@stacksjs/ts-cloud 0.9.3 → 0.10.0

package/dist/bin/{chunk-ynjvbphf.js → chunk-axvr7dwa.js}

@@ -1,8 +1,8 @@
-import{ng as I}from"./chunk-ry030a6b.js";var _=(e)=>e==null?void 0:String(e),b=(e)=>Number(e)===1,y=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function C(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:_(e.environment_id),resourceId:_(e.resource_id),previewId:_(e.preview_id)},key:String(e.key),kind:String(e.kind),value:_(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:_(e.secret_ref),backend:String(e.backend),backendVersion:_(e.backend_version),origin:String(e.origin),required:b(e.required),metadata:y(e.metadata,{}),lastUsedAt:_(e.last_used_at),rotatedAt:_(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function R(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:b(e.required),requiresRedeploy:b(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class q{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?C(r):void 0}find(e,r,o){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,o);return t?C(t):void 0}list(e){let r=["project_id=?"],o=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),o.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),o.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...o).map(C)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),o=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,o,o]),this.get(r)}update(e,r,o){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...o}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[o.value??null,o.valueFingerprint,o.secretRef??null,o.backend,o.backendVersion??null,o.required?1:0,JSON.stringify(o.metadata),o.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let o=this.get(e);if(!o)throw Error("Configuration entry was not found.");if(o.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return o}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((o)=>o.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(R)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(R)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:y(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let o=e.scope;if(o.type==="project"){if(o.id!==e.projectId||o.environmentId||o.resourceId||o.previewId)throw Error("Project configuration scope must reference only its project.");return}if(o.type==="environment"){let n=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(o.id);if(!n||n.project_id!==e.projectId||o.environmentId&&o.environmentId!==o.id||o.resourceId||o.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(o.type==="service"||o.type==="function"){let n=this.controlPlane.getResource(o.id);if(!n||n.projectId!==e.projectId||o.type==="function"&&n.kind!=="function"||o.resourceId&&o.resourceId!==o.id||o.environmentId&&n.environmentId!==o.environmentId||o.previewId)throw Error(`${o.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(o.id);if(!t||t.project_id!==e.projectId||o.previewId&&o.previewId!==o.id||o.environmentId&&o.environmentId!==t.base_environment_id||o.resourceId&&o.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var P=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function O(e){let r={n:`
-`,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(o,t)=>r[t])}function x(e){let r={},o=[],t=e.replace(/\r\n?/g,`
+import{Cg as I}from"./chunk-jnsbzqzz.js";var y=(e)=>e==null?void 0:String(e),b=(e)=>Number(e)===1,E=(e,r)=>{try{return e==null?r:JSON.parse(String(e))}catch{return r}};function S(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:y(e.environment_id),resourceId:y(e.resource_id),previewId:y(e.preview_id)},key:String(e.key),kind:String(e.kind),value:y(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:y(e.secret_ref),backend:String(e.backend),backendVersion:y(e.backend_version),origin:String(e.origin),required:b(e.required),metadata:E(e.metadata,{}),lastUsedAt:y(e.last_used_at),rotatedAt:y(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function C(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:b(e.required),requiresRedeploy:b(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class q{controlPlane;now;constructor(e,r=()=>new Date){this.controlPlane=e;this.now=r}get(e){let r=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return r?S(r):void 0}find(e,r,n){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,r.type,r.id,n);return t?S(t):void 0}list(e){let r=["project_id=?"],n=[e.projectId];if(e.scope)r.push("scope_type=?","scope_id=?"),n.push(e.scope.type,e.scope.id);if(e.kind)r.push("kind=?"),n.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${r.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...n).map(S)}create(e){this.validateScope(e),this.validateEntry(e);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,n,n]),this.get(r)}update(e,r,n){let t=this.get(e);if(!t)throw Error("Configuration entry was not found.");if(this.validateEntry({...t,...n}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[n.value??null,n.valueFingerprint,n.secretRef??null,n.backend,n.backendVersion??null,n.required?1:0,JSON.stringify(n.metadata),n.rotatedAt??null,this.now().toISOString(),e,r]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,r){let n=this.get(e);if(!n)throw Error("Configuration entry was not found.");if(n.version!==r)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,r]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return n}setDependency(e){let r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,r,r]),this.dependencies(e.entryId).find((n)=>n.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(C)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(C)}mutation(e){let r=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return r?{requestHash:r.request_hash,result:E(r.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let r=this.controlPlane.getProject(e.projectId);if(!r||r.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let n=e.scope;if(n.type==="project"){if(n.id!==e.projectId||n.environmentId||n.resourceId||n.previewId)throw Error("Project configuration scope must reference only its project.");return}if(n.type==="environment"){let i=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(n.id);if(!i||i.project_id!==e.projectId||n.environmentId&&n.environmentId!==n.id||n.resourceId||n.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(n.type==="service"||n.type==="function"){let i=this.controlPlane.getResource(n.id);if(!i||i.projectId!==e.projectId||n.type==="function"&&i.kind!=="function"||n.resourceId&&n.resourceId!==n.id||n.environmentId&&i.environmentId!==n.environmentId||n.previewId)throw Error(`${n.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let t=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(n.id);if(!t||t.project_id!==e.projectId||n.previewId&&n.previewId!==n.id||n.environmentId&&n.environmentId!==t.base_environment_id||n.resourceId&&n.resourceId!==t.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var _=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function A(e){let r={n:`
+`,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(n,t)=>r[t])}function R(e){let r={},n=[],t=e.replace(/\r\n?/g,`
 `).split(`
-`);for(let n=0;n<t.length;n++){let s=n+1,c=t[n];if(!c.trim()||c.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(c))c=c.replace(/^\s*export\s+/,"");let l=c.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!l){o.push({line:s,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let i=l[1],a=l[2];if(!P.test(i)){o.push({line:s,key:i,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${i}`});continue}let d=a;if(a.startsWith('"')||a.startsWith("'")){let g=a[0],f=[a.slice(1)],S=!1;while(!0){let m=f[f.length-1],h=!1,E=-1;for(let u=0;u<m.length;u++){if(g==='"'&&m[u]==="\\"&&!h){h=!0;continue}if(m[u]===g&&!h){E=u;break}h=!1}if(E>=0){f[f.length-1]=m.slice(0,E),S=!0;break}if(++n>=t.length)break;f.push(t[n])}if(!S){o.push({line:s,key:i,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${i}.`});continue}if(d=f.join(`
