoint)o.push(["vitess-etcd",Ae()]);o.push(["vitess-vtctld",Oe(t)],["vitess-mysqlctld",Ue(t)],["vitess-vtgate",Ie(t)]);for(let s of t.keyspaces??[])for(let c of s.sharded?["-80","80-"]:["0"])o.push([`vitess-vttablet-${s.name}-${c.replace(/-/g,"x")}`,Le(t,s.name,c)]);for(let[s,c]of o)n.push(...ie(s,c));n.push(...oe()),n.push("systemctl daemon-reload");for(let[s]of o)n.push(`systemctl enable --now ${s}.service`);return n.push(`if [ "$VTESS_VTGATE_AUTH_CHANGED" = 1 ]; then systemctl restart vitess-vtgate.service; printf '%s\\n' "$VTESS_VTGATE_AUTH_SHA" > ${U}; chown ${S}:${S} ${U}; chmod 0600 ${U}; fi`,...ke(t),...ae(t)),n}var Me=new Set(["singlestore","vitess"]);function xi(e){if(e?.engine&&Me.has(e.engine))return!1;return!e?.host||e.host==="127.0.0.1"||e.host==="localhost"}function xr(e,t="psql"){let r=e?.port??5432;if(xi(e))return`${t} -p ${r} -U postgres`;let n=e?.username||"postgres";return`${e?.password?`PGPASSWORD='${e.password.replace(/'/g,"'\\''")}' `:""}${t} -h ${e.host} -p ${r} -U ${n} -w`}function y(e){return e===!0||typeof e==="object"&&e!=null}function Ne(e){let t=[],r=[];if(y(e.mysql))t.push(typeof e.mysql==="object"&&e.mysql.version?`mysql.com@${e.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(y(e.mariadb))t.push(L.mariadb),r.push("mariadb");if(y(e.postgres))t.push("postgresql.org"),r.push("postgres");if(y(e.redis))t.push("redis.io"),r.push("redis");if(y(e.memcached))t.push("memcached.org"),r.push("memcached");if(y(e.meilisearch))t.push("meilisearch.com"),r.push("meilisearch");return{packages:t,services:r}}function jo(e={},t={}){let r=Ne(e),n=Bo(e.vitess),o=t.mail?ne(t.mail):[];if(r.packages.length===0)return[...n,...o];return[...it(r.packages),...Fo(r.services),...n,...o]}function At(e,t={}){if(!e?.name)return[];if(!xi(e))return[];let r=e.name,n=e.username||r,o=e.password||"",s=y(t.postgres)||e.engine==="postgres",c=y(t.mariadb)||e.engine==="mariadb",p=y(t.mysql)||e.engine==="mysql";if(s&&!p&&!c){let a=(d)=>`"${d.replace(/"/g,'""')}"`,P=(d)=>`'${d.replace(/'/g,"''")}'`,O=(d,k)=>["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${P(d)}) THEN`,`    CREATE ROLE ${a(d)} LOGIN PASSWORD ${P(k)};`,"  ELSE",`    ALTER ROLE ${a(d)} LOGIN PASSWORD ${P(k)};`,"  END IF;","END $$;"],x=(d)=>{let k=d.databases&&d.databases.length>0?d.databases:[r],V=[];for(let G of k)if(d.access==="readonly")V.push(`GRANT CONNECT ON DATABASE ${a(G)} TO ${a(d.username)};`,`\\connect ${a(G)}`,`GRANT USAGE ON SCHEMA public TO ${a(d.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${a(d.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${a(n)} IN SCHEMA public GRANT SELECT ON TABLES TO ${a(d.username)};`,"\\connect postgres");else V.push(`GRANT ALL PRIVILEGES ON DATABASE ${a(G)} TO ${a(d.username)};`);return V},I=e.users||[],Se=e.port??5432;return[wt(),`for i in $(seq 1 30); do pg_isready -p ${Se} -q && break; sleep 2; done`,`${xr(e)} <<'TS_CLOUD_PG_EOF'`,...O(n,o),`SELECT 'CREATE DATABASE ${a(r)} OWNER ${a(n)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${P(r)})\\gexec`,...I.flatMap((d)=>[...O(d.username,d.password),...x(d)]),"TS_CLOUD_PG_EOF",...Be(e)]}let l=c?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",i=(a)=>a.replace(/`/g,"``"),f=(a)=>a.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),C=(a)=>{let P=a.databases&&a.databases.length>0?a.databases:[r],O=a.access==="readonly"?"SELECT":"ALL PRIVILEGES",x=[`CREATE USER IF NOT EXISTS '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`CREATE USER IF NOT EXISTS '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`];for(let I of P)x.push(`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'%';`,`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'localhost';`);return x},u=e.users||[];return[wt(),`for i in $(seq 1 30); do mysqladmin --socket=${l} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${l} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${i(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...C({username:n,password:o}),...u.flatMap(C),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function Be(e){return[`${xr(e)} -tA <<'TS_CLOUD_PG_CAP_EOF' || true`,"\\set QUIET on","SELECT CASE WHEN used::float / NULLIF(cap, 0) >= 0.8","  THEN '[ts-cloud] postgres is at ' || used || '/' || cap || ' connections on this server.'","       || ' Raise max_connections (ALTER SYSTEM SET max_connections = ...; then restart) or'","       || ' set idle_session_timeout so abandoned pools are reclaimed.'","  ELSE NULL END","FROM (SELECT (SELECT count(*) FROM pg_stat_activity) AS used,","             (SELECT setting::int FROM pg_settings WHERE name = 'max_connections') AS cap) c","WHERE CASE WHEN used::float / NULLIF(cap, 0) >= 0.8 THEN true ELSE false END;","SELECT '[ts-cloud]   ' || coalesce(datname, '(background)') || ': ' || count(*) || ' connection(s), oldest idle ' ||","       coalesce(round(extract(epoch from max(now() - state_change)) / 60)::text || 'm', 'n/a')","FROM pg_stat_activity","WHERE (SELECT count(*)::float / NULLIF((SELECT setting::int FROM pg_settings WHERE name = 'max_connections'), 0) FROM pg_stat_activity) >= 0.8","GROUP BY datname ORDER BY count(*) DESC;","TS_CLOUD_PG_CAP_EOF"]}function Jc(e){if(!e?.name)return{};let t=e.engine==="singlestore",r=e.engine==="vitess",n=e.engine==="postgres"?"pgsql":t?"singlestore":r?"vitess":"mysql",o=e.port??(e.engine==="postgres"?5432:r?15306:3306),s={DB_CONNECTION:n,DB_HOST:e.host||"127.0.0.1",DB_PORT:String(o),DB_DATABASE:e.name};if(e.username)s.DB_USERNAME=e.username;if(e.password)s.DB_PASSWORD=e.password;if((t||r)&&e.ssl!==!1)s.DB_SSL="true";return s}var Z="/var/backups/ts-cloud",we="/etc/ts-cloud/backups.config.ts",pe="/etc/cron.d/ts-cloud-backups",hn="/usr/local/bin/ts-cloud-backup.sh";function Ve(e){if(!e.name)return null;let t=e.host||"127.0.0.1",r=e.engine==="postgres",n=r?"postgresql":"mysql",o=e.port??(r?5432:3306),s=(c)=>c.replace(/\\/g,"\\\\").replace(/'/g,"\\'");return["  {",`    type: '${n}',`,`    name: '${s(e.name)}',`,"    connection: {",`      hostname: '${s(t)}',`,`      port: ${o},`,`      database: '${s(e.name)}',`,`      username: '${s(e.username||e.name)}',`,`      password: '${s(e.password||"")}',`,"      ssl: false,","    },","    includeSchema: true,","    includeData: true,","  },"].join(`
 `)}function He(e,t){let r=e?Ve(e):null,n=t.bucket?["  destinations: [","    {","      type: 's3',",`      bucket: '${t.bucket}',`,"      prefix: 'db-backups',",...t.endpoint?[`      endpoint: '${t.endpoint}',`]:[],"      optional: false,","    },","  ],"]:[];return["import type { BackupConfig } from 'ts-backups'","","const config: BackupConfig = {","  verbose: true,",`  outputPath: '${Z}',`,"  retention: {",`    count: ${t.retentionCount??5},`,`    maxAge: ${t.retentionDays??30},`,"  },","  databases: [",...r?[r]:[],"  ],",...n,"}","","export default config",""].join(`
-`)}function jo(e){let{database:t,backups:r}=e;if(!r.enabled)return[];let n=r.schedule||"0 2 * * *",o=He(t,r);return["export DEBIAN_FRONTEND=noninteractive",`mkdir -p /etc/ts-cloud ${Z}`,"command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)","bun add -g ts-backups || true",`cat > ${we} <<'TS_CLOUD_BACKUP_CFG_EOF'`,o.replace(/\n$/,""),"TS_CLOUD_BACKUP_CFG_EOF",`cat > ${hn} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -uo pipefail",'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"','notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",'if ! ts-backups start --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',"TS_CLOUD_BACKUP_RUN_EOF",`chmod +x ${hn}`,`cat > ${pe} <<'TS_CLOUD_BACKUP_CRON_EOF'`,`${n} root ${hn} >> /var/log/ts-cloud-backup.log 2>&1`,"TS_CLOUD_BACKUP_CRON_EOF",`chmod 644 ${pe}`]}function Ge(e){return e==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function _i(e,t={}){if(!e?.name)return[];let r=e.name,n=e.engine==="postgres",o=t.from?`TS_CLOUD_DUMP="${t.from}"`:`TS_CLOUD_DUMP="$(find ${Z} -type f -name '*${r}*.sql' -o -type f -name '*${r}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,s=n?`${xr(e)} -d "${r}"`:`mysql --socket=${Ge(e.engine)} -u root "${r}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',o,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+r+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${s}`,'echo "restore complete"']}var Vo=["storage",".env"],Oi=4;function v(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Qs(e){return`${v(e)}/deploy-history.log`}function qe(e,t){return`${v(e)}/deploys/${t}.log`}function ue(e){return`${v(e)}/shared-paths`}function zo(e){return`${e.shared}/stx-images`}function Wt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function de(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Ys(e){return typeof e==="string"?e:e.path}function Jc(e){let t=new Map;for(let r of e)t.set(Ys(r),r);return[...t.values()]}function $e(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Fe(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function $i(e,t=Vo){let r=[`mkdir -p ${e.releases} ${e.shared} ${zo(e)}`,...Fe(e)],n=t.map((s)=>$e(e,s));for(let{path:s,target:c,seed:p}of n){if(!p)continue;if(r.push(`ts_cloud_adopt_shared '${s}' '${c}'`),de(s))r.push(`mkdir -p "$(dirname ${c})"`,`touch ${c}`);else if(s==="storage")r.push(`mkdir -p ${c}/app/public`,`mkdir -p ${c}/framework/cache/data`,`mkdir -p ${c}/framework/sessions`,`mkdir -p ${c}/framework/testing`,`mkdir -p ${c}/framework/views`,`mkdir -p ${c}/logs`);else r.push(`mkdir -p ${c}`)}let o=ue(e.base);return r.push(`mkdir -p ${v(e.base)}`,`cat > ${o} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((s)=>`${s.path}	${s.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Zs(e,t=900){let r=`${v(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function ea(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Ye(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function ta(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Ye(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function ra(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Ke(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Ho(e,t=Vo){let r=[];for(let n of t){let{path:o,target:s,seed:c}=$e(e,n),p=`${e.release}/${o}`,l=[`rm -rf ${p}`,`mkdir -p "$(dirname ${p})"`,`ln -sfn ${s} ${p}`];if(c){if(o!