@stacksjs/ts-cloud 0.9.2 → 0.9.3

package/dist/bin/chunk-vek8a0w6.js

@@ -0,0 +1 @@
+import{id as a,jd as b}from"./chunk-ctd2vg9w.js";import"./chunk-j703btc5.js";import"./chunk-fpm59y25.js";import"./chunk-mh0kdzqp.js";export{b as ACMDnsValidator,a as ACMClient};

package/dist/bin/chunk-waayf9ay.js

@@ -0,0 +1,2 @@
+import{rg as w}from"./chunk-mr0atd2s.js";import{yg as E}from"./chunk-271gk1n2.js";import{$n as R,Co as u,Ho as D,Io as F,Pn as H,Rn as C}from"./chunk-jpjamjey.js";import{execFileSync as P}from"node:child_process";import{mkdirSync as _,mkdtempSync as k,rmSync as S,writeFileSync as Z}from"node:fs";import{tmpdir as m}from"node:os";import{dirname as h,join as J}from"node:path";function A(M,q){for(let z of q){let V=J(M,z.name);_(h(V),{recursive:!0}),Z(V,z.data,z.mode?{mode:z.mode}:void 0)}}async function p(M){let{app:q,projectRoot:z,region:V,repository:W}=M,b=q.architecture??"x86_64",f=b==="arm64"?"linux/arm64":"linux/amd64",U=q.kind==="php",K=M.onStep??(()=>{}),N=k(J(m(),"tscloud-img-"));try{let $=J(N,"app");_($,{recursive:!0});let v,B;if(U){D({projectRoot:z,app:q,skipBuild:M.skipBuild,onStep:K}),K("staging application tree");let G=F(z);A($,G),A(J(N,"runtime"),u().map((T)=>({name:T.path,data:T.contents,mode:T.mode})));let O=q.handlers?.http??"public/index.php";v={http:O,queue:q.handlers?.queue??O,cli:q.handlers?.cli??O},B=H(G.map((T)=>`${T.name}:${T.data.length}`).join("|"))}else{K("bundling application");let G=await C({projectRoot:z,app:q,skipBuild:M.skipBuild,onStep:K});Z(J($,"index.mjs"),G.bundle),v=G.handlers,B=G.sha256}let x=B.slice(0,16);Z(J(N,"Dockerfile"),R({kind:q.kind??"node",phpVersion:q.phpVersion,architecture:b}));let I=new w(V),Q;try{Q=(await I.describeRepositories({repositoryNames:[W]})).repositories?.[0]?.repositoryUri??""}catch{Q=""}if(!Q)K(`creating ECR repository ${W}`),Q=(await I.createRepository({repositoryName:W,imageScanningConfiguration:{scanOnPush:!0}})).repository?.repositoryUri??"";if(!Q)throw Error(`could not resolve ECR repository URI for ${W}`);let X=`${Q}:${x}`;K("docker build"),P("docker",["build","--platform",f,"--provenance=false","--sbom=false","-t",X,N],{stdio:"inherit"}),K("ecr auth + push");let Y=(await I.getAuthorizationToken()).authorizationData?.[0];if(!Y?.authorizationToken||!Y.proxyEndpoint)throw Error("failed to get an ECR authorization token");let j=Y.proxyEndpoint.replace(/^https?:\/\//,""),L=J(N,".docker");return _(L,{recursive:!0}),Z(J(L,"config.json"),JSON.stringify({auths:{[j]:{auth:Y.authorizationToken}}})),P("docker",["push",X],{stdio:"inherit",env:{...process.env,DOCKER_CONFIG:L}}),E(`Image: ${X}`),{imageUri:X,tag:x,handlers:v}}finally{S(N,{recursive:!0,force:!0})}}
+export{p as qg};

package/dist/bin/chunk-ynjvbphf.js

@@ -0,0 +1,8 @@
+import{ng as I}from"./chunk-ry030a6b.js";var _=(e)=>e==null?void 0:String(e),b=(e)=>Number(e)===1,y=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function C(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:_(e.environment_id),resourceId:_(e.resource_id),previewId:_(e.preview_id)},key:String(e.key),kind:String(e.kind),value:_(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:_(e.secret_ref),backend:String(e.backend),backendVersion:_(e.backend_version),origin:String(e.origin),required:b(e.required),metadata:y(e.metadata,{}),lastUsedAt:_(e.last_used_at),rotatedAt:_(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function R(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:b(e.required),requiresRedeploy:b(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class q{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?C(r):void 0}find(e,r,o){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,o);return t?C(t):void 0}list(e){let r=["project_id=?"],o=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),o.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),o.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...o).map(C)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),o=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,o,o]),this.get(r)}update(e,r,o){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...o}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[o.value??null,o.valueFingerprint,o.secretRef??null,o.backend,o.backendVersion??null,o.required?1:0,JSON.stringify(o.metadata),o.