-`),g==='"')d=O(d)}else d=a.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(r,i)){let g=r[i]!==d;if(o.push({line:s,key:i,severity:g?"error":"warning",code:g?"conflict":"duplicate",message:g?`${i} has conflicting values.`:`${i} is duplicated with the same value.`}),g)continue}r[i]=d}return{values:r,diagnostics:o,valid:!o.some((n)=>n.severity==="error")}}function j(e){return Object.entries(e).sort(([r],[o])=>r.localeCompare(o)).map(([r,o])=>{if(!P.test(r))throw Error(`Invalid environment variable name: ${r}`);return`${r}=${JSON.stringify(o)}`}).join(`
+`);for(let i=0;i<t.length;i++){let s=i+1,c=t[i];if(!c.trim()||c.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(c))c=c.replace(/^\s*export\s+/,"");let u=c.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!u){n.push({line:s,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let o=u[1],a=u[2];if(!_.test(o)){n.push({line:s,key:o,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${o}`});continue}let d=a;if(a.startsWith('"')||a.startsWith("'")){let g=a[0],l=[a.slice(1)],v=!1;while(!0){let f=l[l.length-1],m=!1,k=-1;for(let h=0;h<f.length;h++){if(g==='"'&&f[h]==="\\"&&!m){m=!0;continue}if(f[h]===g&&!m){k=h;break}m=!1}if(k>=0){l[l.length-1]=f.slice(0,k),v=!0;break}if(++i>=t.length)break;l.push(t[i])}if(!v){n.push({line:s,key:o,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${o}.`});continue}if(d=l.join(`
+`),g==='"')d=A(d)}else d=a.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(r,o)){let g=r[o]!==d;if(n.push({line:s,key:o,severity:g?"error":"warning",code:g?"conflict":"duplicate",message:g?`${o} has conflicting values.`:`${o} is duplicated with the same value.`}),g)continue}r[o]=d}return{values:r,diagnostics:n,valid:!n.some((i)=>i.severity==="error")}}function j(e){return Object.entries(e).sort(([r],[n])=>r.localeCompare(n)).map(([r,n])=>{if(!_.test(r))throw Error(`Invalid environment variable name: ${r}`);return`${r}=${JSON.stringify(n)}`}).join(`
 `)+(Object.keys(e).length?`
-`:"")}import{createCipheriv as T,createDecipheriv as k,createHash as D,randomBytes as W}from"node:crypto";class w{controlPlane;now;kind="local_encrypted";key;constructor(e,r,o=()=>new Date){this.controlPlane=e;this.now=o;if(!r)throw Error("Configuration encryption key is required.");this.key=D("sha256").update(`ts-cloud:configuration:${r}`).digest()}encrypt(e){let r=W(12),o=T("aes-256-gcm",this.key,r),t=Buffer.concat([o.update(e,"utf8"),o.final()]);return`v1.${r.toString("base64url")}.${o.getAuthTag().toString("base64url")}.${t.toString("base64url")}`}decrypt(e){let[r,o,t,n]=e.split(".");if(r!=="v1"||!o||!t||!n)throw Error("Encrypted configuration secret is unavailable.");try{let s=k("aes-256-gcm",this.key,Buffer.from(o,"base64url"));return s.setAuthTag(Buffer.from(t,"base64url")),Buffer.concat([s.update(Buffer.from(n,"base64url")),s.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let r=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(r))throw Error("Invalid local configuration secret reference.");let t=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(r)?.version??0)+1,n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[r,this.encrypt(e.value),D("sha256").update(e.value).digest("hex"),t,n,n]),{reference:r,version:String(t)}}async resolve(e){let r=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!r)throw Error("Configuration secret was not found.");return this.decrypt(r.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class N{client;region;kind="aws_secrets_manager";constructor(e,r){this.client=e;this.region=r}async put(e){if(e.reference){let o=this.id(e.reference),t=await this.client.putSecretValue({SecretId:o,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:t.VersionId??e.idempotencyKey}}let r=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(r.ARN??r.Name??e.name)}`,version:r.VersionId??e.idempotencyKey}}async resolve(e){let r=await this.client.getSecretValue({SecretId:this.id(e)});if(r.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return r.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let r=new URL(e);if(r.protocol!=="aws-sm:"||r.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(r.pathname.slice(1))}}class ${client;region;kind="aws_ssm";constructor(e,r){this.client=e;this.region=r}async put(e){let r=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,o=await this.client.putParameter({Name:r,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${r}`,version:String(o.Version??1)}}async resolve(e){let r=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(r.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return r.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let r=new URL(e);if(r.protocol!=="aws-ssm:"||r.hostname!==this.region||!r.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return r.pathname}}class M{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as L}from"node:crypto";var B=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,U=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function v(e){return[...new Set(e)].sort()}function A(e,r={}){let o=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!r.inherited,overridden:!!r.overridden,required:e.required,backend:!o||r.canReadSecretMetadata?e.backend:void 0,backendVersion:!o||r.canReadSecretMetadata?e.backendVersion:void 0,reference:o&&r.canReadSecretMetadata?e.secretRef:void 0,value:!o?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class V{store;backends=new Map;fingerprintKey;now;constructor(e,r){if(this.store=e,this.fingerprintKey=r.fingerprintKey??r.encryptionKey,this.now=r.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let o=r.backends??[new w(e.controlPlane,r.encryptionKey,this.now)];for(let t of o)this.backends.set(t.kind,t)}list(e){let r=e.search?.toLowerCase();return this.store.list(e).filter((o)=>!r||o.key.toLowerCase().includes(r)).map((o)=>A(o,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let r=this.store.list({projectId:e.projectId,scope:e.scope}),o=new Map(r.map((i)=>[i.key,i])),t=[],n=[],s=[],c=[];for(let[i,a]of Object.entries(e.values)){t.push(...this.warnings(i,a));let d=o.get(i);if(!d)n.push(i);else if(d.valueFingerprint!==this.fingerprint(a))s.push(i);else c.push(i)}let l=e.removeMissing?r.filter((i)=>!Object.hasOwn(e.values,i.key)).map((i)=>i.key):[];return{added:v(n),changed:v(s),removed:v(l),unchanged:v(c),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...n,...s,...l]),warnings:t}}async set(e){let r=this.requestHash(e),o=e.idempotencyKey;if(o){let m=this.store.mutation(o);if(m){if(m.requestHash!==r)throw Error("Idempotency key was already used for a different configuration mutation.");let h=this.store.get(String(m.result.entryId??""));if(!h)throw Error("Idempotent configuration result is no longer available.");return{entry:h,mutation:m.result.mutation,warnings:[]}}}if(e.value!=null&&B.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let t=this.store.find(e.projectId,e.scope,e.key),n=this.fingerprint(e.value??e.reference??"");if(t&&e.expectedVersion!=null&&t.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(t&&t.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let s=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!t&&(t.valueFingerprint!==n||t.backend!==s||t.required!==!!e.required)&&(this.isProduction(t)||this.store.dependencies(t.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let l=e.reference,i;if(e.kind==="secret"){let m=this.backend(s);if(e.reference&&e.value==null){if(!await m.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");i=t?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let h=await m.put({reference:t?.backend===s?t.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:o??crypto.randomUUID()});l=h.reference,i=h.version}}let a=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&a==null)throw Error("A variable value is required.");let d=!t||t.valueFingerprint!==n||t.backend!==s||t.secretRef!==l||t.backendVersion!==i||t.required!