==".env"&&de(o))r.push(...Ke(p,s));r.push(...l);continue}r.push(`if [ -e ${s} ]; then`,...l.map((i)=>`  ${i}`),"fi")}return r}function je(e,t){let r=ue(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function yn(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function ee(e){return`${v(e)}/previous-release`}function na(e,t="TS_CLOUD_PREV_CURRENT"){let r=ee(e.base);return[`if [ -n "\${${t}:-}" ] && [ -d "$${t}" ] && [ "$(readlink -f "$${t}")" != "$(readlink -f ${e.release})" ]; then mkdir -p ${v(e.base)}; basename "$${t}" > ${r}; fi`]}function _e(e,t){let r=ee(e.base);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,...t?[`TS_CLOUD_RB_TARGET=${e.releases}/${t}`]:["TS_CLOUD_RB_TARGET=",`if [ -f ${r} ]; then TS_CLOUD_REC="${e.releases}/$(cat ${r})"; if [ -d "$TS_CLOUD_REC" ] && [ "$(readlink -f "$TS_CLOUD_REC")" != "$TS_CLOUD_CURRENT" ]; then TS_CLOUD_RB_TARGET="$TS_CLOUD_REC"; fi; fi`,`[ -n "$TS_CLOUD_RB_TARGET" ] || TS_CLOUD_RB_TARGET=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`],'[ -n "$TS_CLOUD_RB_TARGET" ] && [ -d "$TS_CLOUD_RB_TARGET" ] || { echo "no release to roll back to (looked for ${TS_CLOUD_RB_TARGET:-a previous release})" >&2; exit 1; }','[ "$(readlink -f "$TS_CLOUD_RB_TARGET")" != "$TS_CLOUD_CURRENT" ] || { echo "$(basename "$TS_CLOUD_RB_TARGET") is already the live release" >&2; exit 1; }','TS_CLOUD_RB_ID=$(basename "$TS_CLOUD_RB_TARGET")']}function Xc(e,t={}){return[..._e(e,t.to),'echo "would roll back from $(basename "${TS_CLOUD_CURRENT:-none}") to $TS_CLOUD_RB_ID (dry run: nothing changed)"']}function Qc(e,t={}){let r=Math.max(1,t.gateSeconds??5),n=t.systemdDir??"/etc/systemd/system",o=[`ln -sfn "$TS_CLOUD_RB_TARGET" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,`rm -f ${ee(e.base)}`,'echo "rolled back to $TS_CLOUD_RB_ID"'],s=[..._e(e,t.to),...je(e,'"$TS_CLOUD_RB_TARGET"')];if(!t.unitBase)return[...s,...o];let c=t.unitBase,p=`${c}@\${TS_CLOUD_RB_ID}.service`;return[...s,`if [ -f ${n}/${c}@.service ]; then`,`  systemctl start "${p}"`,`  for TS_CLOUD_I in $(seq 1 ${r}); do sleep 1; systemctl is-active --quiet "${p}" || { echo "the release rolled back to, $TS_CLOUD_RB_ID, did not stay up; the current release keeps serving" >&2; journalctl -u "${p}" -n 30 --no-pager >&2 || true; systemctl stop "${p}" 2>/dev/null || true; exit 1; }; done`,...o.map((l)=>`  ${l}`),`  systemctl enable "${p}" 2>/dev/null || true`,`  systemctl list-units --plain --no-legend --type=service "${c}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${c}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`elif [ -f ${n}/${c}.service ]; then`,...o.map((l)=>`  ${l}`),`  systemctl restart ${c}.service`,"else",...o.map((l)=>`  ${l}`),"fi"]}function bn(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function We(e){return`${v(e)}/owner`}function ia(e,t){let r=We(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function Go(e,t){let r=v(e),n=qe(e,t.releaseId),o=Qs(e),s=Math.max(1,t.keepLogs??20),c=t.commit||"",p=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${c} branch=${p} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${c}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${o}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${s+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}
-export{J,ki,Ks,w,Mo,Js,Xs,qc,Wc,D,Et,wt,it,Uo,Ni,Fo,xi,xr,Bo,At,Kc,hn,jo,_i,Vo,Oi,Qs,zo,Wt,Ys,Jc,$i,Zs,ea,ta,ra,Ho,yn,na,Xc,Qc,bn,ia,Go};
+`)}function Vo(e){let{database:t,backups:r}=e;if(!r.enabled)return[];let n=r.schedule||"0 2 * * *",o=He(t,r);return["export DEBIAN_FRONTEND=noninteractive",`mkdir -p /etc/ts-cloud ${Z}`,"command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)","bun add -g ts-backups || true",`cat > ${we} <<'TS_CLOUD_BACKUP_CFG_EOF'`,o.replace(/\n$/,""),"TS_CLOUD_BACKUP_CFG_EOF",`cat > ${hn} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -uo pipefail",'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"','notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",'if ! ts-backups start --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',"TS_CLOUD_BACKUP_RUN_EOF",`chmod +x ${hn}`,`cat > ${pe} <<'TS_CLOUD_BACKUP_CRON_EOF'`,`${n} root ${hn} >> /var/log/ts-cloud-backup.log 2>&1`,"TS_CLOUD_BACKUP_CRON_EOF",`chmod 644 ${pe}`]}function Ge(e){return e==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function _i(e,t={}){if(!e?.name)return[];let r=e.name,n=e.engine==="postgres",o=t.from?`TS_CLOUD_DUMP="${t.from}"`:`TS_CLOUD_DUMP="$(find ${Z} -type f -name '*${r}*.sql' -o -type f -name '*${r}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,s=n?`${xr(e)} -d "${r}"`:`mysql --socket=${Ge(e.engine)} -u root "${r}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',o,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+r+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${s}`,'echo "restore complete"']}var zo=["storage",".env"],Oi=4;function v(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Ys(e){return`${v(e)}/deploy-history.log`}function qe(e,t){return`${v(e)}/deploys/${t}.log`}function ue(e){return`${v(e)}/shared-paths`}function Ho(e){return`${e.shared}/stx-images`}function $i(e){return`${e.shared}/stx-bundles`}function Wt(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function de(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function Zs(e){return typeof e==="string"?e:e.path}function Xc(e){let t=new Map;for(let r of e)t.set(Zs(r),r);return[...t.values()]}function $e(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Fe(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Li(e,t=zo){let r=[`mkdir -p ${e.releases} ${e.shared} ${Ho(e)} ${$i(e)}`,...Fe(e)],n=t.map((s)=>$e(e,s));for(let{path:s,target:c,seed:p}of n){if(!p)continue;if(r.push(`ts_cloud_adopt_shared '${s}' '${c}'`),de(s))r.push(`mkdir -p "$(dirname ${c})"`,`touch ${c}`);else if(s==="storage")r.push(`mkdir -p ${c}/app/public`,`mkdir -p ${c}/framework/cache/data`,`mkdir -p ${c}/framework/sessions`,`mkdir -p ${c}/framework/testing`,`mkdir -p ${c}/framework/views`,`mkdir -p ${c}/logs`);else r.push(`mkdir -p ${c}`)}let o=ue(e.base);return r.push(`mkdir -p ${v(e.base)}`,`cat > ${o} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...n.map((s)=>`${s.path}	${s.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function ea(e,t=900){let r=`${v(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function ta(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Ye(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function ra(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Ye(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function na(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Ke(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Go(e,t=zo){let r=[];for(let n of t){let{path:o,target:s,seed:c}=$e(e,n),p=`${e.release}/${o}`,l=[`rm -rf ${p}`,`mkdir -p "$(dirname ${p})"`,`ln -sfn ${s} ${p}`];if(c){if(o!==".env"&&de(o))r.push(...Ke(p,s));r.push(...l);continue}r.push(`if [ -e ${s} ]; then`,...l.map((i)=>`  ${i}`),"fi")}return r}function je(e,t){let r=ue(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function yn(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function ee(e){return`${v(e)}/previous-release`}function ia(e,t="TS_CLOUD_PREV_CURRENT"){let r=ee(e.base);return[`if [ -n "\${${t}:-}" ] && [ -d "$${t}" ] && [ "$(readlink -f "$${t}")" != "$(readlink -f ${e.release})" ]; then mkdir -p ${v(e.base)}; basename "$${t}" > ${r}; fi`]}function _e(e,t){let r=ee(e.base);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,...t?[`TS_CLOUD_RB_TARGET=${e.releases}/${t}`]:["TS_CLOUD_RB_TARGET=",`if [ -f ${r} ]; then TS_CLOUD_REC="${e.releases}/$(cat ${r})"; if [ -d "$TS_CLOUD_REC" ] && [ "$(readlink -f "$TS_CLOUD_REC")" != "$TS_CLOUD_CURRENT" ]; then TS_CLOUD_RB_TARGET="$TS_CLOUD_REC"; fi; fi`,`[ -n "$TS_CLOUD_RB_TARGET" ] || TS_CLOUD_RB_TARGET=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`],'[ -n "$TS_CLOUD_RB_TARGET" ] && [ -d "$TS_CLOUD_RB_TARGET" ] || { echo "no release to roll back to (looked for ${TS_CLOUD_RB_TARGET:-a previous release})" >&2; exit 1; }','[ "$(readlink -f "$TS_CLOUD_RB_TARGET")" != "$TS_CLOUD_CURRENT" ] || { echo "$(basename "$TS_CLOUD_RB_TARGET") is already the live release" >&2; exit 1; }','TS_CLOUD_RB_ID=$(basename "$TS_CLOUD_RB_TARGET")']}function Qc(e,t={}){return[..._e(e,t.to),'echo "would roll back from $(basename "${TS_CLOUD_CURRENT:-none}") to $TS_CLOUD_RB_ID (dry run: nothing changed)"']}function Yc(e,t={}){let r=Math.max(1,t.gateSeconds??5),n=t.systemdDir??"/etc/systemd/system",o=[`ln -sfn "$TS_CLOUD_RB_TARGET" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,`rm -f ${ee(e.base)}`,'echo "rolled back to $TS_CLOUD_RB_ID"'],s=[..._e(e,t.to),...je(e,'"$TS_CLOUD_RB_TARGET"')];if(!t.unitBase)return[...s,...o];let c=t.unitBase,p=`${c}@\${TS_CLOUD_RB_ID}.service`;return[...s,`if [ -f ${n}/${c}@.service ]; then`,`  systemctl start "${p}"`,`  for TS_CLOUD_I in $(seq 1 ${r}); do sleep 1; systemctl is-active --quiet "${p}" || { echo "the release rolled back to, $TS_CLOUD_RB_ID, did not stay up; the current release keeps serving" >&2; journalctl -u "${p}" -n 30 --no-pager >&2 || true; systemctl stop "${p}" 2>/dev/null || true; exit 1; }; done`,...o.map((l)=>`  ${l}`),`  systemctl enable "${p}" 2>/dev/null || true`,`  systemctl list-units --plain --no-legend --type=service "${c}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${c}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`elif [ -f ${n}/${c}.service ]; then`,...o.map((l)=>`  ${l}`),`  systemctl restart ${c}.service`,"else",...o.map((l)=>`  ${l}`),"fi"]}function bn(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function We(e){return`${v(e)}/owner`}function oa(e,t){let r=We(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function qo(e,t){let r=v(e),n=qe(e,t.releaseId),o=Ys(e),s=Math.max(1,t.keepLogs??20),c=t.commit||"",p=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${n}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${c} branch=${p} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${c}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${o}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${s+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}
+export{J,ki,Js,w,Uo,Xs,Qs,Wc,Kc,D,Et,wt,it,Fo,Ni,Bo,xi,xr,jo,At,Jc,hn,Vo,_i,zo,Oi,Ys,Ho,$i,Wt,Zs,Xc,Li,ea,ta,ra,na,Go,yn,ia,Qc,Yc,bn,oa,qo};

