@stacksjs/ts-cloud 0.16.84 → 0.16.86

package/dist/aws/index.js

@@ -1 +1 @@
-import{Te,vr,Os,_s,Eg,yc,Sc,Ls,$s,Ic,ut,re,gt,me,T,we,Un,bc,Ue,Cc,Qn,vg,Rh,Ms,Fs,Hn,Gn,Dh,Ph,ZS,eI,tI,rI,Gt,nI,iI,sI,oI,Vt,kh,Nh,Bh,qt,xh,Oh,_h,Vn,aI,cI,dI,Tr,lI,uI,gI,Ec,vc,Tg,pI,mI,fI,wr,Lh,$h,Rr,pt,qn,Tc,wg,hI,Rg,yI,jt,SI,II,bI,CI,he,EI,vI,TI,wI,Dr,RI,DI,PI,jn,wc,Rc,Dg,Pg,Dc,Pr}from"../chunk-7ea0q5tg.js";import{ne}from"../chunk-nftqsker.js";import{Re,mt,zn,Mh}from"../chunk-cz4dw2hk.js";import{Pc,Qe,I}from"../chunk-z56sccfh.js";import{He}from"../chunk-fdf181e6.js";import{ft,Ae,Ge,H,Jt,Wn,Us,Qs,kr,Nr,Jn,Br,Hs,Gs,Vs,qs,ie,js,zs,Ks,Ws,ye,Js,Xs,Ys,N,Bc,Xn,xc,Se,xr}from"../chunk-pk8ppz98.js";import{C}from"../chunk-c71hhcsb.js";import{qr,Be}from"../chunk-vq8bejep.js";import{A}from"../chunk-tmp2ym80.js";import{o}from"../chunk-c8kf2268.js";import{We,Tp,wp,Ni,n,g,tA}from"../chunk-m9szynnf.js";export{Se as ACMClient,xr as ACMDnsValidator,n as AWSClient,Tc as ApplicationAutoScalingClient,vr as AwsBackupClient,Ph as BedrockAgentClient,Dh as BedrockAgentRuntimeClient,Gn as BedrockClient,Hn as BedrockRuntimeClient,A as CloudFormationClient,I as CloudFrontClient,we as CloudWatchLogsClient,H as CloudflareProvider,Gt as ComprehendClient,Un as ConnectClient,$s as CostExplorerClient,Xn as DnsProviderFactory,Ue as DynamoDBClient,qr as EC2Client,He as ECRClient,ut as ECSClient,Pr as EFSClient,bc as ELBv2Client,pt as ElastiCacheClient,zn as EmailClient,Rr as EventBridgeClient,Ge as GoDaddyProvider,Re as IAMClient,wg as ImapServer,wr as KendraClient,T as LambdaClient,Cc as OpenSearchClient,ft as PROXIABLE_RECORD_TYPES,Ec as PersonalizeClient,Tg as PersonalizeEventsClient,vc as PersonalizeRuntimeClient,Vn as PollyClient,Ae as PorkbunProvider,ne as RDSClient,Vt as RekognitionClient,C as Route53Client,Ic as Route53DomainsClient,ie as Route53Provider,o as S3Client,mt as SESClient,gt as SNSClient,me as SQSClient,Be as SSMClient,Te as STSClient,qn as SchedulerClient,re as SecretsManagerClient,jt as SmsClient,Dc as SmsVoiceClient,Rg as SmtpServer,jn as SupportClient,wc as SupportTemplates,qt as TextractClient,Qn as TranscribeClient,Tr as TranslateClient,ye as UnifiedDnsValidator,Dr as VoiceClient,nI as analyzeSentiment,Vs as applyDeclaredZoneSettings,Ks as applyZoneMigration,g as buildQueryParams,wp as canonicalUriFor,Ni as coerceXmlValues,tI as completeWithClaude,Pc as configOrigins,oI as containsPii,Nh as countFacesInS3Image,vg as crc32,CI as createDeliveryReceiptHandler,N as createDnsProvider,Xs as createGoDaddyValidator,Ls as createObjectStorageClient,Js as createPorkbunValidator,DI as createRecordingHandler,Ys as createRoute53Validator,dI as createSSML,II as createScheduledSmsHandler,bI as createSmsClient,SI as createSmsInboxHandler,Pg as createSmsInfrastructure,PI as createVoiceClient,RI as createVoicemailHandler,Ms as decodeEventStream,Rh as decodeEventStreamMessage,Br as delegateZone,Hs as delegateZoneFromConfig,Gs as describeDelegation,qs as describeZoneSettings,tA as detectCredentialSource,Bc as detectDnsProvider,kh as detectLabelsFromS3,sI as detectLanguage,xc as dnsProviders,Mh as email,Fs as eventStreamError,js as exportRoute53Zone,iI as extractEntities,Oh as extractFormsFromS3,_h as extractTablesFromS3,xh as extractTextFromS3,EI as formatPhoneNumber,rI as generateEmbeddings,TI as getCountryCode,pI as getRecommendations,mI as getSimilarItems,Dg as getSmsInfrastructureStatus,Bh as isContentSafe,kr as isNameserverRegistrar,wI as isSamePhoneNumber,vI as isValidPhoneNumber,Nr as isZoneHost,_s as keyMatchesFilters,eI as listClaudeModels,gI as listLanguages,cI as listVoices,Eg as migrateObjectStorage,he as normalizePhoneNumber,zs as planZoneMigration,Jt as policyTag,yc as providerEndpoint,Wn as qualifyName,Qs as reconcileDeclaredRecords,Os as remapKey,ZS as requestModelAccess,Us as resolveDeclaredRecords,Sc as resolveObjectStorage,We as resolveS3Endpoint,$h as retrieveForRag,Qe as s3OriginBucket,Jn as sameNameservers,Lh as search,Rc as setupSmsInfrastructure,Tp as signingNameFor,hI as startImapServer,yI as startSmtpServer,aI as textToSpeech,fI as trackEvent,lI as translate,uI as translateToMultiple,Ws as verifyZoneParity};
+import{we,vr,Os,_s,Eg,yc,Sc,Ls,$s,Ic,ut,re,gt,fe,T,Re,Un,bc,Ue,Cc,Qn,vg,Rh,Ms,Fs,Hn,Gn,Dh,Ph,ZS,eI,tI,rI,Gt,nI,iI,sI,oI,Vt,kh,Nh,Bh,qt,xh,Oh,_h,Vn,aI,cI,dI,Tr,lI,uI,gI,Ec,vc,Tg,pI,mI,fI,wr,Lh,$h,Rr,pt,qn,Tc,wg,hI,Rg,yI,jt,SI,II,bI,CI,Ae,EI,vI,TI,wI,Dr,RI,DI,PI,jn,wc,Rc,Dg,Pg,Dc,Pr}from"../chunk-py8dq1ey.js";import{ne}from"../chunk-nftqsker.js";import{De,mt,zn,Mh}from"../chunk-gdw52mn4.js";import{Pc,Qe,I}from"../chunk-z56sccfh.js";import{He}from"../chunk-fdf181e6.js";import{ft,ye,Ge,H,Jt,Wn,Us,Qs,kr,Nr,Jn,Br,Hs,Gs,Vs,qs,ie,js,zs,Ks,Ws,Se,Js,Xs,Ys,N,Bc,Xn,xc,Ie,xr}from"../chunk-e75dvdqf.js";import{C}from"../chunk-c71hhcsb.js";import{qr,Be}from"../chunk-vq8bejep.js";import{A}from"../chunk-tmp2ym80.js";import{o}from"../chunk-c8kf2268.js";import{We,Tp,wp,Ni,n,g,tA}from"../chunk-m9szynnf.js";export{Ie as ACMClient,xr as ACMDnsValidator,n as AWSClient,Tc as ApplicationAutoScalingClient,vr as AwsBackupClient,Ph as BedrockAgentClient,Dh as BedrockAgentRuntimeClient,Gn as BedrockClient,Hn as BedrockRuntimeClient,A as CloudFormationClient,I as CloudFrontClient,Re as CloudWatchLogsClient,H as CloudflareProvider,Gt as ComprehendClient,Un as ConnectClient,$s as CostExplorerClient,Xn as DnsProviderFactory,Ue as DynamoDBClient,qr as EC2Client,He as ECRClient,ut as ECSClient,Pr as EFSClient,bc as ELBv2Client,pt as ElastiCacheClient,zn as EmailClient,Rr as EventBridgeClient,Ge as GoDaddyProvider,De as IAMClient,wg as ImapServer,wr as KendraClient,T as LambdaClient,Cc as OpenSearchClient,ft as PROXIABLE_RECORD_TYPES,Ec as PersonalizeClient,Tg as PersonalizeEventsClient,vc as PersonalizeRuntimeClient,Vn as PollyClient,ye as PorkbunProvider,ne as RDSClient,Vt as RekognitionClient,C as Route53Client,Ic as Route53DomainsClient,ie as Route53Provider,o as S3Client,mt as SESClient,gt as SNSClient,fe as SQSClient,Be as SSMClient,we as STSClient,qn as SchedulerClient,re as SecretsManagerClient,jt as SmsClient,Dc as SmsVoiceClient,Rg as SmtpServer,jn as SupportClient,wc as SupportTemplates,qt as TextractClient,Qn as TranscribeClient,Tr as TranslateClient,Se as UnifiedDnsValidator,Dr as VoiceClient,nI as analyzeSentiment,Vs as applyDeclaredZoneSettings,Ks as applyZoneMigration,g as buildQueryParams,wp as canonicalUriFor,Ni as coerceXmlValues,tI as completeWithClaude,Pc as configOrigins,oI as containsPii,Nh as countFacesInS3Image,vg as crc32,CI as createDeliveryReceiptHandler,N as createDnsProvider,Xs as createGoDaddyValidator,Ls as createObjectStorageClient,Js as createPorkbunValidator,DI as createRecordingHandler,Ys as createRoute53Validator,dI as createSSML,II as createScheduledSmsHandler,bI as createSmsClient,SI as createSmsInboxHandler,Pg as createSmsInfrastructure,PI as createVoiceClient,RI as createVoicemailHandler,Ms as decodeEventStream,Rh as decodeEventStreamMessage,Br as delegateZone,Hs as delegateZoneFromConfig,Gs as describeDelegation,qs as describeZoneSettings,tA as detectCredentialSource,Bc as detectDnsProvider,kh as detectLabelsFromS3,sI as detectLanguage,xc as dnsProviders,Mh as email,Fs as eventStreamError,js as exportRoute53Zone,iI as extractEntities,Oh as extractFormsFromS3,_h as extractTablesFromS3,xh as extractTextFromS3,EI as formatPhoneNumber,rI as generateEmbeddings,TI as getCountryCode,pI as getRecommendations,mI as getSimilarItems,Dg as getSmsInfrastructureStatus,Bh as isContentSafe,kr as isNameserverRegistrar,wI as isSamePhoneNumber,vI as isValidPhoneNumber,Nr as isZoneHost,_s as keyMatchesFilters,eI as listClaudeModels,gI as listLanguages,cI as listVoices,Eg as migrateObjectStorage,Ae as normalizePhoneNumber,zs as planZoneMigration,Jt as policyTag,yc as providerEndpoint,Wn as qualifyName,Qs as reconcileDeclaredRecords,Os as remapKey,ZS as requestModelAccess,Us as resolveDeclaredRecords,Sc as resolveObjectStorage,We as resolveS3Endpoint,$h as retrieveForRag,Qe as s3OriginBucket,Jn as sameNameservers,Lh as search,Rc as setupSmsInfrastructure,Tp as signingNameFor,hI as startImapServer,yI as startSmtpServer,aI as textToSpeech,fI as trackEvent,lI as translate,uI as translateToMultiple,Ws as verifyZoneParity};

package/dist/bin/{chunk-sbm0ft8c.js → chunk-0e56zmps.js}

@@ -1,2 +1,2 @@
-import{ts,Ra}from"./chunk-5xvvxh1f.js";import{g}from"./chunk-1wgyq50e.js";var l=()=>{};async function Jp(a,c=l){for(let e of a){let t=new g(e.replicaRegion),i;try{i=await t.headBucket(e.replicaBucket)}catch(r){if(r?.statusCode===301)throw Error(`Failover replica bucket ${e.replicaBucket} already exists outside ${e.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${e.name}.`);if(r?.statusCode===403)throw Error(`Failover replica bucket ${e.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${e.name}.failover.bucket to a name you own.`);throw r}if(i.exists&&i.region&&i.region!==e.replicaRegion)throw Error(`Failover replica bucket ${e.replicaBucket} is in ${i.region}, not ${e.replicaRegion}.`);if(!i.exists)c(`Creating failover replica bucket ${e.replicaBucket} in ${e.replicaRegion}`),await t.createBucket(e.replicaBucket);if(await t.putPublicAccessBlock(e.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await t.putBucketEncryption(e.replicaBucket,"AES256"),e.replicate){if((await t.getBucketVersioning(e.replicaBucket)).Status!=="Enabled")c(`Enabling versioning on ${e.replicaBucket} (S3 replication requires it)`),await t.putBucketVersioning(e.replicaBucket,"Enabled")}}}async function Xp(a,c,e=l){for(let t of a){let i=c[t.distributionArnOutput];if(!i)throw Error(`Stack output ${t.distributionArnOutput} is missing, so the failover replica ${t.replicaBucket} cannot be scoped to its distribution.`);let r=new g(t.replicaRegion),s={Version:"2012-10-17",Statement:[...((await r.getBucketPolicy(t.replicaBucket))?.Statement??[]).filter((n)=>n?.Sid!==ts),Ra({replicaBucket:t.replicaBucket,distributionArn:i})]};e(`Granting ${i} read access to ${t.replicaBucket}`),await r.putBucketPolicy(t.replicaBucket,s)}}async function Qp(a,c=l){let e={};for(let t of a){let i=new g(t.primaryRegion),r=new g(t.replicaRegion),[u,p]=await Promise.all([i.listAllObjects({bucket:t.primaryBucket}),r.listAllObjects({bucket:t.replicaBucket})]),s=new Map(p.map((o)=>[o.Key,o.Size])),n=u.filter((o)=>s.get(o.Key)!==o.Size);for(let o of n)await r.copyObject({sourceBucket:t.primaryBucket,sourceKey:o.Key,destinationBucket:t.replicaBucket,destinationKey:o.Key});if(n.length>0)c(`Copied ${n.length} object(s) from ${t.primaryBucket} to ${t.replicaBucket}`);e[t.replicaBucket]=n.length}return e}async function Yp(a,c=l){for(let e of a){let t=new g(e.replicaRegion);if(!(await t.headBucket(e.replicaBucket)).exists)continue;await t.emptyBucket(e.replicaBucket),await t.deleteBucket(e.replicaBucket),c(`Deleted failover replica bucket ${e.replicaBucket}`)}}
+import{ts,Ra}from"./chunk-9bmaq8q7.js";import{g}from"./chunk-1wgyq50e.js";var l=()=>{};async function Jp(a,c=l){for(let e of a){let t=new g(e.replicaRegion),i;try{i=await t.headBucket(e.replicaBucket)}catch(r){if(r?.statusCode===301)throw Error(`Failover replica bucket ${e.replicaBucket} already exists outside ${e.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${e.name}.`);if(r?.statusCode===403)throw Error(`Failover replica bucket ${e.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${e.name}.failover.bucket to a name you own.`);throw r}if(i.exists&&i.region&&i.region!==e.replicaRegion)throw Error(`Failover replica bucket ${e.replicaBucket} is in ${i.region}, not ${e.replicaRegion}.`);if(!i.exists)c(`Creating failover replica bucket ${e.replicaBucket} in ${e.replicaRegion}`),await t.createBucket(e.replicaBucket);if(await t.putPublicAccessBlock(e.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await t.putBucketEncryption(e.replicaBucket,"AES256"),e.replicate){if((await t.getBucketVersioning(e.replicaBucket)).Status!=="Enabled")c(`Enabling versioning on ${e.replicaBucket} (S3 replication requires it)`),await t.putBucketVersioning(e.replicaBucket,"Enabled")}}}async function Xp(a,c,e=l){for(let t of a){let i=c[t.distributionArnOutput];if(!i)throw Error(`Stack output ${t.distributionArnOutput} is missing, so the failover replica ${t.replicaBucket} cannot be scoped to its distribution.`);let r=new g(t.replicaRegion),s={Version:"2012-10-17",Statement:[...((await r.getBucketPolicy(t.replicaBucket))?.Statement??[]).filter((n)=>n?.Sid!==ts),Ra({replicaBucket:t.replicaBucket,distributionArn:i})]};e(`Granting ${i} read access to ${t.replicaBucket}`),await r.putBucketPolicy(t.replicaBucket,s)}}async function Qp(a,c=l){let e={};for(let t of a){let i=new g(t.primaryRegion),r=new g(t.replicaRegion),[u,p]=await Promise.all([i.listAllObjects({bucket:t.primaryBucket}),r.listAllObjects({bucket:t.replicaBucket})]),s=new Map(p.map((o)=>[o.Key,o.Size])),n=u.filter((o)=>s.get(o.Key)!==o.Size);for(let o of n)await r.copyObject({sourceBucket:t.primaryBucket,sourceKey:o.Key,destinationBucket:t.replicaBucket,destinationKey:o.Key});if(n.length>0)c(`Copied ${n.length} object(s) from ${t.primaryBucket} to ${t.replicaBucket}`);e[t.replicaBucket]=n.length}return e}async function Yp(a,c=l){for(let e of a){let t=new g(e.replicaRegion);if(!(await t.headBucket(e.replicaBucket)).exists)continue;await t.emptyBucket(e.replicaBucket),await t.deleteBucket(e.replicaBucket),c(`Deleted failover replica bucket ${e.replicaBucket}`)}}
 export{Jp,Xp,Qp,Yp};