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let o=this.get(e);if(!o)throw Error("Configuration entry was not found.");if(o.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return o}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((o)=>o.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(R)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(R)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:y(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let o=e.scope;if(o.type==="project"){if(o.id!==e.projectId||o.environmentId||o.resourceId||o.previewId)throw Error("Project configuration scope must reference only its project.");return}if(o.type==="environment"){let n=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(o.id);if(!n||n.project_id!==e.projectId||o.environmentId&&o.environmentId!==o.id||o.resourceId||o.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(o.type==="service"||o.type==="function"){let n=this.controlPlane.getResource(o.id);if(!n||n.projectId!==e.projectId||o.type==="function"&&n.kind!=="function"||o.resourceId&&o.resourceId!==o.id||o.environmentId&&n.environmentId!==o.environmentId||o.previewId)throw Error(`${o.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(o.id);if(!t||t.project_id!==e.projectId||o.previewId&&o.previewId!==o.id||o.environmentId&&o.environmentId!==t.base_environment_id||o.resourceId&&o.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var P=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function O(e){let r={n:`
+`,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(o,t)=>r[t])}function x(e){let r={},o=[],t=e.replace(/\r\n?/g,`
+`).split(`
+`);for(let n=0;n<t.length;n++){let s=n+1,c=t[n];if(!c.trim()||c.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(c))c=c.replace(/^\s*export\s+/,"");let l=c.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!l){o.push({line:s,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let i=l[1],a=l[2];if(!P.test(i)){o.push({line:s,key:i,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${i}`});continue}let d=a;if(a.startsWith('"')||a.startsWith("'")){let g=a[0],f=[a.slice(1)],S=!1;while(!0){let m=f[f.length-1],h=!1,E=-1;for(let u=0;u<m.length;u++){if(g==='"'&&m[u]==="\\"&&!h){h=!0;continue}if(m[u]===g&&!h){E=u;break}h=!1}if(E>=0){f[f.length-1]=m.slice(0,E),S=!0;break}if(++n>=t.length)break;f.push(t[n])}if(!S){o.push({line:s,key:i,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${i}.`});continue}if(d=f.join(`
+`),g==='"')d=O(d)}else d=a.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(r,i)){let g=r[i]!==d;if(o.push({line:s,key:i,severity:g?"error":"warning",code:g?"conflict":"duplicate",message:g?`${i} has conflicting values.`:`${i} is duplicated with the same value.`}),g)continue}r[i]=d}return{values:r,diagnostics:o,valid:!o.some((n)=>n.severity==="error")}}function j(e){return Object.entries(e).sort(([r],[o])=>r.localeCompare(o)).map(([r,o])=>{if(!P.test(r))throw Error(`Invalid environment variable name: ${r}`);return`${r}=${JSON.stringify(o)}`}).join(`
+`)+(Object.keys(e).length?`
+`:"")}import{createCipheriv as T,createDecipheriv as k,createHash as D,randomBytes as W}from"node:crypto";class w{controlPlane;now;kind="local_encrypted";key;constructor(e,r,o=()=>new Date){this.controlPlane=e;this.now=o;if(!r)throw Error("Configuration encryption key is required.");this.key=D("sha256").update(`ts-cloud:configuration:${r}`).digest()}encrypt(e){let r=W(12),o=T("aes-256-gcm",this.key,r),t=Buffer.concat([o.update(e,"utf8"),o.final()]);return`v1.${r.toString("base64url")}.${o.getAuthTag().toString("base64url")}.${t.toString("base64url")}`}decrypt(e){let[r,o,t,n]=e.split(".");if(r!=="v1"||!o||!t||!n)throw Error("Encrypted configuration secret is unavailable.");try{let s=k("aes-256-gcm",this.key,Buffer.from(o,"base64url"));return s.setAuthTag(Buffer.from(t,"base64url")),Buffer.concat([s.update(Buffer.from(n,"base64url")),s.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let r=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(r))throw Error("Invalid local configuration secret reference.");let t=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(r)?.version??0)+1,n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[r,this.encrypt(e.value),D("sha256").update(e.value).digest("hex"),t,n,n]),{reference:r,version:String(t)}}async resolve(e){let r=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!r)throw Error("Configuration secret was not found.");return this.decrypt(r.