package/dist/bin/{chunk-vbq4ten8.js → chunk-vwgpwjwh.js}

@@ -1,3 +1,3 @@
-import{p}from"./chunk-qpvydcfm.js";import{$e,ha,Mi,Ka,Pn,qi,Ja,Xa,ic,oc}from"./chunk-v3j9wgmn.js";import{n,r,a,e,u,i,Ee}from"./chunk-favx96qj.js";import{v}from"./chunk-zs0q8sh5.js";import{P}from"./chunk-aekwpste.js";import{g}from"./chunk-8bgfn8ek.js";class K{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new p(void 0,{profile:s})}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId,ClientRequestToken:t.ClientRequestToken||crypto.randomUUID()};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";function k(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:$e(t,s),artifactBucket:ha(c,s),assetsBucket:Mi(c,s)}}function Tt(t,s){let o=k(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function q(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let d=l?.code||l?.name||"",m=String(l?.message||"");if(d==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(m)){o=l,await new Promise((f)=>setTimeout(f,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new K(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((d)=>({envName:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(t.secrets).map(([d,m])=>({envName:d,secretId:m}));if(Array.isArray(t.secrets)){let d=new Map;for(let{envName:f,secretId:S}of l)d.set(f,[...d.get(f)??[],S]);let m=[...d.entries()].filter(([,f])=>f.length>1);if(m.length){let f=m.map(([S,R])=>`${S} ← ${R.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${f}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:d,secretId:m}of l){let S=(await o.getSecretValue({SecretId:m})).SecretString??"";try{let R=JSON.parse(S);if(R&&typeof R==="object"&&!Array.isArray(R)){for(let[w,N]of Object.entries(R))c[w]=String(N);continue}}catch{}c[d]=S}return c}function Yd(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function Us(t,s,o,c,l,d,m,f={}){let S=t.kind==="php"?ic({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...f,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...m?{TSCLOUD_QUEUE:m,SQS_QUEUE:m}:{},...d?{ASSET_URL:d}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function he(t,s,o,c,l=!1){let d=0;for(let m of oe(o)){let f=Se(o,m).replace(/\\/g,"/");if(!l&&f.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${f}`,body:pe(m),contentType:Re(m),cacheControl:"public, max-age=31536000, immutable"}),d++}return d}function Oo(t,s){let o=Object.entries(s).reduce((c,[l,d])=>c+Buffer.byteLength(`${l}=${d}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,d])=>[l,Buffer.byteLength(`${l}=${d}`,"utf8")]).sort((l,d)=>d[1]-l[1]).slice(0,5).map(([l,d])=>`${l} (${d}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function U(t,s,o,c){Oo(s,o),await q(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await q(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await q(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await q(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function dm(t,s,o={}){let c=k(t,s),{app:l,slug:d,region:m,stackName:f,artifactBucket:S}=c,R=o.projectRoot??process.cwd();i(`Deploying serverless app: ${d} (${s})`),e(`Stack: ${f}`),e(`Region: ${m}`);let w=new g(m),N=new v(m),T=new P(m),D=l.kind==="php",O=l.packaging==="image",h=qi(l),V,E,b,Y,M=[];if(O&&h.usesLayer&&h.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${h.kind}${h.kind==="node"?` ${h.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){u("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-agmznzms.js"),C=await y({app:l,projectRoot:R,region:m,repository:`${d}-${s}`,skipBuild:o.skipBuild,onStep:(I)=>e(`  ${I}`)});V=C.handlers,E={kind:"image",imageUri:C.imageUri},b=C.tag,M.push({ParameterKey:"ImageUri",ParameterValue:C.imageUri})}else{u("Packaging application");let y=D?oc({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await Pn({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),C=Ka(d,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,b=y.sha256,h.usesLayer){let x=h.layerEnvVar?process.env[h.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=h.layerKind==="php"?"serverless:build-php-layer":h.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${h.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${h.layerEnvVar} env var (build one with \`cloud ${ge}\`)${h.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await w.bucketExists(S))u(`Creating artifact bucket ${S}`),await w.createBucket(S);if(await w.headObject(S,C).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else u("Uploading artifact"),await w.putObject({bucket:S,key:C,body:y.zip,contentType:"application/zip"});E={kind:"zip",bucket:S,key:C},M.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:C})}let A=Xa({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(A.template),re=["CAPABILITY_NAMED_IAM"],L=await N.describeStacks({stackName:f}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),J=L!==void 0;if(L&&/DELETE_IN_PROGRESS/.test(L))u("Waiting for an in-progress stack delete to finish"),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;else if(L&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(L))u(`Deleting unusable stack (status ${L}) before recreate`),await N.deleteStack(f),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;u(J?"Updating infrastructure stack":"Creating infrastructure stack");try{if(J)await N.updateStack({stackName:f,templateBody:te,parameters:M,capabilities:re}),await N.waitForStack(f,"stack-update-complete");else await N.createStack({stackName:f,templateBody:te,parameters:M,capabilities:re,onFailure:"DELETE"}),await N.waitForStack(f,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await N.getStackOutputs(f).catch(()=>({})),B;if(l.assets){let y=ne(R,l.assets);if(de(y)){let C=l.assetDomain||Q.AssetsCdnDomain;B=C?`https://${C}/${b}`:void 0,u(`Syncing assets from ${l.assets}`);let I=await he(w,c.assetsBucket,y,b,l.dotFilesAsAssets);e(`Uploaded ${I} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}u("Resolving secrets");let _=await ye(l,m);if(l.database?.connection==="aurora-serverless")try{let C=await new K(m).getSecretValue({SecretId:`${d}/${s}/db`}),I=JSON.parse(C.SecretString??"{}");if(I.username)_.DB_USERNAME=I.username;if(I.password)_.DB_PASSWORD=I.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await w.bucketExists(S))await w.createBucket(S);let H=await G(w,S,d,s),F={},Z=A.queueNames[0],ee=Yd(l,Q);if(u("Activating functions"),F.http=Us(l,c,s,"http",_,B,Z,ee),await U(T,A.functionNames.http,F.http,E),F.cli=Us(l,c,s,"cli",_,B,Z,ee),await U(T,A.functionNames.cli,F.cli,E),A.queueNames.length)F.queue=Us(l,c,s,"queue",_,B,Z,ee),await U(T,A.functionNames.queue,F.queue,E);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(u("Publishing versions + flipping live alias"),W.http=await X(T,A.functionNames.http),W.cli=await X(T,A.functionNames.cli),A.queueNames.length)W.queue=await X(T,A.functionNames.queue)}if(await ae(w,S,d,s,{sha:b,code:E,previousSha:H?.sha,previousCode:H?.code,previousFunctionEnv:H?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:H?.functionVersions}:{},functionEnv:F,functionNames:{http:A.functionNames.http,cli:A.functionNames.cli,...A.queueNames.length?{queue:A.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){u("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let C=await T.invoke({FunctionName:A.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(C.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${C.Payload}`)}}let j=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&j){u("Health check");try{let y=await fetch(j,{method:"GET"});e(`GET ${j} → ${y.status}`)}catch(y){a(`Health check could not reach ${j}: ${y.message}`)}}Ee(["Serverless deploy complete","",j?`URL:   ${j}`:"",`Stack: ${f}`,`Build: ${b.slice(0,12)}`].filter(Boolean).join(`
-`),"green")}async function Fs(t,s){let o=k(t,s),c=new g(o.region),l=new P(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d)throw Error("No previous release to redeploy. Run a full deploy first.");i(`Redeploying ${o.slug} (${s}) — build ${d.sha.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;u(`Re-activating ${m} (${f})`),await U(l,f,d.functionEnv[m]??{},d.code);let S=d.functionVersions?.[m];if(S)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:S}))}n("Redeploy complete")}async function Bs(t,s){let o=k(t,s),c=new g(o.region),l=new P(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d?.previousCode)throw Error("No previous release to roll back to.");i(`Rolling back ${o.slug} (${s}) → ${d.previousSha?.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;u(`Restoring ${m} (${f})`);let S=d.previousFunctionEnv?.[m]??d.functionEnv[m]??{};await U(l,f,S,d.previousCode);let R=d.previousFunctionVersions?.[m];if(R)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:R}))}await ae(c,o.artifactBucket,o.slug,s,{...d,sha:d.previousSha??d.sha,code:d.previousCode,functionEnv:d.previousFunctionEnv??d.functionEnv,functionVersions:d.previousFunctionVersions??d.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),n("Rollback complete")}async function $o(t,s,o,c){let l=k(t,s),d=new P(l.region),m=`${l.slug}-${s}-http`,S={...(await d.getFunction(m)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=o?"1":"0",o&&c)S.MAINTENANCE_BYPASS_SECRET=c;if(!o)delete S.MAINTENANCE_BYPASS_SECRET;if(await q(()=>d.updateFunctionConfiguration({FunctionName:m,Environment:{Variables:S}})),(l.app.provisionedConcurrency??0)>0)await d.waitForFunctionActive(m,120),await X(d,m);n(o?"Application is now in maintenance mode (503)":"Application is live")}async function Gt(t,s,o){let c=k(t,s),l=new P(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"});if(m.FunctionError)throw Error(`Command failed: ${m.Payload}`);return m.Payload??""}var ce=(t,s)=>`commands/${t}/${s}/history.json`,ve=50;async function le(t,s,o,c){try{return(await t.getObjectJson(s,ce(o,c)))?.records??[]}catch{return[]}}async function um(t,s,o){let c=k(t,s),l=new P(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"}),f=m.Payload??"",S=m.FunctionError?"error":"ok",R=-1;try{let w=new g(c.region);if(await w.bucketExists(c.artifactBucket)){let N=await le(w,c.artifactBucket,c.slug,s);R=N.reduce((T,D)=>Math.max(T,D.id),0)+1,N.push({id:R,command:o,timestamp:new Date().toISOString(),status:S,output:f.slice(0,4000)}),await w.putObjectJson(c.artifactBucket,ce(c.slug,s),{records:N.slice(-ve)})}}catch{}if(m.FunctionError)throw Error(`Command failed${R>0?