package/dist/bin/{chunk-vr9jcw65.js → chunk-1vw6khps.js}

@@ -1 +1 @@
-import{Em,wm,ua,ol,pa,ma,wn,ze,I,ga,sl,H,Fr,w,su,Y,jr,fa,Xo,le,U,Qo,au,cu,lu,du,l,o,Am,Rm,T,ha,ya,ba,Im,Pm,$e,Sa,Fi,uu,Dm,km,He,Dt,va,al,cl,Nm,ll,dl,ul,Yo,Ca,st,Zo,An,ji,Rn,Ge,pu,es,ts,Ta,Ea,wa,Aa,Ra,Ia,Ae,j,mu,gu,pl,b,M,at,N,ml,kt,ye,Qt,xm,gl,Re,rs,qe,Yt,Vi,Ie,ns,Le,fu,zi,Pe,De,ie,Hi,X,Zt,Nt,ke,t,In,_m,fl,Pa,Om,$m,Lm,Mm,Da,Um,Bm,Fm,jm,Vm,zm,Hm,Gm,qm,Wm,Km,Jm,hu,yu,bu,Su,vu,Cu,Tu,er,hl,yl,Vr,Gi,Xm,bl,Qm,Ym,Pn,Zm,eg,tg,rg,ng,ig,Eu,wu,Au,Ru,Iu,qi,og,Dn,Pu,Sl,Du,ka,be,ku,Nu,xt,is,tr,xu,vl,_u,Ou,$u,Cl,Se,sg,ag,cg,lg,Lu,dg,Ne,ug,pg,mg,Na,xa,Mu,Tl,El,gg,fg,hg,yg,bg,Uu,_a,Sg,vg,Cg,Tg,Eg,Bu,Fu,wg,Ag,Rg,Ig,Pg,Dg,kg,ju,Ng,wl,Oa,xg,_g,Og,$g,Al,Rl,Il,Lg,$a,Vu,zu,Hu,Gu,La,qu,Mg,Ug,Bg,Fg,jg,Vg,zg,Wu,Ku,Ju,Xu,Pl,Hg,Gg,qg,Wg,Kg,Jg,Xg,Qg,Yg,Qu,Yu,Zu,ep,Zg,ef,Dl,tf,kl,Nl,xl,_l,rf,nf,of,sf,ct,Wi,af,cf,lf,df,uf,pf,mf,gf,tp,ff,hf,Ol,$l,yf,bf,rp,Sf,vf,Cf,Tf,Ef,wf,Af,Rf,If,Pf,Df,kf,Nf,xf,_f,Of,$f,Lf,Mf,Uf,Bf,Ma,np,Ua,ip,Ba,op,Fa,sp,ja,ap,zr,cp,Va,lp,Ki,dp,za,up,Ha,pp,Ll,Ff,Ml,jf,Ga,mp,Hr,gp,Ul,Vf,qa,fp,Bl,zf,Fl,Hf,jl,Gf,Wa,hp,Vl,qf,zl,Wf,Hl,Kf,Gl,Jf,Ka,yp,Ja,bp,ql,Xf,Wl,Qf,Kl,Yf,Jl,Zf,Xl,eh,Ql,th,Xa,Sp,Yl,rh,Zl,nh,ed,ih,td,oh,rd,sh,nd,ah,id,od,sd,ad,cd,ch,ld,lh,dd,dh,ud,uh,_t,pd,vp,os,Qa,kn,Cp,Ji,rr,Ya,Za,Tp,Ep,ec,md,tc,gd,ph,mh,rc,nc,ic,fd,Xi,hd,yd,ss,oc,sc,bd,wp,Ap,Rp,gh,Sd,vd,fh,Ip,Cd,Pp,Dp,kp,hh,Td,Nn,ac,Ed,yh,Np,as,cs,cc,wd,bh,lc,xp,Ad,Sh,Rd,vh,Id,Ch}from"./chunk-5xvvxh1f.js";import{dc,Z,uc,ls,_p,Ot,Op,$p,xn,Lp,Mp,Up,Bp,Fp}from"./chunk-8rkfwgb4.js";export{za as ABTestManager,qe as AI,_u as AWSAPIError,Ba as AWSConfigManager,_m as AWS_PSEUDO_PARAMETERS,ct as AWS_REGIONS,ns as ApiGateway,In as Arn,ie as AssetHasher,Pe as Auth,Ma as BackupManager,dd as BatchProcessingManager,Va as BlueGreenManager,ed as BounceComplaintHandler,Gl as BuildOptimizationManager,Ge as CDN,nc as CHAIN_HEADER,va as CLOUDFRONT_FAILOVER_STATUS_CODES,vf as COMMON_CROSS_ACCOUNT_ROLES,Vi as Cache,Ki as CanaryManager,Vl as CertificateManager,xt as CloudError,fl as CloudFormationBuilder,Du as CloudFormationClient,Nu as CloudFrontClient,Fa as CloudTrailManager,ep as CommandHistory,ke as Communication,b as Compute,is as ConfigurationError,Ka as ContainerRegistryManager,tr as CredentialError,kl as CrossRegionReferenceManager,yu as DASHBOARD_ENTRY,bu as DASHBOARD_PORT_BASE,Su as DASHBOARD_PORT_SPAN,hu as DASHBOARD_STATE_DIR,al as DEFAULT_FAILOVER_STATUS_CODES,Xi as DEFAULT_RECURSION_LIMITS,Ne as DEFAULT_SERVICE_LIMITS,ua as DEFAULT_STATE_DIR,pu as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,rc as DEPTH_HEADER,ld as DLQMonitoringManager,Ae as DNS,Yl as DNSSECManager,Yt as Database,Fl as DatabaseUserManager,Se as DebugLogger,uu as DependencyGraph,De as Deployment,xu as DeploymentError,Ua as DisasterRecoveryManager,N as Email,id as EmailAdvanced,td as EmailAnalyticsManager,od as EmailHandlers,nd as EmailTemplateManager,Ou as ErrorCodes,ts as FAILOVER_REPLICA_POLICY_SID,cd as FIFOQueueManager,Na as FileCache,at as FileSystem,t as Fn,Nl as GlobalResourceManager,ja as GuardDutyManager,Uu as HashCache,Ad as HealthCheckManager,Hl as ImageScanningManager,Qt as JobLoader,Ed as LARAVEL_SERVERLESS_BUILD_STEPS,Kl as LambdaConcurrencyManager,Ql as LambdaDLQManager,Jl as LambdaDestinationsManager,ql as LambdaLayersManager,Xl as LambdaVPCManager,Wl as LambdaVersionsManager,Ga as LogsManager,Cp as MANAGED_NODE_VERSIONS,hl as MANAGEMENT_DASHBOARD_SITE_PREFIX,Le as Messaging,Ml as MetricsManager,Ul as MigrationManager,Al as MockCloudFormation,Il as MockDynamoDB,Rl as MockS3,zi as Monitoring,Ol as MultiAccountManager,Dl as MultiRegionManager,Ku as MultiStepProgress,M as Network,Rd as NetworkSecurityManager,dl as ORIGIN_CONNECTION_ATTEMPTS,ul as ORIGIN_CONNECTION_TIMEOUT,cl as ORIGIN_GROUP_ALLOWED_METHODS,Nm as ORIGIN_GROUP_ID_SUFFIX,ll as ORIGIN_GROUP_SELECTION_CRITERIA,$l as OrganizationManager,Np as PHP_DEFAULT_EXCLUDES,Tp as PHP_LAYER_EXTENSIONS,X as ParameterStore,Bl as PerformanceManager,Ie as Permissions,kt as Phone,sd as PhoneAdvanced,ml as PhoneHandlers,$a as PreviewEnvironmentManager,La as PreviewNotificationService,Wu as ProgressBar,Ha as ProgressiveDeploymentManager,du as Pseudo,ye as Queue,ud as QueueManagementManager,Em as QueuePresets,rp as RECOMMENDED_ACCOUNT_STRUCTURES,Sf as RECOMMENDED_SCPS,Qu as REPL,Zu as REPLCommandBuilder,Yu as REPLContext,Bu as RateLimiter,wm as RealtimePresets,ss as RecursionGuard,Nt as Redirects,xl as RegionPairManager,Dt as Registry,qa as ReplicaManager,Id as ResourceManagementManager,Zl as Route53ResolverManager,Xa as Route53RoutingManager,ka as S3Client,be as S3Error,Re as SMS,ol as STATE_DIR_ENV_VAR,es as STORAGE_FAILOVER_METADATA_KEY,Zt as Search,Hi as Secrets,Wa as SecretsManager,jl as SecretsRotationManager,j as Security,zr as SecurityHubManager,zl as SecurityScanningManager,rd as SenderReputationManager,Ja as ServiceMeshManager,rs as Sftp,ad as SmsAdvanced,gl as SmsHandlers,Ju as Spinner,_l as StackDependencyManager,xm as StacksIntegration,wd as StaticSiteManager,He as Storage,lc as StorageAdvancedManager,Hr as SyntheticsManager,ic as TRACE_HEADER,Xu as TaskList,Qo as TemplateBuilder,xa as TemplateCache,vl as ValidationError,fu as Workflow,Ll as XRayManager,up as abTestManager,pl as amazonLinuxImageId,gu as amazonLinuxImageParameter,Dm as analyzeStackDiff,Qa as artifactKey,An as assertOriginGroupMethods,Kg as autocomplete,op as awsConfigManager,np as backupManager,Sg as batch,dh as batchProcessingManager,lp as blueGreenManager,ih as bounceComplaintHandler,mh as buildBunRuntimeLayerZip,Pa as buildCloudFormationTemplate,Ra as buildFailoverReplicaPolicyStatement,fa as buildMailEnv,ph as buildNodeRuntimeLayerZip,Jf as buildOptimizationManager,Ca as buildOriginGroup,Zo as buildOriginGroups,yh as buildPhpRuntimeLayerZip,Aa as buildReplicationConfiguration,wa as buildReplicationRole,dp as canaryManager,Pg as categorizeChanges,qf as certificateManager,lg as checkIAMPermissions,Sd as checkInvocation,ug as checkServiceQuotas,Fu as chunk,Mp as clearSigningKeyCache,ju as cloudConfigSchema,sp as cloudTrailManager,cs as collectPhpAppEntries,Qm as composePresets,Za as composeServerlessAppTemplate,yp as containerRegistryManager,Bm as createApiBackendPreset,kp as createCliHandler,og as createCredentialProvider,Jm as createDashboardSite,Hm as createDataPipelinePreset,Cl as createError,Da as createExistingStaticFullStackPreset,Um as createFullStackAppPreset,hh as createHandlers,Pp as createHttpHandler,jm as createJamstackPreset,Wm as createLaravelPreset,Gm as createMLApiPreset,Vm as createMicroservicesPreset,Lg as createMockAWS,$m as createNodeJsServerPreset,Lm as createNodeJsServerlessPreset,Ym as createPreset,ls as createPresignedUrl,_p as createPresignedUrlAsync,Dp as createQueueHandler,zm as createRealtimeAppPreset,ku as createS3Client,Km as createServerlessLaravelPreset,Mm as createServerlessNodePreset,Om as createStaticSitePreset,qm as createTraditionalWebAppPreset,Fm as createWordPressPreset,_t as createZip,rf as crossRegionReferenceManager,Hf as databaseUserManager,wl as defaultLocalConfig,Fr as deploymentCoexistenceError,vu as deriveManagementDashboardPort,sl as detectDeploymentTargets,ag as detectMisconfigurations,dc as detectServiceRegion,Ag as diffTemplates,lh as dlqMonitoringManager,rh as dnssecManager,ip as drManager,oh as emailAnalyticsManager,ah as emailTemplateManager,Ip as eventToRequest,bl as extendPreset,ch as fifoQueueManager,bg as findChangedFiles,wf as formatAccountStructure,Fg as formatBytes,km as formatDiff,jg as formatDuration,Xg as formatFlagSuggestions,Zg as formatHistory,ef as formatHistoryStats,zg as formatKeyValue,Vg as formatList,Bg as formatProgressBar,tp as formatRegion,ff as formatRegionList,Hg as formatSuggestion,Mg as formatTable,Ug as formatTree,Au as fromEC2Metadata,Ru as fromECSMetadata,Eu as fromEnvironment,wu as fromSharedCredentials,Iu as fromWebIdentity,fd as functionFingerprint,tc as generateAppImageDockerfile,Uf as generateApprovalConfig,pd as generateBootstrap,Hu as generateCleanupWorkflow,Gu as generateCostReportWorkflow,Tf as generateCrossAccountRoleCF,$f as generateDeploymentConfig,kf as generateDeploymentPipeline,Af as generateDeploymentWorkflow,o as generateLogicalId,Of as generateManualPipeline,Df as generateMatrixWorkflow,Lf as generateMultiEnvConfig,Nf as generateMultiEnvPipeline,Rf as generateMultiEnvWorkflow,If as generatePRPreviewWorkflow,Bf as generateParallelConfig,Td as generatePhpFpmConfig,md as generatePhpLayerDockerfile,xf as generatePreviewPipeline,zu as generatePreviewWorkflow,l as generateResourceName,Mf as generateScheduledConfig,_f as generateScheduledPipeline,Pf as generateScheduledWorkflow,Sl as getAccountId,af as getAllRegions,pf as getClosestRegion,Qg as getCommandUsage,qg as getContextualHelp,qi as getCredentials,Dg as getDeploymentStrategy,kg as getDiffStats,Rg as getDiffSummary,$u as getErrorDetails,Oa as getLocalConfig,Og as getLocalCredentials,_g as getLocalEndpoint,$g as getLocalEnvVars,pg as getQuotaUsageSummary,Cf as getRecommendedStructure,Wi as getRegion,hf as getRegionStats,lf as getRegionsByCompliance,cf as getRegionsByLocation,df as getRegionsByPricingTier,Lu as getRequiredPermissions,Up as getSigningKeyCacheSize,Am as getTimestamp,nf as globalResourceManager,ap as guardDutyManager,er as hasManagementDashboardSite,gg as hashBuffer,fg as hashDirectory,Tl as hashFile,hg as hashManifest,El as hashString,Sh as healthCheckManager,Kf as imageScanningManager,yd as inspectInvocation,Ap as installRecursionFetch,bd as invocationContext,mu as isArmInstanceType,Gg as isLikelyTypo,xg as isLocalDevelopment,Vr as isManagementDashboardSiteName,Bp as isNodeCryptoAvailable,ji as isS3RestEndpoint,ma as isStateDirConfigured,ga as isStatePath,uf as isValidRegion,Fp as isWebCryptoAvailable,Yf as lambdaConcurrencyManager,th as lambdaDLQManager,Zf as lambdaDestinationsManager,Xf as lambdaLayersManager,eh as lambdaVPCManager,Qf as lambdaVersionsManager,ac as laravelServerlessEnvDefaults,mp as logsManager,su as mailEnabled,jr as mailFirewallPorts,Xo as mailWebmailSites,Ot as makeAWSRequest,$p as makeAWSRequestAsync,Op as makeAWSRequestOnce,yl as managementDashboardSiteName,Pn as mergeInfrastructure,jf as metricsManager,Vf as migrationManager,yf as multiAccountManager,tf as multiRegionManager,vh as networkSecurityManager,bf as organizationManager,cc as packagePhpApp,kn as packageServerlessApp,_a as parallel,vg as parallelMap,Cg as parallelWithRetry,hd as parseChain,Lp as parseJSONResponse,xn as parseXMLResponse,zf as performanceManager,ec as phpLayerBuildStage,Ep as phpLayerPackages,Nn as phpRuntimeLayerAssets,Vu as previewManager,qu as previewNotifications,wg as processInChunks,pp as progressiveDeploymentManager,oc as propagationHeaders,uh as queueManagementManager,yg as quickHash,sc as recursionBlockedResponse,of as regionPairManager,fp as replicaManager,Ig as requiresReplacement,gh as resetRecursionRuntime,fh as resolveApp,w as resolveAppDatabase,U as resolveCloudProvider,Dn as resolveCredentials,Cu as resolveDashboardDomain,Tu as resolveDashboardDomains,Pm as resolveDeployBucketName,H as resolveDeploymentMode,Yo as resolveFailoverStatusCodes,le as resolveMailProxy,Y as resolveMailService,Xm as resolveManagementDashboardSite,Gi as resolveManagementDashboardSites,st as resolveOriginConnection,T as resolveProjectStackName,Ya as resolveQueueNames,rr as resolveQueues,wp as resolveRecursionConfig,Pu as resolveRegion,$e as resolveServerlessAppStackName,Sa as resolveServerlessArtifactBucketName,Fi as resolveServerlessAssetBucketName,Ji as resolveServerlessRuntime,ba as resolveSiteBucketName,ya as resolveSiteResourceName,ha as resolveSiteStackName,I as resolveStatePath,Im as resolveStorageBucketName,Ta as resolveStorageFailover,Ch as resourceManagementManager,Cd as responseToResult,nh as route53ResolverManager,Sp as route53RoutingManager,vp as runBuildHooks,as as runPhpBuildHooks,Ea as s3RegionalDomain,Rm as sanitizeName,Wg as searchCommands,hp as secretsManager,Gf as secretsRotationManager,cp as securityHubManager,Wf as securityScanningManager,sh as senderReputationManager,Tg as sequence,bp as serviceMeshManager,pa as setStateDir,os as sha256,Rp as sharedRecursionGuard,gd as sharedRuntimeLoop,Z as signRequest,uc as signRequestAsync,sf as stackDependencyManager,wn as stateDir,ze as statePath,bh as staticSiteManager,xp as storageAdvancedManager,Ia as storageFailoverReplicasFromTemplate,Pl as suggestCommand,Jg as suggestFlags,dg as suggestIAMPolicy,mg as suggestQuotaIncrease,gf as suggestRegionPairs,mf as suggestRegions,gp as syntheticsManager,Mu as templateCache,Ef as validateAccountStructure,Ng as validateAgainstSchema,Yg as validateCommand,sg as validateConfiguration,cg as validateCredentials,Rn as validateOriginGroups,lu as validateResourceLimits,au as validateTemplate,cu as validateTemplateSize,ng as withCDN,rg as withCache,tg as withDatabase,vd as withInvocation,Zm as withMonitoring,ig as withQueue,eg as withSecurity,Eg as withTimeout,Ff as xrayManager};
+import{Em,wm,ua,ol,pa,ma,wn,ze,I,ga,sl,H,Fr,w,su,Y,jr,fa,Xo,de,U,Qo,au,cu,lu,du,l,o,Am,Rm,T,ha,ya,ba,Im,Pm,$e,Sa,Fi,uu,Dm,km,He,Dt,va,al,cl,Nm,ll,dl,ul,Yo,Ca,st,Zo,An,ji,Rn,Ge,pu,es,ts,Ta,Ea,wa,Aa,Ra,Ia,Ae,j,mu,gu,pl,b,M,at,N,ml,kt,ye,Qt,xm,gl,Re,rs,qe,Yt,Vi,Ie,ns,Le,fu,zi,Pe,De,oe,Hi,X,Zt,Nt,ke,t,In,_m,fl,Pa,Om,$m,Lm,Mm,Da,Um,Bm,Fm,jm,Vm,zm,Hm,Gm,qm,Wm,Km,Jm,hu,yu,bu,Su,vu,Cu,Tu,er,hl,yl,Vr,Gi,Xm,bl,Qm,Ym,Pn,Zm,eg,tg,rg,ng,ig,Eu,wu,Au,Ru,Iu,qi,og,Dn,Pu,Sl,Du,ka,be,ku,Nu,xt,is,tr,xu,vl,_u,Ou,$u,Cl,Se,sg,ag,cg,lg,Lu,dg,Ne,ug,pg,mg,Na,xa,Mu,Tl,El,gg,fg,hg,yg,bg,Uu,_a,Sg,vg,Cg,Tg,Eg,Bu,Fu,wg,Ag,Rg,Ig,Pg,Dg,kg,ju,Ng,wl,Oa,xg,_g,Og,$g,Al,Rl,Il,Lg,$a,Vu,zu,Hu,Gu,La,qu,Mg,Ug,Bg,Fg,jg,Vg,zg,Wu,Ku,Ju,Xu,Pl,Hg,Gg,qg,Wg,Kg,Jg,Xg,Qg,Yg,Qu,Yu,Zu,ep,Zg,ef,Dl,tf,kl,Nl,xl,_l,rf,nf,of,sf,ct,Wi,af,cf,lf,df,uf,pf,mf,gf,tp,ff,hf,Ol,$l,yf,bf,rp,Sf,vf,Cf,Tf,Ef,wf,Af,Rf,If,Pf,Df,kf,Nf,xf,_f,Of,$f,Lf,Mf,Uf,Bf,Ma,np,Ua,ip,Ba,op,Fa,sp,ja,ap,zr,cp,Va,lp,Ki,dp,za,up,Ha,pp,Ll,Ff,Ml,jf,Ga,mp,Hr,gp,Ul,Vf,qa,fp,Bl,zf,Fl,Hf,jl,Gf,Wa,hp,Vl,qf,zl,Wf,Hl,Kf,Gl,Jf,Ka,yp,Ja,bp,ql,Xf,Wl,Qf,Kl,Yf,Jl,Zf,Xl,eh,Ql,th,Xa,Sp,Yl,rh,Zl,nh,ed,ih,td,oh,rd,sh,nd,ah,id,od,sd,ad,cd,ch,ld,lh,dd,dh,ud,uh,_t,pd,vp,os,Qa,kn,Cp,Ji,rr,Ya,Za,Tp,Ep,ec,md,tc,gd,ph,mh,rc,nc,ic,fd,Xi,hd,yd,ss,oc,sc,bd,wp,Ap,Rp,gh,Sd,vd,fh,Ip,Cd,Pp,Dp,kp,hh,Td,Nn,ac,Ed,yh,Np,as,cs,cc,wd,bh,lc,xp,Ad,Sh,Rd,vh,Id,Ch}from"./chunk-9bmaq8q7.js";import{dc,Z,uc,ls,_p,Ot,Op,$p,xn,Lp,Mp,Up,Bp,Fp}from"./chunk-8rkfwgb4.js";export{za as ABTestManager,qe as AI,_u as AWSAPIError,Ba as AWSConfigManager,_m as AWS_PSEUDO_PARAMETERS,ct as AWS_REGIONS,ns as ApiGateway,In as Arn,oe as AssetHasher,Pe as Auth,Ma as BackupManager,dd as BatchProcessingManager,Va as BlueGreenManager,ed as BounceComplaintHandler,Gl as BuildOptimizationManager,Ge as CDN,nc as CHAIN_HEADER,va as CLOUDFRONT_FAILOVER_STATUS_CODES,vf as COMMON_CROSS_ACCOUNT_ROLES,Vi as Cache,Ki as CanaryManager,Vl as CertificateManager,xt as CloudError,fl as CloudFormationBuilder,Du as CloudFormationClient,Nu as CloudFrontClient,Fa as CloudTrailManager,ep as CommandHistory,ke as Communication,b as Compute,is as ConfigurationError,Ka as ContainerRegistryManager,tr as CredentialError,kl as CrossRegionReferenceManager,yu as DASHBOARD_ENTRY,bu as DASHBOARD_PORT_BASE,Su as DASHBOARD_PORT_SPAN,hu as DASHBOARD_STATE_DIR,al as DEFAULT_FAILOVER_STATUS_CODES,Xi as DEFAULT_RECURSION_LIMITS,Ne as DEFAULT_SERVICE_LIMITS,ua as DEFAULT_STATE_DIR,pu as DEFAULT_STORAGE_FAILOVER_STATUS_CODES,rc as DEPTH_HEADER,ld as DLQMonitoringManager,Ae as DNS,Yl as DNSSECManager,Yt as Database,Fl as DatabaseUserManager,Se as DebugLogger,uu as DependencyGraph,De as Deployment,xu as DeploymentError,Ua as DisasterRecoveryManager,N as Email,id as EmailAdvanced,td as EmailAnalyticsManager,od as EmailHandlers,nd as EmailTemplateManager,Ou as ErrorCodes,ts as FAILOVER_REPLICA_POLICY_SID,cd as FIFOQueueManager,Na as FileCache,at as FileSystem,t as Fn,Nl as GlobalResourceManager,ja as GuardDutyManager,Uu as HashCache,Ad as HealthCheckManager,Hl as ImageScanningManager,Qt as JobLoader,Ed as LARAVEL_SERVERLESS_BUILD_STEPS,Kl as LambdaConcurrencyManager,Ql as LambdaDLQManager,Jl as LambdaDestinationsManager,ql as LambdaLayersManager,Xl as LambdaVPCManager,Wl as LambdaVersionsManager,Ga as LogsManager,Cp as MANAGED_NODE_VERSIONS,hl as MANAGEMENT_DASHBOARD_SITE_PREFIX,Le as Messaging,Ml as MetricsManager,Ul as MigrationManager,Al as MockCloudFormation,Il as MockDynamoDB,Rl as MockS3,zi as Monitoring,Ol as MultiAccountManager,Dl as MultiRegionManager,Ku as MultiStepProgress,M as Network,Rd as NetworkSecurityManager,dl as ORIGIN_CONNECTION_ATTEMPTS,ul as ORIGIN_CONNECTION_TIMEOUT,cl as ORIGIN_GROUP_ALLOWED_METHODS,Nm as ORIGIN_GROUP_ID_SUFFIX,ll as ORIGIN_GROUP_SELECTION_CRITERIA,$l as OrganizationManager,Np as PHP_DEFAULT_EXCLUDES,Tp as PHP_LAYER_EXTENSIONS,X as ParameterStore,Bl as PerformanceManager,Ie as Permissions,kt as Phone,sd as PhoneAdvanced,ml as PhoneHandlers,$a as PreviewEnvironmentManager,La as PreviewNotificationService,Wu as ProgressBar,Ha as ProgressiveDeploymentManager,du as Pseudo,ye as Queue,ud as QueueManagementManager,Em as QueuePresets,rp as RECOMMENDED_ACCOUNT_STRUCTURES,Sf as RECOMMENDED_SCPS,Qu as REPL,Zu as REPLCommandBuilder,Yu as REPLContext,Bu as RateLimiter,wm as RealtimePresets,ss as RecursionGuard,Nt as Redirects,xl as RegionPairManager,Dt as Registry,qa as ReplicaManager,Id as ResourceManagementManager,Zl as Route53ResolverManager,Xa as Route53RoutingManager,ka as S3Client,be as S3Error,Re as SMS,ol as STATE_DIR_ENV_VAR,es as STORAGE_FAILOVER_METADATA_KEY,Zt as Search,Hi as Secrets,Wa as SecretsManager,jl as SecretsRotationManager,j as Security,zr as SecurityHubManager,zl as SecurityScanningManager,rd as SenderReputationManager,Ja as ServiceMeshManager,rs as Sftp,ad as SmsAdvanced,gl as SmsHandlers,Ju as Spinner,_l as StackDependencyManager,xm as StacksIntegration,wd as StaticSiteManager,He as Storage,lc as StorageAdvancedManager,Hr as SyntheticsManager,ic as TRACE_HEADER,Xu as TaskList,Qo as TemplateBuilder,xa as TemplateCache,vl as ValidationError,fu as Workflow,Ll as XRayManager,up as abTestManager,pl as amazonLinuxImageId,gu as amazonLinuxImageParameter,Dm as analyzeStackDiff,Qa as artifactKey,An as assertOriginGroupMethods,Kg as autocomplete,op as awsConfigManager,np as backupManager,Sg as batch,dh as batchProcessingManager,lp as blueGreenManager,ih as bounceComplaintHandler,mh as buildBunRuntimeLayerZip,Pa as buildCloudFormationTemplate,Ra as buildFailoverReplicaPolicyStatement,fa as buildMailEnv,ph as buildNodeRuntimeLayerZip,Jf as buildOptimizationManager,Ca as buildOriginGroup,Zo as buildOriginGroups,yh as buildPhpRuntimeLayerZip,Aa as buildReplicationConfiguration,wa as buildReplicationRole,dp as canaryManager,Pg as categorizeChanges,qf as certificateManager,lg as checkIAMPermissions,Sd as checkInvocation,ug as checkServiceQuotas,Fu as chunk,Mp as clearSigningKeyCache,ju as cloudConfigSchema,sp as cloudTrailManager,cs as collectPhpAppEntries,Qm as composePresets,Za as composeServerlessAppTemplate,yp as containerRegistryManager,Bm as createApiBackendPreset,kp as createCliHandler,og as createCredentialProvider,Jm as createDashboardSite,Hm as createDataPipelinePreset,Cl as createError,Da as createExistingStaticFullStackPreset,Um as createFullStackAppPreset,hh as createHandlers,Pp as createHttpHandler,jm as createJamstackPreset,Wm as createLaravelPreset,Gm as createMLApiPreset,Vm as createMicroservicesPreset,Lg as createMockAWS,$m as createNodeJsServerPreset,Lm as createNodeJsServerlessPreset,Ym as createPreset,ls as createPresignedUrl,_p as createPresignedUrlAsync,Dp as createQueueHandler,zm as createRealtimeAppPreset,ku as createS3Client,Km as createServerlessLaravelPreset,Mm as createServerlessNodePreset,Om as createStaticSitePreset,qm as createTraditionalWebAppPreset,Fm as createWordPressPreset,_t as createZip,rf as crossRegionReferenceManager,Hf as databaseUserManager,wl as defaultLocalConfig,Fr as deploymentCoexistenceError,vu as deriveManagementDashboardPort,sl as detectDeploymentTargets,ag as detectMisconfigurations,dc as detectServiceRegion,Ag as diffTemplates,lh as dlqMonitoringManager,rh as dnssecManager,ip as drManager,oh as emailAnalyticsManager,ah as emailTemplateManager,Ip as eventToRequest,bl as extendPreset,ch as fifoQueueManager,bg as findChangedFiles,wf as formatAccountStructure,Fg as formatBytes,km as formatDiff,jg as formatDuration,Xg as formatFlagSuggestions,Zg as formatHistory,ef as formatHistoryStats,zg as formatKeyValue,Vg as formatList,Bg as formatProgressBar,tp as formatRegion,ff as formatRegionList,Hg as formatSuggestion,Mg as formatTable,Ug as formatTree,Au as fromEC2Metadata,Ru as fromECSMetadata,Eu as fromEnvironment,wu as fromSharedCredentials,Iu as fromWebIdentity,fd as functionFingerprint,tc as generateAppImageDockerfile,Uf as generateApprovalConfig,pd as generateBootstrap,Hu as generateCleanupWorkflow,Gu as generateCostReportWorkflow,Tf as generateCrossAccountRoleCF,$f as generateDeploymentConfig,kf as generateDeploymentPipeline,Af as generateDeploymentWorkflow,o as generateLogicalId,Of as generateManualPipeline,Df as generateMatrixWorkflow,Lf as generateMultiEnvConfig,Nf as generateMultiEnvPipeline,Rf as generateMultiEnvWorkflow,If as generatePRPreviewWorkflow,Bf as generateParallelConfig,Td as generatePhpFpmConfig,md as generatePhpLayerDockerfile,xf as generatePreviewPipeline,zu as generatePreviewWorkflow,l as generateResourceName,Mf as generateScheduledConfig,_f as generateScheduledPipeline,Pf as generateScheduledWorkflow,Sl as getAccountId,af as getAllRegions,pf as getClosestRegion,Qg as getCommandUsage,qg as getContextualHelp,qi as getCredentials,Dg as getDeploymentStrategy,kg as getDiffStats,Rg as getDiffSummary,$u as getErrorDetails,Oa as getLocalConfig,Og as getLocalCredentials,_g as getLocalEndpoint,$g as getLocalEnvVars,pg as getQuotaUsageSummary,Cf as getRecommendedStructure,Wi as getRegion,hf as getRegionStats,lf as getRegionsByCompliance,cf as getRegionsByLocation,df as getRegionsByPricingTier,Lu as getRequiredPermissions,Up as getSigningKeyCacheSize,Am as getTimestamp,nf as globalResourceManager,ap as guardDutyManager,er as hasManagementDashboardSite,gg as hashBuffer,fg as hashDirectory,Tl as hashFile,hg as hashManifest,El as hashString,Sh as healthCheckManager,Kf as imageScanningManager,yd as inspectInvocation,Ap as installRecursionFetch,bd as invocationContext,mu as isArmInstanceType,Gg as isLikelyTypo,xg as isLocalDevelopment,Vr as isManagementDashboardSiteName,Bp as isNodeCryptoAvailable,ji as isS3RestEndpoint,ma as isStateDirConfigured,ga as isStatePath,uf as isValidRegion,Fp as isWebCryptoAvailable,Yf as lambdaConcurrencyManager,th as lambdaDLQManager,Zf as lambdaDestinationsManager,Xf as lambdaLayersManager,eh as lambdaVPCManager,Qf as lambdaVersionsManager,ac as laravelServerlessEnvDefaults,mp as logsManager,su as mailEnabled,jr as mailFirewallPorts,Xo as mailWebmailSites,Ot as makeAWSRequest,$p as makeAWSRequestAsync,Op as makeAWSRequestOnce,yl as managementDashboardSiteName,Pn as mergeInfrastructure,jf as metricsManager,Vf as migrationManager,yf as multiAccountManager,tf as multiRegionManager,vh as networkSecurityManager,bf as organizationManager,cc as packagePhpApp,kn as packageServerlessApp,_a as parallel,vg as parallelMap,Cg as parallelWithRetry,hd as parseChain,Lp as parseJSONResponse,xn as parseXMLResponse,zf as performanceManager,ec as phpLayerBuildStage,Ep as phpLayerPackages,Nn as phpRuntimeLayerAssets,Vu as previewManager,qu as previewNotifications,wg as processInChunks,pp as progressiveDeploymentManager,oc as propagationHeaders,uh as queueManagementManager,yg as quickHash,sc as recursionBlockedResponse,of as regionPairManager,fp as replicaManager,Ig as requiresReplacement,gh as resetRecursionRuntime,fh as resolveApp,w as resolveAppDatabase,U as resolveCloudProvider,Dn as resolveCredentials,Cu as resolveDashboardDomain,Tu as resolveDashboardDomains,Pm as resolveDeployBucketName,H as resolveDeploymentMode,Yo as resolveFailoverStatusCodes,de as resolveMailProxy,Y as resolveMailService,Xm as resolveManagementDashboardSite,Gi as resolveManagementDashboardSites,st as resolveOriginConnection,T as resolveProjectStackName,Ya as resolveQueueNames,rr as resolveQueues,wp as resolveRecursionConfig,Pu as resolveRegion,$e as resolveServerlessAppStackName,Sa as resolveServerlessArtifactBucketName,Fi as resolveServerlessAssetBucketName,Ji as resolveServerlessRuntime,ba as resolveSiteBucketName,ya as resolveSiteResourceName,ha as resolveSiteStackName,I as resolveStatePath,Im as resolveStorageBucketName,Ta as resolveStorageFailover,Ch as resourceManagementManager,Cd as responseToResult,nh as route53ResolverManager,Sp as route53RoutingManager,vp as runBuildHooks,as as runPhpBuildHooks,Ea as s3RegionalDomain,Rm as sanitizeName,Wg as searchCommands,hp as secretsManager,Gf as secretsRotationManager,cp as securityHubManager,Wf as securityScanningManager,sh as senderReputationManager,Tg as sequence,bp as serviceMeshManager,pa as setStateDir,os as sha256,Rp as sharedRecursionGuard,gd as sharedRuntimeLoop,Z as signRequest,uc as signRequestAsync,sf as stackDependencyManager,wn as stateDir,ze as statePath,bh as staticSiteManager,xp as storageAdvancedManager,Ia as storageFailoverReplicasFromTemplate,Pl as suggestCommand,Jg as suggestFlags,dg as suggestIAMPolicy,mg as suggestQuotaIncrease,gf as suggestRegionPairs,mf as suggestRegions,gp as syntheticsManager,Mu as templateCache,Ef as validateAccountStructure,Ng as validateAgainstSchema,Yg as validateCommand,sg as validateConfiguration,cg as validateCredentials,Rn as validateOriginGroups,lu as validateResourceLimits,au as validateTemplate,cu as validateTemplateSize,ng as withCDN,rg as withCache,tg as withDatabase,vd as withInvocation,Zm as withMonitoring,ig as withQueue,eg as withSecurity,Eg as withTimeout,Ff as xrayManager};