==!!e.required,g=t?d?this.store.update(t.id,t.version,{value:a,valueFingerprint:n,secretRef:l,backend:s,backendVersion:i,required:!!e.required,metadata:I(e.metadata??t.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():t.rotatedAt}):t:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:a,valueFingerprint:n,secretRef:l,backend:s,backendVersion:i,origin:e.origin??"managed",required:!!e.required,metadata:I(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),f=this.affectedResources(e.projectId,e.scope,[e.key]),S={added:t?[]:[e.key],changed:t&&d?[e.key]:[],removed:[],unchanged:t&&!d?[e.key]:[],affectedResourceIds:f,versions:{[e.key]:g.version}};if(o)this.store.recordMutation({projectId:e.projectId,idempotencyKey:o,requestHash:r,actorId:e.actorId,result:{entryId:g.id,mutation:S}});return this.audit(e.projectId,e.actorId,t&&d?"configuration.updated":t?"configuration.unchanged":"configuration.created",g,f),{entry:g,mutation:S,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let r=x(e.source);if(!r.valid)return{document:r,warnings:[]};let o=new Set(e.secretKeys??[]),t={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},n=[];for(let[s,c]of Object.entries(r.values)){let l=await this.set({...e,source:void 0,key:s,value:c,kind:o.has(s)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${s}`:void 0});t.added.push(...l.mutation.added),t.changed.push(...l.mutation.changed),t.unchanged.push(...l.mutation.unchanged),t.affectedResourceIds.push(...l.mutation.affectedResourceIds),Object.assign(t.versions,l.mutation.versions),n.push(...l.warnings)}return t.added=v(t.added),t.changed=v(t.changed),t.unchanged=v(t.unchanged),t.affectedResourceIds=v(t.affectedResourceIds),{document:r,mutation:t,warnings:n}}exportVariables(e){return j(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((r)=>[r.key,r.value??""])))}async transfer(e){let r=this.store.get(e.entryId);if(!r)throw Error("Configuration entry was not found.");if(r.scope.type===e.targetScope.type&&r.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let o=r.kind==="variable"?r.value:r.backend==="external"?void 0:await this.backend(r.backend).resolve(r.secretRef),t=r.kind==="secret"?r.backend:void 0,n=await this.set({organizationId:r.organizationId,projectId:r.projectId,scope:e.targetScope,key:r.key,kind:r.kind,value:o,reference:r.backend==="external"?r.secretRef:void 0,backend:t,required:r.required,metadata:r.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:r.origin});if(e.mode==="move")await this.remove({entryId:r.id,expectedVersion:r.version,confirmed:e.confirmed,actorId:e.actorId});let s={added:n.mutation.added,changed:n.mutation.changed,removed:e.mode==="move"?[r.key]:[],unchanged:n.mutation.unchanged,affectedResourceIds:v([...n.mutation.affectedResourceIds,...this.affectedResources(r.projectId,r.scope,[r.key])]),versions:n.mutation.versions};return{entry:n.entry,mutation:s}}async resolve(e){let r=this.store.list({projectId:e.projectId}),o=r.filter((a)=>this.applies(a,e)).sort((a,d)=>this.rank(a.scope.type)-this.rank(d.scope.type)),t=new Map,n=new Set;for(let a of o){if(t.has(a.key))n.add(a.key);t.set(a.key,a)}let s={},c={},l=[],i=new Set(e.allowedPreviewSecrets??[]);for(let[a,d]of t){if(e.previewId&&d.kind==="secret"&&d.scope.type!=="preview"&&(!e.trustedPreview||!i.has(a)))continue;if(d.kind==="variable")s[a]=d.value??"";else if(e.nativeReferences)s[a]=d.secretRef;else{let g=this.backend(d.backend);if(!await g.validate(d.secretRef)){if(l.push({key:a,code:"stale_reference",message:`${a} points to an unavailable secret.`}),d.required)l.push({key:a,code:"missing_required",message:`${a} is required but unavailable.`});continue}s[a]=await g.resolve(d.secretRef)}c[a]=A(d,{inherited:d.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:n.has(a),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),d.id])}return{values:s,entries:c,warnings:l,configurationHash:this.fingerprint([...t.values()].map((a)=>`${a.key}:${a.valueFingerprint}:${a.version}`).sort().join(`
-`))}}async reveal(e){let r=this.store.get(e.entryId);if(!r||r.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let o=await this.backend(r.backend).resolve(r.secretRef);return this.audit(r.projectId,e.actorId,"configuration.secret.revealed",r,[]),o}async remove(e){let r=this.store.get(e.entryId);if(!r)throw Error("Configuration entry was not found.");let o=this.store.dependencies(r.id);if(((r.scope.environmentId?this.store.controlPlane.listEnvironments(r.projectId).some((c)=>c.id===r.scope.environmentId&&c.kind==="production"):r.scope.type==="project")||o.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(r.kind==="secret"&&r.backend!=="external")await this.backend(r.backend).remove(r.secretRef);this.store.remove(r.id,e.expectedVersion);let n=v(o.map((c)=>c.resourceId)),s={added:[],changed:[],removed:[r.key],unchanged:[],affectedResourceIds:n,versions:{}};return this.audit(r.projectId,e.actorId,"configuration.deleted",r,n),s}applies(e,r){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===r.environmentId;if(e.scope.type==="service")return e.scope.id===r.resourceId;if(e.scope.type==="function")return e.scope.id===r.functionId;return e.scope.id===r.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${L("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let r=this.backends.get(e);if(!r)throw Error(`Configuration secret backend is not configured: ${e}`);return r}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((r)=>r.id===e.scope.environmentId&&r.kind==="production")}warnings(e,r){let o=[];if(U.test(e))o.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(r)>65536)o.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return o}affectedResources(e,r,o){let t=this.store.list({projectId:e,scope:r}).filter((n)=>o.includes(n.key)).flatMap((n)=>this.store.dependencies(n.id).map((s)=>s.resourceId));if(r.type==="service"||r.type==="function")return v([...t,r.id]);if(r.type==="environment")return v([...t,...this.store.controlPlane.listResources(e,r.id).map((n)=>n.id)]);if(r.type==="preview"){let n=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(r.id);return v([...t,...n?[n.resource_id]:[]])}return v([...t,...this.store.controlPlane.listResources(e).map((n)=>n.id)])}audit(e,r,o,t,n){this.store.controlPlane.appendEvent({projectId:e,actorId:r,type:o,payload:{entryId:t.id,key:t.key,kind:t.kind,scopeType:t.scope.type,scopeId:t.scope.id,backend:t.backend,version:t.version,affectedResourceIds:n}})}}async function X(e,r,o,t){let n={added:0,changed:0,removed:0,overridden:0},s=async(c,l)=>{let i=e.store.list({projectId:r.project.id,scope:c,kind:"variable"}),a=new Set(Object.keys(l));for(let d of i.filter((g)=>g.origin==="config"&&!a.has(g.key)))await e.remove({entryId:d.id,expectedVersion:d.version,confirmed:!0,actorId:t}),n.removed++;for(let[d,g]of Object.entries(l)){let f=e.store.find(r.project.id,c,d);if(f?.origin!=="config"){if(f)n.overridden++;else await e.set({organizationId:r.organization.id,projectId:r.project.id,scope:c,key:d,kind:"variable",value:String(g),origin:"config",confirmed:!0,actorId:t}),n.added++;continue}if(f.value===String(g))continue;await e.set({organizationId:r.organization.id,projectId:r.project.id,scope:c,key:d,kind:"variable",value:String(g),origin:"config",confirmed:!0,actorId:t,expectedVersion:f.version}),n.changed++}};for(let[c,l]of Object.entries(o.environments??{})){let i=r.environments.get(c);if(!i)continue;let a=l,d={...a.variables??{},...a.app?.env??{}};await s({type:"environment",id:i.id,environmentId:i.id},d);for(let[g,f]of Object.entries(o.sites??{})){let S=r.store.listResources(r.project.id,i.id).find((m)=>m.kind==="application"&&m.slug===g);if(S)await s({type:"service",id:S.id,environmentId:i.id,resourceId:S.id},{...f.env??{}})}for(let[g,f]of Object.entries(o.infrastructure?.functions??{})){let S=r.store.listResources(r.project.id,i.id).find((m)=>m.kind==="function"&&m.slug===g);if(S)await s({type:"function",id:S.id,environmentId:i.id,resourceId:S.id},{...f.environment??{}})}}return n}export{q as ag,x as bg,j as cg,w as dg,N as eg,$ as fg,M as gg,V as hg,X as ig};