` (#${R})`:""}: ${f}`);return{id:R,status:S,output:f}}async function Zd(t,s){let o=k(t,s),c=new g(o.region);return le(c,o.artifactBucket,o.slug,s)}async function pm(t,s,o){let c=await Zd(t,s);if(!c.length)return;return o==null?c[c.length-1]:c.find((l)=>l.id===o)}async function mm(t,s,o){let c=Buffer.from(o,"utf-8").toString("base64");return Gt(t,s,`tscloud:db-query --sql-base64=${c}`)}async function z(t,s){let o=k(t,s),c=new v(o.region),l=new P(o.region),d=new g(o.region),m="not deployed",f={};try{let{Stacks:O}=await c.describeStacks({stackName:o.stackName});m=O?.[0]?.StackStatus??m;for(let h of O?.[0]?.Outputs??[])if(h.OutputKey)f[h.OutputKey]=h.OutputValue??""}catch{}let S=Ja(o.app,o.slug,s),R=o.app.provisionedConcurrency??0,w=["http","cli",...S.length?["queue"]:[]],N=`${o.slug}-${s}`,T=[];for(let O of w){let h=`${N}-${O}`,V={mode:O,name:h,version:"$LATEST"};if(R>0){let E=await l.getAlias(h,"live").catch(()=>null);if(E?.FunctionVersion){V.version=E.FunctionVersion;let b=await l.getProvisionedConcurrencyConfig(h,"live").catch(()=>null);if(b)V.provisioned={status:b.Status??"-",allocated:b.AllocatedProvisionedConcurrentExecutions??0,requested:b.RequestedProvisionedConcurrentExecutions??0}}}T.push(V)}let D=await G(d,o.artifactBucket,o.slug,s).catch(()=>null);return{slug:o.slug,environment:s,region:o.region,stackStatus:m,endpoint:f.HttpApiEndpoint,assetUrl:D?.assetUrl,scheduler:o.app.scheduler??"on",queues:S,provisionedConcurrency:R,functions:T,lastRelease:D?{sha:D.sha,timestamp:D.timestamp}:void 0}}function ue(t,s){return`${t}-${s}-db`}async function js(t,s,o,c){let l=k(t,s);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:d}=await import("./chunk-g0w0jec3.js"),m=new d(l.region),f=ue(l.slug,s);u(`Scaling ${f} → ${o}–${c} ACUs`),await m.modifyDBCluster({DBClusterIdentifier:f,ServerlessV2ScalingConfiguration:{MinCapacity:o,MaxCapacity:c},ApplyImmediately:!0}),n(`Scaling applied to ${f} (takes effect shortly).`)}async function gm(t,s,o){let c=k(t,s);if(c.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!o.toTime&&!o.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:l}=await import("./chunk-g0w0jec3.js"),d=new l(c.region),m=ue(c.slug,s),f=o.latest?"latest":o.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),S=o.target??`${m}-restore-${f}`;u(`Restoring ${m} → new cluster ${S} (${o.latest?"latest restorable time":o.toTime.toISOString()})`),await d.restoreDBClusterToPointInTime({DBClusterIdentifier:S,SourceDBClusterIdentifier:m,RestoreToTime:o.toTime,UseLatestRestorableTime:o.latest}),u("Waiting for the restored cluster to be ready");for(let R=0;R<120;R++){let{DBClusters:w}=await d.describeDBClusters({DBClusterIdentifier:S}),N=w?.[0]?.Status;if(N&&N!=="creating")break;await new Promise((T)=>setTimeout(T,15000))}return u("Adding a writer instance"),await d.createDBInstance({DBInstanceIdentifier:`${S}-1`,DBClusterIdentifier:S,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),n(`Restore complete → cluster ${S} with writer ${S}-1. Point an env's database at it once available.`),S}
-export{K,Tt,Yd,Us,Oo,dm,Fs,Bs,$o,Gt,um,Zd,pm,mm,z,js,gm};
+import{p}from"./chunk-kwfbth5c.js";import{$e,ya,Ui,Ja,Pn,Wi,Xa,Qa,oc,sc}from"./chunk-dbtm1j98.js";import{n,r,a,e,u,i,Ee}from"./chunk-pxm3w8a3.js";import{v}from"./chunk-7pxqdq44.js";import{P}from"./chunk-9vjg754g.js";import{g}from"./chunk-vcs8wtay.js";class K{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new p(void 0,{profile:s})}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId,ClientRequestToken:t.ClientRequestToken||crypto.randomUUID()};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";function k(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:$e(t,s),artifactBucket:ya(c,s),assetsBucket:Ui(c,s)}}function Tt(t,s){let o=k(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function q(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let d=l?.code||l?.name||"",m=String(l?.message||"");if(d==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(m)){o=l,await new Promise((f)=>setTimeout(f,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new K(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((d)=>({envName:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(t.secrets).map(([d,m])=>({envName:d,secretId:m}));if(Array.isArray(t.secrets)){let d=new Map;for(let{envName:f,secretId:S}of l)d.set(f,[...d.get(f)??[],S]);let m=[...d.entries()].filter(([,f])=>f.length>1);if(m.length){let f=m.map(([S,R])=>`${S} ← ${R.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${f}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:d,secretId:m}of l){let S=(await o.getSecretValue({SecretId:m})).SecretString??"";try{let R=JSON.parse(S);if(R&&typeof R==="object"&&!Array.isArray(R)){for(let[w,N]of Object.entries(R))c[w]=String(N);continue}}catch{}c[d]=S}return c}function Zd(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function Fs(t,s,o,c,l,d,m,f={}){let S=t.kind==="php"?oc({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...f,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...m?{TSCLOUD_QUEUE:m,SQS_QUEUE:m}:{},...d?{ASSET_URL:d}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function he(t,s,o,c,l=!1){let d=0;for(let m of oe(o)){let f=Se(o,m).replace(/\\/g,"/");if(!l&&f.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${f}`,body:pe(m),contentType:Re(m),cacheControl:"public, max-age=31536000, immutable"}),d++}return d}function $o(t,s){let o=Object.entries(s).reduce((c,[l,d])=>c+Buffer.byteLength(`${l}=${d}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,d])=>[l,Buffer.byteLength(`${l}=${d}`,"utf8")]).sort((l,d)=>d[1]-l[1]).slice(0,5).map(([l,d])=>`${l} (${d}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function U(t,s,o,c){$o(s,o),await q(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await q(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await q(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await q(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function um(t,s,o={}){let c=k(t,s),{app:l,slug:d,region:m,stackName:f,artifactBucket:S}=c,R=o.projectRoot??process.cwd();i(`Deploying serverless app: ${d} (${s})`),e(`Stack: ${f}`),e(`Region: ${m}`);let w=new g(m),N=new v(m),T=new P(m),D=l.kind==="php",O=l.packaging==="image",h=Wi(l),V,E,b,Y,M=[];if(O&&h.usesLayer&&h.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${h.kind}${h.kind==="node"?` ${h.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){u("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-af8511dv.js"),C=await y({app:l,projectRoot:R,region:m,repository:`${d}-${s}`,skipBuild:o.skipBuild,onStep:(I)=>e(`  ${I}`)});V=C.handlers,E={kind:"image",imageUri:C.imageUri},b=C.tag,M.push({ParameterKey:"ImageUri",ParameterValue:C.imageUri})}else{u("Packaging application");let y=D?sc({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await Pn({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),C=Ja(d,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,b=y.sha256,h.usesLayer){let x=h.layerEnvVar?process.env[h.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=h.layerKind==="php"?"serverless:build-php-layer":h.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${h.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${h.layerEnvVar} env var (build one with \`cloud ${ge}\`)${h.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await w.bucketExists(S))u(`Creating artifact bucket ${S}`),await w.createBucket(S);if(await w.headObject(S,C).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else u("Uploading artifact"),await w.putObject({bucket:S,key:C,body:y.zip,contentType:"application/zip"});E={kind:"zip",bucket:S,key:C},M.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:C})}let A=Qa({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(A.template),re=["CAPABILITY_NAMED_IAM"],L=await N.describeStacks({stackName:f}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),J=L!==void 0;if(L&&/DELETE_IN_PROGRESS/.test(L))u("Waiting for an in-progress stack delete to finish"),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;else if(L&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(L))u(`Deleting unusable stack (status ${L}) before recreate`),await N.deleteStack(f),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),J=!1;u(J?"Updating infrastructure stack":"Creating infrastructure stack");try{if(J)await N.updateStack({stackName:f,templateBody:te,parameters:M,capabilities:re}),await N.waitForStack(f,"stack-update-complete");else await N.createStack({stackName:f,templateBody:te,parameters:M,capabilities:re,onFailure:"DELETE"}),await N.waitForStack(f,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await N.getStackOutputs(f).catch(()=>({})),B;if(l.assets){let y=ne(R,l.assets);if(de(y)){let C=l.assetDomain||Q.AssetsCdnDomain;B=C?`https://${C}/${b}`:void 0,u(`Syncing assets from ${l.assets}`);let I=await he(w,c.assetsBucket,y,b,l.dotFilesAsAssets);e(`Uploaded ${I} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}u("Resolving secrets");let _=await ye(l,m);if(l.database?.connection==="aurora-serverless")try{let C=await new K(m).getSecretValue({SecretId:`${d}/${s}/db`}),I=JSON.parse(C.SecretString??"{}");if(I.username)_.DB_USERNAME=I.username;if(I.password)_.DB_PASSWORD=I.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await w.bucketExists(S))await w.createBucket(S);let H=await G(w,S,d,s),F={},Z=A.queueNames[0],ee=Zd(l,Q);if(u("Activating functions"),F.http=Fs(l,c,s,"http",_,B,Z,ee),await U(T,A.functionNames.http,F.http,E),F.cli=Fs(l,c,s,"cli",_,B,Z,ee),await U(T,A.functionNames.cli,F.cli,E),A.queueNames.length)F.queue=Fs(l,c,s,"queue",_,B,Z,ee),await U(T,A.functionNames.queue,F.queue,E);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(u("Publishing versions + flipping live alias"),W.http=await X(T,A.functionNames.http),W.cli=await X(T,A.functionNames.cli),A.queueNames.length)W.queue=await X(T,A.functionNames.queue)}if(await ae(w,S,d,s,{sha:b,code:E,previousSha:H?.sha,previousCode:H?.code,previousFunctionEnv:H?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:H?.functionVersions}:{},functionEnv:F,functionNames:{http:A.functionNames.http,cli:A.functionNames.cli,...A.queueNames.length?{queue:A.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){u("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let C=await T.invoke({FunctionName:A.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(C.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${C.Payload}`)}}let j=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&j){u("Health check");try{let y=await fetch(j,{method:"GET"});e(`GET ${j} → ${y.status}`)}catch(y){a(`Health check could not reach ${j}: ${y.message}`)}}Ee(["Serverless deploy complete","",j?`URL:   ${j}`:"",`Stack: ${f}`,`Build: ${b.slice(0,12)}`].filter(Boolean).join(`