package/dist/bin/{chunk-j1dpdjec.js → chunk-2dbyh1g2.js}

@@ -1,11 +1,11 @@
-import{H,Fr}from"./chunk-5xvvxh1f.js";function W(e,t){return`/var/www/${e}-${t}`}var me=new Set(["laravel","php","statamic","wordpress"]);function ki(e){return e.type!=null&&me.has(e.type)}function Bs(e){let t=e.proxyTo;if(t==null)return[];return(Array.isArray(t)?t:[t]).map((s)=>String(s).trim()).filter((s)=>s.length>0)}function fe(e){return Bs(e).length>0}function re(e){if(e.deploy)return e.deploy;if(ki(e))return"server";if(e.start)return"server";return"bucket"}function A(e){if(e.redirect)return"redirect";if(fe(e))return"proxy";if(ki(e))return"server-php";if(re(e)==="bucket")return"bucket";return e.start?"server-app":"server-static"}function Io(e){return e.infrastructure?.compute!=null||Boolean(e.cloud?.attachTo?.trim())}function Fs(e,t={}){let r=[],s=[],o=e.sites||{},n=Io(e),l=Fr(e);if(l)r.push(l);let p=new Map;for(let[c,i]of Object.entries(o)){if(!i)continue;let f=re(i),C=A(i);if(C==="redirect"){if(!i.domain)r.push(`Site '${c}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof i.redirect==="string"?i.redirect:i.redirect?.to))r.push(`Site '${c}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!n)r.push(`Site '${c}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let a=[];if(i.start)a.push("start");if(i.root)a.push("root");if(i.proxyTo)a.push("proxyTo");if(a.length>0)s.push(`Site '${c}' is a redirect site but also sets ${a.join(", ")}. These are ignored.`);continue}if(C==="proxy"){if(!i.domain)r.push(`Site '${c}' is a proxy site but has no \`domain\` to route from.`);if(!n)r.push(`Site '${c}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let u=[];if(i.start)u.push("start");if(i.root)u.push("root");if(typeof i.port==="number")u.push("port");if(i.build)u.push("build");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)s.push(`Site '${c}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${u.join(", ")} ${u.length===1?"is":"are"} ignored — remove ${u.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(f==="server"&&!i.start&&!i.root){r.push(`Site '${c}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(C==="server-php"){if(!n)r.push(`Site '${c}' is a PHP site (type:'${i.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!i.repository?.url)r.push(`Site '${c}' is a PHP site (type:'${i.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(C==="server-app"){if(!n)r.push(`Site '${c}' deploys to a server (deploy:'server'${i.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof i.port==="number"){let u=t.occupiedPorts?.get(i.port);if(u)r.push(`Site '${c}' wants port ${i.port}, which project '${u}' already serves on this box. Attached projects share one port namespace. Give '${c}' a free port, or let the attach allocate one.`);let a=p.get(i.port);if(a)r.push(`Sites '${a}' and '${c}' both use port ${i.port}. Server apps sharing a box must use distinct ports.`);else p.set(i.port,c)}}else if(C==="server-static"){if(!i.root)r.push(`Site '${c}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!n)r.push(`Site '${c}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!i.root)r.push(`Site '${c}' deploys to a bucket but has no \`root\` directory to upload.`);let u=[];if(i.start)u.push("start");if(typeof i.port==="number")u.push("port");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)s.push(`Site '${c}' deploys to a bucket but sets server-only field(s): ${u.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:s}}function js(e){let t=A(e);return t!=="bucket"&&t!=="redirect"&&t!=="proxy"}function Wc(e){return A(e)==="bucket"}function Kc(e,t){if(H(e)==="serverless")return!0;let r=Object.entries(e.sites??{}).filter(([,o])=>o!=null),s=t?r.filter(([o])=>o===t):r;if(s.length===0)return!0;return!s.every(([,o])=>{let n=A(o);return n==="redirect"||n==="proxy"})}var U={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",mail:"github.com/mail-os/mail",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var R="/opt/pantry";function N(e){return`'${e.split("'").join("'\\''")}'`}function Tt(e={}){let t=e.installDir??"/usr/local/bin",r=e.version?`export PANTRY_VERSION=${N(e.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"';return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system",`export PANTRY_INSTALL_DIR=${t}`,r,"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",`OS=$(uname -s | tr '[:upper:]' '[:lower:]'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-\${OS}-\${ARCH}.zip"; if [ "\${PANTRY_VERSION:-latest}" = latest ]; then REL='latest/download'; else REL="download/v\${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "\${TMP}/\${ZIP}" "https://github.com/pantry-pm/pantry/releases/\${REL}/\${ZIP}"; mkdir -p ${t}; unzip -o "\${TMP}/\${ZIP}" -d ${t}; chmod +x ${t}/pantry; rm -rf "\${TMP}"`,`export PATH="${t}:$PATH"`,"mkdir -p /opt/pantry"]}function Ve(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function it(e){if(e.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(e)].map(N).join(" ")})`]}function Po(e){return[...new Set(e)].flatMap((t)=>[`(cd /opt/pantry && pantry start ${N(t)})`,`(cd /opt/pantry && pantry enable ${N(t)})`])}var m="/etc/mail",g="mail-server",F="mail",Y=`${R}/pantry/.bin`;function h(e){return`'${String(e).split("'").join("'\\''")}'`}function P(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function Te(e){return[e.version?`${U.mail}@${e.version}`:U.mail]}function K(e,t){return`${m}/dkim/${t}.${e.dkim.selector}.pem`}function se(e){return`${e.storagePath}/smtp.db`}function ge(e){let t=["# Generated by ts-cloud. Edits are overwritten on the next deploy —","# change `services.mail` in the cloud config instead.","","[server]",`host = ${P(e.bindAddress)}`,`port = ${e.ports.smtp}`,`hostname = ${P(e.hostname)}`];if(e.domains.length>0)t.push(`local_domains = ${P(e.domains.join(", "))}`);if(e.mode==="catcher")t.push("catch_all = true");if(t.push(`max_message_size = ${e.maxMessageSize}`,"","[tls]",`enabled = ${e.tls.enabled}`),e.tls.certPath)t.push(`cert_path = ${P(e.tls.certPath)}`);if(e.tls.keyPath)t.push(`key_path = ${P(e.tls.keyPath)}`);if(t.push("","[auth]",`enabled = ${e.mode==="server"}`,"","[antispam]",`dnsbl = ${e.spam.dnsbl}`,`dnsbl_reject = ${e.spam.dnsblReject}`,`greylist = ${e.spam.greylist}`,`spam_filter = ${e.spam.enabled}`,`junk_score = ${e.spam.junkScore}`,`reject_score = ${e.spam.rejectScore}`,"","[dkim]",`rotation_enabled = ${e.dkim.enabled&&e.dkim.rotate}`,`rotation_interval_days = ${e.dkim.rotateIntervalDays}`,"","[acme]",`enabled = ${e.tls.acme}`),e.tls.acmeEmail)t.push(`email = ${P(e.tls.acmeEmail)}`);if(t.push("","[webhook]",`enabled = ${!!e.webhookUrl}`),e.webhookUrl)t.push(`url = ${P(e.webhookUrl)}`);return t.push(""),t.join(`
+import{H,Fr}from"./chunk-9bmaq8q7.js";function W(e,t){return`/var/www/${e}-${t}`}var me=new Set(["laravel","php","statamic","wordpress"]);function ki(e){return e.type!=null&&me.has(e.type)}function Bs(e){let t=e.proxyTo;if(t==null)return[];return(Array.isArray(t)?t:[t]).map((s)=>String(s).trim()).filter((s)=>s.length>0)}function fe(e){return Bs(e).length>0}function re(e){if(e.deploy)return e.deploy;if(ki(e))return"server";if(e.start)return"server";return"bucket"}function A(e){if(e.redirect)return"redirect";if(fe(e))return"proxy";if(ki(e))return"server-php";if(re(e)==="bucket")return"bucket";return e.start?"server-app":"server-static"}function Io(e){return e.infrastructure?.compute!=null||Boolean(e.cloud?.attachTo?.trim())}function Fs(e,t={}){let r=[],s=[],o=e.sites||{},n=Io(e),l=Fr(e);if(l)r.push(l);let p=new Map;for(let[c,i]of Object.entries(o)){if(!i)continue;let f=re(i),C=A(i);if(C==="redirect"){if(!i.domain)r.push(`Site '${c}' is a redirect site but has no \`domain\` to redirect from.`);if(!(typeof i.redirect==="string"?i.redirect:i.redirect?.to))r.push(`Site '${c}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);if(!n)r.push(`Site '${c}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);let a=[];if(i.start)a.push("start");if(i.root)a.push("root");if(i.proxyTo)a.push("proxyTo");if(a.length>0)s.push(`Site '${c}' is a redirect site but also sets ${a.join(", ")}. These are ignored.`);continue}if(C==="proxy"){if(!i.domain)r.push(`Site '${c}' is a proxy site but has no \`domain\` to route from.`);if(!n)r.push(`Site '${c}' is a proxy site but no \`infrastructure.compute\` is configured to host the gateway that forwards it.`);let u=[];if(i.start)u.push("start");if(i.root)u.push("root");if(typeof i.port==="number")u.push("port");if(i.build)u.push("build");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)s.push(`Site '${c}' sets \`proxyTo\`, so ts-cloud ships and supervises nothing for it. ${u.join(", ")} ${u.length===1?"is":"are"} ignored — remove ${u.length===1?"it":"them"}, or drop \`proxyTo\` to let ts-cloud own the service.`);continue}if(f==="server"&&!i.start&&!i.root){r.push(`Site '${c}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);continue}if(C==="server-php"){if(!n)r.push(`Site '${c}' is a PHP site (type:'${i.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);if(!i.repository?.url)r.push(`Site '${c}' is a PHP site (type:'${i.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`)}else if(C==="server-app"){if(!n)r.push(`Site '${c}' deploys to a server (deploy:'server'${i.deploy?"":" inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);if(typeof i.port==="number"){let u=t.occupiedPorts?.get(i.port);if(u)r.push(`Site '${c}' wants port ${i.port}, which project '${u}' already serves on this box. Attached projects share one port namespace. Give '${c}' a free port, or let the attach allocate one.`);let a=p.get(i.port);if(a)r.push(`Sites '${a}' and '${c}' both use port ${i.port}. Server apps sharing a box must use distinct ports.`);else p.set(i.port,c)}}else if(C==="server-static"){if(!i.root)r.push(`Site '${c}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);if(!n)r.push(`Site '${c}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`)}else{if(!i.root)r.push(`Site '${c}' deploys to a bucket but has no \`root\` directory to upload.`);let u=[];if(i.start)u.push("start");if(typeof i.port==="number")u.push("port");if(i.preStart&&i.preStart.length>0)u.push("preStart");if(u.length>0)s.push(`Site '${c}' deploys to a bucket but sets server-only field(s): ${u.join(", ")}. These are ignored. Set deploy:'server' to use them.`)}}return{errors:r,warnings:s}}function js(e){let t=A(e);return t!=="bucket"&&t!=="redirect"&&t!=="proxy"}function Wc(e){return A(e)==="bucket"}function Kc(e,t){if(H(e)==="serverless")return!0;let r=Object.entries(e.sites??{}).filter(([,o])=>o!=null),s=t?r.filter(([o])=>o===t):r;if(s.length===0)return!0;return!s.every(([,o])=>{let n=A(o);return n==="redirect"||n==="proxy"})}var U={php:"php.net",nginx:"nginx.org",composer:"getcomposer.org",mysql:"mysql.com",mariadb:"mariadb.com/server",postgres:"postgresql.org",vitess:"vitess.io",etcd:"etcd.io",redis:"redis.io",memcached:"memcached.org",meilisearch:"meilisearch.com",mail:"github.com/mail-os/mail",git:"git-scm.com",certbot:"certbot.eff.org",bun:"bun.sh",node:"nodejs.org",deno:"deno.land"};var R="/opt/pantry";function N(e){return`'${e.split("'").join("'\\''")}'`}function Tt(e={}){let t=e.installDir??"/usr/local/bin",r=e.version?`export PANTRY_VERSION=${N(e.version)}`:'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"';return["export DEBIAN_FRONTEND=noninteractive","export PANTRY_SERVICE_SCOPE=system",`export PANTRY_INSTALL_DIR=${t}`,r,"command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)","command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",`OS=$(uname -s | tr '[:upper:]' '[:lower:]'); ARCH=$(uname -m); case "$ARCH" in x86_64|amd64) ARCH=x64 ;; arm64|aarch64) ARCH=arm64 ;; esac; ZIP="pantry-\${OS}-\${ARCH}.zip"; if [ "\${PANTRY_VERSION:-latest}" = latest ]; then REL='latest/download'; else REL="download/v\${PANTRY_VERSION}"; fi; TMP=$(mktemp -d); curl -fsSL -o "\${TMP}/\${ZIP}" "https://github.com/pantry-pm/pantry/releases/\${REL}/\${ZIP}"; mkdir -p ${t}; unzip -o "\${TMP}/\${ZIP}" -d ${t}; chmod +x ${t}/pantry; rm -rf "\${TMP}"`,`export PATH="${t}:$PATH"`,"mkdir -p /opt/pantry"]}function Ve(){return'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true'}function it(e){if(e.length===0)return[];return[`(cd /opt/pantry && pantry install ${[...new Set(e)].map(N).join(" ")})`]}function Po(e){return[...new Set(e)].flatMap((t)=>[`(cd /opt/pantry && pantry start ${N(t)})`,`(cd /opt/pantry && pantry enable ${N(t)})`])}var m="/etc/mail",g="mail-server",F="mail",Y=`${R}/pantry/.bin`;function h(e){return`'${String(e).split("'").join("'\\''")}'`}function P(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function Te(e){return[e.version?`${U.mail}@${e.version}`:U.mail]}function K(e,t){return`${m}/dkim/${t}.${e.dkim.selector}.pem`}function se(e){return`${e.storagePath}/smtp.db`}function ge(e){let t=["# Generated by ts-cloud. Edits are overwritten on the next deploy —","# change `services.mail` in the cloud config instead.","","[server]",`host = ${P(e.bindAddress)}`,`port = ${e.ports.smtp}`,`hostname = ${P(e.hostname)}`];if(e.domains.length>0)t.push(`local_domains = ${P(e.domains.join(", "))}`);if(e.mode==="catcher")t.push("catch_all = true");if(t.push(`max_message_size = ${e.maxMessageSize}`,"","[tls]",`enabled = ${e.tls.enabled}`),e.tls.certPath)t.push(`cert_path = ${P(e.tls.certPath)}`);if(e.tls.keyPath)t.push(`key_path = ${P(e.tls.keyPath)}`);if(t.push("","[auth]",`enabled = ${e.mode==="server"}`,"","[antispam]",`dnsbl = ${e.spam.dnsbl}`,`dnsbl_reject = ${e.spam.dnsblReject}`,`greylist = ${e.spam.greylist}`,`spam_filter = ${e.spam.enabled}`,`junk_score = ${e.spam.junkScore}`,`reject_score = ${e.spam.rejectScore}`,"","[dkim]",`rotation_enabled = ${e.dkim.enabled&&e.dkim.rotate}`,`rotation_interval_days = ${e.dkim.rotateIntervalDays}`,"","[acme]",`enabled = ${e.tls.acme}`),e.tls.acmeEmail)t.push(`email = ${P(e.tls.acmeEmail)}`);if(t.push("","[webhook]",`enabled = ${!!e.webhookUrl}`),e.webhookUrl)t.push(`url = ${P(e.webhookUrl)}`);return t.push(""),t.join(`
 `)}function he(e){let t=["# Generated by ts-cloud. See /etc/mail/config.toml for the rest.",`SMTP_HOSTNAME=${e.hostname}`,`SMTP_DB_PATH=${se(e)}`,`SMTP_DNSBL_REJECT=${e.spam.dnsblReject}`,`SMTP_DELIVERY_METHOD=${e.delivery==="ses"?"ses":"direct"}`];if(e.delivery==="ses")t.push(`SMTP_SES_REGION=${e.sesRegion}`);if(e.ports.submission)t.push(`SUBMISSION_PORT=${e.ports.submission}`);if(e.ports.submissions)t.push(`SMTPS_PORT=${e.ports.submissions}`);if(e.ports.imap)t.push("IMAP_ENABLED=1",`IMAP_PORT=${e.ports.imap}`);if(e.webmail.enabled)t.push("SMTP_ENABLE_WEBMAIL=true",`SMTP_WEBMAIL_PORT=${e.webmail.port}`,`SMTP_WEBMAIL_TLS=${e.webmail.tls}`,`SMTP_WEBMAIL_SECURE_COOKIES=${e.webmail.secureCookies}`,`SMTP_WEBMAIL_ATTACHMENT_MAX_FILE=${e.webmail.attachmentMaxFileBytes}`,`SMTP_WEBMAIL_ATTACHMENT_MAX_TOTAL=${e.webmail.attachmentMaxTotalBytes}`,`SMTP_WEBMAIL_ATTACHMENT_MAX_COUNT=${e.webmail.attachmentMaxCount}`,`SMTP_WEBMAIL_UNDO_SEND_SECONDS=${e.webmail.undoSendSeconds}`);if(e.tls.requireForAuth)t.push("SMTP_REQUIRE_TLS_FOR_AUTH=true");if(e.dkim.enabled&&e.domains.length>0){let r=e.domains.find((o)=>o!==e.hostname)||e.hostname,s=e.domains.filter((o)=>o!==r);if(t.push(`DKIM_DOMAIN=${r}`,`DKIM_SELECTOR=${e.dkim.selector}`,`DKIM_PRIVATE_KEY_PATH=${K(e,r)}`),s.length>0){let o=s.map((n)=>`${n}:${e.dkim.selector}:${K(e,n)}`);t.push(`DKIM_EXTRA_KEYS=${o.join(",")}`)}}return t.push(""),t.join(`
 `)}function ye(e){let t=[e.ports.smtp,e.ports.submission,e.ports.submissions,e.ports.imap,e.ports.imaps].some((r)=>typeof r==="number"&&r<1024);return["[Unit]","Description=Mail server (SMTP/IMAP + webmail)","After=network-online.target","Wants=network-online.target","","[Service]","Type=simple",`User=${g}`,`Group=${g}`,`WorkingDirectory=${e.storagePath}`,`EnvironmentFile=${m}/mail.env`,...e.tls.systemCredentials?[`LoadCredential=server.crt:${e.tls.systemCredentials.certPath}`,`LoadCredential=server.key:${e.tls.systemCredentials.keyPath}`]:[],`Environment="PATH=${Y}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"`,`ExecStart=${Y}/mail serve --config ${m}/config.toml`,"Restart=always","RestartSec=5","LimitNOFILE=65536",...t?["AmbientCapabilities=CAP_NET_BIND_SERVICE","CapabilityBoundingSet=CAP_NET_BIND_SERVICE"]:[],"NoNewPrivileges=true","PrivateTmp=true","ProtectSystem=strict","ProtectHome=true","ProtectKernelTunables=true","ProtectKernelModules=true","ProtectControlGroups=true",`ReadWritePaths=${e.storagePath} ${m}`,"","[Install]","WantedBy=multi-user.target",""].join(`