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class N{client;region;kind="aws_secrets_manager";constructor(e,r){this.client=e;this.region=r}async put(e){if(e.reference){let o=this.id(e.reference),t=await this.client.putSecretValue({SecretId:o,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:t.VersionId??e.idempotencyKey}}let r=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(r.ARN??r.Name??e.name)}`,version:r.VersionId??e.idempotencyKey}}async resolve(e){let r=await this.client.getSecretValue({SecretId:this.id(e)});if(r.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return r.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let r=new URL(e);if(r.protocol!=="aws-sm:"||r.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(r.pathname.slice(1))}}class ${client;region;kind="aws_ssm";constructor(e,r){this.client=e;this.region=r}async put(e){let r=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,o=await this.client.putParameter({Name:r,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${r}`,version:String(o.Version??1)}}async resolve(e){let r=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(r.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return r.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let r=new URL(e);if(r.protocol!=="aws-ssm:"||r.hostname!==this.region||!r.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return r.pathname}}class M{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as L}from"node:crypto";var B=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,U=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function v(e){return[...new Set(e)].sort()}function A(e,r={}){let o=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!r.inherited,overridden:!!r.overridden,required:e.required,backend:!o||r.canReadSecretMetadata?e.backend:void 0,backendVersion:!o||r.canReadSecretMetadata?e.backendVersion:void 0,reference:o&&r.canReadSecretMetadata?e.secretRef:void 0,value:!o?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class V{store;backends=new Map;fingerprintKey;now;constructor(e,r){if(this.store=e,this.fingerprintKey=r.fingerprintKey??r.encryptionKey,this.now=r.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let o=r.backends??[new w(e.controlPlane,r.encryptionKey,this.now)];for(let t of o)this.backends.set(t.kind,t)}list(e){let r=e.search?.toLowerCase();return this.store.list(e).filter((o)=>!r||o.key.toLowerCase().includes(r)).map((o)=>A(o,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let r=this.store.list({projectId:e.projectId,scope:e.scope}),o=new Map(r.map((i)=>[i.key,i])),t=[],n=[],s=[],c=[];for(let[i,a]of Object.entries(e.values)){t.push(...this.warnings(i,a));let d=o.get(i);if(!d)n.push(i);else if(d.valueFingerprint!==this.fingerprint(a))s.push(i);else c.push(i)}let l=e.removeMissing?r.filter((i)=>!Object.hasOwn(e.values,i.key)).map((i)=>i.key):[];return{added:v(n),changed:v(s),removed:v(l),unchanged:v(c),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...n,...s,...l]),warnings:t}}async set(e){let r=this.requestHash(e),o=e.idempotencyKey;if(o){let m=this.store.mutation(o);if(m){if(m.requestHash!==r)throw Error("Idempotency key was already used for a different configuration mutation.");let h=this.store.get(String(m.result.entryId??""));if(!h)throw Error("Idempotent configuration result is no longer available.");return{entry:h,mutation:m.result.mutation,warnings:[]}}}if(e.value!=null&&B.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let t=this.store.find(e.projectId,e.scope,e.key),n=this.fingerprint(e.value??e.reference??"");if(t&&e.expectedVersion!=null&&t.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(t&&t.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let s=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!t&&(t.valueFingerprint!==n||t.backend!==s||t.required!==!!e.required)&&(this.isProduction(t)||this.store.dependencies(t.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let l=e.reference,i;if(e.kind==="secret"){let m=this.backend(s);if(e.reference&&e.value==null){if(!await m.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");i=t?