+`),"green")}async function Bs(t,s){let o=k(t,s),c=new g(o.region),l=new P(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d)throw Error("No previous release to redeploy. Run a full deploy first.");i(`Redeploying ${o.slug} (${s}) — build ${d.sha.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;u(`Re-activating ${m} (${f})`),await U(l,f,d.functionEnv[m]??{},d.code);let S=d.functionVersions?.[m];if(S)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:S}))}n("Redeploy complete")}async function js(t,s){let o=k(t,s),c=new g(o.region),l=new P(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d?.previousCode)throw Error("No previous release to roll back to.");i(`Rolling back ${o.slug} (${s}) → ${d.previousSha?.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;u(`Restoring ${m} (${f})`);let S=d.previousFunctionEnv?.[m]??d.functionEnv[m]??{};await U(l,f,S,d.previousCode);let R=d.previousFunctionVersions?.[m];if(R)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:R}))}await ae(c,o.artifactBucket,o.slug,s,{...d,sha:d.previousSha??d.sha,code:d.previousCode,functionEnv:d.previousFunctionEnv??d.functionEnv,functionVersions:d.previousFunctionVersions??d.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),n("Rollback complete")}async function Lo(t,s,o,c){let l=k(t,s),d=new P(l.region),m=`${l.slug}-${s}-http`,S={...(await d.getFunction(m)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=o?"1":"0",o&&c)S.MAINTENANCE_BYPASS_SECRET=c;if(!o)delete S.MAINTENANCE_BYPASS_SECRET;if(await q(()=>d.updateFunctionConfiguration({FunctionName:m,Environment:{Variables:S}})),(l.app.provisionedConcurrency??0)>0)await d.waitForFunctionActive(m,120),await X(d,m);n(o?"Application is now in maintenance mode (503)":"Application is live")}async function Gt(t,s,o){let c=k(t,s),l=new P(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"});if(m.FunctionError)throw Error(`Command failed: ${m.Payload}`);return m.Payload??""}var ce=(t,s)=>`commands/${t}/${s}/history.json`,ve=50;async function le(t,s,o,c){try{return(await t.getObjectJson(s,ce(o,c)))?.records??[]}catch{return[]}}async function pm(t,s,o){let c=k(t,s),l=new P(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"}),f=m.Payload??"",S=m.FunctionError?"error":"ok",R=-1;try{let w=new g(c.region);if(await w.bucketExists(c.artifactBucket)){let N=await le(w,c.artifactBucket,c.slug,s);R=N.reduce((T,D)=>Math.max(T,D.id),0)+1,N.push({id:R,command:o,timestamp:new Date().toISOString(),status:S,output:f.slice(0,4000)}),await w.putObjectJson(c.artifactBucket,ce(c.slug,s),{records:N.slice(-ve)})}}catch{}if(m.FunctionError)throw Error(`Command failed${R>0?` (#${R})`:""}: ${f}`);return{id:R,status:S,output:f}}async function eu(t,s){let o=k(t,s),c=new g(o.region);return le(c,o.artifactBucket,o.slug,s)}async function mm(t,s,o){let c=await eu(t,s);if(!c.length)return;return o==null?c[c.length-1]:c.find((l)=>l.id===o)}async function gm(t,s,o){let c=Buffer.from(o,"utf-8").toString("base64");return Gt(t,s,`tscloud:db-query --sql-base64=${c}`)}async function z(t,s){let o=k(t,s),c=new v(o.region),l=new P(o.region),d=new g(o.region),m="not deployed",f={};try{let{Stacks:O}=await c.describeStacks({stackName:o.stackName});m=O?.[0]?.StackStatus??m;for(let h of O?.[0]?.Outputs??[])if(h.OutputKey)f[h.OutputKey]=h.OutputValue??""}catch{}let S=Xa(o.app,o.slug,s),R=o.app.provisionedConcurrency??0,w=["http","cli",...S.length?["queue"]:[]],N=`${o.slug}-${s}`,T=[];for(let O of w){let h=`${N}-${O}`,V={mode:O,name:h,version:"$LATEST"};if(R>0){let E=await l.getAlias(h,"live").catch(()=>null);if(E?.FunctionVersion){V.version=E.FunctionVersion;let b=await l.getProvisionedConcurrencyConfig(h,"live").catch(()=>null);if(b)V.provisioned={status:b.Status??"-",allocated:b.AllocatedProvisionedConcurrentExecutions??0,requested:b.RequestedProvisionedConcurrentExecutions??0}}}T.push(V)}let D=await G(d,o.artifactBucket,o.slug,s).catch(()=>null);return{slug:o.slug,environment:s,region:o.region,stackStatus:m,endpoint:f.HttpApiEndpoint,assetUrl:D?.assetUrl,scheduler:o.app.scheduler??"on",queues:S,provisionedConcurrency:R,functions:T,lastRelease:D?{sha:D.sha,timestamp:D.timestamp}:void 0}}function ue(t,s){return`${t}-${s}-db`}async function Vs(t,s,o,c){let l=k(t,s);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:d}=await import("./chunk-c6tt4fj9.js"),m=new d(l.region),f=ue(l.slug,s);u(`Scaling ${f} → ${o}–${c} ACUs`),await m.modifyDBCluster({DBClusterIdentifier:f,ServerlessV2ScalingConfiguration:{MinCapacity:o,MaxCapacity:c},ApplyImmediately:!0}),n(`Scaling applied to ${f} (takes effect shortly).`)}async function fm(t,s,o){let c=k(t,s);if(c.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!o.toTime&&!o.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:l}=await import("./chunk-c6tt4fj9.js"),d=new l(c.region),m=ue(c.slug,s),f=o.latest?"latest":o.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),S=o.target??`${m}-restore-${f}`;u(`Restoring ${m} → new cluster ${S} (${o.latest?"latest restorable time":o.toTime.toISOString()})`),await d.restoreDBClusterToPointInTime({DBClusterIdentifier:S,SourceDBClusterIdentifier:m,RestoreToTime:o.toTime,UseLatestRestorableTime:o.latest}),u("Waiting for the restored cluster to be ready");for(let R=0;R<120;R++){let{DBClusters:w}=await d.describeDBClusters({DBClusterIdentifier:S}),N=w?.[0]?.Status;if(N&&N!=="creating")break;await new Promise((T)=>setTimeout(T,15000))}return u("Adding a writer instance"),await d.createDBInstance({DBInstanceIdentifier:`${S}-1`,DBClusterIdentifier:S,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),n(`Restore complete → cluster ${S} with writer ${S}-1. Point an env's database at it once available.`),S}
+export{K,Tt,Zd,Fs,$o,um,Bs,js,Lo,Gt,pm,eu,mm,gm,z,Vs,fm};

package/dist/bin/chunk-vy27rc50.js

@@ -0,0 +1 @@
+import{yi}from"./chunk-mn0rzykt.js";import"./chunk-34r2fwwn.js";import"./chunk-5zp3s61y.js";import"./chunk-7pxqdq44.js";import"./chunk-vf5w5aed.js";import"./chunk-vcs8wtay.js";import"./chunk-kwfbth5c.js";import"./chunk-dbtm1j98.js";import"./chunk-yc1n2h5w.js";export{yi as resolveServerDashboardData};

package/dist/bin/{chunk-d38cyam8.js → chunk-xkcvfpd0.js}

@@ -1,4 +1,4 @@
-import{gn,W,ko,Ht,U}from"./chunk-mver6psb.js";import{v}from"./chunk-zs0q8sh5.js";import{kr,E}from"./chunk-5ad4b744.js";import{g}from"./chunk-8bgfn8ek.js";import{F}from"./chunk-9pj5r0x0.js";function H(t){let{bucketName:i,domain:a,aliases:e,certificateArn:d,defaultRootObject:o="index.html",errorDocument:n="404.html",passthroughUrls:r=!1,singlePageApp:l=!1,dynamicApp:m=!1,computeOriginDomain:D,computeOriginPort:P=3008,computeOriginId:N="app-compute",retainOnStackDelete:O=!1}=t,C=O?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},w=m&&!!D,T=w?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],R=w?["GET","HEAD"]:["GET","HEAD"],y={},I={};y.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},I.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},I.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},y.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let A;if(r&&w)A="InstallRootRedirectFunction",y[A]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{gn,W,No,Ht,U}from"./chunk-nxsa7efz.js";import{v}from"./chunk-7pxqdq44.js";import{kr,E}from"./chunk-a68bhc0s.js";import{g}from"./chunk-vcs8wtay.js";import{F}from"./chunk-p801tzxz.js";function H(t){let{bucketName:i,domain:a,aliases:e,certificateArn:d,defaultRootObject:o="index.html",errorDocument:n="404.html",passthroughUrls:r=!1,singlePageApp:l=!1,dynamicApp:m=!1,computeOriginDomain:D,computeOriginPort:P=3008,computeOriginId:N="app-compute",retainOnStackDelete:O=!1}=t,C=O?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},w=m&&!!D,T=w?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],R=w?["GET","HEAD"]:["GET","HEAD"],y={},I={};y.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},I.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},I.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},y.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let A;if(r&&w)A="InstallRootRedirectFunction",y[A]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{gn,W,ko,Ht,U}from"./chunk-mver6psb.js";import{v}from"./chunk-zs0q8sh5.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:I,stackName:o,bucket:w,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:I,stackName:o,bucket:w,message:`Stack deployment failed: ${s.message}`}}let c=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],S=(s)=>c.find((u)=>u.OutputKey===s)?.OutputValue,p=S("DistributionDomain");if(p&&l)console.log(`Creating DNS records via ${l.name}...`),await M(l,e,p);else if(p&&!l)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:I,stackName:o,bucket:S("BucketName")||w,distributionId:S("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function M(t,i,a){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(i.split(".").length===2)if(t instanceof gn){console.log(`Creating Route53 alias record for apex domain ${i} -> ${a}`);let o=await t.createCloudFrontAlias({domain:i,name:i,cloudFrontDomainName:a});if(!o.success)console.warn(`Warning: Could not create Route53 alias record: ${o.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created Route53 alias record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating Route53 alias record for ${n} -> ${a}`);let r=await t.createCloudFrontAlias({domain:i,name:n,cloudFrontDomainName:a});if(!r.success)console.warn(`Warning: Could not create www Route53 alias: ${r.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created Route53 alias record: ${n} -> ${a}`)}else{try{let l=await t.listRecords(i,"A");if(l.success)for(let m of l.records){let D=m.name.replace(/\.