-`)}function Ee(e){if(!e.dkim.enabled||e.domains.length===0)return[];let t=[`mkdir -p ${m}/dkim`];for(let r of e.domains){let s=K(e,r);t.push(`if [ ! -f ${h(s)} ]; then openssl genrsa -out ${h(s)} 2048; fi`,`chmod 0600 ${h(s)}`,`echo "DKIM ${e.dkim.selector}._domainkey.${r} IN TXT v=DKIM1; k=rsa; p=$(openssl rsa -in ${h(s)} -pubout -outform PEM 2>/dev/null | grep -v '^-----' | tr -d '\\n')"`)}return t.push(`chown -R ${g}:${g} ${m}/dkim`),t}function ve(e){if(e.accounts.length===0)return[];let t=(r)=>`runuser -u ${g} -- env SMTP_DB_PATH="$TS_CLOUD_MAIL_DB" ${Y}/mail user:local ${r}`;return e.accounts.flatMap((r)=>[t(`create ${h(r.address)} ${h(r.password)} ${h(r.address)}`),...r.passwordPolicy==="managed"?[t(`change-password ${h(r.address)} ${h(r.password)}`)]:[]])}function Do(e){if(!e.enabled)return[];return[...it(Te(e)),`id -u ${g} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin ${g}`,`mkdir -p ${e.storagePath} ${m}`,`chown -R ${g}:${g} ${e.storagePath}`,`TS_CLOUD_MAIL_DB="$(grep -sE '^SMTP_DB_PATH=' ${m}/mail.env | head -1 | cut -d= -f2- || true)"`,`[ -n "$TS_CLOUD_MAIL_DB" ] || TS_CLOUD_MAIL_DB=${h(se(e))}`,`cat > ${m}/config.toml <<'TS_CLOUD_MAIL_CONF_EOF'`,ge(e),"TS_CLOUD_MAIL_CONF_EOF",`cat > ${m}/mail.env <<'TS_CLOUD_MAIL_ENV_EOF'`,he(e),"TS_CLOUD_MAIL_ENV_EOF",`sed -i "s|^SMTP_DB_PATH=.*|SMTP_DB_PATH=$TS_CLOUD_MAIL_DB|" ${m}/mail.env`,`chmod 0640 ${m}/mail.env`,`chown root:${g} ${m}/mail.env`,...Ee(e),`cat > /etc/systemd/system/${F}.service <<'TS_CLOUD_MAIL_UNIT_EOF'`,ye(e),"TS_CLOUD_MAIL_UNIT_EOF",...e.tls.systemCredentials?["cat > /etc/systemd/system/ts-cloud-mail-tls.path <<'TS_CLOUD_MAIL_TLS_PATH'","[Unit]","Description=Refresh mail after gateway certificate renewal","[Path]",`PathChanged=${e.tls.systemCredentials.certPath}`,`PathChanged=${e.tls.systemCredentials.keyPath}`,"Unit=ts-cloud-mail-tls.service","[Install]","WantedBy=multi-user.target","TS_CLOUD_MAIL_TLS_PATH","cat > /etc/systemd/system/ts-cloud-mail-tls.service <<'TS_CLOUD_MAIL_TLS_UNIT'","[Unit]","Description=Load renewed mail TLS credentials","[Service]","Type=oneshot","ExecStart=/usr/bin/systemctl restart mail.service","TS_CLOUD_MAIL_TLS_UNIT"]:["systemctl disable --now ts-cloud-mail-tls.path 2>/dev/null || true"],"systemctl daemon-reload",...e.tls.systemCredentials?["systemctl enable --now ts-cloud-mail-tls.path"]:[],`systemctl enable ${F}`,`systemctl restart ${F}`,...ve(e)]}var T=`${R}/pantry/.bin`,z=15306,j=15991,w=15999,ne=16101,B=2379,y="/var/lib/vitess",Q=100;function Ni(e){return e===!0||typeof e==="object"&&e!==null}function Ce(e){return typeof e==="object"&&e!==null?e:{}}function _(e){return`'${String(e).split("'").join("'\\''")}'`}function Pe(e){let r=[e.version?`vitess.io@${e.version}`:"vitess.io"];if(e.mode!=="combo"&&!e.etcdEndpoint)r.push("etcd.io");return r.push("mysql.com@8.0.43"),r}var S="vitess",Re=`${T}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,ce="/usr/local/lib/vitess",J=new Map;function X(e){return`${ce}/${e}.sh`}function L(e,t){return J.set(e,De(t)),`/bin/sh ${X(e)}`}function oe(){let e=[`mkdir -p ${ce}`];for(let[t,r]of J)e.push(`cat > ${X(t)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,r,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${X(t)}`);return e}function De(e){return["#!/bin/sh","set -e",`cd ${R}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${T}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${T}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${e.join(" ")}`].join(`
-`)}function b(e){let t=["[Unit]",`Description=${e.description}`,`After=network.target${e.after?.length?` ${e.after.join(" ")}`:""}`];if(e.requires?.length)t.push(`Requires=${e.requires.join(" ")}`);return t.push("","[Service]","Type=simple",`User=${S}`,`Group=${S}`,`Environment="PATH=${Re}"`,`Environment="VTDATAROOT=${y}"`,...Object.entries(e.environment??{}).map(([r,s])=>`Environment="${r}=${s}"`),...(e.execStartPre??[]).map((r)=>`ExecStartPre=${r}`),`ExecStart=${e.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),t.join(`
-`)}function ie(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,t,"TS_CLOUD_VITESS_UNIT_EOF"]}function Le(e){let t=e.cell??"zone1",r=e.vtgatePort??z,o=`${((e.keyspaces?.length)?e.keyspaces:[{name:"app"}]).map((n)=>{let l=(n.sharded?["-80","80-"]:["0"]).map((p)=>`shards:{name:"${p}"}`).join(" ");return`keyspaces:{name:"${n.name}" ${l}}`}).join(" ")} cells:"${t}"`;return b({description:"Vitess (vtcombo, single-process development stack)",execStart:L("vtcombo",[`${T}/vtcombo`,`--cell ${t}`,`--proto-topo ${_(o)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${j}`,`--grpc-port ${w}`])})}function be(){return b({description:"etcd (Vitess topology store)",execStart:L("etcd",[`${T}/etcd`,`--data-dir ${y}/etcd`,`--listen-client-urls http://127.0.0.1:${B}`,`--advertise-client-urls http://127.0.0.1:${B}`]),execStartPre:[`+/bin/mkdir -p ${y}/etcd`,`+/bin/chown ${S}:${S} ${y}/etcd`]})}function Z(e){return["--topo-implementation etcd2",`--topo-global-server-address ${e.etcdEndpoint??`http://127.0.0.1:${B}`}`,"--topo-global-root /vitess/global"]}function Ae(e){let t=!e.etcdEndpoint;return b({description:"Vitess vtctld (control plane)",after:t?["vitess-etcd.service"]:[],requires:t?["vitess-etcd.service"]:[],execStart:L("vtctld",[`${T}/vtctld`,...Z(e),`--cell ${e.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${w}`,`--port ${w+1}`])})}function Oe(e,t,r){let s=e.cell??"zone1";return b({description:`Vitess vttablet (${t}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:L("vttablet",[`${T}/vttablet`,...Z(e),`--tablet-path ${s}-${String(Q).padStart(10,"0")}`,`--init-keyspace ${t}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${_("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${ne}`,`--grpc-port ${ne+1}`,`--db-port ${e.mysqlPort??3306}`,`--mycnf-mysql-port ${e.mysqlPort??3306}`])})}function Ue(e){return b({description:"Vitess mysqlctld (managed mysqld)",execStart:L("mysqlctld",[`${T}/mysqlctld`,`--tablet-uid ${Q}`,`--mysql-port ${e.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${y}`,`+/bin/chown ${S}:${S} ${y}`]})}var le="/etc/vitess/auth.json",x="/var/lib/vitess/vtgate-auth.sha256";function xe(e){let t=e.username??"vitess",r=e.password??"";return["mkdir -p /etc/vitess",'VTESS_AUTH_TMP="$(mktemp)"',`cat > "$VTESS_AUTH_TMP" <<'TS_CLOUD_VITESS_AUTH_EOF'`,JSON.stringify({[t]:[{Password:r,UserData:t}]}),"TS_CLOUD_VITESS_AUTH_EOF",`VTESS_VTGATE_AUTH_SHA="$(sha256sum "$VTESS_AUTH_TMP" | awk '{print $1}')"`,"VTESS_VTGATE_AUTH_CHANGED=1",`if [ -f ${x} ] && [ "$(cat ${x})" = "$VTESS_VTGATE_AUTH_SHA" ]; then VTESS_VTGATE_AUTH_CHANGED=0; fi`,`install -o ${S} -g ${S} -m 0600 "$VTESS_AUTH_TMP" ${le}`,'rm -f "$VTESS_AUTH_TMP"']}function ke(e){let t=e.cell??"zone1";return b({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:L("vtgate",[`${T}/vtgate`,...Z(e),`--cell ${t}`,`--cells-to-watch ${t}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${_("grpc-vtgateservice")}`,`--mysql-server-port ${e.vtgatePort??z}`,`--mysql-server-bind-address ${e.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${le}`,`--port ${j}`,`--grpc-port ${j+1}`])})}function Ie(e){let t=e.cell??"zone1",r=e.etcdEndpoint??`http://127.0.0.1:${B}`,s=`${T}/vtctldclient --server 127.0.0.1:${w}`,o=[`for i in $(seq 1 30); do ${s} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${s} GetCellInfoNames 2>/dev/null | grep -qx ${_(t)}; then`,`  ${s} AddCellInfo --root ${_(`/vitess/${t}`)} --server-address ${_(r)} ${_(t)}`,"fi"];for(let n of e.keyspaces??[]){let l=n.sharded?" --sharded":"";o.push(`if ! ${s} GetKeyspace ${_(n.name)} >/dev/null 2>&1; then`,`  ${s} CreateKeyspace${l} ${_(n.name)}`,"fi");let p=`${t}-${String(Q).padStart(10,"0")}`;for(let c of n.sharded?["-80","80-"]:["0"]){let i=`${n.name}/${c}`;o.push("for i in $(seq 1 90); do",`  if ${s} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${s} PlannedReparentShard ${_(i)} --new-primary ${_(p)} >/dev/null 2>&1 && break`,`  ${s} InitShardPrimary --force ${_(i)} ${_(p)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${s} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${i}" >&2; exit 1`,"fi")}o.push(`${s} RebuildKeyspaceGraph ${_(n.name)} >/dev/null`)}return o}function ae(e){let t=e.vtgatePort??z;return["for i in $(seq 1 60); do",`  if (cd ${R} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${_(e.password??"")} ${T}/mysql -h 127.0.0.1 -P ${t} -u ${_(e.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${t}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${t}" >&2`,"exit 1"]}function ko(e){if(!Ni(e))return[];let t=Ce(e),r=t.mode==="combo";J.clear();let s=['if [ "$(uname -m)" != "x86_64" ]; then','  echo "vitess: Vitess publishes only x86_64 release tarballs; this box is $(uname -m). Drop managedServices.vitess or use an x86_64 host." >&2',"  exit 1","fi",...it(Pe(t)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${T}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${S} >/dev/null 2>&1 || useradd --system --home-dir ${y} --shell /usr/sbin/nologin ${S}`,`mkdir -p ${y}`,`chown -R ${S}:${S} ${y}`];if(r)return s.push(...ie("vitess-vtcombo",Le(t)),...oe(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...ae(t)),s;s.push(...xe(t));let o=[];if(!t.etcdEndpoint)o.push(["vitess-etcd",be()]);o.push(["vitess-vtctld",Ae(t)],["vitess-mysqlctld",Ue(t)],["vitess-vtgate",ke(t)]);for(let n of t.keyspaces??[])for(let l of n.sharded?["-80","80-"]:["0"])o.push([`vitess-vttablet-${n.name}-${l.replace(/-/g,"x")}`,Oe(t,n.name,l)]);for(let[n,l]of o)s.push(...ie(n,l));s.push(...oe()),s.push("systemctl daemon-reload");for(let[n]of o)s.push(`systemctl enable --now ${n}.service`);return s.push(`if [ "$VTESS_VTGATE_AUTH_CHANGED" = 1 ]; then systemctl restart vitess-vtgate.service; printf '%s\\n' "$VTESS_VTGATE_AUTH_SHA" > ${x}; chown ${S}:${S} ${x}; chmod 0600 ${x}; fi`,...Ie(t),...ae(t)),s}var Me=new Set(["singlestore","vitess"]);function gn(e){if(e?.engine&&Me.has(e.engine))return!1;return!e?.host||e.host==="127.0.0.1"||e.host==="localhost"}function Et(e,t="psql"){let r=e?.port??5432;if(gn(e))return`${t} -p ${r} -U postgres`;let s=e?.username||"postgres";return`${e?.password?`PGPASSWORD='${e.password.replace(/'/g,"'\\''")}' `:""}${t} -h ${e.host} -p ${r} -U ${s} -w`}function E(e){return e===!0||typeof e==="object"&&e!=null}function Ne(e){let t=[],r=[];if(E(e.mysql))t.push(typeof e.mysql==="object"&&e.mysql.version?`mysql.com@${e.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(E(e.mariadb))t.push(U.mariadb),r.push("mariadb");if(E(e.postgres))t.push("postgresql.org"),r.push("postgres");if(E(e.redis))t.push("redis.io"),r.push("redis");if(E(e.memcached))t.push("memcached.org"),r.push("memcached");if(E(e.meilisearch))t.push("meilisearch.com"),r.push("meilisearch");return{packages:t,services:r}}function No(e={},t={}){let r=Ne(e),s=ko(e.vitess),o=t.mail?Do(t.mail):[];if(r.packages.length===0)return[...s,...o];return[...it(r.packages),...Po(r.services),...s,...o]}function wt(e,t={}){if(e?.requireLocalPasswordAuth&&(e.engine!=="postgres"||!gn(e)||!e.name||!e.username||!e.password||e.users?.some((a)=>!a.password)))throw Error("Password authentication requires a named local PostgreSQL database and nonempty login passwords");if(!e?.name)return[];if(!gn(e))return[];let r=e.name,s=e.username||r,o=e.password||"",n=E(t.postgres)||e.engine==="postgres",l=E(t.mariadb)||e.engine==="mariadb",p=E(t.mysql)||e.engine==="mysql";if(n&&!p&&!l){let a=(d)=>`"${d.replace(/"/g,'""')}"`,D=(d)=>`'${d.replace(/'/g,"''")}'`,O=(d,M)=>[...e.requireLocalPasswordAuth?["SET password_encryption = 'scram-sha-256';"]:[],"DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${D(d)}) THEN`,`    CREATE ROLE ${a(d)} LOGIN PASSWORD ${D(M)};`,"  ELSE",`    ALTER ROLE ${a(d)} LOGIN PASSWORD ${D(M)};`,"  END IF;","END $$;"],k=(d)=>{let M=d.databases&&d.databases.length>0?d.databases:[r],G=[];for(let q of M)if(d.access==="readonly")G.push(`GRANT CONNECT ON DATABASE ${a(q)} TO ${a(d.username)};`,`\\connect ${a(q)}`,`GRANT USAGE ON SCHEMA public TO ${a(d.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${a(d.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${a(s)} IN SCHEMA public GRANT SELECT ON TABLES TO ${a(d.username)};`,"\\connect postgres");else G.push(`GRANT ALL PRIVILEGES ON DATABASE ${a(q)} TO ${a(d.username)};`);return G},I=e.users||[],Se=e.port??5432;return[Ve(),`for i in $(seq 1 30); do pg_isready -p ${Se} -q && break; sleep 2; done`,`${Et(e)}${e.requireLocalPasswordAuth?" -v ON_ERROR_STOP=1":""} <<'TS_CLOUD_PG_EOF'`,...O(s,o),`SELECT 'CREATE DATABASE ${a(r)} OWNER ${a(s)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${D(r)})\\gexec`,...I.flatMap((d)=>[...O(d.username,d.password),...k(d)]),"TS_CLOUD_PG_EOF",...e.requireLocalPasswordAuth?[`TS_CLOUD_PG_HBA=$(${Et(e)} -Atc 'SHOW hba_file')`,'case "$TS_CLOUD_PG_HBA" in /*) ;; *) echo "Invalid PostgreSQL authentication path" >&2; exit 1 ;; esac','[ -f "$TS_CLOUD_PG_HBA.before-ts-cloud-password-auth" ] || cp -p "$TS_CLOUD_PG_HBA" "$TS_CLOUD_PG_HBA.before-ts-cloud-password-auth"','TS_CLOUD_PG_AUTH=$(mktemp "$TS_CLOUD_PG_HBA.ts-cloud.XXXXXXXX")',"{","  printf '%s\\n' '# BEGIN ts-cloud password authentication' 'host all all 127.0.0.1/32 scram-sha-256' 'host all all ::1/128 scram-sha-256' 'host replication all 127.0.0.1/32 scram-sha-256' 'host replication all ::1/128 scram-sha-256' '# END ts-cloud password authentication'",`  sed '/^# BEGIN ts-cloud password authentication$/,/^# END ts-cloud password authentication$/d' "$TS_CLOUD_PG_HBA"`,'} > "$TS_CLOUD_PG_AUTH"','chown --reference="$TS_CLOUD_PG_HBA" "$TS_CLOUD_PG_AUTH"','chmod --reference="$TS_CLOUD_PG_HBA" "$TS_CLOUD_PG_AUTH"','mv -f "$TS_CLOUD_PG_AUTH" "$TS_CLOUD_PG_HBA"',`${Et(e)} -v ON_ERROR_STOP=1 -c 'SELECT pg_reload_conf()'`]:[],...we(e)]}let c=l?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",i=(a)=>a.replace(/`/g,"``"),f=(a)=>a.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),C=(a)=>{let D=a.databases&&a.databases.length>0?a.databases:[r],O=a.access==="readonly"?"SELECT":"ALL PRIVILEGES",k=[`CREATE USER IF NOT EXISTS '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`CREATE USER IF NOT EXISTS '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`];for(let I of D)k.push(`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'%';`,`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'localhost';`);return k},u=e.users||[];return[Ve(),`for i in $(seq 1 30); do mysqladmin --socket=${c} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${c} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${i(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...C({username:s,password:o}),...u.flatMap(C),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function we(e){return[`${Et(e)} -tA <<'TS_CLOUD_PG_CAP_EOF' || true`,"\\set QUIET on","SELECT CASE WHEN used::float / NULLIF(cap, 0) >= 0.8","  THEN '[ts-cloud] postgres is at ' || used || '/' || cap || ' connections on this server.'","       || ' Raise max_connections (ALTER SYSTEM SET max_connections = ...; then restart) or'","       || ' set idle_session_timeout so abandoned pools are reclaimed.'","  ELSE NULL END","FROM (SELECT (SELECT count(*) FROM pg_stat_activity) AS used,","             (SELECT setting::int FROM pg_settings WHERE name = 'max_connections') AS cap) c","WHERE CASE WHEN used::float / NULLIF(cap, 0) >= 0.8 THEN true ELSE false END;","SELECT '[ts-cloud]   ' || coalesce(datname, '(background)') || ': ' || count(*) || ' connection(s), oldest idle ' ||","       coalesce(round(extract(epoch from max(now() - state_change)) / 60)::text || 'm', 'n/a')","FROM pg_stat_activity","WHERE (SELECT count(*)::float / NULLIF((SELECT setting::int FROM pg_settings WHERE name = 'max_connections'), 0) FROM pg_stat_activity) >= 0.8","GROUP BY datname ORDER BY count(*) DESC;","TS_CLOUD_PG_CAP_EOF"]}function Jc(e){if(!e?.name)return{};let t=e.engine==="singlestore",r=e.engine==="vitess",s=e.engine==="postgres"?"pgsql":t?"singlestore":r?"vitess":"mysql",o=e.port??(e.engine==="postgres"?5432:r?15306:3306),n={DB_CONNECTION:s,DB_HOST:e.host||"127.0.0.1",DB_PORT:String(o),DB_DATABASE:e.name};if(e.username)n.DB_USERNAME=e.username;if(e.password)n.DB_PASSWORD=e.password;if((t||r)&&e.ssl!==!1)n.DB_SSL="true";return n}var V="/var/backups/ts-cloud",ee="/etc/ts-cloud/backups.config.ts",pe="/etc/cron.d/ts-cloud-backups",fn="/usr/local/bin/ts-cloud-backup.sh";function Be(e){if(!e.name)return null;if(!["postgres","mysql","mariadb"].includes(e.engine||""))throw Error("Unsupported scheduled SQL backup engine");return JSON.stringify({type:e.engine==="postgres"?"postgresql":"mysql",name:e.name,connection:{hostname:e.host||"127.0.0.1",port:e.port??(e.engine==="postgres"?5432:3306),database:e.name,username:e.username||e.name,password:e.password||"",ssl:!1},includeSchema:!0,includeData:!0})}function He(e,t){let r=e?Be(e):null,s=t.bucket?{type:"s3",bucket:t.bucket,prefix:t.prefix||"db-backups",...t.endpoint?{endpoint:t.endpoint}:{},...t.region?{region:t.region}:{},keepDays:t.retentionDays??30,optional:!1,...t.encryptionKey?{encryption:{keyEnv:"TS_CLOUD_BACKUP_ENCRYPTION_KEY"}}:{}}:void 0,o={verbose:!0,outputPath:V,retention:{count:t.retentionCount??5,maxAge:t.retentionDays??30},databases:[],files:t.files||[],destinations:s?[s]:[]};return["import type { BackupConfig } from 'ts-backups'",`const config: BackupConfig = ${JSON.stringify(o,null,2)}`,`config.databases = [
+`)}function Ee(e){if(!e.dkim.enabled||e.domains.length===0)return[];let t=[`mkdir -p ${m}/dkim`];for(let r of e.domains){let s=K(e,r);t.push(`if [ ! -f ${h(s)} ]; then openssl genrsa -out ${h(s)} 2048; fi`,`chmod 0600 ${h(s)}`,`echo "DKIM ${e.dkim.selector}._domainkey.${r} IN TXT v=DKIM1; k=rsa; p=$(openssl rsa -in ${h(s)} -pubout -outform PEM 2>/dev/null | grep -v '^-----' | tr -d '\\n')"`)}return t.push(`chown -R ${g}:${g} ${m}/dkim`),t}function ve(e){if(e.accounts.length===0)return[];let t=(r)=>`runuser -u ${g} -- env SMTP_DB_PATH="$TS_CLOUD_MAIL_DB" ${Y}/mail user:local ${r}`;return e.accounts.flatMap((r)=>[t(`create ${h(r.address)} ${h(r.password)} ${h(r.address)}`),...r.passwordPolicy==="managed"?[t(`change-password ${h(r.address)} ${h(r.password)}`)]:[]])}function Do(e){if(!e.enabled)return[];return[...it(Te(e)),`id -u ${g} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin ${g}`,`mkdir -p ${e.storagePath} ${m}`,`chown -R ${g}:${g} ${e.storagePath}`,`TS_CLOUD_MAIL_DB="$(grep -sE '^SMTP_DB_PATH=' ${m}/mail.env | head -1 | cut -d= -f2- || true)"`,`[ -n "$TS_CLOUD_MAIL_DB" ] || TS_CLOUD_MAIL_DB=${h(se(e))}`,`cat > ${m}/config.toml <<'TS_CLOUD_MAIL_CONF_EOF'`,ge(e),"TS_CLOUD_MAIL_CONF_EOF",`cat > ${m}/mail.env <<'TS_CLOUD_MAIL_ENV_EOF'`,he(e),"TS_CLOUD_MAIL_ENV_EOF",`sed -i "s|^SMTP_DB_PATH=.*|SMTP_DB_PATH=$TS_CLOUD_MAIL_DB|" ${m}/mail.env`,`chmod 0640 ${m}/mail.env`,`chown root:${g} ${m}/mail.env`,...Ee(e),`cat > /etc/systemd/system/${F}.service <<'TS_CLOUD_MAIL_UNIT_EOF'`,ye(e),"TS_CLOUD_MAIL_UNIT_EOF",...e.tls.systemCredentials?["cat > /etc/systemd/system/ts-cloud-mail-tls.path <<'TS_CLOUD_MAIL_TLS_PATH'","[Unit]","Description=Refresh mail after gateway certificate renewal","[Path]",`PathChanged=${e.tls.systemCredentials.certPath}`,`PathChanged=${e.tls.systemCredentials.keyPath}`,"Unit=ts-cloud-mail-tls.service","[Install]","WantedBy=multi-user.target","TS_CLOUD_MAIL_TLS_PATH","cat > /etc/systemd/system/ts-cloud-mail-tls.service <<'TS_CLOUD_MAIL_TLS_UNIT'","[Unit]","Description=Load renewed mail TLS credentials","[Service]","Type=oneshot","ExecStart=/usr/bin/systemctl restart mail.service","TS_CLOUD_MAIL_TLS_UNIT"]:["systemctl disable --now ts-cloud-mail-tls.path 2>/dev/null || true"],"systemctl daemon-reload",...e.tls.systemCredentials?["systemctl enable --now ts-cloud-mail-tls.path"]:[],`systemctl enable ${F}`,`systemctl restart ${F}`,...ve(e)]}var T=`${R}/pantry/.bin`,z=15306,j=15991,w=15999,ne=16101,B=2379,y="/var/lib/vitess",Q=100;function Ni(e){return e===!0||typeof e==="object"&&e!==null}function Ce(e){return typeof e==="object"&&e!==null?e:{}}function _(e){return`'${String(e).split("'").join("'\\''")}'`}function Pe(e){let r=[e.version?`vitess.io@${e.version}`:"vitess.io"];if(e.mode!=="combo"&&!e.etcdEndpoint)r.push("etcd.io");return r.push("mysql.com@8.0.43"),r}var S="vitess",Re=`${T}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,ce="/usr/local/lib/vitess",J=new Map;function X(e){return`${ce}/${e}.sh`}function b(e,t){return J.set(e,De(t)),`/bin/sh ${X(e)}`}function oe(){let e=[`mkdir -p ${ce}`];for(let[t,r]of J)e.push(`cat > ${X(t)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`,r,"TS_CLOUD_VITESS_LAUNCHER_EOF",`chmod 0755 ${X(t)}`);return e}function De(e){return["#!/bin/sh","set -e",`cd ${R}`,`PANTRY_ENV="$(pantry env 2>/dev/null | grep -E '^(export [A-Za-z_]|[A-Za-z_][A-Za-z0-9_]*=)' || true)"`,'if [ -n "$PANTRY_ENV" ]; then eval "$PANTRY_ENV"; fi',`VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${T}/mysqld 2>/dev/null)")")"`,`VTROOT="$(dirname "$(dirname "$(readlink -f ${T}/mysqlctld 2>/dev/null)")")"`,"export VT_MYSQL_ROOT VTROOT",'LD_LIBRARY_PATH="$VT_MYSQL_ROOT/lib:$VTROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"',"export LD_LIBRARY_PATH",`exec ${e.join(" ")}`].join(`