+`:"")}import{createCipheriv as D,createDecipheriv as O,createHash as x,randomBytes as M}from"node:crypto";class w{controlPlane;now;kind="local_encrypted";key;constructor(e,r,n=()=>new Date){this.controlPlane=e;this.now=n;if(!r)throw Error("Configuration encryption key is required.");this.key=x("sha256").update(`ts-cloud:configuration:${r}`).digest()}encrypt(e){let r=M(12),n=D("aes-256-gcm",this.key,r),t=Buffer.concat([n.update(e,"utf8"),n.final()]);return`v1.${r.toString("base64url")}.${n.getAuthTag().toString("base64url")}.${t.toString("base64url")}`}decrypt(e){let[r,n,t,i]=e.split(".");if(r!=="v1"||!n||!t||!i)throw Error("Encrypted configuration secret is unavailable.");try{let s=O("aes-256-gcm",this.key,Buffer.from(n,"base64url"));return s.setAuthTag(Buffer.from(t,"base64url")),Buffer.concat([s.update(Buffer.from(i,"base64url")),s.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let r=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(r))throw Error("Invalid local configuration secret reference.");let t=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(r)?.version??0)+1,i=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[r,this.encrypt(e.value),x("sha256").update(e.value).digest("hex"),t,i,i]),{reference:r,version:String(t)}}async resolve(e){let r=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!r)throw Error("Configuration secret was not found.");return this.decrypt(r.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class T{client;region;kind="aws_secrets_manager";constructor(e,r){this.client=e;this.region=r}async put(e){if(e.reference){let n=this.id(e.reference),t=await this.client.putSecretValue({SecretId:n,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:t.VersionId??e.idempotencyKey}}let r=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(r.ARN??r.Name??e.name)}`,version:r.VersionId??e.idempotencyKey}}async resolve(e){let r=await this.client.getSecretValue({SecretId:this.id(e)});if(r.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return r.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let r=new URL(e);if(r.protocol!=="aws-sm:"||r.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(r.pathname.slice(1))}}class V{client;region;kind="aws_ssm";constructor(e,r){this.client=e;this.region=r}async put(e){let r=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,n=await this.client.putParameter({Name:r,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${r}`,version:String(n.Version??1)}}async resolve(e){let r=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(r.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return r.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let r=new URL(e);if(r.protocol!=="aws-ssm:"||r.hostname!==this.region||!r.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return r.pathname}}class W{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as B}from"node:crypto";var K=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,N=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function p(e){return[...new Set(e)].sort()}function P(e,r={}){let n=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!r.inherited,overridden:!!r.overridden,required:e.required,backend:!n||r.canReadSecretMetadata?e.backend:void 0,backendVersion:!n||r.canReadSecretMetadata?e.backendVersion:void 0,reference:n&&r.canReadSecretMetadata?e.secretRef:void 0,value:!n?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class L{store;backends=new Map;fingerprintKey;now;constructor(e,r){if(this.store=e,this.fingerprintKey=r.fingerprintKey??r.encryptionKey,this.now=r.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let n=r.backends??[new w(e.controlPlane,r.encryptionKey,this.now)];for(let t of n)this.backends.set(t.kind,t)}list(e){let r=e.search?.toLowerCase();return this.store.list(e).filter((n)=>!r||n.key.toLowerCase().includes(r)).map((n)=>P(n,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let r=this.store.list({projectId:e.projectId,scope:e.scope}),n=new Map(r.map((o)=>[o.key,o])),t=[],i=[],s=[],c=[];for(let[o,a]of Object.entries(e.values)){t.push(...this.warnings(o,a));let d=n.get(o);if(!d)i.push(o);else if(d.valueFingerprint!==this.fingerprint(a))s.push(o);else c.push(o)}let u=e.removeMissing?r.filter((o)=>!Object.hasOwn(e.values,o.key)).map((o)=>o.key):[];return{added:p(i),changed:p(s),removed:p(u),unchanged:p(c),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...i,...s,...u]),warnings:t}}async set(e){let r=this.requestHash(e),n=e.idempotencyKey;if(n){let f=this.store.mutation(n);if(f){if(f.requestHash!==r)throw Error("Idempotency key was already used for a different configuration mutation.");let m=this.store.get(String(f.result.entryId??""));if(!m)throw Error("Idempotent configuration result is no longer available.");return{entry:m,mutation:f.result.mutation,warnings:[]}}}if(e.value!=null&&K.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let t=this.store.find(e.projectId,e.scope,e.key),i=this.fingerprint(e.value??e.reference??"");if(t&&e.expectedVersion!=null&&t.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(t&&t.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let s=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!t&&(t.valueFingerprint!==i||t.backend!==s||t.required!==!!e.required)&&(this.isProduction(t)||this.store.dependencies(t.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let u=e.reference,o;if(e.kind==="secret"){let f=this.backend(s);if(e.reference&&e.value==null){if(!await f.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");o=t?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let m=await f.put({reference:t?.backend===s?t.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:n??crypto.randomUUID()});u=m.reference,o=m.version}}let a=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&a==null)throw Error("A variable value is required.");let d=!t||t.valueFingerprint!==i||t.backend!==s||t.secretRef!==u||t.backendVersion!==o||t.required!==!!e.required,g=t?d?this.store.update(t.id,t.version,{value:a,valueFingerprint:i,secretRef:u,backend:s,backendVersion:o,required:!!e.required,metadata:I(e.metadata??t.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():t.rotatedAt}):t:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:a,valueFingerprint:i,secretRef:u,backend:s,backendVersion:o,origin:e.origin??"managed",required:!!e.required,metadata:I(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),l=this.affectedResources(e.projectId,e.scope,[e.key]),v={added:t?[]:[e.key],changed:t&&d?[e.key]:[],removed:[],unchanged:t&&!d?[e.key]:[],affectedResourceIds:l,versions:{[e.key]:g.version}};if(n)this.store.recordMutation({projectId:e.projectId,idempotencyKey:n,requestHash:r,actorId:e.actorId,result:{entryId:g.id,mutation:v}});return this.audit(e.projectId,e.actorId,t&&d?"configuration.updated":t?"configuration.unchanged":"configuration.created",g,l),{entry:g,mutation:v,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let r=R(e.source);if(!r.valid)return{document:r,warnings:[]};let n=new Set(e.secretKeys??[]),t={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},i=[];for(let[s,c]of Object.entries(r.values)){let u=await this.set({...e,source:void 0,key:s,value:c,kind:n.has(s)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${s}`:void 0});t.added.push(...u.mutation.added),t.changed.push(...u.mutation.changed),t.unchanged.push(...u.mutation.unchanged),t.affectedResourceIds.push(...u.mutation.affectedResourceIds),Object.assign(t.versions,u.mutation.versions),i.push(...u.warnings)}return t.added=p(t.added),t.changed=p(t.changed),t.unchanged=p(t.unchanged),t.affectedResourceIds=p(t.affectedResourceIds),{document:r,mutation:t,warnings:i}}exportVariables(e){return j(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((r)=>[r.key,r.value??""])))}async transfer(e){let r=this.store.get(e.entryId);if(!r)throw Error("Configuration entry was not found.");if(r.scope.type===e.targetScope.type&&r.