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let h=await m.put({reference:t?.backend===s?t.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:o??crypto.randomUUID()});l=h.reference,i=h.version}}let a=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&a==null)throw Error("A variable value is required.");let d=!t||t.valueFingerprint!==n||t.backend!==s||t.secretRef!==l||t.backendVersion!==i||t.required!==!!e.required,g=t?d?this.store.update(t.id,t.version,{value:a,valueFingerprint:n,secretRef:l,backend:s,backendVersion:i,required:!!e.required,metadata:I(e.metadata??t.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():t.rotatedAt}):t:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:a,valueFingerprint:n,secretRef:l,backend:s,backendVersion:i,origin:e.origin??"managed",required:!!e.required,metadata:I(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),f=this.affectedResources(e.projectId,e.scope,[e.key]),S={added:t?[]:[e.key],changed:t&&d?[e.key]:[],removed:[],unchanged:t&&!d?[e.key]:[],affectedResourceIds:f,versions:{[e.key]:g.version}};if(o)this.store.recordMutation({projectId:e.projectId,idempotencyKey:o,requestHash:r,actorId:e.actorId,result:{entryId:g.id,mutation:S}});return this.audit(e.projectId,e.actorId,t&&d?"configuration.updated":t?"configuration.unchanged":"configuration.created",g,f),{entry:g,mutation:S,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let r=x(e.source);if(!r.valid)return{document:r,warnings:[]};let o=new Set(e.secretKeys??[]),t={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},n=[];for(let[s,c]of Object.entries(r.values)){let l=await this.set({...e,source:void 0,key:s,value:c,kind:o.has(s)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${s}`:void 0});t.added.push(...l.mutation.added),t.changed.push(...l.mutation.changed),t.unchanged.push(...l.mutation.unchanged),t.affectedResourceIds.push(...l.mutation.affectedResourceIds),Object.assign(t.versions,l.mutation.versions),n.push(...l.warnings)}return t.added=v(t.added),t.changed=v(t.changed),t.unchanged=v(t.unchanged),t.affectedResourceIds=v(t.affectedResourceIds),{document:r,mutation:t,warnings:n}}exportVariables(e){return j(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((r)=>[r.key,r.value??""])))}async transfer(e){let r=this.store.get(e.entryId);if(!r)throw Error("Configuration entry was not found.");if(r.scope.type===e.targetScope.type&&r.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let o=r.kind==="variable"?r.value:r.backend==="external"?void 0:await this.backend(r.backend).resolve(r.secretRef),t=r.kind==="secret"?r.backend:void 0,n=await this.set({organizationId:r.organizationId,projectId:r.projectId,scope:e.targetScope,key:r.key,kind:r.kind,value:o,reference:r.backend==="external"?r.secretRef:void 0,backend:t,required:r.required,metadata:r.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:r.origin});if(e.mode==="move")await this.remove({entryId:r.id,expectedVersion:r.version,confirmed:e.confirmed,actorId:e.actorId});let s={added:n.mutation.added,changed:n.mutation.changed,removed:e.mode==="move"?[r.key]:[],unchanged:n.mutation.unchanged,affectedResourceIds:v([...n.mutation.affectedResourceIds,...this.affectedResources(r.projectId,r.scope,[r.key])]),versions:n.mutation.versions};return{entry:n.entry,mutation:s}}async resolve(e){let r=this.store.list({projectId:e.projectId}),o=r.filter((a)=>this.applies(a,e)).sort((a,d)=>this.rank(a.scope.type)-this.rank(d.scope.type)),t=new Map,n=new Set;for(let a of o){if(t.has(a.key))n.add(a.key);t.set(a.key,a)}let s={},c={},l=[],i=new Set(e.allowedPreviewSecrets??[]);for(let[a,d]of t){if(e.previewId&&d.kind==="secret"&&d.scope.type!=="preview"&&(!e.trustedPreview||!i.has(a)))continue;if(d.kind==="variable")s[a]=d.value??"";else if(e.nativeReferences)s[a]=d.secretRef;else{let g=this.backend(d.backend);if(!await g.validate(d.secretRef)){if(l.push({key:a,code:"stale_reference",message:`${a} points to an unavailable secret.`}),d.required)l.push({key:a,code:"missing_required",message:`${a} is required but unavailable.`});continue}s[a]=await g.resolve(d.secretRef)}c[a]=A(d,{inherited:d.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:n.has(a),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),d.id])}return{values:s,entries:c,warnings:l,configurationHash:this.fingerprint([...t.values()].map((a)=>`${a.key}:${a.valueFingerprint}:${a.version}`).sort().join(`