+`)}function L(e){let t=["[Unit]",`Description=${e.description}`,`After=network.target${e.after?.length?` ${e.after.join(" ")}`:""}`];if(e.requires?.length)t.push(`Requires=${e.requires.join(" ")}`);return t.push("","[Service]","Type=simple",`User=${S}`,`Group=${S}`,`Environment="PATH=${Re}"`,`Environment="VTDATAROOT=${y}"`,...Object.entries(e.environment??{}).map(([r,s])=>`Environment="${r}=${s}"`),...(e.execStartPre??[]).map((r)=>`ExecStartPre=${r}`),`ExecStart=${e.execStart}`,"Restart=always","RestartSec=5","LimitNOFILE=65535","","[Install]","WantedBy=multi-user.target"),t.join(`
+`)}function ie(e,t){return[`cat > /etc/systemd/system/${e}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,t,"TS_CLOUD_VITESS_UNIT_EOF"]}function be(e){let t=e.cell??"zone1",r=e.vtgatePort??z,o=`${((e.keyspaces?.length)?e.keyspaces:[{name:"app"}]).map((n)=>{let l=(n.sharded?["-80","80-"]:["0"]).map((p)=>`shards:{name:"${p}"}`).join(" ");return`keyspaces:{name:"${n.name}" ${l}}`}).join(" ")} cells:"${t}"`;return L({description:"Vitess (vtcombo, single-process development stack)",execStart:b("vtcombo",[`${T}/vtcombo`,`--cell ${t}`,`--proto-topo ${_(o)}`,`--mysql-server-port ${r}`,"--mysql-server-bind-address 127.0.0.1","--mysql-auth-server-impl none","--start-mysql",`--port ${j}`,`--grpc-port ${w}`])})}function Le(){return L({description:"etcd (Vitess topology store)",execStart:b("etcd",[`${T}/etcd`,`--data-dir ${y}/etcd`,`--listen-client-urls http://127.0.0.1:${B}`,`--advertise-client-urls http://127.0.0.1:${B}`]),execStartPre:[`+/bin/mkdir -p ${y}/etcd`,`+/bin/chown ${S}:${S} ${y}/etcd`]})}function Z(e){return["--topo-implementation etcd2",`--topo-global-server-address ${e.etcdEndpoint??`http://127.0.0.1:${B}`}`,"--topo-global-root /vitess/global"]}function Ae(e){let t=!e.etcdEndpoint;return L({description:"Vitess vtctld (control plane)",after:t?["vitess-etcd.service"]:[],requires:t?["vitess-etcd.service"]:[],execStart:b("vtctld",[`${T}/vtctld`,...Z(e),`--cell ${e.cell??"zone1"}`,"--service-map grpc-vtctl,grpc-vtctld",`--grpc-port ${w}`,`--port ${w+1}`])})}function Oe(e,t,r){let s=e.cell??"zone1";return L({description:`Vitess vttablet (${t}/${r})`,after:["vitess-vtctld.service","vitess-mysqlctld.service"],requires:["vitess-mysqlctld.service"],execStart:b("vttablet",[`${T}/vttablet`,...Z(e),`--tablet-path ${s}-${String(Q).padStart(10,"0")}`,`--init-keyspace ${t}`,`--init-shard ${r}`,"--init-tablet-type replica",`--service-map ${_("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,`--port ${ne}`,`--grpc-port ${ne+1}`,`--db-port ${e.mysqlPort??3306}`,`--mycnf-mysql-port ${e.mysqlPort??3306}`])})}function Ue(e){return L({description:"Vitess mysqlctld (managed mysqld)",execStart:b("mysqlctld",[`${T}/mysqlctld`,`--tablet-uid ${Q}`,`--mysql-port ${e.mysqlPort??3306}`,'--init-db-sql-file "$VTROOT/config/init_db.sql"',"--wait-time 2m"]),execStartPre:[`+/bin/mkdir -p ${y}`,`+/bin/chown ${S}:${S} ${y}`]})}var le="/etc/vitess/auth.json",x="/var/lib/vitess/vtgate-auth.sha256";function xe(e){let t=e.username??"vitess",r=e.password??"";return["mkdir -p /etc/vitess",'VTESS_AUTH_TMP="$(mktemp)"',`cat > "$VTESS_AUTH_TMP" <<'TS_CLOUD_VITESS_AUTH_EOF'`,JSON.stringify({[t]:[{Password:r,UserData:t}]}),"TS_CLOUD_VITESS_AUTH_EOF",`VTESS_VTGATE_AUTH_SHA="$(sha256sum "$VTESS_AUTH_TMP" | awk '{print $1}')"`,"VTESS_VTGATE_AUTH_CHANGED=1",`if [ -f ${x} ] && [ "$(cat ${x})" = "$VTESS_VTGATE_AUTH_SHA" ]; then VTESS_VTGATE_AUTH_CHANGED=0; fi`,`install -o ${S} -g ${S} -m 0600 "$VTESS_AUTH_TMP" ${le}`,'rm -f "$VTESS_AUTH_TMP"']}function ke(e){let t=e.cell??"zone1";return L({description:"Vitess vtgate (query router)",after:["vitess-vtctld.service"],execStart:b("vtgate",[`${T}/vtgate`,...Z(e),`--cell ${t}`,`--cells-to-watch ${t}`,"--tablet-types-to-wait PRIMARY,REPLICA",`--service-map ${_("grpc-vtgateservice")}`,`--mysql-server-port ${e.vtgatePort??z}`,`--mysql-server-bind-address ${e.bindAddress??"127.0.0.1"}`,"--mysql-auth-server-impl static",`--mysql-auth-server-static-file ${le}`,`--port ${j}`,`--grpc-port ${j+1}`])})}function Ie(e){let t=e.cell??"zone1",r=e.etcdEndpoint??`http://127.0.0.1:${B}`,s=`${T}/vtctldclient --server 127.0.0.1:${w}`,o=[`for i in $(seq 1 30); do ${s} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,`if ! ${s} GetCellInfoNames 2>/dev/null | grep -qx ${_(t)}; then`,`  ${s} AddCellInfo --root ${_(`/vitess/${t}`)} --server-address ${_(r)} ${_(t)}`,"fi"];for(let n of e.keyspaces??[]){let l=n.sharded?" --sharded":"";o.push(`if ! ${s} GetKeyspace ${_(n.name)} >/dev/null 2>&1; then`,`  ${s} CreateKeyspace${l} ${_(n.name)}`,"fi");let p=`${t}-${String(Q).padStart(10,"0")}`;for(let c of n.sharded?["-80","80-"]:["0"]){let i=`${n.name}/${c}`;o.push("for i in $(seq 1 90); do",`  if ${s} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then break; fi`,`  ${s} PlannedReparentShard ${_(i)} --new-primary ${_(p)} >/dev/null 2>&1 && break`,`  ${s} InitShardPrimary --force ${_(i)} ${_(p)} >/dev/null 2>&1 && break`,"  sleep 2","done",`if ! ${s} GetShard ${_(i)} 2>/dev/null | grep -q '"is_primary_serving": *true'; then`,`  echo "no primary could be elected for ${i}" >&2; exit 1`,"fi")}o.push(`${s} RebuildKeyspaceGraph ${_(n.name)} >/dev/null`)}return o}function ae(e){let t=e.vtgatePort??z;return["for i in $(seq 1 60); do",`  if (cd ${R} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${_(e.password??"")} ${T}/mysql -h 127.0.0.1 -P ${t} -u ${_(e.username??"vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,`    echo "vtgate is serving on ${t}"; exit 0`,"  fi","  sleep 2","done",`echo "vtgate did not become ready on port ${t}" >&2`,"exit 1"]}function ko(e){if(!Ni(e))return[];let t=Ce(e),r=t.mode==="combo";J.clear();let s=['if [ "$(uname -m)" != "x86_64" ]; then','  echo "vitess: Vitess publishes only x86_64 release tarballs; this box is $(uname -m). Drop managedServices.vitess or use an x86_64 host." >&2',"  exit 1","fi",...it(Pe(t)),`VT_MYSQL_LIB="$(dirname "$(dirname "$(readlink -f ${T}/mysqld)")")/lib"`,'if [ -d "$VT_MYSQL_LIB" ]; then',`  printf '%s\\n' "$VT_MYSQL_LIB" > /etc/ld.so.conf.d/vitess-mysql.conf`,"  ldconfig","else",'  echo "mysqld library directory not found under $VT_MYSQL_LIB" >&2; exit 1',"fi",`id -u ${S} >/dev/null 2>&1 || useradd --system --home-dir ${y} --shell /usr/sbin/nologin ${S}`,`mkdir -p ${y}`,`chown -R ${S}:${S} ${y}`];if(r)return s.push(...ie("vitess-vtcombo",be(t)),...oe(),"systemctl daemon-reload","systemctl enable --now vitess-vtcombo.service",...ae(t)),s;s.push(...xe(t));let o=[];if(!t.etcdEndpoint)o.push(["vitess-etcd",Le()]);o.push(["vitess-vtctld",Ae(t)],["vitess-mysqlctld",Ue(t)],["vitess-vtgate",ke(t)]);for(let n of t.keyspaces??[])for(let l of n.sharded?["-80","80-"]:["0"])o.push([`vitess-vttablet-${n.name}-${l.replace(/-/g,"x")}`,Oe(t,n.name,l)]);for(let[n,l]of o)s.push(...ie(n,l));s.push(...oe()),s.push("systemctl daemon-reload");for(let[n]of o)s.push(`systemctl enable --now ${n}.service`);return s.push(`if [ "$VTESS_VTGATE_AUTH_CHANGED" = 1 ]; then systemctl restart vitess-vtgate.service; printf '%s\\n' "$VTESS_VTGATE_AUTH_SHA" > ${x}; chown ${S}:${S} ${x}; chmod 0600 ${x}; fi`,...Ie(t),...ae(t)),s}var Me=new Set(["singlestore","vitess"]);function gn(e){if(e?.engine&&Me.has(e.engine))return!1;return!e?.host||e.host==="127.0.0.1"||e.host==="localhost"}function Et(e,t="psql"){let r=e?.port??5432;if(gn(e))return`${t} -p ${r} -U postgres`;let s=e?.username||"postgres";return`${e?.password?`PGPASSWORD='${e.password.replace(/'/g,"'\\''")}' `:""}${t} -h ${e.host} -p ${r} -U ${s} -w`}function E(e){return e===!0||typeof e==="object"&&e!=null}function Ne(e){let t=[],r=[];if(E(e.mysql))t.push(typeof e.mysql==="object"&&e.mysql.version?`mysql.com@${e.mysql.version}`:"mysql.com@8.0.43"),r.push("mysql");else if(E(e.mariadb))t.push(U.mariadb),r.push("mariadb");if(E(e.postgres))t.push("postgresql.org"),r.push("postgres");if(E(e.redis))t.push("redis.io"),r.push("redis");if(E(e.memcached))t.push("memcached.org"),r.push("memcached");if(E(e.meilisearch))t.push("meilisearch.com"),r.push("meilisearch");return{packages:t,services:r}}function No(e={},t={}){let r=Ne(e),s=ko(e.vitess),o=t.mail?Do(t.mail):[];if(r.packages.length===0)return[...s,...o];return[...it(r.packages),...Po(r.services),...s,...o]}function wt(e,t={}){if(e?.requireLocalPasswordAuth&&(e.engine!=="postgres"||!gn(e)||!e.name||!e.username||!e.password||e.users?.some((a)=>!a.password)))throw Error("Password authentication requires a named local PostgreSQL database and nonempty login passwords");if(!e?.name)return[];if(!gn(e))return[];let r=e.name,s=e.username||r,o=e.password||"",n=E(t.postgres)||e.engine==="postgres",l=E(t.mariadb)||e.engine==="mariadb",p=E(t.mysql)||e.engine==="mysql";if(n&&!p&&!l){let a=(d)=>`"${d.replace(/"/g,'""')}"`,D=(d)=>`'${d.replace(/'/g,"''")}'`,O=(d,M)=>[...e.requireLocalPasswordAuth?["SET password_encryption = 'scram-sha-256';"]:[],"DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${D(d)}) THEN`,`    CREATE ROLE ${a(d)} LOGIN PASSWORD ${D(M)};`,"  ELSE",`    ALTER ROLE ${a(d)} LOGIN PASSWORD ${D(M)};`,"  END IF;","END $$;"],k=(d)=>{let M=d.databases&&d.databases.length>0?d.databases:[r],G=[];for(let q of M)if(d.access==="readonly")G.push(`GRANT CONNECT ON DATABASE ${a(q)} TO ${a(d.username)};`,`\\connect ${a(q)}`,`GRANT USAGE ON SCHEMA public TO ${a(d.username)};`,`GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${a(d.username)};`,`ALTER DEFAULT PRIVILEGES FOR ROLE ${a(s)} IN SCHEMA public GRANT SELECT ON TABLES TO ${a(d.username)};`,"\\connect postgres");else G.push(`GRANT ALL PRIVILEGES ON DATABASE ${a(q)} TO ${a(d.username)};`);return G},I=e.users||[],Se=e.port??5432;return[Ve(),`for i in $(seq 1 30); do pg_isready -p ${Se} -q && break; sleep 2; done`,`${Et(e)}${e.requireLocalPasswordAuth?" -v ON_ERROR_STOP=1":""} <<'TS_CLOUD_PG_EOF'`,...O(s,o),`SELECT 'CREATE DATABASE ${a(r)} OWNER ${a(s)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${D(r)})\\gexec`,...I.flatMap((d)=>[...O(d.username,d.password),...k(d)]),"TS_CLOUD_PG_EOF",...e.requireLocalPasswordAuth?[`TS_CLOUD_PG_HBA=$(${Et(e)} -Atc 'SHOW hba_file')`,'case "$TS_CLOUD_PG_HBA" in /*) ;; *) echo "Invalid PostgreSQL authentication path" >&2; exit 1 ;; esac','[ -f "$TS_CLOUD_PG_HBA.before-ts-cloud-password-auth" ] || cp -p "$TS_CLOUD_PG_HBA" "$TS_CLOUD_PG_HBA.before-ts-cloud-password-auth"','TS_CLOUD_PG_AUTH=$(mktemp "$TS_CLOUD_PG_HBA.ts-cloud.XXXXXXXX")',"{","  printf '%s\\n' '# BEGIN ts-cloud password authentication' 'host all all 127.0.0.1/32 scram-sha-256' 'host all all ::1/128 scram-sha-256' 'host replication all 127.0.0.1/32 scram-sha-256' 'host replication all ::1/128 scram-sha-256' '# END ts-cloud password authentication'",`  sed '/^# BEGIN ts-cloud password authentication$/,/^# END ts-cloud password authentication$/d' "$TS_CLOUD_PG_HBA"`,'} > "$TS_CLOUD_PG_AUTH"','chown --reference="$TS_CLOUD_PG_HBA" "$TS_CLOUD_PG_AUTH"','chmod --reference="$TS_CLOUD_PG_HBA" "$TS_CLOUD_PG_AUTH"','mv -f "$TS_CLOUD_PG_AUTH" "$TS_CLOUD_PG_HBA"',`${Et(e)} -v ON_ERROR_STOP=1 -c 'SELECT pg_reload_conf()'`]:[],...we(e)]}let c=l?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock",i=(a)=>a.replace(/`/g,"``"),f=(a)=>a.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),C=(a)=>{let D=a.databases&&a.databases.length>0?a.databases:[r],O=a.access==="readonly"?"SELECT":"ALL PRIVILEGES",k=[`CREATE USER IF NOT EXISTS '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`CREATE USER IF NOT EXISTS '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'%' IDENTIFIED BY '${f(a.password)}';`,`ALTER USER '${f(a.username)}'@'localhost' IDENTIFIED BY '${f(a.password)}';`];for(let I of D)k.push(`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'%';`,`GRANT ${O} ON \`${i(I)}\`.* TO '${f(a.username)}'@'localhost';`);return k},u=e.users||[];return[Ve(),`for i in $(seq 1 30); do mysqladmin --socket=${c} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,`mysql --socket=${c} -u root <<'TS_CLOUD_SQL_EOF'`,`CREATE DATABASE IF NOT EXISTS \`${i(r)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,...C({username:s,password:o}),...u.flatMap(C),"FLUSH PRIVILEGES;","TS_CLOUD_SQL_EOF"]}function we(e){return[`${Et(e)} -tA <<'TS_CLOUD_PG_CAP_EOF' || true`,"\\set QUIET on","SELECT CASE WHEN used::float / NULLIF(cap, 0) >= 0.8","  THEN '[ts-cloud] postgres is at ' || used || '/' || cap || ' connections on this server.'","       || ' Raise max_connections (ALTER SYSTEM SET max_connections = ...; then restart) or'","       || ' set idle_session_timeout so abandoned pools are reclaimed.'","  ELSE NULL END","FROM (SELECT (SELECT count(*) FROM pg_stat_activity) AS used,","             (SELECT setting::int FROM pg_settings WHERE name = 'max_connections') AS cap) c","WHERE CASE WHEN used::float / NULLIF(cap, 0) >= 0.8 THEN true ELSE false END;","SELECT '[ts-cloud]   ' || coalesce(datname, '(background)') || ': ' || count(*) || ' connection(s), oldest idle ' ||","       coalesce(round(extract(epoch from max(now() - state_change)) / 60)::text || 'm', 'n/a')","FROM pg_stat_activity","WHERE (SELECT count(*)::float / NULLIF((SELECT setting::int FROM pg_settings WHERE name = 'max_connections'), 0) FROM pg_stat_activity) >= 0.8","GROUP BY datname ORDER BY count(*) DESC;","TS_CLOUD_PG_CAP_EOF"]}function Jc(e){if(!e?.name)return{};let t=e.engine==="singlestore",r=e.engine==="vitess",s=e.engine==="postgres"?"pgsql":t?"singlestore":r?"vitess":"mysql",o=e.port??(e.engine==="postgres"?5432:r?15306:3306),n={DB_CONNECTION:s,DB_HOST:e.host||"127.0.0.1",DB_PORT:String(o),DB_DATABASE:e.name};if(e.username)n.DB_USERNAME=e.username;if(e.password)n.DB_PASSWORD=e.password;if((t||r)&&e.ssl!==!1)n.DB_SSL="true";return n}var V="/var/backups/ts-cloud",ee="/etc/ts-cloud/backups.config.ts",pe="/etc/cron.d/ts-cloud-backups",fn="/usr/local/bin/ts-cloud-backup.sh";function Be(e){if(!e.name)return null;if(!["postgres","mysql","mariadb"].includes(e.engine||""))throw Error("Unsupported scheduled SQL backup engine");return JSON.stringify({type:e.engine==="postgres"?"postgresql":"mysql",name:e.name,connection:{hostname:e.host||"127.0.0.1",port:e.port??(e.engine==="postgres"?5432:3306),database:e.name,username:e.username||e.name,password:e.password||"",ssl:!1},includeSchema:!0,includeData:!0})}function He(e,t){let r=e?Be(e):null,s=t.bucket?{type:"s3",bucket:t.bucket,prefix:t.prefix||"db-backups",...t.endpoint?{endpoint:t.endpoint}:{},...t.region?{region:t.region}:{},keepDays:t.retentionDays??30,optional:!1,...t.encryptionKey?{encryption:{keyEnv:"TS_CLOUD_BACKUP_ENCRYPTION_KEY"}}:{}}:void 0,o={verbose:!0,outputPath:V,retention:{count:t.retentionCount??5,maxAge:t.retentionDays??30},databases:[],files:t.files||[],destinations:s?[s]:[]};return["import type { BackupConfig } from 'ts-backups'",`const config: BackupConfig = ${JSON.stringify(o,null,2)}`,`config.databases = [
 ${r||""}
 ]`,...t.credentials?["config.destinations![0]!.credentials = { accessKeyId: process.env.TS_CLOUD_BACKUP_ACCESS_KEY!, secretAccessKey: process.env.TS_CLOUD_BACKUP_SECRET_KEY! }"]:[],"export default config",""].join(`
 `)}function xi(e){let{database:t,backups:r}=e;if(!r.enabled)return[];if(r.credentials&&(!r.bucket||!r.credentials.accessKeyId||!r.credentials.secretAccessKey))throw Error("Scheduled backups require complete destination credentials and a bucket");if(r.encryptionKey&&(r.encryptionKey.length<32||!r.bucket))throw Error("Encrypted offsite backups require a bucket and a separate recovery key of at least 32 characters");let s=r.version||"0.1.6";if(!/^\d+\.\d+\.\d+$/.test(s))throw Error("Pin a released ts-backups version");let o=r.schedule||"0 2 * * *";if(!/^[0-9*,/ -]+$/.test(o)||o.trim().split(/\s+/).length!==5)throw Error("Invalid backup schedule");let n=(c)=>`'${c.replace(/'/g,"'\\''")}'`;if(r.archive){let c=new URL(r.archive.url);if(c.protocol!=="https:"||c.username||c.password||!/^[a-f0-9]{64}$/i.test(r.archive.sha256))throw Error("Backup archives require an HTTPS URL and SHA-256 checksum")}let l=Object.entries({...r.credentials?{TS_CLOUD_BACKUP_ACCESS_KEY:r.credentials.accessKeyId,TS_CLOUD_BACKUP_SECRET_KEY:r.credentials.secretAccessKey}:{},...r.encryptionKey?{TS_CLOUD_BACKUP_ENCRYPTION_KEY:r.encryptionKey}:{}}).map(([c,i])=>`${c}=${n(i)}`).join(`