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let n=r.kind==="variable"?r.value:r.backend==="external"?void 0:await this.backend(r.backend).resolve(r.secretRef),t=r.kind==="secret"?r.backend:void 0,i=await this.set({organizationId:r.organizationId,projectId:r.projectId,scope:e.targetScope,key:r.key,kind:r.kind,value:n,reference:r.backend==="external"?r.secretRef:void 0,backend:t,required:r.required,metadata:r.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:r.origin});if(e.mode==="move")await this.remove({entryId:r.id,expectedVersion:r.version,confirmed:e.confirmed,actorId:e.actorId});let s={added:i.mutation.added,changed:i.mutation.changed,removed:e.mode==="move"?[r.key]:[],unchanged:i.mutation.unchanged,affectedResourceIds:p([...i.mutation.affectedResourceIds,...this.affectedResources(r.projectId,r.scope,[r.key])]),versions:i.mutation.versions};return{entry:i.entry,mutation:s}}async resolve(e){let r=this.store.list({projectId:e.projectId}),n=r.filter((a)=>this.applies(a,e)).sort((a,d)=>this.rank(a.scope.type)-this.rank(d.scope.type)),t=new Map,i=new Set;for(let a of n){if(t.has(a.key))i.add(a.key);t.set(a.key,a)}let s={},c={},u=[],o=new Set(e.allowedPreviewSecrets??[]);for(let[a,d]of t){if(e.previewId&&d.kind==="secret"&&d.scope.type!=="preview"&&(!e.trustedPreview||!o.has(a)))continue;if(d.kind==="variable")s[a]=d.value??"";else if(e.nativeReferences)s[a]=d.secretRef;else{let g=this.backend(d.backend);if(!await g.validate(d.secretRef)){if(u.push({key:a,code:"stale_reference",message:`${a} points to an unavailable secret.`}),d.required)u.push({key:a,code:"missing_required",message:`${a} is required but unavailable.`});continue}s[a]=await g.resolve(d.secretRef)}c[a]=P(d,{inherited:d.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:i.has(a),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),d.id])}return{values:s,entries:c,warnings:u,configurationHash:this.fingerprint([...t.values()].map((a)=>`${a.key}:${a.valueFingerprint}:${a.version}`).sort().join(`
+`))}}async reveal(e){let r=this.store.get(e.entryId);if(!r||r.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let n=await this.backend(r.backend).resolve(r.secretRef);return this.audit(r.projectId,e.actorId,"configuration.secret.revealed",r,[]),n}async remove(e){let r=this.store.get(e.entryId);if(!r)throw Error("Configuration entry was not found.");let n=this.store.dependencies(r.id);if(((r.scope.environmentId?this.store.controlPlane.listEnvironments(r.projectId).some((c)=>c.id===r.scope.environmentId&&c.kind==="production"):r.scope.type==="project")||n.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(r.kind==="secret"&&r.backend!=="external")await this.backend(r.backend).remove(r.secretRef);this.store.remove(r.id,e.expectedVersion);let i=p(n.map((c)=>c.resourceId)),s={added:[],changed:[],removed:[r.key],unchanged:[],affectedResourceIds:i,versions:{}};return this.audit(r.projectId,e.actorId,"configuration.deleted",r,i),s}applies(e,r){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===r.environmentId;if(e.scope.type==="service")return e.scope.id===r.resourceId;if(e.scope.type==="function")return e.scope.id===r.functionId;return e.scope.id===r.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${B("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let r=this.backends.get(e);if(!r)throw Error(`Configuration secret backend is not configured: ${e}`);return r}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((r)=>r.id===e.scope.environmentId&&r.kind==="production")}warnings(e,r){let n=[];if(N.test(e))n.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(r)>65536)n.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return n}affectedResources(e,r,n){let t=this.store.list({projectId:e,scope:r}).filter((i)=>n.includes(i.key)).flatMap((i)=>this.store.dependencies(i.id).map((s)=>s.resourceId));if(r.type==="service"||r.type==="function")return p([...t,r.id]);if(r.type==="environment")return p([...t,...this.store.controlPlane.listResources(e,r.id).map((i)=>i.id)]);if(r.type==="preview"){let i=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(r.id);return p([...t,...i?[i.resource_id]:[]])}return p([...t,...this.store.controlPlane.listResources(e).map((i)=>i.id)])}audit(e,r,n,t,i){this.store.controlPlane.appendEvent({projectId:e,actorId:r,type:n,payload:{entryId:t.id,key:t.key,kind:t.kind,scopeType:t.scope.type,scopeId:t.scope.id,backend:t.backend,version:t.version,affectedResourceIds:i}})}}async function X(e,r,n,t){let i={added:0,changed:0,removed:0,overridden:0},s=async(c,u)=>{let o=e.store.list({projectId:r.project.id,scope:c,kind:"variable"}),a=new Set(Object.keys(u));for(let d of o.filter((g)=>g.origin==="config"&&!a.has(g.key)))await e.remove({entryId:d.id,expectedVersion:d.version,confirmed:!0,actorId:t}),i.removed++;for(let[d,g]of Object.entries(u)){let l=e.store.find(r.project.id,c,d);if(l?.origin!=="config"){if(l)i.overridden++;else await e.set({organizationId:r.organization.id,projectId:r.project.id,scope:c,key:d,kind:"variable",value:String(g),origin:"config",confirmed:!0,actorId:t}),i.added++;continue}if(l.value===String(g))continue;await e.set({organizationId:r.organization.id,projectId:r.project.id,scope:c,key:d,kind:"variable",value:String(g),origin:"config",confirmed:!0,actorId:t,expectedVersion:l.version}),i.changed++}};for(let[c,u]of Object.entries(n.environments??{})){let o=r.environments.get(c);if(!o)continue;let a=u,d={...a.variables??{},...a.app?.env??{}};await s({type:"environment",id:o.id,environmentId:o.id},d);for(let[g,l]of Object.entries(n.sites??{})){let v=r.store.listResources(r.project.id,o.id).find((f)=>f.kind==="application"&&f.slug===g);if(v)await s({type:"service",id:v.id,environmentId:o.id,resourceId:v.id},{...l.env??{}})}for(let[g,l]of Object.entries(n.infrastructure?.functions??{})){let v=r.store.listResources(r.project.id,o.id).find((f)=>f.kind==="function"&&f.slug===g);if(v)await s({type:"function",id:v.id,environmentId:o.id,resourceId:v.id},{...l.environment??{}})}}return i}export{q as pg,R as qg,j as rg,w as sg,T as tg,V as ug,W as vg,L as wg,X as xg};

package/dist/bin/chunk-b0hj9m5e.js

@@ -0,0 +1,2 @@
+import{bh as l,ch as a}from"./chunk-ey9fagrr.js";class g{client;region;constructor(e="us-east-1"){this.region=e,this.client=new l}async describeDBInstances(e){let r={Action:"DescribeDBInstances",Version:"2014-10-31"};if(e?.DBInstanceIdentifier)r.DBInstanceIdentifier=e.DBInstanceIdentifier;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;if(e?.Filters)e.Filters.forEach((o,c)=>{r[`Filters.Filter.${c+1}.Name`]=o.Name,o.Values.forEach((u,d)=>{r[`Filters.Filter.${c+1}.Values.Value.${d+1}`]=u})});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBInstancesResult||n,s=i.DBInstances?.DBInstance||[];if(!Array.isArray(s))s=s?[s]:[];return{DBInstances:s,Marker:i.Marker}}async describeDBInstance(e){return(await this.describeDBInstances({DBInstanceIdentifier:e})).DBInstances?.[0]}async describeDBClusters(e){let r={Action:"DescribeDBClusters",Version:"2014-10-31"};if(e?.DBClusterIdentifier)r.DBClusterIdentifier=e.DBClusterIdentifier;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;if(e?.Filters)e.Filters.forEach((o,c)=>{r[`Filters.Filter.${c+1}.Name`]=o.Name,o.Values.forEach((u,d)=>{r[`Filters.Filter.${c+1}.Values.Value.${d+1}`]=u})});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBClustersResult||n,s=i.DBClusters?.DBCluster||[];if(!Array.isArray(s))s=s?[s]:[];return{DBClusters:s,Marker:i.Marker}}async describeDBSnapshots(e){let r={Action:"DescribeDBSnapshots",Version:"2014-10-31"};if(e?.DBInstanceIdentifier)r.DBInstanceIdentifier=e.DBInstanceIdentifier;if(e?.DBSnapshotIdentifier)r.DBSnapshotIdentifier=e.DBSnapshotIdentifier;if(e?.SnapshotType)r.SnapshotType=e.SnapshotType;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBSnapshotsResult||n,s=i.DBSnapshots?.DBSnapshot||[];if(!Array.isArray(s))s=s?[s]:[];return{DBSnapshots:s,Marker:i.Marker}}async describeDBSubnetGroups(e){let r={Action:"DescribeDBSubnetGroups",Version:"2014-10-31"};if(e?.