$/,"");if(D===i||D==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(i,{name:i,type:"A",content:m.content})}}catch(l){console.log(`Note: Could not check for conflicting A records: ${l instanceof Error?l.message:l}`)}console.log(`Creating ALIAS record for apex domain ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"ALIAS",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create ALIAS record: ${o.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created ALIAS record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating CNAME record for ${n} -> ${a}`);let r=await t.upsertRecord(i,{name:n,type:"CNAME",content:a,ttl:600});if(!r.success)console.warn(`Warning: Could not create www DNS record: ${r.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created CNAME record: ${n} -> ${a}`)}else{console.log(`Creating CNAME record for ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"CNAME",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create DNS record: ${o.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created CNAME record: ${i} -> ${a}`)}}async function Ji(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await j(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:n}=await import("./chunk-0v5tsfx5.js"),r=await n({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(m,D,P)=>{e?.("upload",`${m}/${D}: ${P}`)}});if(r.errors.length>0)return{...o,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(o.distributionId&&r.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-0v5tsfx5.js");await m(o.distributionId)}e?.("complete","Deployment complete!");let l=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged) with external DNS`:`Deployed ${r.uploaded} files successfully with external DNS`;return{...o,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:l}}function Rd(t){let{bucketName:i,domain:a,certificateArn:e,hostedZoneId:d,defaultRootObject:o="index.html",errorDocument:n="404.html"}=t,r={},l={};r.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},l.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},l.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},r.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},r.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:I,stackName:o,bucket:w,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:I,stackName:o,bucket:w,message:`Stack deployment failed: ${s.message}`}}let c=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],S=(s)=>c.find((u)=>u.OutputKey===s)?.OutputValue,p=S("DistributionDomain");if(p&&l)console.log(`Creating DNS records via ${l.name}...`),await M(l,e,p);else if(p&&!l)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:I,stackName:o,bucket:S("BucketName")||w,distributionId:S("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function M(t,i,a){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(i.split(".").length===2)if(t instanceof gn){console.log(`Creating Route53 alias record for apex domain ${i} -> ${a}`);let o=await t.createCloudFrontAlias({domain:i,name:i,cloudFrontDomainName:a});if(!o.success)console.warn(`Warning: Could not create Route53 alias record: ${o.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created Route53 alias record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating Route53 alias record for ${n} -> ${a}`);let r=await t.createCloudFrontAlias({domain:i,name:n,cloudFrontDomainName:a});if(!r.success)console.warn(`Warning: Could not create www Route53 alias: ${r.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created Route53 alias record: ${n} -> ${a}`)}else{try{let l=await t.listRecords(i,"A");if(l.success)for(let m of l.records){let D=m.name.replace(/\.$/,"");if(D===i||D==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(i,{name:i,type:"A",content:m.content})}}catch(l){console.log(`Note: Could not check for conflicting A records: ${l instanceof Error?l.message:l}`)}console.log(`Creating ALIAS record for apex domain ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"ALIAS",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create ALIAS record: ${o.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created ALIAS record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating CNAME record for ${n} -> ${a}`);let r=await t.upsertRecord(i,{name:n,type:"CNAME",content:a,ttl:600});if(!r.success)console.warn(`Warning: Could not create www DNS record: ${r.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created CNAME record: ${n} -> ${a}`)}else{console.log(`Creating CNAME record for ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"CNAME",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create DNS record: ${o.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created CNAME record: ${i} -> ${a}`)}}async function Xi(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await j(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:n}=await import("./chunk-y815amx5.js"),r=await n({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(m,D,P)=>{e?.("upload",`${m}/${D}: ${P}`)}});if(r.errors.length>0)return{...o,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(o.distributionId&&r.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-y815amx5.js");await m(o.distributionId)}e?.("complete","Deployment complete!");let l=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged) with external DNS`:`Deployed ${r.uploaded} files successfully with external DNS`;return{...o,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:l}}function Id(t){let{bucketName:i,domain:a,certificateArn:e,hostedZoneId:d,defaultRootObject:o="index.html",errorDocument:n="404.html"}=t,r={},l={};r.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},l.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},l.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},r.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},r.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 
@@ -56,5 +56,5 @@ import{gn,W,ko,Ht,U}from"./chunk-mver6psb.js";import{v}from"./chunk-zs0q8sh5.js"
   }
 
   return request;
-}`}};let m={Enabled:!0,DefaultRootObject:o,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${i}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${i}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${o}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${n}`,ErrorCachingMinTTL:300}]};if(a&&e)m.Aliases=[a],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(r.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},l.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},l.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},r.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},a&&d)r.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},r.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},l.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${a||i}`,Resources:r,Outputs:l}}async function Id(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let c=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!c)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return j({siteName:t.siteName,region:t.region,domain:c,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let i=t.region||"us-east-1",a="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let d=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),o=t.stackName||`${t.siteName}-static-site`,n=new v(a),r=new F,l=new W("us-east-1"),m=new ko("us-east-1"),{hostedZoneId:D,certificateArn:P}=t;if(e&&!D){let c=await r.findHostedZoneForDomain(e);if(c)D=c.Id.replace("/hostedzone/","");else return{success:!1,stackName:o,bucket:d,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!P&&D){let c=await l.findCertificateByDomain(e);if(c&&c.Status==="ISSUED")P=c.CertificateArn;else P=(await m.requestAndValidate({domainName:e,hostedZoneId:D,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let N=!1,O;try{let c=await n.describeStacks({stackName:o});if(c.Stacks.length>0){let S=c.Stacks[0],p=S.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await n.waitForStack(o,"stack-delete-complete"),N=!1;else if(p==="DELETE_COMPLETE")N=!1;else N=!0,O=(S.Outputs||[]).find((u)=>u.OutputKey==="BucketName")?.OutputValue}}catch(c){if(c.message?.includes("does not exist")||c.code==="ValidationError")N=!1;else throw c}let C=O||d;if(!N){let c=new g(i),S=new E,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let s=await S.listDistributions();for(let u of s)if((u.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${u.Id} for ${e}`);let k=await S.getDistributionConfig(u.Id),f=kr(k.DistributionConfig);if(f){let x=e.replace(/\./g,"-");if(!f.startsWith(x)&&!f.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${f}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${f}`),D&&u.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(V){console.log(`Note: Could not update Route53 records: ${V.message}`)}return{success:!0,stackName:`existing-${u.Id}`,bucket:f,distributionId:u.Id,distributionDomain:u.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution"}}}}catch{}if(D)try{let u=(await r.listResourceRecordSets({HostedZoneId:D})).ResourceRecordSets||[];for(let b of u)if(b.Name===`${e}.`&&(b.Type==="A"||b.Type==="AAAA")){if(b.AliasTarget){console.log(`Found orphaned Route53 ${b.Type} record for ${e}, cleaning up...`);try{await r.deleteRecord({HostedZoneId:D,RecordSet:b}),console.log(`Deleted orphaned Route53 ${b.Type} record for ${e}`)}catch(k){console.log(`Note: Could not delete Route53 record: ${k.message}`)}}}}catch{}}if(!p)try{if((await c.headBucket(d)).exists){console.log(`Found orphaned S3 bucket ${d}, cleaning up...