-`),p="/opt/ts-cloud/backups";return["umask 077",`mkdir -p /etc/ts-cloud ${V} ${p}`,`chmod 700 ${V} ${p}`,'export PATH="/opt/ts-cloud/bun/bin:/opt/pantry/pantry/.bin:/usr/local/bin:/usr/bin:/bin"',`test -f ${p}/package.json || printf '%s' '{"private":true}' > ${p}/package.json`,...r.archive?[`curl --fail --silent --show-error --location ${n(r.archive.url)} --output ${p}/release.tgz`,`printf '%s\\n' ${n(`${r.archive.sha256.toLowerCase()}  ${p}/release.tgz`)} | sha256sum --check --status`,`bun add --cwd ${p} --no-save ${p}/release.tgz`,`test "$(cd ${p} && bun -e 'console.log((await Bun.file("node_modules/ts-backups/package.json").json()).version)')" = ${n(s)}`]:[`bun add --cwd ${p} --no-save ts-backups@${s}`],`printf '%s' ${n(He(t,r))} > ${ee}`,`printf '%s\\n' ${n(l)} > /etc/ts-cloud/backups.env`,`chmod 600 ${ee} /etc/ts-cloud/backups.env`,`cat > ${fn} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -euo pipefail","umask 077","exec 9>/run/lock/ts-cloud-backups.lock","flock -n 9 || exit 0",'export PATH="/opt/ts-cloud/bun/bin:/opt/pantry/pantry/.bin:/usr/local/bin:/usr/bin:/bin"','eval "$(cd /opt/pantry && pantry env)"',"set -a",". /etc/ts-cloud/backups.env","set +a",'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",`if ! ${p}/node_modules/.bin/ts-backups start --config ${ee}; then notify "ts-cloud backup failed"; exit 1; fi`,"date -u +%FT%TZ > /var/backups/ts-cloud/last-success","TS_CLOUD_BACKUP_RUN_EOF",`chmod 700 ${fn}`,`printf '%s\\n' ${n(`${o} root ${fn} >> /var/log/ts-cloud-backup.log 2>&1`)} > ${pe}`,`chmod 644 ${pe}`]}function Ge(e){return e==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function _i(e,t={}){if(!e?.name)return[];let r=e.name,s=e.engine==="postgres",o=t.from?`TS_CLOUD_DUMP="${t.from}"`:`TS_CLOUD_DUMP="$(find ${V} -type f -name '*${r}*.sql' -o -type f -name '*${r}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,n=s?`${Et(e)} -d "${r}"`:`mysql --socket=${Ge(e.engine)} -u root "${r}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',o,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+r+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${n}`,'echo "restore complete"']}var xo=["storage",".env"],Oi=4;function v(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Vs(e){return`${v(e)}/deploy-history.log`}function qe(e,t){return`${v(e)}/deploys/${t}.log`}function ue(e){return`${v(e)}/shared-paths`}function _o(e){return`${e.shared}/stx-images`}function $i(e){return`${e.shared}/stx-bundles`}function Ht(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function de(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function zs(e){return typeof e==="string"?e:e.path}function Xc(e){let t=new Map;for(let r of e)t.set(zs(r),r);return[...t.values()]}function $e(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Fe(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Li(e,t=xo){let r=[`mkdir -p ${e.releases} ${e.shared} ${_o(e)} ${$i(e)}`,...Fe(e)],s=t.map((n)=>$e(e,n));for(let{path:n,target:l,seed:p}of s){if(!p)continue;if(r.push(`ts_cloud_adopt_shared '${n}' '${l}'`),de(n))r.push(`mkdir -p "$(dirname ${l})"`,`touch ${l}`);else if(n==="storage")r.push(`mkdir -p ${l}/app/public`,`mkdir -p ${l}/framework/cache/data`,`mkdir -p ${l}/framework/sessions`,`mkdir -p ${l}/framework/testing`,`mkdir -p ${l}/framework/views`,`mkdir -p ${l}/logs`);else r.push(`mkdir -p ${l}`)}let o=ue(e.base);return r.push(`mkdir -p ${v(e.base)}`,`cat > ${o} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...s.map((n)=>`${n.path}	${n.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Hs(e,t=900){let r=`${v(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Gs(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Ye(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function qs(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Ye(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function Ws(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Ke(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Oo(e,t=xo){let r=[];for(let s of t){let{path:o,target:n,seed:l}=$e(e,s),p=`${e.release}/${o}`,c=[`rm -rf ${p}`,`mkdir -p "$(dirname ${p})"`,`ln -sfn ${n} ${p}`];if(l){if(o!==".env"&&de(o))r.push(...Ke(p,n));r.push(...c);continue}r.push(`if [ -e ${n} ]; then`,...c.map((i)=>`  ${i}`),"fi")}return r}function je(e,t){let r=ue(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function hn(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function te(e){return`${v(e)}/previous-release`}function Ks(e,t="TS_CLOUD_PREV_CURRENT"){let r=te(e.base);return[`if [ -n "\${${t}:-}" ] && [ -d "$${t}" ] && [ "$(readlink -f "$${t}")" != "$(readlink -f ${e.release})" ]; then mkdir -p ${v(e.base)}; basename "$${t}" > ${r}; fi`]}function _e(e,t){let r=te(e.base);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,...t?[`TS_CLOUD_RB_TARGET=${e.releases}/${t}`]:["TS_CLOUD_RB_TARGET=",`if [ -f ${r} ]; then TS_CLOUD_REC="${e.releases}/$(cat ${r})"; if [ -d "$TS_CLOUD_REC" ] && [ "$(readlink -f "$TS_CLOUD_REC")" != "$TS_CLOUD_CURRENT" ]; then TS_CLOUD_RB_TARGET="$TS_CLOUD_REC"; fi; fi`,`[ -n "$TS_CLOUD_RB_TARGET" ] || TS_CLOUD_RB_TARGET=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`],'[ -n "$TS_CLOUD_RB_TARGET" ] && [ -d "$TS_CLOUD_RB_TARGET" ] || { echo "no release to roll back to (looked for ${TS_CLOUD_RB_TARGET:-a previous release})" >&2; exit 1; }','[ "$(readlink -f "$TS_CLOUD_RB_TARGET")" != "$TS_CLOUD_CURRENT" ] || { echo "$(basename "$TS_CLOUD_RB_TARGET") is already the live release" >&2; exit 1; }','TS_CLOUD_RB_ID=$(basename "$TS_CLOUD_RB_TARGET")']}function Qc(e,t={}){return[..._e(e,t.to),'echo "would roll back from $(basename "${TS_CLOUD_CURRENT:-none}") to $TS_CLOUD_RB_ID (dry run: nothing changed)"']}function Yc(e,t={}){let r=Math.max(1,t.gateSeconds??5),s=t.systemdDir??"/etc/systemd/system",o=[`ln -sfn "$TS_CLOUD_RB_TARGET" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,`rm -f ${te(e.base)}`,'echo "rolled back to $TS_CLOUD_RB_ID"'],n=[..._e(e,t.to),...je(e,'"$TS_CLOUD_RB_TARGET"')];if(!t.unitBase)return[...n,...o];let l=t.unitBase,p=`${l}@\${TS_CLOUD_RB_ID}.service`;return[...n,`if [ -f ${s}/${l}@.service ]; then`,`  systemctl start "${p}"`,`  for TS_CLOUD_I in $(seq 1 ${r}); do sleep 1; systemctl is-active --quiet "${p}" || { echo "the release rolled back to, $TS_CLOUD_RB_ID, did not stay up; the current release keeps serving" >&2; journalctl -u "${p}" -n 30 --no-pager >&2 || true; systemctl stop "${p}" 2>/dev/null || true; exit 1; }; done`,...o.map((c)=>`  ${c}`),`  systemctl enable "${p}" 2>/dev/null || true`,`  systemctl list-units --plain --no-legend --type=service "${l}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${l}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`elif [ -f ${s}/${l}.service ]; then`,...o.map((c)=>`  ${c}`),`  systemctl restart ${l}.service`,"else",...o.map((c)=>`  ${c}`),"fi"]}function yn(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function We(e){return`${v(e)}/owner`}function Js(e,t){let r=We(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function $o(e,t){let r=v(e),s=qe(e,t.releaseId),o=Vs(e),n=Math.max(1,t.keepLogs??20),l=t.commit||"",p=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${s}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${l} branch=${p} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${l}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${o}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${n+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}
+`),p="/opt/ts-cloud/backups";return["umask 077",`mkdir -p /etc/ts-cloud ${V} ${p}`,`chmod 700 ${V} ${p}`,'export PATH="/opt/ts-cloud/bun/bin:/opt/pantry/pantry/.bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"',`test -f ${p}/package.json || printf '%s' '{"private":true}' > ${p}/package.json`,...r.archive?[`curl --fail --silent --show-error --location ${n(r.archive.url)} --output ${p}/release.tgz`,`printf '%s\\n' ${n(`${r.archive.sha256.toLowerCase()}  ${p}/release.tgz`)} | sha256sum --check --status`,`bun add --cwd ${p} --no-save ${p}/release.tgz`,`test "$(cd ${p} && bun -e 'console.log((await Bun.file("node_modules/ts-backups/package.json").json()).version)')" = ${n(s)}`]:[`bun add --cwd ${p} --no-save ts-backups@${s}`],`printf '%s' ${n(He(t,r))} > ${ee}`,`printf '%s\\n' ${n(l)} > /etc/ts-cloud/backups.env`,`chmod 600 ${ee} /etc/ts-cloud/backups.env`,`cat > ${fn} <<'TS_CLOUD_BACKUP_RUN_EOF'`,"#!/bin/bash","set -euo pipefail","umask 077","exec 9>/run/lock/ts-cloud-backups.lock","flock -n 9 || exit 0",'export PATH="/opt/ts-cloud/bun/bin:/opt/pantry/pantry/.bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"','eval "$(cd /opt/pantry && pantry env)"',"set -a",". /etc/ts-cloud/backups.env","set +a",'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',"cd /etc/ts-cloud",`if ! ${p}/node_modules/.bin/ts-backups start --config ${ee}; then notify "ts-cloud backup failed"; exit 1; fi`,"date -u +%FT%TZ > /var/backups/ts-cloud/last-success","TS_CLOUD_BACKUP_RUN_EOF",`chmod 700 ${fn}`,`printf '%s\\n' ${n(`${o} root ${fn} >> /var/log/ts-cloud-backup.log 2>&1`)} > ${pe}`,`chmod 644 ${pe}`]}function Ge(e){return e==="mariadb"?"/var/lib/pantry/mariadb/mariadbd.sock":"/var/lib/pantry/mysql/mysqld.sock"}function _i(e,t={}){if(!e?.name)return[];let r=e.name,s=e.engine==="postgres",o=t.from?`TS_CLOUD_DUMP="${t.from}"`:`TS_CLOUD_DUMP="$(find ${V} -type f -name '*${r}*.sql' -o -type f -name '*${r}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`,n=s?`${Et(e)} -d "${r}"`:`mysql --socket=${Ge(e.engine)} -u root "${r}"`;return["set -uo pipefail",'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',o,'[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }','echo "[ts-cloud] restoring '+r+' from $TS_CLOUD_DUMP"',`case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${n}`,'echo "restore complete"']}var xo=["storage",".env"],Oi=4;function v(e){return`${e.replace(/\/+$/,"")}/.ts-cloud`}function Vs(e){return`${v(e)}/deploy-history.log`}function qe(e,t){return`${v(e)}/deploys/${t}.log`}function ue(e){return`${v(e)}/shared-paths`}function _o(e){return`${e.shared}/stx-images`}function $i(e){return`${e.shared}/stx-bundles`}function Ht(e,t){let r=e.replace(/\/+$/,"");return{base:r,releases:`${r}/releases`,shared:`${r}/shared`,current:`${r}/current`,release:`${r}/releases/${t}`}}function de(e){let t=e.split("/").pop()||e;if(t===".env"||t.startsWith(".env."))return!0;return/\.[a-z0-9]+$/i.test(t)}function zs(e){return typeof e==="string"?e:e.path}function Xc(e){let t=new Map;for(let r of e)t.set(zs(r),r);return[...t.values()]}function $e(e,t){if(typeof t==="string")return{path:t,target:`${e.shared}/${t}`,seed:!0};return{path:t.path,target:t.target??`${e.shared}/${t.path}`,seed:t.seed!==!1}}function Fe(e){return["ts_cloud_adopt_shared() {",'  TS_CLOUD_SP="$1"','  TS_CLOUD_DST="$2"',`  TS_CLOUD_SRC="${e.current}/$TS_CLOUD_SP"`,'  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi','  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi','  mkdir -p "$(dirname "$TS_CLOUD_DST")"','  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',"  for TS_CLOUD_SIDECAR in -wal -shm; do",'    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',"  done",'  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',"  return 0","}"]}function Li(e,t=xo){let r=[`mkdir -p ${e.releases} ${e.shared} ${_o(e)} ${$i(e)}`,...Fe(e)],s=t.map((n)=>$e(e,n));for(let{path:n,target:l,seed:p}of s){if(!p)continue;if(r.push(`ts_cloud_adopt_shared '${n}' '${l}'`),de(n))r.push(`mkdir -p "$(dirname ${l})"`,`touch ${l}`);else if(n==="storage")r.push(`mkdir -p ${l}/app/public`,`mkdir -p ${l}/framework/cache/data`,`mkdir -p ${l}/framework/sessions`,`mkdir -p ${l}/framework/testing`,`mkdir -p ${l}/framework/views`,`mkdir -p ${l}/logs`);else r.push(`mkdir -p ${l}`)}let o=ue(e.base);return r.push(`mkdir -p ${v(e.base)}`,`cat > ${o} <<'TS_CLOUD_SHARED_PATHS_EOF'`,...s.map((n)=>`${n.path}	${n.target}`),"TS_CLOUD_SHARED_PATHS_EOF"),r}function Hs(e,t=900){let r=`${v(e.base)}/deploy.lock`;return[`mkdir -p "$(dirname ${r})"`,`exec 9>${r}`,`flock -w ${t} 9 || { echo "[ts-cloud] another deploy of this site has held the lock for ${t}s — refusing to race it" >&2; exit 1; }`]}function Gs(e){let t=`${e.release}.incoming`;return[`rm -rf ${t}`,`mkdir -p ${t}`,...Ye(e),'if [ "$TS_CLOUD_IS_LIVE" = "yes" ]; then',`  TS_CLOUD_STAGED=${t}`,"else",`  rm -rf ${e.release}`,`  mkdir -p ${e.release}`,`  rmdir ${t}`,`  TS_CLOUD_STAGED=${e.release}`,"fi"]}function qs(e){let t=`TS_CLOUD_TRAP_LIVE="$(readlink -f ${e.current} 2>/dev/null || true)"`,r=`TS_CLOUD_TRAP_TARGET="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`;return`trap '${`if [ $? -ne 0 ]; then ${t}; ${r}; [ "$TS_CLOUD_TRAP_LIVE" = "$TS_CLOUD_TRAP_TARGET" ] || rm -rf ${e.release}; fi`}' EXIT`}function Ye(e){return[`TS_CLOUD_LIVE_PATH="$(readlink -f ${e.current} 2>/dev/null || true)"`,`TS_CLOUD_RELEASE_PATH="$(readlink -f ${e.release} 2>/dev/null || echo ${e.release})"`,'if [ -n "$TS_CLOUD_LIVE_PATH" ] && [ "$TS_CLOUD_LIVE_PATH" = "$TS_CLOUD_RELEASE_PATH" ]; then TS_CLOUD_IS_LIVE=yes; else TS_CLOUD_IS_LIVE=no; fi']}function Ws(e){let t=`${e.release}.incoming`;return[`if [ "$TS_CLOUD_STAGED" = "${t}" ]; then`,`  rm -rf ${e.release}.previous`,`  mv ${e.release} ${e.release}.previous`,`  mv ${t} ${e.release}`,`  rm -rf ${e.release}.previous`,"fi"]}function Ke(e,t){return[`if [ -f ${e} ] && [ ! -L ${e} ] && [ -s ${e} ] && [ ! -s ${t} ]; then`,`  cp -a ${e} ${t}`,`  echo "[ts-cloud] seeded shared/ from the release's own copy of the file"`,"fi"]}function Oo(e,t=xo){let r=[];for(let s of t){let{path:o,target:n,seed:l}=$e(e,s),p=`${e.release}/${o}`,c=[`rm -rf ${p}`,`mkdir -p "$(dirname ${p})"`,`ln -sfn ${n} ${p}`];if(l){if(o!==".env"&&de(o))r.push(...Ke(p,n));r.push(...c);continue}r.push(`if [ -e ${n} ]; then`,...c.map((i)=>`  ${i}`),"fi")}return r}function je(e,t){let r=ue(e.base);return[`if [ -f ${r} ]; then`,'  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do','    [ -n "$TS_CLOUD_SP" ] || continue',`    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${e.shared}/$TS_CLOUD_SP"`,'    [ -e "$TS_CLOUD_TGT" ] || continue',`    rm -rf ${t}/"$TS_CLOUD_SP"`,`    mkdir -p "$(dirname ${t}/"$TS_CLOUD_SP")"`,`    ln -sfn "$TS_CLOUD_TGT" ${t}/"$TS_CLOUD_SP"`,`  done < ${r}`,"fi"]}function hn(e){return[`ln -sfn ${e.release} ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`]}function te(e){return`${v(e)}/previous-release`}function Ks(e,t="TS_CLOUD_PREV_CURRENT"){let r=te(e.base);return[`if [ -n "\${${t}:-}" ] && [ -d "$${t}" ] && [ "$(readlink -f "$${t}")" != "$(readlink -f ${e.release})" ]; then mkdir -p ${v(e.base)}; basename "$${t}" > ${r}; fi`]}function _e(e,t){let r=te(e.base);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,...t?[`TS_CLOUD_RB_TARGET=${e.releases}/${t}`]:["TS_CLOUD_RB_TARGET=",`if [ -f ${r} ]; then TS_CLOUD_REC="${e.releases}/$(cat ${r})"; if [ -d "$TS_CLOUD_REC" ] && [ "$(readlink -f "$TS_CLOUD_REC")" != "$TS_CLOUD_CURRENT" ]; then TS_CLOUD_RB_TARGET="$TS_CLOUD_REC"; fi; fi`,`[ -n "$TS_CLOUD_RB_TARGET" ] || TS_CLOUD_RB_TARGET=$(ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do [ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)`],'[ -n "$TS_CLOUD_RB_TARGET" ] && [ -d "$TS_CLOUD_RB_TARGET" ] || { echo "no release to roll back to (looked for ${TS_CLOUD_RB_TARGET:-a previous release})" >&2; exit 1; }','[ "$(readlink -f "$TS_CLOUD_RB_TARGET")" != "$TS_CLOUD_CURRENT" ] || { echo "$(basename "$TS_CLOUD_RB_TARGET") is already the live release" >&2; exit 1; }','TS_CLOUD_RB_ID=$(basename "$TS_CLOUD_RB_TARGET")']}function Qc(e,t={}){return[..._e(e,t.to),'echo "would roll back from $(basename "${TS_CLOUD_CURRENT:-none}") to $TS_CLOUD_RB_ID (dry run: nothing changed)"']}function Yc(e,t={}){let r=Math.max(1,t.gateSeconds??5),s=t.systemdDir??"/etc/systemd/system",o=[`ln -sfn "$TS_CLOUD_RB_TARGET" ${e.current}.tmp`,`mv -Tf ${e.current}.tmp ${e.current}`,`rm -f ${te(e.base)}`,'echo "rolled back to $TS_CLOUD_RB_ID"'],n=[..._e(e,t.to),...je(e,'"$TS_CLOUD_RB_TARGET"')];if(!t.unitBase)return[...n,...o];let l=t.unitBase,p=`${l}@\${TS_CLOUD_RB_ID}.service`;return[...n,`if [ -f ${s}/${l}@.service ]; then`,`  systemctl start "${p}"`,`  for TS_CLOUD_I in $(seq 1 ${r}); do sleep 1; systemctl is-active --quiet "${p}" || { echo "the release rolled back to, $TS_CLOUD_RB_ID, did not stay up; the current release keeps serving" >&2; journalctl -u "${p}" -n 30 --no-pager >&2 || true; systemctl stop "${p}" 2>/dev/null || true; exit 1; }; done`,...o.map((c)=>`  ${c}`),`  systemctl enable "${p}" 2>/dev/null || true`,`  systemctl list-units --plain --no-legend --type=service "${l}@*.service" 2>/dev/null | awk '{print $1}' | { grep -v "^${l}@\${TS_CLOUD_RB_ID}.service$" || true; } | while read -r TS_CLOUD_U; do systemctl stop "$TS_CLOUD_U" 2>/dev/null || true; systemctl disable "$TS_CLOUD_U" 2>/dev/null || true; done`,`elif [ -f ${s}/${l}.service ]; then`,...o.map((c)=>`  ${c}`),`  systemctl restart ${l}.service`,"else",...o.map((c)=>`  ${c}`),"fi"]}function yn(e,t=4){let r=Math.max(1,t);return[`TS_CLOUD_CURRENT=$(readlink -f ${e.current} 2>/dev/null || true)`,`ls -1dt ${e.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${r+1} | while read -r TS_CLOUD_OLD; do`,'  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',"done"]}function We(e){return`${v(e)}/owner`}function Js(e,t){let r=We(e);return[`if [ -f "${r}" ]; then`,`  TS_CLOUD_OWNER=$(cat "${r}")`,`  if [ "$TS_CLOUD_OWNER" != "${t}" ]; then`,`    echo "[ts-cloud] REFUSING deploy: ${e} belongs to project '$TS_CLOUD_OWNER', not '${t}'. Another project on this box derives the same site key — give one of them a distinct site name/domain, or remove ${r} to transfer ownership." >&2`,"    exit 1","  fi","else",`  mkdir -p "$(dirname "${r}")"`,`  printf '%s\\n' "${t}" > "${r}"`,"fi"]}function $o(e,t){let r=v(e),s=qe(e,t.releaseId),o=Vs(e),n=Math.max(1,t.keepLogs??20),l=t.commit||"",p=t.branch||"";return[`mkdir -p ${r}/deploys`,`exec > >(tee -a ${s}) 2>&1`,`echo "[ts-cloud] deploy ${t.releaseId} commit=${l} branch=${p} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,"ts_cloud_record_deploy() {","  TS_CLOUD_RC=$?",'  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',`  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${t.releaseId}" "${l}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${o}`,"}","trap ts_cloud_record_deploy EXIT",`ls -1t ${r}/deploys/*.log 2>/dev/null | tail -n +${n+1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`]}
 export{W,ki,Bs,A,Io,Fs,js,Wc,Kc,R,Tt,Ve,it,Po,Do,Ni,ko,gn,Et,No,wt,Jc,fn,xi,_i,xo,Oi,Vs,_o,$i,Ht,zs,Xc,Li,Hs,Gs,qs,Ws,Oo,hn,Ks,Qc,Yc,yn,Js,$o};