+`))}}async reveal(e){let r=this.store.get(e.entryId);if(!r||r.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let o=await this.backend(r.backend).resolve(r.secretRef);return this.audit(r.projectId,e.actorId,"configuration.secret.revealed",r,[]),o}async remove(e){let r=this.store.get(e.entryId);if(!r)throw Error("Configuration entry was not found.");let o=this.store.dependencies(r.id);if(((r.scope.environmentId?this.store.controlPlane.listEnvironments(r.projectId).some((c)=>c.id===r.scope.environmentId&&c.kind==="production"):r.scope.type==="project")||o.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(r.kind==="secret"&&r.backend!=="external")await this.backend(r.backend).remove(r.secretRef);this.store.remove(r.id,e.expectedVersion);let n=v(o.map((c)=>c.resourceId)),s={added:[],changed:[],removed:[r.key],unchanged:[],affectedResourceIds:n,versions:{}};return this.audit(r.projectId,e.actorId,"configuration.deleted",r,n),s}applies(e,r){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===r.environmentId;if(e.scope.type==="service")return e.scope.id===r.resourceId;if(e.scope.type==="function")return e.scope.id===r.functionId;return e.scope.id===r.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${L("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let r=this.backends.get(e);if(!r)throw Error(`Configuration secret backend is not configured: ${e}`);return r}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((r)=>r.id===e.scope.environmentId&&r.kind==="production")}warnings(e,r){let o=[];if(U.test(e))o.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(r)>65536)o.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return o}affectedResources(e,r,o){let t=this.store.list({projectId:e,scope:r}).filter((n)=>o.includes(n.key)).flatMap((n)=>this.store.dependencies(n.id).map((s)=>s.resourceId));if(r.type==="service"||r.type==="function")return v([...t,r.id]);if(r.type==="environment")return v([...t,...this.store.controlPlane.listResources(e,r.id).map((n)=>n.id)]);if(r.type==="preview"){let n=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(r.id);return v([...t,...n?[n.resource_id]:[]])}return v([...t,...this.store.controlPlane.listResources(e).map((n)=>n.id)])}audit(e,r,o,t,n){this.store.controlPlane.appendEvent({projectId:e,actorId:r,type:o,payload:{entryId:t.id,key:t.key,kind:t.kind,scopeType:t.scope.type,scopeId:t.scope.id,backend:t.backend,version:t.version,affectedResourceIds:n}})}}async function X(e,r,o,t){let n={added:0,changed:0,removed:0,overridden:0},s=async(c,l)=>{let i=e.store.list({projectId:r.project.id,scope:c,kind:"variable"}),a=new Set(Object.keys(l));for(let d of i.filter((g)=>g.origin==="config"&&!a.has(g.key)))await e.remove({entryId:d.id,expectedVersion:d.version,confirmed:!0,actorId:t}),n.removed++;for(let[d,g]of Object.entries(l)){let f=e.store.find(r.project.id,c,d);if(f?.origin!=="config"){if(f)n.overridden++;else await e.set({organizationId:r.organization.id,projectId:r.project.id,scope:c,key:d,kind:"variable",value:String(g),origin:"config",confirmed:!0,actorId:t}),n.added++;continue}if(f.value===String(g))continue;await e.set({organizationId:r.organization.id,projectId:r.project.id,scope:c,key:d,kind:"variable",value:String(g),origin:"config",confirmed:!0,actorId:t,expectedVersion:f.version}),n.changed++}};for(let[c,l]of Object.entries(o.environments??{})){let i=r.environments.get(c);if(!i)continue;let a=l,d={...a.variables??{},...a.app?.env??{}};await s({type:"environment",id:i.id,environmentId:i.id},d);for(let[g,f]of Object.entries(o.sites??{})){let S=r.store.listResources(r.project.id,i.id).find((m)=>m.kind==="application"&&m.slug===g);if(S)await s({type:"service",id:S.id,environmentId:i.id,resourceId:S.id},{...f.env??{}})}for(let[g,f]of Object.entries(o.infrastructure?.functions??{})){let S=r.store.listResources(r.project.id,i.id).find((m)=>m.kind==="function"&&m.slug===g);if(S)await s({type:"function",id:S.id,environmentId:i.id,resourceId:S.id},{...f.environment??{}})}}return n}export{q as ag,x as bg,j as cg,w as dg,N as eg,$ as fg,M as gg,V as hg,X as ig};

package/dist/bin/chunk-yv9sth30.js

@@ -0,0 +1 @@
+import{dd as a}from"./chunk-fhc6ntvd.js";import"./chunk-fpm59y25.js";import"./chunk-mh0kdzqp.js";export{a as RDSClient};