`);try{let u=c.emptyBucket(d).then(()=>c.deleteBucket(d)),b=new Promise((k,f)=>setTimeout(()=>f(Error("Bucket cleanup timeout")),30000));await Promise.race([u,b]),console.log(`Deleted orphaned S3 bucket ${d}`)}catch(u){console.log(`Note: Could not clean up S3 bucket: ${u.message}`);let b=Date.now().toString(36);C=`${d}-${b}`,console.log(`Using alternative bucket name: ${C}`)}}}catch{}}let w=Rd({bucketName:C,domain:e,certificateArn:P,hostedZoneId:D,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),T=Object.entries(t.tags||{}).map(([c,S])=>({Key:c,Value:S}));T.push({Key:"ManagedBy",Value:"ts-cloud"}),T.push({Key:"Application",Value:t.siteName});let R,y=!1;if(N){y=!0,console.log(`Updating CloudFormation stack: ${o}`),console.log(`Using existing bucket: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`);try{R=(await n.updateStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T})).StackId,console.log(`Update initiated, stack ID: ${R}`)}catch(c){if(c.message?.includes("No updates are to be performed")){let S=await n.describeStacks({stackName:o});R=S.Stacks[0].StackId;let p=S.Stacks[0]?.Outputs||[],s=(u)=>p.find((b)=>b.OutputKey===u)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:s("BucketName")||C,distributionId:s("DistributionId"),distributionDomain:s("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure is already up to date"}}else throw c}}else console.log(`Creating CloudFormation stack: ${o}`),console.log(`Bucket name: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`),console.log("Stack does not exist, creating..."),R=(await n.createStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${R}`);console.log(`Waiting for stack to reach ${y?"stack-update-complete":"stack-create-complete"}...`);try{await n.waitForStack(o,y?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(c){if(c.message?.includes("must be verified")||c.message?.includes("Access denied for operation")||c.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let S=new E;if(e)try{let p=await S.listDistributions();for(let s of p)if((s.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${s.Id} with alias ${e}`);let b=await S.getDistributionConfig(s.Id),k=kr(b.DistributionConfig);if(k)return console.log(`Using existing S3 bucket: ${k}`),{success:!0,stackName:`existing-${s.Id}`,bucket:k,distributionId:s.Id,distributionDomain:s.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new g(i);if((await p.headBucket(C)).exists)console.log(`Using existing S3 bucket: ${C}`);else console.log(`Creating S3 bucket: ${C}...`),await p.createBucket(C);await p.putBucketWebsite(C,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(C,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${C} configured`);let u=`OAC-${C}`;console.log(`Creating Origin Access Control: ${u}...`);let b=await S.findOrCreateOriginAccessControl(u);console.log(`Origin Access Control ${b.Id} ready`),console.log("Creating CloudFront distribution...");let k=await S.createDistributionForS3({bucketName:C,bucketRegion:i,originAccessControlId:b.Id,aliases:e?[e]:[],certificateArn:P,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||C}`});console.log(`CloudFront distribution ${k.Id} created`),console.log("Updating S3 bucket policy...");let f=E.getS3BucketPolicyForCloudFront(C,k.ARN);if(await p.putBucketPolicy(C,f),console.log("S3 bucket policy updated"),e&&D){console.log(`Creating Route53 records for ${e}...`);try{await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(x){console.log(`Note: Could not create Route53 records: ${x.message}`)}}return{success:!0,stackName:`direct-${k.Id}`,bucket:C,distributionId:k.Id,distributionDomain:k.DomainName,domain:e,certificateArn:P,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:R,stackName:o,bucket:C,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:R,stackName:o,bucket:C,message:`Stack deployment failed: ${c.message}`}}let A=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],h=(c)=>A.find((S)=>S.OutputKey===c)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:h("BucketName")||C,distributionId:h("DistributionId"),distributionDomain:h("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure deployed successfully"}}async function Pd(t){let{sourceDir:i,bucket:a,region:e,cacheControl:d="max-age=31536000, public",onProgress:o}=t,n=new g(e),{readdir:r}=await import("node:fs/promises"),{join:l,relative:m}=await import("node:path"),{createHash:D}=await import("node:crypto");async function P(A){let h=[],c=await r(A,{withFileTypes:!0});for(let S of c){let p=l(A,S.name);if(S.isDirectory())h.push(...await P(p));else h.push(p)}return h}function N(A){let h=A.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[h||""]||"application/octet-stream"}function O(A){return D("md5").update(A).digest("hex")}async function C(){let A=new Map,h;do{let c=await n.listObjects({bucket:a,maxKeys:1000,continuationToken:h});for(let S of c.objects){let p=S.ETag?.replace(/"/g,"")||"";A.set(S.Key,p)}h=c.nextContinuationToken}while(h);return A}let w=await P(i),T=[],R=0,y=0,I=await C();for(let A of w){let h=m(i,A),c=N(A),S=A.endsWith(".html")?"max-age=3600, public":d;try{let p=Buffer.from(await Bun.file(A).arrayBuffer()),s=O(p),u=I.get(h);if(u&&u===s){y++,o?.(R+y,w.length,h);continue}await n.putObject({bucket:a,key:h,body:p,contentType:c,cacheControl:S}),R++,o?.(R+y,w.length,h)}catch(p){T.push(`Failed to upload ${h}: ${p.message}`)}}return{uploaded:R,skipped:y,errors:T}}async function Dd(t){return{invalidationId:(await new E().invalidateAll(t)).Id}}async function Vp(t,i="us-east-1"){let a=new v(i);try{let n=((await a.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((r)=>r.OutputKey==="BucketName")?.OutputValue;if(n)await new g(i).emptyBucket(n)}catch{}await a.deleteStack(t);let e=await a.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function zp(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await Id(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(l){console.log(`Note: Could not clean bucket: ${l.message}`)}}e?.("upload","Uploading files to S3...");let n=await Pd({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(l,m,D)=>{e?.("upload",`${l}/${m}: ${D}`)}});if(n.errors.length>0)return{...o,success:!1,message:`Upload errors: ${n.errors.join(", ")}`,filesUploaded:n.uploaded};if(o.distributionId&&n.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await Dd(o.distributionId);e?.("complete","Deployment complete!");let r=n.skipped>0?`Deployed ${n.uploaded} files (${n.skipped} unchanged)`:`Deployed ${n.uploaded} files successfully`;return{...o,filesUploaded:n.uploaded,filesSkipped:n.skipped,message:r}}
-export{Rd,Id,Pd,Dd,Vp,zp,Ji};
+}`}};let m={Enabled:!0,DefaultRootObject:o,HttpVersion:"http2and3",IPV6Enabled:!0,PriceClass:"PriceClass_100",Origins:[{Id:`S3-${i}`,DomainName:{"Fn::GetAtt":["S3Bucket","RegionalDomainName"]},S3OriginConfig:{OriginAccessIdentity:""},OriginAccessControlId:{"Fn::GetAtt":["CloudFrontOAC","Id"]}}],DefaultCacheBehavior:{TargetOriginId:`S3-${i}`,ViewerProtocolPolicy:"redirect-to-https",AllowedMethods:["GET","HEAD"],CachedMethods:["GET","HEAD"],Compress:!0,CachePolicyId:"658327ea-f89d-4fab-a63d-7e88639e58f6",FunctionAssociations:[{EventType:"viewer-request",FunctionARN:{"Fn::GetAtt":["UrlRewriteFunction","FunctionARN"]}}]},CustomErrorResponses:[{ErrorCode:403,ResponseCode:200,ResponsePagePath:`/${o}`,ErrorCachingMinTTL:300},{ErrorCode:404,ResponseCode:404,ResponsePagePath:`/${n}`,ErrorCachingMinTTL:300}]};if(a&&e)m.Aliases=[a],m.ViewerCertificate={AcmCertificateArn:e,SslSupportMethod:"sni-only",MinimumProtocolVersion:"TLSv1.2_2021"};else m.ViewerCertificate={CloudFrontDefaultCertificate:!0};if(r.CloudFrontDistribution={Type:"AWS::CloudFront::Distribution",DependsOn:["S3Bucket","CloudFrontOAC","UrlRewriteFunction"],Properties:{DistributionConfig:m}},l.DistributionId={Description:"CloudFront Distribution ID",Value:{Ref:"CloudFrontDistribution"}},l.DistributionDomain={Description:"CloudFront Distribution Domain",Value:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]}},r.S3BucketPolicy={Type:"AWS::S3::BucketPolicy",DependsOn:["S3Bucket","CloudFrontDistribution"],Properties:{Bucket:{Ref:"S3Bucket"},PolicyDocument:{Version:"2012-10-17",Statement:[{Sid:"AllowCloudFrontServicePrincipal",Effect:"Allow",Principal:{Service:"cloudfront.amazonaws.com"},Action:"s3:GetObject",Resource:{"Fn::Sub":"arn:aws:s3:::${S3Bucket}/*"},Condition:{StringEquals:{"AWS:SourceArn":{"Fn::Sub":"arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"}}}}]}}},a&&d)r.DNSRecord={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"A",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},r.DNSRecordIPv6={Type:"AWS::Route53::RecordSet",DependsOn:"CloudFrontDistribution",Properties:{HostedZoneId:d,Name:a,Type:"AAAA",AliasTarget:{DNSName:{"Fn::GetAtt":["CloudFrontDistribution","DomainName"]},HostedZoneId:"Z2FDTNDATAQYW2",EvaluateTargetHealth:!1}}},l.SiteUrl={Description:"Site URL",Value:{"Fn::Sub":"https://${DNSRecord}"}};return{AWSTemplateFormatVersion:"2010-09-09",Description:`Static site infrastructure for ${a||i}`,Resources:r,Outputs:l}}async function Pd(t){if(t.dnsProvider&&t.dnsProvider.provider!=="route53"){let c=t.domain||(t.subdomain&&t.baseDomain?`${t.subdomain}.${t.baseDomain}`:void 0);if(!c)return{success:!1,stackName:t.stackName||`${t.siteName}-static-site`,bucket:t.bucket||`${t.siteName}-${Date.now()}`,message:"Domain is required when using external DNS provider"};return j({siteName:t.siteName,region:t.region,domain:c,bucket:t.bucket,certificateArn:t.certificateArn,stackName:t.stackName,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument,cacheControl:t.cacheControl,tags:t.tags,dnsProvider:t.dnsProvider})}let i=t.region||"us-east-1",a="us-east-1",e;if(t.domain)e=t.domain;else if(t.subdomain&&t.baseDomain)e=`${t.subdomain}.${t.baseDomain}`;let d=t.bucket||(e?e.replace(/\./g,"-"):`${t.siteName}-${Date.now()}`),o=t.stackName||`${t.siteName}-static-site`,n=new v(a),r=new F,l=new W("us-east-1"),m=new No("us-east-1"),{hostedZoneId:D,certificateArn:P}=t;if(e&&!D){let c=await r.findHostedZoneForDomain(e);if(c)D=c.Id.replace("/hostedzone/","");else return{success:!1,stackName:o,bucket:d,message:`No Route53 hosted zone found for ${t.baseDomain||e}. Please create one first.`}}if(e&&!P&&D){let c=await l.findCertificateByDomain(e);if(c&&c.Status==="ISSUED")P=c.CertificateArn;else P=(await m.requestAndValidate({domainName:e,hostedZoneId:D,waitForValidation:!0,maxWaitMinutes:10})).certificateArn}let N=!1,O;try{let c=await n.describeStacks({stackName:o});if(c.Stacks.length>0){let S=c.Stacks[0],p=S.StackStatus;if(p==="DELETE_IN_PROGRESS")console.log("Previous stack is still being deleted, waiting..."),await n.waitForStack(o,"stack-delete-complete"),N=!1;else if(p==="DELETE_COMPLETE")N=!1;else N=!0,O=(S.Outputs||[]).find((u)=>u.OutputKey==="BucketName")?.OutputValue}}catch(c){if(c.message?.includes("does not exist")||c.code==="ValidationError")N=!1;else throw c}let C=O||d;if(!N){let c=new g(i),S=new E,p=!1;if(e){try{console.log(`Checking for existing CloudFront distribution for ${e}...