package/dist/bin/{chunk-b61yq5rn.js → chunk-4k2x5x3k.js}

@@ -1 +1 @@
-import{Or,nl,il,Pt,$r,Lr,Mr,Ur,Cn}from"./chunk-yd2vnd4y.js";import"./chunk-eqw1dk00.js";import"./chunk-5xvvxh1f.js";import"./chunk-8rkfwgb4.js";export{$r as AwsSecretsManagerConfigurationBackend,Lr as AwsSsmConfigurationBackend,Ur as ConfigurationService,Or as ConfigurationStore,Mr as ExternalConfigurationBackend,Pt as LocalEncryptedConfigurationBackend,nl as parseDotenv,il as serializeDotenv,Cn as synchronizeConfiguredConfiguration};
+import{Or,nl,il,Pt,$r,Lr,Mr,Ur,Cn}from"./chunk-ndvma07s.js";import"./chunk-xycxw00z.js";import"./chunk-9bmaq8q7.js";import"./chunk-8rkfwgb4.js";export{$r as AwsSecretsManagerConfigurationBackend,Lr as AwsSsmConfigurationBackend,Ur as ConfigurationService,Or as ConfigurationStore,Mr as ExternalConfigurationBackend,Pt as LocalEncryptedConfigurationBackend,nl as parseDotenv,il as serializeDotenv,Cn as synchronizeConfiguredConfiguration};

package/dist/bin/{chunk-c4krzg7x.js → chunk-4mep3m41.js}

@@ -1,4 +1,4 @@
-import{ze,I,er,Vr,Gi}from"./chunk-5xvvxh1f.js";import{execSync as D}from"node:child_process";import{randomBytes as R}from"node:crypto";import{chmodSync as j,copyFileSync as x,existsSync as u,mkdirSync as w,readFileSync as U,statSync as N,writeFileSync as m}from"node:fs";import{tmpdir as E}from"node:os";import{basename as P,dirname as v,isAbsolute as O,join as a,resolve as B}from"node:path";import{fileURLToPath as C}from"node:url";function h(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((r)=>[r,""]))}function M(e){let r=JSON.parse(JSON.stringify(e??{}));if(r.hetzner)delete r.hetzner.apiToken;delete r.aws,delete r.stateDir;for(let t of Object.values(r.sites??{})){if(t?.env)t.env=h(t.env);if(t?.environment)t.environment=h(t.environment)}for(let t of Object.values(r.environments??{}))if(t?.variables)t.variables=h(t.variables);for(let t of Object.values(r.infrastructure?.databases??{}))if(t?.password)t.password="";if(r.infrastructure?.appDatabase?.password)r.infrastructure.appDatabase.password="";if(r.infrastructure?.compute?.database?.password)r.infrastructure.compute.database.password="";if(r.infrastructure?.compute?.managedServices?.vitess?.password)r.infrastructure.compute.managedServices.vitess.password="";return r}function y(e){let r=M(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(r,null,2)}`,""].join(`
+import{ze,I,er,Vr,Gi}from"./chunk-9bmaq8q7.js";import{execSync as D}from"node:child_process";import{randomBytes as R}from"node:crypto";import{chmodSync as j,copyFileSync as x,existsSync as u,mkdirSync as w,readFileSync as U,statSync as N,writeFileSync as m}from"node:fs";import{tmpdir as E}from"node:os";import{basename as P,dirname as v,isAbsolute as O,join as a,resolve as B}from"node:path";import{fileURLToPath as C}from"node:url";function h(e){if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.keys(e).map((r)=>[r,""]))}function M(e){let r=JSON.parse(JSON.stringify(e??{}));if(r.hetzner)delete r.hetzner.apiToken;delete r.aws,delete r.stateDir;for(let t of Object.values(r.sites??{})){if(t?.env)t.env=h(t.env);if(t?.environment)t.environment=h(t.environment)}for(let t of Object.values(r.environments??{}))if(t?.variables)t.variables=h(t.variables);for(let t of Object.values(r.infrastructure?.databases??{}))if(t?.password)t.password="";if(r.infrastructure?.appDatabase?.password)r.infrastructure.appDatabase.password="";if(r.infrastructure?.compute?.database?.password)r.infrastructure.compute.database.password="";if(r.infrastructure?.compute?.managedServices?.vitess?.password)r.infrastructure.compute.managedServices.vitess.password="";return r}function y(e){let r=M(e);return["// Generated by ts-cloud for the management dashboard — do not edit.","//","// This is the project's resolved cloud config, inlined so it needs no","// imports on the box. Credentials are deliberately absent.",`export default ${JSON.stringify(r,null,2)}`,""].join(`
 `)}var eu="dashboard";function el(){return ze("dashboard-credentials.json")}function F(){return R(24).toString("base64url")}function tu(e,r,t){let s=process.env.TS_CLOUD_UI_PASSWORD?.trim();if(s)return{password:s,source:"env"};if(b(process.env.TS_CLOUD_UI_PUBLIC))return{password:void 0,source:"public"};let n=el(),i=I(e,"dashboard-credentials.json");try{if(u(i)){let o=JSON.parse(U(i,"utf8"));if(o?.password)return{password:o.password,source:"generated"}}}catch{}let d=F();try{w(v(i),{recursive:!0}),m(i,`${JSON.stringify({username:r,password:d,generatedAt:new Date().toISOString()},null,2)}
 `),j(i,384),t.info(`Management dashboard: generated a password for '${r}' and saved it to ${n} (read it there — it is not printed). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`)}catch(o){t.warn(`Management dashboard: could not persist the generated password (${o?.message??o}). Using it for this deploy only — pass: ${d}
 This password is now in your deploy log. Set TS_CLOUD_UI_PASSWORD to a value of your own and redeploy once ${n} is writable.`)}return{password:d,source:"generated"}}var L={info:()=>{},warn:()=>{}};function b(e){return e!=null&&e!==""&&e!=="0"&&e.toLowerCase()!=="false"}function J(){return ze("dashboard-release")}function T(){let e=v(C(import.meta.url));for(let r of[a(e,"..","..","package.json"),a(e,"..","package.json")])try{let t=JSON.parse(U(r,"utf8"));if(t.name==="@stacksjs/ts-cloud"&&t.version)return`^${t.version}`}catch{}return"latest"}function z(){return process.env.TS_CLOUD_UI_VERSION?.trim()||T()}function V(e,r,t){if(!e?.project?.slug)return t.warn("Management dashboard: the cloud config has no project slug — skipping the live dashboard."),null;let s=I(r,"dashboard-release");try{w(s,{recursive:!0}),m(a(s,"cloud.config.ts"),y(e));let n=z();if(n.startsWith("file:")){let d=n.slice(5),o=O(d)?d:B(r,d);if(!u(o)||!N(o).isFile())n=T(),t.warn(`Management dashboard: TS_CLOUD_UI_VERSION points to a missing package file (${o}); using the deploying ts-cloud version ${n} instead.`);else{let c=P(o),l=a(s,c);if(o!==l)x(o,l);n=`file:./${c}`}}let i={name:"ts-cloud-dashboard",private:!0,type:"module",dependencies:{"@stacksjs/ts-cloud":n}};return m(a(s,"package.json"),`${JSON.stringify(i,null,2)}

package/dist/bin/{chunk-7477zgt9.js → chunk-6wvjr3ne.js}

@@ -1 +1 @@
-import{eu,el,tu,zo,Ho,Go,Zs}from"./chunk-c4krzg7x.js";import"./chunk-5xvvxh1f.js";import"./chunk-8rkfwgb4.js";export{eu as MANAGEMENT_DASHBOARD_SITE,Zs as buildManagementDashboardArtifact,el as dashboardCredentialsFile,Ho as ensureManagementDashboard,Go as managementDashboardSiteNames,tu as resolveDashboardAuth,zo as resolveUiSource};
+import{eu,el,tu,zo,Ho,Go,Zs}from"./chunk-4mep3m41.js";import"./chunk-9bmaq8q7.js";import"./chunk-8rkfwgb4.js";export{eu as MANAGEMENT_DASHBOARD_SITE,Zs as buildManagementDashboardArtifact,el as dashboardCredentialsFile,Ho as ensureManagementDashboard,Go as managementDashboardSiteNames,tu as resolveDashboardAuth,zo as resolveUiSource};

package/dist/bin/{chunk-kvwm9z1r.js → chunk-71fa7yed.js}

@@ -1 +1 @@
-import{Jp,Xp,Qp,Yp}from"./chunk-sbm0ft8c.js";import"./chunk-1wgyq50e.js";import"./chunk-btrxye8p.js";import"./chunk-5xvvxh1f.js";import"./chunk-8rkfwgb4.js";export{Yp as deleteFailoverReplicaBuckets,Jp as ensureFailoverReplicaBuckets,Xp as grantFailoverReplicaAccess,Qp as seedFailoverReplicas};
+import{Jp,Xp,Qp,Yp}from"./chunk-0e56zmps.js";import"./chunk-1wgyq50e.js";import"./chunk-btrxye8p.js";import"./chunk-9bmaq8q7.js";import"./chunk-8rkfwgb4.js";export{Yp as deleteFailoverReplicaBuckets,Jp as ensureFailoverReplicaBuckets,Xp as grantFailoverReplicaAccess,Qp as seedFailoverReplicas};