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e?.MaxRecords)r.MaxRecords=e.MaxRecords;if(e?.Marker)r.Marker=e.Marker;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t}),i=n.DescribeDBSubnetGroupsResult||n,s=i.DBSubnetGroups?.DBSubnetGroup||[];if(!Array.isArray(s))s=s?[s]:[];return{DBSubnetGroups:s,Marker:i.Marker}}async createDBInstance(e){let r={Action:"CreateDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier,DBInstanceClass:e.DBInstanceClass,Engine:e.Engine};if(e.DBClusterIdentifier)r.DBClusterIdentifier=e.DBClusterIdentifier;if(e.MasterUsername)r.MasterUsername=e.MasterUsername;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.DBName)r.DBName=e.DBName;if(e.AllocatedStorage)r.AllocatedStorage=e.AllocatedStorage;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.AvailabilityZone)r.AvailabilityZone=e.AvailabilityZone;if(e.PreferredMaintenanceWindow)r.PreferredMaintenanceWindow=e.PreferredMaintenanceWindow;if(e.PreferredBackupWindow)r.PreferredBackupWindow=e.PreferredBackupWindow;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.MultiAZ!==void 0)r.MultiAZ=e.MultiAZ;if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.AutoMinorVersionUpgrade!==void 0)r.AutoMinorVersionUpgrade=e.AutoMinorVersionUpgrade;if(e.LicenseModel)r.LicenseModel=e.LicenseModel;if(e.PubliclyAccessible!==void 0)r.PubliclyAccessible=e.PubliclyAccessible;if(e.StorageType)r.StorageType=e.StorageType;if(e.StorageEncrypted!==void 0)r.StorageEncrypted=e.StorageEncrypted;if(e.KmsKeyId)r.KmsKeyId=e.KmsKeyId;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});if(e.Tags)e.Tags.forEach((s,o)=>{r[`Tags.Tag.${o+1}.Key`]=s.Key,r[`Tags.Tag.${o+1}.Value`]=s.Value});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.CreateDBInstanceResult||n).DBInstance}}async createDBCluster(e){let r={Action:"CreateDBCluster",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier,Engine:e.Engine};if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.MasterUsername)r.MasterUsername=e.MasterUsername;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.DatabaseName)r.DatabaseName=e.DatabaseName;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.StorageEncrypted!==void 0)r.StorageEncrypted=e.StorageEncrypted;if(e.KmsKeyId)r.KmsKeyId=e.KmsKeyId;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.ServerlessV2ScalingConfiguration)r["ServerlessV2ScalingConfiguration.MinCapacity"]=e.ServerlessV2ScalingConfiguration.MinCapacity,r["ServerlessV2ScalingConfiguration.MaxCapacity"]=e.ServerlessV2ScalingConfiguration.MaxCapacity;e.VpcSecurityGroupIds?.forEach((i,s)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${s+1}`]=i});let t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()});return{DBCluster:(t.CreateDBClusterResult||t).DBCluster}}async deleteDBInstance(e){let r={Action:"DeleteDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.SkipFinalSnapshot!==void 0)r.SkipFinalSnapshot=e.SkipFinalSnapshot;if(e.FinalDBSnapshotIdentifier)r.FinalDBSnapshotIdentifier=e.FinalDBSnapshotIdentifier;if(e.DeleteAutomatedBackups!==void 0)r.DeleteAutomatedBackups=e.DeleteAutomatedBackups;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.DeleteDBInstanceResult||n).DBInstance}}async modifyDBInstance(e){let r={Action:"ModifyDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.DBInstanceClass)r.DBInstanceClass=e.DBInstanceClass;if(e.AllocatedStorage)r.AllocatedStorage=e.AllocatedStorage;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.PreferredBackupWindow)r.PreferredBackupWindow=e.PreferredBackupWindow;if(e.PreferredMaintenanceWindow)r.PreferredMaintenanceWindow=e.PreferredMaintenanceWindow;if(e.MultiAZ!==void 0)r.MultiAZ=e.MultiAZ;if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.AutoMinorVersionUpgrade!==void 0)r.AutoMinorVersionUpgrade=e.AutoMinorVersionUpgrade;if(e.PubliclyAccessible!==void 0)r.PubliclyAccessible=e.PubliclyAccessible;if(e.ApplyImmediately!==void 0)r.ApplyImmediately=e.ApplyImmediately;if(e.StorageType)r.StorageType=e.StorageType;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.ModifyDBInstanceResult||n).DBInstance}}async modifyDBCluster(e){let r={Action:"ModifyDBCluster",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier};if(e.ServerlessV2ScalingConfiguration)r["ServerlessV2ScalingConfiguration.MinCapacity"]=e.ServerlessV2ScalingConfiguration.MinCapacity,r["ServerlessV2ScalingConfiguration.MaxCapacity"]=e.ServerlessV2ScalingConfiguration.MaxCapacity;if(e.BackupRetentionPeriod!==void 0)r.BackupRetentionPeriod=e.BackupRetentionPeriod;if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.MasterUserPassword)r.MasterUserPassword=e.MasterUserPassword;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.ApplyImmediately!==void 0)r.ApplyImmediately=e.ApplyImmediately;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBCluster:(n.ModifyDBClusterResult||n).DBCluster}}async rebootDBCluster(e){let r={Action:"FailoverDBCluster",Version:"2014-10-31",DBClusterIdentifier:e},t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()});return{DBCluster:(t.FailoverDBClusterResult||t).DBCluster}}async createDBClusterSnapshot(e,r){let t={Action:"CreateDBClusterSnapshot",Version:"2014-10-31",DBClusterIdentifier:e,DBClusterSnapshotIdentifier:r};return this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(t)).toString()})}async describeDBClusterSnapshots(e={}){let r={Action:"DescribeDBClusterSnapshots",Version:"2014-10-31",...e},t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()}),n=t.DescribeDBClusterSnapshotsResult||t,i=n.DBClusterSnapshots?.DBClusterSnapshot??n.DBClusterSnapshots??[];return{DBClusterSnapshots:Array.isArray(i)?i:[i]}}async deleteDBClusterSnapshot(e){await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a({Action:"DeleteDBClusterSnapshot",Version:"2014-10-31",DBClusterSnapshotIdentifier:e})).toString()})}async deleteDBCluster(e,r){let t={Action:"DeleteDBCluster",Version:"2014-10-31",DBClusterIdentifier:e,SkipFinalSnapshot:!r};if(r)t.FinalDBSnapshotIdentifier=r;let n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(t)).toString()});return{DBCluster:(n.DeleteDBClusterResult||n).DBCluster}}async restoreDBClusterToPointInTime(e){let r={Action:"RestoreDBClusterToPointInTime",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier,SourceDBClusterIdentifier:e.SourceDBClusterIdentifier};if(e.RestoreToTime)r.RestoreToTime=e.RestoreToTime.toISOString();if(e.UseLatestRestorableTime)r.UseLatestRestorableTime=!0;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBCluster:(n.RestoreDBClusterToPointInTimeResult||n).DBCluster}}async restoreDBClusterFromSnapshot(e){let r={Action:"RestoreDBClusterFromSnapshot",Version:"2014-10-31",DBClusterIdentifier:e.DBClusterIdentifier,SnapshotIdentifier:e.SnapshotIdentifier,Engine:e.Engine};if(e.EngineVersion)r.EngineVersion=e.EngineVersion;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds?.forEach((i,s)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${s+1}`]=i}),e.ServerlessV2ScalingConfiguration)r["ServerlessV2ScalingConfiguration.MinCapacity"]=e.ServerlessV2ScalingConfiguration.MinCapacity,r["ServerlessV2ScalingConfiguration.MaxCapacity"]=e.ServerlessV2ScalingConfiguration.MaxCapacity;let t=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(a(r)).toString()});return{DBCluster:(t.RestoreDBClusterFromSnapshotResult||t).DBCluster}}async startDBInstance(e){let t=new URLSearchParams(a({Action:"StartDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e})).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.StartDBInstanceResult||n).DBInstance}}async stopDBInstance(e){let r={Action:"StopDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.DBSnapshotIdentifier)r.DBSnapshotIdentifier=e.DBSnapshotIdentifier;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.StopDBInstanceResult||n).DBInstance}}async rebootDBInstance(e){let r={Action:"RebootDBInstance",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier};if(e.ForceFailover!