`);let s=await S.listDistributions();for(let u of s)if((u.Aliases?.Items??[]).includes(e)){p=!0,console.log(`Found existing CloudFront distribution ${u.Id} for ${e}`);let k=await S.getDistributionConfig(u.Id),f=kr(k.DistributionConfig);if(f){let x=e.replace(/\./g,"-");if(!f.startsWith(x)&&!f.includes(t.siteName)){console.log(`Warning: Found distribution with mismatched bucket ${f}, skipping...`);continue}if(console.log(`Using existing S3 bucket: ${f}`),D&&u.DomainName)try{console.log(`Ensuring Route53 records exist for ${e}...`),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:u.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records ensured for ${e}`)}catch(V){console.log(`Note: Could not update Route53 records: ${V.message}`)}return{success:!0,stackName:`existing-${u.Id}`,bucket:f,distributionId:u.Id,distributionDomain:u.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution"}}}}catch{}if(D)try{let u=(await r.listResourceRecordSets({HostedZoneId:D})).ResourceRecordSets||[];for(let b of u)if(b.Name===`${e}.`&&(b.Type==="A"||b.Type==="AAAA")){if(b.AliasTarget){console.log(`Found orphaned Route53 ${b.Type} record for ${e}, cleaning up...`);try{await r.deleteRecord({HostedZoneId:D,RecordSet:b}),console.log(`Deleted orphaned Route53 ${b.Type} record for ${e}`)}catch(k){console.log(`Note: Could not delete Route53 record: ${k.message}`)}}}}catch{}}if(!p)try{if((await c.headBucket(d)).exists){console.log(`Found orphaned S3 bucket ${d}, cleaning up...`);try{let u=c.emptyBucket(d).then(()=>c.deleteBucket(d)),b=new Promise((k,f)=>setTimeout(()=>f(Error("Bucket cleanup timeout")),30000));await Promise.race([u,b]),console.log(`Deleted orphaned S3 bucket ${d}`)}catch(u){console.log(`Note: Could not clean up S3 bucket: ${u.message}`);let b=Date.now().toString(36);C=`${d}-${b}`,console.log(`Using alternative bucket name: ${C}`)}}}catch{}}let w=Id({bucketName:C,domain:e,certificateArn:P,hostedZoneId:D,defaultRootObject:t.defaultRootObject,errorDocument:t.errorDocument}),T=Object.entries(t.tags||{}).map(([c,S])=>({Key:c,Value:S}));T.push({Key:"ManagedBy",Value:"ts-cloud"}),T.push({Key:"Application",Value:t.siteName});let R,y=!1;if(N){y=!0,console.log(`Updating CloudFormation stack: ${o}`),console.log(`Using existing bucket: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`);try{R=(await n.updateStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T})).StackId,console.log(`Update initiated, stack ID: ${R}`)}catch(c){if(c.message?.includes("No updates are to be performed")){let S=await n.describeStacks({stackName:o});R=S.Stacks[0].StackId;let p=S.Stacks[0]?.Outputs||[],s=(u)=>p.find((b)=>b.OutputKey===u)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:s("BucketName")||C,distributionId:s("DistributionId"),distributionDomain:s("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure is already up to date"}}else throw c}}else console.log(`Creating CloudFormation stack: ${o}`),console.log(`Bucket name: ${C}`),console.log(`Domain: ${e||"not specified"}`),console.log(`Certificate ARN: ${P||"not specified"}`),console.log("Stack does not exist, creating..."),R=(await n.createStack({stackName:o,templateBody:JSON.stringify(w),capabilities:["CAPABILITY_IAM"],tags:T,onFailure:"DELETE"})).StackId,console.log(`Create initiated, stack ID: ${R}`);console.log(`Waiting for stack to reach ${y?"stack-update-complete":"stack-create-complete"}...`);try{await n.waitForStack(o,y?"stack-update-complete":"stack-create-complete"),console.log("Stack operation completed successfully!")}catch(c){if(c.message?.includes("must be verified")||c.message?.includes("Access denied for operation")||c.message?.includes("failed")){console.log("CloudFormation deployment failed, trying direct API creation...");let S=new E;if(e)try{let p=await S.listDistributions();for(let s of p)if((s.Aliases?.Items??[]).includes(e)){console.log(`Found existing CloudFront distribution ${s.Id} with alias ${e}`);let b=await S.getDistributionConfig(s.Id),k=kr(b.DistributionConfig);if(k)return console.log(`Using existing S3 bucket: ${k}`),{success:!0,stackName:`existing-${s.Id}`,bucket:k,distributionId:s.Id,distributionDomain:s.DomainName,domain:e,certificateArn:P,message:"Using existing CloudFront distribution (account verification pending for new distributions)"}}}catch{}console.log("No existing infrastructure found, creating via direct API calls...");try{let p=new g(i);if((await p.headBucket(C)).exists)console.log(`Using existing S3 bucket: ${C}`);else console.log(`Creating S3 bucket: ${C}...`),await p.createBucket(C);await p.putBucketWebsite(C,{IndexDocument:t.defaultRootObject||"index.html",ErrorDocument:t.errorDocument||"404.html"}),await p.putPublicAccessBlock(C,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!1,RestrictPublicBuckets:!1}),console.log(`S3 bucket ${C} configured`);let u=`OAC-${C}`;console.log(`Creating Origin Access Control: ${u}...`);let b=await S.findOrCreateOriginAccessControl(u);console.log(`Origin Access Control ${b.Id} ready`),console.log("Creating CloudFront distribution...");let k=await S.createDistributionForS3({bucketName:C,bucketRegion:i,originAccessControlId:b.Id,aliases:e?[e]:[],certificateArn:P,defaultRootObject:t.defaultRootObject||"index.html",comment:`Distribution for ${e||C}`});console.log(`CloudFront distribution ${k.Id} created`),console.log("Updating S3 bucket policy...");let f=E.getS3BucketPolicyForCloudFront(C,k.ARN);if(await p.putBucketPolicy(C,f),console.log("S3 bucket policy updated"),e&&D){console.log(`Creating Route53 records for ${e}...`);try{await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"A",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),await r.createAliasRecord({HostedZoneId:D,Name:e,Type:"AAAA",TargetHostedZoneId:F.CloudFrontHostedZoneId,TargetDNSName:k.DomainName,EvaluateTargetHealth:!1}),console.log(`Route53 records created for ${e}`)}catch(x){console.log(`Note: Could not create Route53 records: ${x.message}`)}}return{success:!0,stackName:`direct-${k.Id}`,bucket:C,distributionId:k.Id,distributionDomain:k.DomainName,domain:e,certificateArn:P,message:"Static site infrastructure created via direct API calls"}}catch(p){return console.log(`Direct API creation failed: ${p.message}`),{success:!1,stackId:R,stackName:o,bucket:C,message:`Deployment failed: ${p.message}`}}}return{success:!1,stackId:R,stackName:o,bucket:C,message:`Stack deployment failed: ${c.message}`}}let A=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],h=(c)=>A.find((S)=>S.OutputKey===c)?.OutputValue;return{success:!0,stackId:R,stackName:o,bucket:h("BucketName")||C,distributionId:h("DistributionId"),distributionDomain:h("DistributionDomain"),domain:e,certificateArn:P,message:"Static site infrastructure deployed successfully"}}async function Dd(t){let{sourceDir:i,bucket:a,region:e,cacheControl:d="max-age=31536000, public",onProgress:o}=t,n=new g(e),{readdir:r}=await import("node:fs/promises"),{join:l,relative:m}=await import("node:path"),{createHash:D}=await import("node:crypto");async function P(A){let h=[],c=await r(A,{withFileTypes:!0});for(let S of c){let p=l(A,S.name);if(S.isDirectory())h.push(...await P(p));else h.push(p)}return h}function N(A){let h=A.split(".").pop()?.toLowerCase();return{html:"text/html; charset=utf-8",css:"text/css; charset=utf-8",js:"application/javascript; charset=utf-8",json:"application/json; charset=utf-8",png:"image/png",jpg:"image/jpeg",jpeg:"image/jpeg",gif:"image/gif",svg:"image/svg+xml",ico:"image/x-icon",webp:"image/webp",woff:"font/woff",woff2:"font/woff2",ttf:"font/ttf",xml:"application/xml",txt:"text/plain; charset=utf-8",sh:"text/plain; charset=utf-8",bash:"text/plain; charset=utf-8",ps1:"text/plain; charset=utf-8"}[h||""]||"application/octet-stream"}function O(A){return D("md5").update(A).digest("hex")}async function C(){let A=new Map,h;do{let c=await n.listObjects({bucket:a,maxKeys:1000,continuationToken:h});for(let S of c.objects){let p=S.ETag?.replace(/"/g,"")||"";A.set(S.Key,p)}h=c.nextContinuationToken}while(h);return A}let w=await P(i),T=[],R=0,y=0,I=await C();for(let A of w){let h=m(i,A),c=N(A),S=A.endsWith(".html")?"max-age=3600, public":d;try{let p=Buffer.from(await Bun.file(A).arrayBuffer()),s=O(p),u=I.get(h);if(u&&u===s){y++,o?.(R+y,w.length,h);continue}await n.putObject({bucket:a,key:h,body:p,contentType:c,cacheControl:S}),R++,o?.(R+y,w.length,h)}catch(p){T.push(`Failed to upload ${h}: ${p.message}`)}}return{uploaded:R,skipped:y,errors:T}}async function kd(t){return{invalidationId:(await new E().invalidateAll(t)).Id}}async function zp(t,i="us-east-1"){let a=new v(i);try{let n=((await a.describeStacks({stackName:t})).Stacks[0]?.Outputs||[]).find((r)=>r.OutputKey==="BucketName")?.OutputValue;if(n)await new g(i).emptyBucket(n)}catch{}await a.deleteStack(t);let e=await a.waitForStackComplete(t,60,1e4);return{success:e.success||e.status==="DELETE_COMPLETE",message:e.success?"Static site deleted successfully":`Deletion failed: ${e.status}`}}async function Hp(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await Pd(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(l){console.log(`Note: Could not clean bucket: ${l.message}`)}}e?.("upload","Uploading files to S3...");let n=await Dd({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(l,m,D)=>{e?.("upload",`${l}/${m}: ${D}`)}});if(n.errors.length>0)return{...o,success:!1,message:`Upload errors: ${n.errors.join(", ")}`,filesUploaded:n.uploaded};if(o.distributionId&&n.uploaded>0)e?.("invalidate","Invalidating CloudFront cache..."),await kd(o.distributionId);e?.("complete","Deployment complete!");let r=n.skipped>0?`Deployed ${n.uploaded} files (${n.skipped} unchanged)`:`Deployed ${n.uploaded} files successfully`;return{...o,filesUploaded:n.uploaded,filesSkipped:n.skipped,message:r}}
+export{Id,Pd,Dd,kd,zp,Hp,Xi};

package/dist/bin/chunk-y815amx5.js

@@ -0,0 +1 @@
+import{Id,Pd,Dd,kd,zp,Hp}from"./chunk-xkcvfpd0.js";import"./chunk-nxsa7efz.js";import"./chunk-a68bhc0s.js";import"./chunk-7pxqdq44.js";import"./chunk-p801tzxz.js";import"./chunk-vcs8wtay.js";import"./chunk-kwfbth5c.js";export{zp as deleteStaticSite,Pd as deployStaticSite,Hp as deployStaticSiteFull,Id as generateStaticSiteTemplate,kd as invalidateCache,Dd as uploadStaticFiles};