package/dist/bin/{chunk-hkgbbph1.js → chunk-76ekkat8.js}

@@ -1,3 +1,3 @@
-import{p}from"./chunk-btrxye8p.js";import{$e,Sa,Fi,Qa,kn,Ji,Ya,Za,ac,cc}from"./chunk-5xvvxh1f.js";import{n,r,a,e,u,i,Ee}from"./chunk-qpasspad.js";import{v}from"./chunk-yf2drw7r.js";import{D}from"./chunk-19mhwmfp.js";import{g}from"./chunk-1wgyq50e.js";class J{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new p(void 0,{profile:s})}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId,ClientRequestToken:t.ClientRequestToken||crypto.randomUUID()};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";function k(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:$e(t,s),artifactBucket:Sa(c,s),assetsBucket:Fi(c,s)}}function Rt(t,s){let o=k(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function q(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let d=l?.code||l?.name||"",m=String(l?.message||"");if(d==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(m)){o=l,await new Promise((f)=>setTimeout(f,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new J(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((d)=>({envName:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(t.secrets).map(([d,m])=>({envName:d,secretId:m}));if(Array.isArray(t.secrets)){let d=new Map;for(let{envName:f,secretId:S}of l)d.set(f,[...d.get(f)??[],S]);let m=[...d.entries()].filter(([,f])=>f.length>1);if(m.length){let f=m.map(([S,R])=>`${S} ← ${R.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${f}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:d,secretId:m}of l){let S=(await o.getSecretValue({SecretId:m})).SecretString??"";try{let R=JSON.parse(S);if(R&&typeof R==="object"&&!Array.isArray(R)){for(let[w,N]of Object.entries(R))c[w]=String(N);continue}}catch{}c[d]=S}return c}function ru(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function ea(t,s,o,c,l,d,m,f={}){let S=t.kind==="php"?ac({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...f,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...m?{TSCLOUD_QUEUE:m,SQS_QUEUE:m}:{},...d?{ASSET_URL:d}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function he(t,s,o,c,l=!1){let d=0;for(let m of oe(o)){let f=Se(o,m).replace(/\\/g,"/");if(!l&&f.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${f}`,body:pe(m),contentType:Re(m),cacheControl:"public, max-age=31536000, immutable"}),d++}return d}function qo(t,s){let o=Object.entries(s).reduce((c,[l,d])=>c+Buffer.byteLength(`${l}=${d}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,d])=>[l,Buffer.byteLength(`${l}=${d}`,"utf8")]).sort((l,d)=>d[1]-l[1]).slice(0,5).map(([l,d])=>`${l} (${d}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function _(t,s,o,c){qo(s,o),await q(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await q(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await q(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await q(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function ym(t,s,o={}){let c=k(t,s),{app:l,slug:d,region:m,stackName:f,artifactBucket:S}=c,R=o.projectRoot??process.cwd();i(`Deploying serverless app: ${d} (${s})`),e(`Stack: ${f}`),e(`Region: ${m}`);let w=new g(m),N=new v(m),T=new D(m),P=l.kind==="php",O=l.packaging==="image",h=Ji(l),V,E,b,Y,U=[];if(O&&h.usesLayer&&h.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${h.kind}${h.kind==="node"?` ${h.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){u("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-1nnt30xt.js"),C=await y({app:l,projectRoot:R,region:m,repository:`${d}-${s}`,skipBuild:o.skipBuild,onStep:(I)=>e(`  ${I}`)});V=C.handlers,E={kind:"image",imageUri:C.imageUri},b=C.tag,U.push({ParameterKey:"ImageUri",ParameterValue:C.imageUri})}else{u("Packaging application");let y=P?cc({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await kn({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),C=Qa(d,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,b=y.sha256,h.usesLayer){let x=h.layerEnvVar?process.env[h.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=h.layerKind==="php"?"serverless:build-php-layer":h.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${h.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${h.layerEnvVar} env var (build one with \`cloud ${ge}\`)${h.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await w.bucketExists(S))u(`Creating artifact bucket ${S}`),await w.createBucket(S);if(await w.headObject(S,C).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else u("Uploading artifact"),await w.putObject({bucket:S,key:C,body:y.zip,contentType:"application/zip"});E={kind:"zip",bucket:S,key:C},U.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:C})}let A=Za({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(A.template),re=["CAPABILITY_NAMED_IAM"],L=await N.describeStacks({stackName:f}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),M=L!==void 0;if(L&&/DELETE_IN_PROGRESS/.test(L))u("Waiting for an in-progress stack delete to finish"),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),M=!1;else if(L&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(L))u(`Deleting unusable stack (status ${L}) before recreate`),await N.deleteStack(f),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),M=!1;u(M?"Updating infrastructure stack":"Creating infrastructure stack");try{if(M)await N.updateStack({stackName:f,templateBody:te,parameters:U,capabilities:re}),await N.waitForStack(f,"stack-update-complete");else await N.createStack({stackName:f,templateBody:te,parameters:U,capabilities:re,onFailure:"DELETE"}),await N.waitForStack(f,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await N.getStackOutputs(f).catch(()=>({})),B;if(l.assets){let y=ne(R,l.assets);if(de(y)){let C=l.assetDomain||Q.AssetsCdnDomain;B=C?`https://${C}/${b}`:void 0,u(`Syncing assets from ${l.assets}`);let I=await he(w,c.assetsBucket,y,b,l.dotFilesAsAssets);e(`Uploaded ${I} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}u("Resolving secrets");let j=await ye(l,m);if(l.database?.connection==="aurora-serverless")try{let C=await new J(m).getSecretValue({SecretId:`${d}/${s}/db`}),I=JSON.parse(C.SecretString??"{}");if(I.username)j.DB_USERNAME=I.username;if(I.password)j.DB_PASSWORD=I.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await w.bucketExists(S))await w.createBucket(S);let H=await G(w,S,d,s),F={},Z=A.queueNames[0],ee=ru(l,Q);if(u("Activating functions"),F.http=ea(l,c,s,"http",j,B,Z,ee),await _(T,A.functionNames.http,F.http,E),F.cli=ea(l,c,s,"cli",j,B,Z,ee),await _(T,A.functionNames.cli,F.cli,E),A.queueNames.length)F.queue=ea(l,c,s,"queue",j,B,Z,ee),await _(T,A.functionNames.queue,F.queue,E);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(u("Publishing versions + flipping live alias"),W.http=await X(T,A.functionNames.http),W.cli=await X(T,A.functionNames.cli),A.queueNames.length)W.queue=await X(T,A.functionNames.queue)}if(await ae(w,S,d,s,{sha:b,code:E,previousSha:H?.sha,previousCode:H?.code,previousFunctionEnv:H?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:H?.functionVersions}:{},functionEnv:F,functionNames:{http:A.functionNames.http,cli:A.functionNames.cli,...A.queueNames.length?{queue:A.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){u("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let C=await T.invoke({FunctionName:A.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(C.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${C.Payload}`)}}let K=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&K){u("Health check");try{let y=await fetch(K,{method:"GET"});e(`GET ${K} → ${y.status}`)}catch(y){a(`Health check could not reach ${K}: ${y.message}`)}}Ee(["Serverless deploy complete","",K?`URL:   ${K}`:"",`Stack: ${f}`,`Build: ${b.slice(0,12)}`].filter(Boolean).join(`
+import{p}from"./chunk-btrxye8p.js";import{$e,Sa,Fi,Qa,kn,Ji,Ya,Za,ac,cc}from"./chunk-9bmaq8q7.js";import{n,r,a,e,u,i,Ee}from"./chunk-qpasspad.js";import{v}from"./chunk-yf2drw7r.js";import{D}from"./chunk-19mhwmfp.js";import{g}from"./chunk-1wgyq50e.js";class J{client;region;constructor(t="us-east-1",s){this.region=t,this.client=new p(void 0,{profile:s})}async createSecret(t){let s={Name:t.Name};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.Tags&&t.Tags.length>0)s.Tags=t.Tags;if(t.AddReplicaRegions&&t.AddReplicaRegions.length>0)s.AddReplicaRegions=t.AddReplicaRegions;if(t.ForceOverwriteReplicaSecret!==void 0)s.ForceOverwriteReplicaSecret=t.ForceOverwriteReplicaSecret;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,ReplicationStatus:o.ReplicationStatus}}async updateSecret(t){let s={SecretId:t.SecretId,ClientRequestToken:t.ClientRequestToken||crypto.randomUUID()};if(t.Description)s.Description=t.Description;if(t.KmsKeyId)s.KmsKeyId=t.KmsKeyId;if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async putSecretValue(t){let s={SecretId:t.SecretId};if(t.SecretBinary)s.SecretBinary=t.SecretBinary;if(t.SecretString)s.SecretString=t.SecretString;if(t.VersionStages&&t.VersionStages.length>0)s.VersionStages=t.VersionStages;s.ClientRequestToken=t.ClientRequestToken||crypto.randomUUID();let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,VersionStages:o.VersionStages}}async getSecretValue(t){let s={SecretId:t.SecretId};if(t.VersionId)s.VersionId=t.VersionId;if(t.VersionStage)s.VersionStage=t.VersionStage;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId,SecretBinary:o.SecretBinary,SecretString:o.SecretString,VersionStages:o.VersionStages,CreatedDate:o.CreatedDate}}async describeSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return this.parseSecret(o)}async listSecrets(t){let s={};if(t?.MaxResults)s.MaxResults=t.MaxResults;if(t?.NextToken)s.NextToken=t.NextToken;if(t?.Filters&&t.Filters.length>0)s.Filters=t.Filters;if(t?.SortOrder)s.SortOrder=t.SortOrder;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{SecretList:o.SecretList?.map((c)=>this.parseSecret(c)),NextToken:o.NextToken}}async deleteSecret(t){let s={SecretId:t.SecretId};if(t.RecoveryWindowInDays!==void 0)s.RecoveryWindowInDays=t.RecoveryWindowInDays;if(t.ForceDeleteWithoutRecovery!==void 0)s.ForceDeleteWithoutRecovery=t.ForceDeleteWithoutRecovery;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,DeletionDate:o.DeletionDate}}async restoreSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async rotateSecret(t){let s={SecretId:t.SecretId};if(t.ClientRequestToken)s.ClientRequestToken=t.ClientRequestToken;if(t.RotationLambdaARN)s.RotationLambdaARN=t.RotationLambdaARN;if(t.RotationRules)s.RotationRules=t.RotationRules;if(t.RotateImmediately!==void 0)s.RotateImmediately=t.RotateImmediately;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,VersionId:o.VersionId}}async cancelRotateSecret(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async getResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name,ResourcePolicy:o.ResourcePolicy}}async putResourcePolicy(t){let s={SecretId:t.SecretId,ResourcePolicy:t.ResourcePolicy};if(t.BlockPublicPolicy!==void 0)s.BlockPublicPolicy=t.BlockPublicPolicy;let o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async deleteResourcePolicy(t){let s={SecretId:t},o=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)});return{ARN:o.ARN,Name:o.Name}}async tagResource(t){let s={SecretId:t.SecretId,Tags:t.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async untagResource(t){let s={SecretId:t.SecretId,TagKeys:t.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(s)})}async setString(t,s,o){try{let c=await this.putSecretValue({SecretId:t,SecretString:s});return{ARN:c.ARN,VersionId:c.VersionId}}catch(c){if(c.code==="ResourceNotFoundException"){let l=await this.createSecret({Name:t,SecretString:s,Description:o?.description,KmsKeyId:o?.kmsKeyId,Tags:o?.tags});return{ARN:l.ARN,VersionId:l.VersionId}}throw c}}async setJson(t,s,o){return this.setString(t,JSON.stringify(s),o)}async getString(t){return(await this.getSecretValue({SecretId:t})).SecretString}async getJson(t){let s=await this.getString(t);if(s)return JSON.parse(s);return}async listAll(){let t=[],s;do{let o=await this.listSecrets({NextToken:s});if(o.SecretList)t.push(...o.SecretList);s=o.NextToken}while(s);return t}parseSecret(t){return{ARN:t.ARN,Name:t.Name,Description:t.Description,KmsKeyId:t.KmsKeyId,RotationEnabled:t.RotationEnabled,RotationLambdaARN:t.RotationLambdaARN,RotationRules:t.RotationRules,LastRotatedDate:t.LastRotatedDate,LastChangedDate:t.LastChangedDate,LastAccessedDate:t.LastAccessedDate,DeletedDate:t.DeletedDate,NextRotationDate:t.NextRotationDate,Tags:t.Tags,SecretVersionsToStages:t.SecretVersionsToStages,CreatedDate:t.CreatedDate,PrimaryRegion:t.PrimaryRegion}}}import{existsSync as de,readdirSync as me,readFileSync as pe,statSync as fe}from"node:fs";import{join as ne,relative as Se}from"node:path";function k(t,s){let o=t.environments?.[s]?.app;if(!o)throw Error(`No serverless app configured for environment '${s}'. Add environments.${s}.app to your config.`);let c=t.project.slug,l=t.environments?.[s]?.region||t.project.region||"us-east-1";return{app:o,slug:c,region:l,stackName:$e(t,s),artifactBucket:Sa(c,s),assetsBucket:Fi(c,s)}}function Rt(t,s){let o=k(t,s),c=`${o.slug}-${s}`;return{region:o.region,slug:o.slug,stackName:o.stackName,functions:{http:`${c}-http`,queue:`${c}-queue`,cli:`${c}-cli`}}}async function q(t,s=8){let o;for(let c=0;c<s;c++)try{return await t()}catch(l){let d=l?.code||l?.name||"",m=String(l?.message||"");if(d==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(m)){o=l,await new Promise((f)=>setTimeout(f,3000));continue}throw l}throw o}var ie=(t,s)=>`releases/${t}/${s}/current.json`;async function G(t,s,o,c){try{return await t.getObjectJson(s,ie(o,c))}catch{return null}}async function ae(t,s,o,c,l){await t.putObjectJson(s,ie(o,c),l)}async function ye(t,s){if(!t.secrets)return{};let o=new J(s),c={},l=Array.isArray(t.secrets)?t.secrets.map((d)=>({envName:d.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:d})):Object.entries(t.secrets).map(([d,m])=>({envName:d,secretId:m}));if(Array.isArray(t.secrets)){let d=new Map;for(let{envName:f,secretId:S}of l)d.set(f,[...d.get(f)??[],S]);let m=[...d.entries()].filter(([,f])=>f.length>1);if(m.length){let f=m.map(([S,R])=>`${S} ← ${R.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${f}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:d,secretId:m}of l){let S=(await o.getSecretValue({SecretId:m})).SecretString??"";try{let R=JSON.parse(S);if(R&&typeof R==="object"&&!Array.isArray(R)){for(let[w,N]of Object.entries(R))c[w]=String(N);continue}}catch{}c[d]=S}return c}function ru(t,s){let o={},c=s.DbProxyEndpoint||s.DbEndpoint;if(c)o.DB_CONNECTION="mysql",o.DB_HOST=c,o.DB_PORT="3306",o.DB_DATABASE=o.DB_DATABASE||"app";if(s.CacheEndpoint){if(o.REDIS_HOST=s.CacheEndpoint,o.REDIS_PORT="6379",t.cache?.driver==="elasticache")o.CACHE_STORE="redis",o.CACHE_DRIVER="redis",o.SESSION_DRIVER="redis"}return o}function ea(t,s,o,c,l,d,m,f={}){let S=t.kind==="php"?ac({cacheDriver:t.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:c,TSCLOUD_ENV:o,MAINTENANCE_MODE:"0",...t.octane?{TSCLOUD_OCTANE:"1"}:{},...t.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...t.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...S,...f,...s.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${s.slug}-${o}-cache`}:{},...m?{TSCLOUD_QUEUE:m,SQS_QUEUE:m}:{},...d?{ASSET_URL:d}:{},...t.env??{},...l}}function Re(t){let s=t.slice(t.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[s]??"application/octet-stream"}function*oe(t){for(let s of me(t)){let o=ne(t,s);if(fe(o).isDirectory())yield*oe(o);else yield o}}async function he(t,s,o,c,l=!1){let d=0;for(let m of oe(o)){let f=Se(o,m).replace(/\\/g,"/");if(!l&&f.split("/").some((S)=>S.startsWith(".")))continue;await t.putObject({bucket:s,key:`${c}/${f}`,body:pe(m),contentType:Re(m),cacheControl:"public, max-age=31536000, immutable"}),d++}return d}function qo(t,s){let o=Object.entries(s).reduce((c,[l,d])=>c+Buffer.byteLength(`${l}=${d}`,"utf8"),0);if(o>4096){let c=Object.entries(s).map(([l,d])=>[l,Buffer.byteLength(`${l}=${d}`,"utf8")]).sort((l,d)=>d[1]-l[1]).slice(0,5).map(([l,d])=>`${l} (${d}B)`).join(", ");throw Error(`${t}: environment variables total ${o}B, over AWS's 4096B limit (${o-4096}B too large). Largest: ${c}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function _(t,s,o,c){qo(s,o),await q(()=>t.updateFunctionConfiguration({FunctionName:s,Environment:{Variables:o}})),await t.waitForFunctionActive(s,120);let l=c.kind==="image"?{FunctionName:s,ImageUri:c.imageUri}:{FunctionName:s,S3Bucket:c.bucket,S3Key:c.key};await q(()=>t.updateFunctionCode(l)),await t.waitForFunctionActive(s,120)}async function X(t,s){let c=(await q(()=>t.publishVersion({FunctionName:s}))).Version;if(!c)throw Error(`publishVersion returned no version for ${s}`);return await q(()=>t.updateAlias({FunctionName:s,Name:"live",FunctionVersion:c})),c}async function ym(t,s,o={}){let c=k(t,s),{app:l,slug:d,region:m,stackName:f,artifactBucket:S}=c,R=o.projectRoot??process.cwd();i(`Deploying serverless app: ${d} (${s})`),e(`Stack: ${f}`),e(`Region: ${m}`);let w=new g(m),N=new v(m),T=new D(m),P=l.kind==="php",O=l.packaging==="image",h=Ji(l),V,E,b,Y,U=[];if(O&&h.usesLayer&&h.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${h.kind}${h.kind==="node"?` ${h.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(O){u("Building + pushing container image");let{buildAndPushServerlessImage:y}=await import("./chunk-8tfqpp9m.js"),C=await y({app:l,projectRoot:R,region:m,repository:`${d}-${s}`,skipBuild:o.skipBuild,onStep:(I)=>e(`  ${I}`)});V=C.handlers,E={kind:"image",imageUri:C.imageUri},b=C.tag,U.push({ParameterKey:"ImageUri",ParameterValue:C.imageUri})}else{u("Packaging application");let y=P?cc({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}):await kn({projectRoot:R,app:l,skipBuild:o.skipBuild,onStep:(x)=>e(`  ${x}`)}),C=Qa(d,s,y.sha256);if(e(`Artifact: ${y.sha256.slice(0,12)} (${(y.zip.length/1024).toFixed(0)} KB)`),V=y.handlers,b=y.sha256,h.usesLayer){let x=h.layerEnvVar?process.env[h.layerEnvVar]:void 0;if(Y=l.layers??(x?[x]:void 0),!Y?.length){let ge=h.layerKind==="php"?"serverless:build-php-layer":h.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${h.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${h.layerEnvVar} env var (build one with \`cloud ${ge}\`)${h.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await w.bucketExists(S))u(`Creating artifact bucket ${S}`),await w.createBucket(S);if(await w.headObject(S,C).then((x)=>x!==null).catch(()=>!1))e("Artifact already uploaded — reusing");else u("Uploading artifact"),await w.putObject({bucket:S,key:C,body:y.zip,contentType:"application/zip"});E={kind:"zip",bucket:S,key:C},U.push({ParameterKey:"ArtifactBucket",ParameterValue:S},{ParameterKey:"ArtifactKey",ParameterValue:C})}let A=Za({config:t,environment:s,app:l,handlers:V,runtimeLayers:Y}),te=JSON.stringify(A.template),re=["CAPABILITY_NAMED_IAM"],L=await N.describeStacks({stackName:f}).then((y)=>y.Stacks[0]?.StackStatus).catch(()=>{return}),M=L!==void 0;if(L&&/DELETE_IN_PROGRESS/.test(L))u("Waiting for an in-progress stack delete to finish"),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),M=!1;else if(L&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(L))u(`Deleting unusable stack (status ${L}) before recreate`),await N.deleteStack(f),await N.waitForStack(f,"stack-delete-complete").catch(()=>{}),M=!1;u(M?"Updating infrastructure stack":"Creating infrastructure stack");try{if(M)await N.updateStack({stackName:f,templateBody:te,parameters:U,capabilities:re}),await N.waitForStack(f,"stack-update-complete");else await N.createStack({stackName:f,templateBody:te,parameters:U,capabilities:re,onFailure:"DELETE"}),await N.waitForStack(f,"stack-create-complete")}catch(y){if(/No updates are to be performed/i.test(String(y?.message)))e("No infrastructure changes");else throw y}let Q=await N.getStackOutputs(f).catch(()=>({})),B;if(l.assets){let y=ne(R,l.assets);if(de(y)){let C=l.assetDomain||Q.AssetsCdnDomain;B=C?`https://${C}/${b}`:void 0,u(`Syncing assets from ${l.assets}`);let I=await he(w,c.assetsBucket,y,b,l.dotFilesAsAssets);e(`Uploaded ${I} asset(s)${B?` → ${B}`:""}`)}else a(`Assets directory not found: ${y}`)}u("Resolving secrets");let j=await ye(l,m);if(l.database?.connection==="aurora-serverless")try{let C=await new J(m).getSecretValue({SecretId:`${d}/${s}/db`}),I=JSON.parse(C.SecretString??"{}");if(I.username)j.DB_USERNAME=I.username;if(I.password)j.DB_PASSWORD=I.password}catch(y){a(`Could not resolve Aurora DB credentials: ${y.message}`)}if(!await w.bucketExists(S))await w.createBucket(S);let H=await G(w,S,d,s),F={},Z=A.queueNames[0],ee=ru(l,Q);if(u("Activating functions"),F.http=ea(l,c,s,"http",j,B,Z,ee),await _(T,A.functionNames.http,F.http,E),F.cli=ea(l,c,s,"cli",j,B,Z,ee),await _(T,A.functionNames.cli,F.cli,E),A.queueNames.length)F.queue=ea(l,c,s,"queue",j,B,Z,ee),await _(T,A.functionNames.queue,F.queue,E);let se=(l.provisionedConcurrency??0)>0,W={};if(se){if(u("Publishing versions + flipping live alias"),W.http=await X(T,A.functionNames.http),W.cli=await X(T,A.functionNames.cli),A.queueNames.length)W.queue=await X(T,A.functionNames.queue)}if(await ae(w,S,d,s,{sha:b,code:E,previousSha:H?.sha,previousCode:H?.code,previousFunctionEnv:H?.functionEnv,...se?{functionVersions:W,previousFunctionVersions:H?.functionVersions}:{},functionEnv:F,functionNames:{http:A.functionNames.http,cli:A.functionNames.cli,...A.queueNames.length?{queue:A.functionNames.queue}:{}},assetUrl:B,timestamp:new Date().toISOString()}),!o.skipDeployHooks&&l.deploy?.length){u("Running deploy hooks");for(let y of l.deploy){e(`  deploy: ${y}`);let C=await T.invoke({FunctionName:A.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:y},LogType:"Tail"});if(C.FunctionError)throw r("Deploy hook failed — the new build is ALREADY LIVE."),e(`  Roll back with: cloud serverless:rollback --env ${s}`),Error(`Deploy hook failed (${y}): ${C.Payload}`)}}let K=Q.HttpApiEndpoint;if(!o.skipHealthCheck&&K){u("Health check");try{let y=await fetch(K,{method:"GET"});e(`GET ${K} → ${y.status}`)}catch(y){a(`Health check could not reach ${K}: ${y.message}`)}}Ee(["Serverless deploy complete","",K?`URL:   ${K}`:"",`Stack: ${f}`,`Build: ${b.slice(0,12)}`].filter(Boolean).join(`
 `),"green")}async function ta(t,s){let o=k(t,s),c=new g(o.region),l=new D(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d)throw Error("No previous release to redeploy. Run a full deploy first.");i(`Redeploying ${o.slug} (${s}) — build ${d.sha.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;u(`Re-activating ${m} (${f})`),await _(l,f,d.functionEnv[m]??{},d.code);let S=d.functionVersions?.[m];if(S)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:S}))}n("Redeploy complete")}async function ra(t,s){let o=k(t,s),c=new g(o.region),l=new D(o.region),d=await G(c,o.artifactBucket,o.slug,s);if(!d?.previousCode)throw Error("No previous release to roll back to.");i(`Rolling back ${o.slug} (${s}) → ${d.previousSha?.slice(0,12)}`);for(let[m,f]of Object.entries(d.functionNames)){if(!f)continue;u(`Restoring ${m} (${f})`);let S=d.previousFunctionEnv?.[m]??d.functionEnv[m]??{};await _(l,f,S,d.previousCode);let R=d.previousFunctionVersions?.[m];if(R)await q(()=>l.updateAlias({FunctionName:f,Name:"live",FunctionVersion:R}))}await ae(c,o.artifactBucket,o.slug,s,{...d,sha:d.previousSha??d.sha,code:d.previousCode,functionEnv:d.previousFunctionEnv??d.functionEnv,functionVersions:d.previousFunctionVersions??d.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),n("Rollback complete")}async function Wo(t,s,o,c){let l=k(t,s),d=new D(l.region),m=`${l.slug}-${s}-http`,S={...(await d.getFunction(m)).Configuration?.Environment?.Variables??{}};if(S.MAINTENANCE_MODE=o?"1":"0",o&&c)S.MAINTENANCE_BYPASS_SECRET=c;if(!o)delete S.MAINTENANCE_BYPASS_SECRET;if(await q(()=>d.updateFunctionConfiguration({FunctionName:m,Environment:{Variables:S}})),(l.app.provisionedConcurrency??0)>0)await d.waitForFunctionActive(m,120),await X(d,m);n(o?"Application is now in maintenance mode (503)":"Application is live")}async function Wt(t,s,o){let c=k(t,s),l=new D(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"});if(m.FunctionError)throw Error(`Command failed: ${m.Payload}`);return m.Payload??""}var ce=(t,s)=>`commands/${t}/${s}/history.json`,ve=50;async function le(t,s,o,c){try{return(await t.getObjectJson(s,ce(o,c)))?.records??[]}catch{return[]}}async function bm(t,s,o){let c=k(t,s),l=new D(c.region),d=`${c.slug}-${s}-cli`,m=await l.invoke({FunctionName:d,InvocationType:"RequestResponse",Payload:{command:o},LogType:"Tail"}),f=m.Payload??"",S=m.FunctionError?"error":"ok",R=-1;try{let w=new g(c.region);if(await w.bucketExists(c.artifactBucket)){let N=await le(w,c.artifactBucket,c.slug,s);R=N.reduce((T,P)=>Math.max(T,P.id),0)+1,N.push({id:R,command:o,timestamp:new Date().toISOString(),status:S,output:f.slice(0,4000)}),await w.putObjectJson(c.artifactBucket,ce(c.slug,s),{records:N.slice(-ve)})}}catch{}if(m.FunctionError)throw Error(`Command failed${R>0?` (#${R})`:""}: ${f}`);return{id:R,status:S,output:f}}async function nu(t,s){let o=k(t,s),c=new g(o.region);return le(c,o.artifactBucket,o.slug,s)}async function Sm(t,s,o){let c=await nu(t,s);if(!c.length)return;return o==null?c[c.length-1]:c.find((l)=>l.id===o)}async function vm(t,s,o){let c=Buffer.from(o,"utf-8").toString("base64");return Wt(t,s,`tscloud:db-query --sql-base64=${c}`)}async function z(t,s){let o=k(t,s),c=new v(o.region),l=new D(o.region),d=new g(o.region),m="not deployed",f={};try{let{Stacks:O}=await c.describeStacks({stackName:o.stackName});m=O?.[0]?.StackStatus??m;for(let h of O?.[0]?.Outputs??[])if(h.OutputKey)f[h.OutputKey]=h.OutputValue??""}catch{}let S=Ya(o.app,o.slug,s),R=o.app.provisionedConcurrency??0,w=["http","cli",...S.length?["queue"]:[]],N=`${o.slug}-${s}`,T=[];for(let O of w){let h=`${N}-${O}`,V={mode:O,name:h,version:"$LATEST"};if(R>0){let E=await l.getAlias(h,"live").catch(()=>null);if(E?.FunctionVersion){V.version=E.FunctionVersion;let b=await l.getProvisionedConcurrencyConfig(h,"live").catch(()=>null);if(b)V.provisioned={status:b.Status??"-",allocated:b.AllocatedProvisionedConcurrentExecutions??0,requested:b.RequestedProvisionedConcurrentExecutions??0}}}T.push(V)}let P=await G(d,o.artifactBucket,o.slug,s).catch(()=>null);return{slug:o.slug,environment:s,region:o.region,stackStatus:m,endpoint:f.HttpApiEndpoint,assetUrl:P?.assetUrl,scheduler:o.app.scheduler??"on",queues:S,provisionedConcurrency:R,functions:T,lastRelease:P?{sha:P.sha,timestamp:P.timestamp}:void 0}}function ue(t,s){return`${t}-${s}-db`}async function na(t,s,o,c){let l=k(t,s);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:d}=await import("./chunk-b9ersj22.js"),m=new d(l.region),f=ue(l.slug,s);u(`Scaling ${f} → ${o}–${c} ACUs`),await m.modifyDBCluster({DBClusterIdentifier:f,ServerlessV2ScalingConfiguration:{MinCapacity:o,MaxCapacity:c},ApplyImmediately:!0}),n(`Scaling applied to ${f} (takes effect shortly).`)}async function Cm(t,s,o){let c=k(t,s);if(c.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!o.toTime&&!o.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:l}=await import("./chunk-b9ersj22.js"),d=new l(c.region),m=ue(c.slug,s),f=o.latest?"latest":o.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),S=o.target??`${m}-restore-${f}`;u(`Restoring ${m} → new cluster ${S} (${o.latest?"latest restorable time":o.toTime.toISOString()})`),await d.restoreDBClusterToPointInTime({DBClusterIdentifier:S,SourceDBClusterIdentifier:m,RestoreToTime:o.toTime,UseLatestRestorableTime:o.latest}),u("Waiting for the restored cluster to be ready");for(let R=0;R<120;R++){let{DBClusters:w}=await d.describeDBClusters({DBClusterIdentifier:S}),N=w?.[0]?.Status;if(N&&N!=="creating")break;await new Promise((T)=>setTimeout(T,15000))}return u("Adding a writer instance"),await d.createDBInstance({DBInstanceIdentifier:`${S}-1`,DBClusterIdentifier:S,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),n(`Restore complete → cluster ${S} with writer ${S}-1. Point an env's database at it once available.`),S}
 export{J,Rt,ru,ea,qo,ym,ta,ra,Wo,Wt,bm,nu,Sm,vm,z,na,Cm};

package/dist/bin/chunk-7aqzsbak.js

@@ -0,0 +1 @@
+import{Ds,mm,gm,ks}from"./chunk-ff3x4pgw.js";import"./chunk-2dbyh1g2.js";import"./chunk-9bmaq8q7.js";import"./chunk-8rkfwgb4.js";export{mm as getComputeDeployHistory,ks as restoreDatabaseBackup,Ds as rollbackComputeSite,gm as runComputeRecipe};

package/dist/bin/{chunk-7yhy2a7h.js → chunk-86w3vzx8.js}

@@ -1 +1 @@
-import{rl,Tm}from"./chunk-08sws53b.js";import"./chunk-69mejej3.js";import"./chunk-1wgyq50e.js";import"./chunk-btrxye8p.js";export{rl as EmailClient,Tm as email};
+import{rl,Tm}from"./chunk-bxks81wn.js";import"./chunk-69mejej3.js";import"./chunk-1wgyq50e.js";import"./chunk-btrxye8p.js";export{rl as EmailClient,Tm as email};

package/dist/bin/chunk-8tfqpp9m.js

@@ -0,0 +1 @@
+import{qp}from"./chunk-bycbwddj.js";import"./chunk-z9g7fa1w.js";import"./chunk-qpasspad.js";import"./chunk-btrxye8p.js";import"./chunk-9bmaq8q7.js";import"./chunk-8rkfwgb4.js";export{qp as buildAndPushServerlessImage};