==void 0)r.ForceFailover=e.ForceFailover;let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.RebootDBInstanceResult||n).DBInstance}}async createDBSnapshot(e){let r={Action:"CreateDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier,DBSnapshotIdentifier:e.DBSnapshotIdentifier};if(e.Tags)e.Tags.forEach((s,o)=>{r[`Tags.Tag.${o+1}.Key`]=s.Key,r[`Tags.Tag.${o+1}.Value`]=s.Value});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBSnapshot:(n.CreateDBSnapshotResult||n).DBSnapshot}}async deleteDBSnapshot(e){let t=new URLSearchParams(a({Action:"DeleteDBSnapshot",Version:"2014-10-31",DBSnapshotIdentifier:e})).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBSnapshot:(n.DeleteDBSnapshotResult||n).DBSnapshot}}async restoreDBInstanceFromDBSnapshot(e){let r={Action:"RestoreDBInstanceFromDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:e.DBInstanceIdentifier,DBSnapshotIdentifier:e.DBSnapshotIdentifier};if(e.DBInstanceClass)r.DBInstanceClass=e.DBInstanceClass;if(e.Port)r.Port=e.Port;if(e.AvailabilityZone)r.AvailabilityZone=e.AvailabilityZone;if(e.DBSubnetGroupName)r.DBSubnetGroupName=e.DBSubnetGroupName;if(e.MultiAZ!==void 0)r.MultiAZ=e.MultiAZ;if(e.PubliclyAccessible!==void 0)r.PubliclyAccessible=e.PubliclyAccessible;if(e.AutoMinorVersionUpgrade!==void 0)r.AutoMinorVersionUpgrade=e.AutoMinorVersionUpgrade;if(e.StorageType)r.StorageType=e.StorageType;if(e.DeletionProtection!==void 0)r.DeletionProtection=e.DeletionProtection;if(e.VpcSecurityGroupIds)e.VpcSecurityGroupIds.forEach((s,o)=>{r[`VpcSecurityGroupIds.VpcSecurityGroupId.${o+1}`]=s});if(e.Tags)e.Tags.forEach((s,o)=>{r[`Tags.Tag.${o+1}.Key`]=s.Key,r[`Tags.Tag.${o+1}.Value`]=s.Value});let t=new URLSearchParams(a(r)).toString(),n=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t});return{DBInstance:(n.RestoreDBInstanceFromDBSnapshotResult||n).DBInstance}}async waitForDBInstanceAvailable(e,r=60,t=30000){for(let n=0;n<r;n++){let i=await this.describeDBInstance(e);if(i?.DBInstanceStatus==="available")return i;if(["deleted","failed","incompatible-restore","incompatible-parameters"].includes(i?.DBInstanceStatus||""))throw Error(`DB instance ${e} is in terminal state: ${i?.DBInstanceStatus}`);await new Promise((s)=>setTimeout(s,t))}throw Error(`Timeout waiting for DB instance ${e} to become available`)}async waitForDBInstanceDeleted(e,r=60,t=30000){for(let n=0;n<r;n++)try{let i=await this.describeDBInstance(e);if(i?.DBInstanceStatus==="deleting"){await new Promise((s)=>setTimeout(s,t));continue}throw Error(`DB instance ${e} is in state: ${i?.DBInstanceStatus}`)}catch(i){if(i.code==="DBInstanceNotFound"||i.code==="DBInstanceNotFoundFault")return;throw i}throw Error(`Timeout waiting for DB instance ${e} to be deleted`)}}
+export{g as fd};

package/dist/bin/{chunk-mh0kdzqp.js → chunk-b2ymh8k0.js}

@@ -1,2 +1,2 @@
 import{createRequire as g}from"node:module";var d=Object.defineProperty;var e=(a)=>a;function f(a,b){this[a]=e.bind(null,b)}var h=(a,b)=>{for(var c in b)d(a,c,{get:b[c],enumerable:!0,configurable:!0,set:f.bind(b,c)})};var j=g(import.meta.url);
-export{h as Uo,j as Vo};
+export{h as lp,j as mp};

package/dist/bin/chunk-b35989e3.js

@@ -0,0 +1,50 @@
+import{bh as a}from"./chunk-ey9fagrr.js";class d{client;region;constructor(e="us-east-1"){this.region=e,this.client=new a}async createHostedZone(e){let t=e.CallerReference||`${Date.now()}-${Math.random().toString(36).slice(2)}`,o=`<?xml version="1.0" encoding="UTF-8"?>
+<CreateHostedZoneRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
+  <Name>${e.Name}</Name>
+  <CallerReference>${t}</CallerReference>`;if(e.HostedZoneConfig){if(o+=`
+  <HostedZoneConfig>`,e.HostedZoneConfig.Comment)o+=`
+    <Comment>${e.HostedZoneConfig.Comment}</Comment>`;if(e.HostedZoneConfig.PrivateZone!==void 0)o+=`
+    <PrivateZone>${e.HostedZoneConfig.PrivateZone}</PrivateZone>`;o+=`
+  </HostedZoneConfig>`}if(e.VPC)o+=`
+  <VPC>
+    <VPCRegion>${e.VPC.VPCRegion}</VPCRegion>
+    <VPCId>${e.VPC.VPCId}</VPCId>
+  </VPC>`;if(e.DelegationSetId)o+=`
+  <DelegationSetId>${e.DelegationSetId}</DelegationSetId>`;o+=`
+</CreateHostedZoneRequest>`;let n=await this.client.request({service:"route53",region:this.region,method:"POST",path:"/2013-04-01/hostedzone",headers:{"content-type":"application/xml"},body:o});return this.parseCreateHostedZoneResponse(n)}async listHostedZones(e){let t={};if(e?.Marker)t.marker=e.Marker;if(e?.MaxItems)t.maxitems=e.MaxItems;let o=await this.client.request({service:"route53",region:this.region,method:"GET",path:"/2013-04-01/hostedzone",queryParams:Object.keys(t).length>0?t:void 0});return this.parseListHostedZonesResponse(o)}async listHostedZonesByName(e){let t={};if(e?.DNSName)t.dnsname=e.DNSName;if(e?.HostedZoneId)t.hostedzoneid=e.HostedZoneId;if(e?.MaxItems)t.maxitems=e.MaxItems;let o=await this.client.request({service:"route53",region:this.region,method:"GET",path:"/2013-04-01/hostedzonesbyname",queryParams:Object.keys(t).length>0?t:void 0});return this.parseListHostedZonesResponse(o)}async getHostedZone(e){let t=e.Id.replace("/hostedzone/",""),o=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/hostedzone/${t}`});return this.parseGetHostedZoneResponse(o)}async deleteHostedZone(e){let t=e.Id.replace("/hostedzone/","");await this.client.request({service:"route53",region:this.region,method:"DELETE",path:`/2013-04-01/hostedzone/${t}`})}async listResourceRecordSets(e){let t=e.HostedZoneId.replace("/hostedzone/",""),o={};if(e.StartRecordName)o.name=e.StartRecordName;if(e.StartRecordType)o.type=e.StartRecordType;if(e.StartRecordIdentifier)o.identifier=e.StartRecordIdentifier;if(e.MaxItems)o.maxitems=e.MaxItems;let n=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/hostedzone/${t}/rrset`,queryParams:Object.keys(o).length>0?o:void 0});return this.parseListResourceRecordSetsResponse(n)}async changeResourceRecordSets(e){let t=e.HostedZoneId.replace("/hostedzone/",""),o=`<?xml version="1.0" encoding="UTF-8"?>
+<ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">
+  <ChangeBatch>`;if(e.ChangeBatch.Comment)o+=`
+    <Comment>${this.escapeXml(e.ChangeBatch.Comment)}</Comment>`;o+=`
+    <Changes>`;for(let s of e.ChangeBatch.Changes){if(o+=`
+      <Change>
+        <Action>${s.Action}</Action>
+        <ResourceRecordSet>
+          <Name>${s.ResourceRecordSet.Name}</Name>
+          <Type>${s.ResourceRecordSet.Type}</Type>`,s.ResourceRecordSet.TTL!==void 0)o+=`
+          <TTL>${s.ResourceRecordSet.TTL}</TTL>`;if(s.ResourceRecordSet.SetIdentifier)o+=`
+          <SetIdentifier>${s.ResourceRecordSet.SetIdentifier}</SetIdentifier>`;if(s.ResourceRecordSet.Weight!==void 0)o+=`
+          <Weight>${s.ResourceRecordSet.Weight}</Weight>`;if(s.ResourceRecordSet.Region)o+=`
+          <Region>${s.ResourceRecordSet.Region}</Region>`;if(s.ResourceRecordSet.Failover)o+=`
+          <Failover>${s.ResourceRecordSet.Failover}</Failover>`;if(s.ResourceRecordSet.HealthCheckId)o+=`
+          <HealthCheckId>${s.ResourceRecordSet.HealthCheckId}</HealthCheckId>`;if(s.ResourceRecordSet.ResourceRecords&&s.ResourceRecordSet.ResourceRecords.length>0){o+=`
+          <ResourceRecords>`;for(let r of s.ResourceRecordSet.ResourceRecords)o+=`
+            <ResourceRecord>
+              <Value>${this.escapeXml(r.Value)}</Value>
+            </ResourceRecord>`;o+=`
+          </ResourceRecords>`}if(s.ResourceRecordSet.AliasTarget)o+=`
+          <AliasTarget>
+            <HostedZoneId>${s.ResourceRecordSet.AliasTarget.HostedZoneId}</HostedZoneId>
+            <DNSName>${s.ResourceRecordSet.AliasTarget.DNSName}</DNSName>
+            <EvaluateTargetHealth>${s.ResourceRecordSet.AliasTarget.EvaluateTargetHealth}</EvaluateTargetHealth>
+          </AliasTarget>`;if(s.ResourceRecordSet.GeoLocation){if(o+=`
+          <GeoLocation>`,s.ResourceRecordSet.GeoLocation.ContinentCode)o+=`
+            <ContinentCode>${s.ResourceRecordSet.GeoLocation.ContinentCode}</ContinentCode>`;if(s.ResourceRecordSet.GeoLocation.CountryCode)o+=`
+            <CountryCode>${s.ResourceRecordSet.GeoLocation.CountryCode}</CountryCode>`;if(s.ResourceRecordSet.GeoLocation.SubdivisionCode)o+=`
+            <SubdivisionCode>${s.ResourceRecordSet.GeoLocation.SubdivisionCode}</SubdivisionCode>`;o+=`
+          </GeoLocation>`}o+=`
+        </ResourceRecordSet>
+      </Change>`}o+=`
+    </Changes>
+  </ChangeBatch>
+</ChangeResourceRecordSetsRequest>`;let n=await this.client.request({service:"route53",region:this.region,method:"POST",path:`/2013-04-01/hostedzone/${t}/rrset`,headers:{"content-type":"application/xml"},body:o});return this.parseChangeResourceRecordSetsResponse(n)}escapeXml(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}parseCreateHostedZoneResponse(e){let t=e.CreateHostedZoneResponse||e;return{HostedZone:this.parseHostedZone(t.HostedZone),ChangeInfo:{Id:t.ChangeInfo?.Id||"",Status:t.ChangeInfo?.Status||"",SubmittedAt:t.ChangeInfo?.SubmittedAt||""},DelegationSet:this.parseDelegationSet(t.DelegationSet),Location:t.Location||""}}parseListHostedZonesResponse(e){let t=e.ListHostedZonesResponse||e.ListHostedZonesByNameResponse||e,o=t.HostedZones?.HostedZone||t.HostedZones||[];if(!Array.isArray(o))o=o?[o]:[];return{HostedZones:o.map((n)=>this.parseHostedZone(n)),IsTruncated:t.IsTruncated==="true"||t.IsTruncated===!0,MaxItems:t.MaxItems||"100",Marker:t.Marker,NextMarker:t.NextMarker}}parseGetHostedZoneResponse(e){let t=e.GetHostedZoneResponse||e;return{HostedZone:this.parseHostedZone(t.HostedZone),DelegationSet:this.parseDelegationSet(t.DelegationSet),VPCs:t.VPCs?.VPC?Array.isArray(t.VPCs.VPC)?t.VPCs.VPC:[t.VPCs.VPC]:void 0}}parseListResourceRecordSetsResponse(e){let t=e.ListResourceRecordSetsResponse||e,o=t.ResourceRecordSets?.ResourceRecordSet||t.ResourceRecordSets||[];if(!Array.isArray(o))o=o?[o]:[];return{ResourceRecordSets:o.map((n)=>this.parseResourceRecordSet(n)),IsTruncated:t.IsTruncated==="true"||t.IsTruncated===!0,MaxItems:t.MaxItems||"100",NextRecordName:t.NextRecordName,NextRecordType:t.NextRecordType,NextRecordIdentifier:t.NextRecordIdentifier}}parseChangeResourceRecordSetsResponse(e){let t=e.ChangeResourceRecordSetsResponse||e;return{ChangeInfo:{Id:t.ChangeInfo?.Id||"",Status:t.ChangeInfo?.Status||"",SubmittedAt:t.ChangeInfo?.SubmittedAt||"",Comment:t.ChangeInfo?.Comment}}}parseHostedZone(e){if(!e)return{Id:"",Name:""};return{Id:e.Id||"",Name:e.Name||"",CallerReference:e.CallerReference,Config:e.Config?{Comment:e.Config.Comment,PrivateZone:e.Config.PrivateZone==="true"||e.Config.PrivateZone===!0}:void 0,ResourceRecordSetCount:e.ResourceRecordSetCount?Number(e.ResourceRecordSetCount):void 0}}parseDelegationSet(e){if(!e)return{NameServers:[]};let t=e.NameServers?.NameServer||e.NameServers||[];if(!Array.isArray(t))t=t?[t]:[];return{Id:e.Id,CallerReference:e.CallerReference,NameServers:t}}parseResourceRecordSet(e){if(!e)return{Name:"",Type:""};let t=e.ResourceRecords?.ResourceRecord||e.ResourceRecords||[];if(!Array.isArray(t))t=t?[t]:[];return{Name:e.Name||"",Type:e.Type||"",TTL:e.TTL?Number(e.TTL):void 0,ResourceRecords:t.map((o)=>({Value:o.Value||o})),AliasTarget:e.AliasTarget?{HostedZoneId:e.AliasTarget.HostedZoneId,DNSName:e.AliasTarget.DNSName,EvaluateTargetHealth:e.AliasTarget.EvaluateTargetHealth==="true"||e.AliasTarget.EvaluateTargetHealth===!0}:void 0,SetIdentifier:e.SetIdentifier,Weight:e.Weight?Number(e.Weight):void 0,Region:e.Region,GeoLocation:e.GeoLocation,Failover:e.Failover,HealthCheckId:e.HealthCheckId}}async findHostedZoneByName(e){let t=e.endsWith(".")?e:`${e}.`;return(await this.listHostedZonesByName({DNSName:t})).HostedZones.find((s)=>s.Name===t)||null}async createARecord(e){let t=Array.isArray(e.Value)?e.Value:[e.Value];return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"A",TTL:e.TTL||300,ResourceRecords:t.map((o)=>({Value:o}))}}]}})}async createCnameRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"CNAME",TTL:e.TTL||300,ResourceRecords:[{Value:e.Value}]}}]}})}async createAliasRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:e.Type||"A",AliasTarget:{HostedZoneId:e.TargetHostedZoneId,DNSName:e.TargetDNSName,EvaluateTargetHealth:e.EvaluateTargetHealth??!1}}}]}})}async createTxtRecord(e){let o=(Array.isArray(e.Value)?e.Value:[e.Value]).map((n)=>{if(!n.startsWith('"'))return`"${n}"`;return n});return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"TXT",TTL:e.TTL||300,ResourceRecords:o.map((n)=>({Value:n}))}}]}})}async createMxRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:e.Name,Type:"MX",TTL:e.TTL||300,ResourceRecords:e.Values.map((t)=>({Value:`${t.priority} ${t.mailServer}`}))}}]}})}async deleteRecord(e){return this.changeResourceRecordSets({HostedZoneId:e.HostedZoneId,ChangeBatch:{Changes:[{Action:"DELETE",ResourceRecordSet:e.RecordSet}]}})}async waitForChange(e,t=60,o=5000){let n=e.replace("/change/","");for(let s=0;s<t;s++){let r=await this.client.request({service:"route53",region:this.region,method:"GET",path:`/2013-04-01/change/${n}`});if((r.GetChangeResponse?.ChangeInfo?.Status||r.ChangeInfo?.Status)==="INSYNC")return!0;await new Promise((i)=>setTimeout(i,o))}return!1}async findOrCreateHostedZone(e){let t=e.domainName.endsWith(".")?e.domainName:`${e.domainName}.`,o=await this.findHostedZoneByName(t);if(o){let s=await this.getHostedZone({Id:o.Id});return{hostedZone:o,nameServers:s.DelegationSet.NameServers,isNew:!1}}let n=await this.createHostedZone({Name:t,HostedZoneConfig:{Comment:e.comment||`Hosted zone for ${e.domainName}`,PrivateZone:e.privateZone},VPC:e.vpc});return{hostedZone:n.HostedZone,nameServers:n.DelegationSet.NameServers,isNew:!0}}static getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length<=2)return e;return t.slice(-2).join(".")}async findHostedZoneForDomain(e){let o=e.replace(/\.$/,"").split(".");for(let n=0;n<o.length-1;n++){let s=o.slice(n).join("."),r=await this.findHostedZoneByName(s);if(r)return r}return null}async ensureHostedZone(e){let t=await this.findOrCreateHostedZone({domainName:e.domainName,comment:e.comment});return{hostedZoneId:t.hostedZone.Id.replace("/hostedzone/",""),nameServers:t.nameServers,isNew:t.isNew,action:t.isNew?"created":"found"}}async setupDomainDns(e){let{domain:t,createIfNotExists:o=!0}=e,n=await this.findHostedZoneByName(t);if(n){let r=await this.getHostedZone({Id:n.Id});return{success:!0,hostedZoneId:n.Id.replace("/hostedzone/",""),nameServers:r.DelegationSet.NameServers,isNew:!1,message:`Found existing hosted zone for ${t}`}}if(!o)return{success:!1,hostedZoneId:null,nameServers:[],isNew:!1,message:`No hosted zone found for ${t} and createIfNotExists is false`};let s=await this.createHostedZone({Name:t,HostedZoneConfig:{Comment:`Created automatically by ts-cloud for ${t}`}});return{success:!0,hostedZoneId:s.HostedZone.Id.replace("/hostedzone/",""),nameServers:s.DelegationSet.NameServers,isNew:!0,message:`Created new hosted zone for ${t}. Please update your domain registrar with these name servers: ${s.DelegationSet.NameServers.join(", ")}`}}static CloudFrontHostedZoneId="Z2FDTNDATAQYW2";static S3WebsiteHostedZoneIds={"us-east-1":"Z3AQBSTGFYJSTF","us-east-2":"Z2O1EMRO9K5GLX","us-west-1":"Z2F56UZL2M1ACD","us-west-2":"Z3BJ6K6RIION7M","ap-east-1":"ZNB98KWMFR0R6","ap-south-1":"Z11RGJOFQNVJUP","ap-northeast-1":"Z2M4EHUR26P7ZW","ap-northeast-2":"Z3W03O7B5YMIYP","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"Z3O0J2DXBE1FTB","ap-southeast-2":"Z1WCIGYICN2BYD","ca-central-1":"Z1QDHH18159H29","eu-central-1":"Z21DNDUVLTQW6Q","eu-west-1":"Z1BKCTXD74EZPE","eu-west-2":"Z3GKZC51ZF0DB4","eu-west-3":"Z3R1K369G5AVDG","eu-north-1":"Z3BAZG2TWCNX0D","sa-east-1":"Z7KQH4QJS55SO"};static ALBHostedZoneIds={"us-east-1":"Z35SXDOTRQ7X7K","us-east-2":"Z3AADJGX6KTTL2","us-west-1":"Z368ELLRRE2KJ0","us-west-2":"Z1H1FL5HABSF5","ap-east-1":"Z3DQVH9N71FHZ0","ap-south-1":"ZP97RAFLXTNZK","ap-northeast-1":"Z14GRHDCWA56QT","ap-northeast-2":"ZWKZPGTI48KDX","ap-northeast-3":"Z5LXEBD8Y73MNV","ap-southeast-1":"Z1LMS91P8CMLE5","ap-southeast-2":"Z1GM3OXH4ZPM65","ca-central-1":"ZQSVJUPU6J1EY","eu-central-1":"Z215JYRZR1TBD5","eu-west-1":"Z32O12XQLNTSW2","eu-west-2":"ZHURV8PSTC4K8","eu-west-3":"Z3Q77PNBQS71R4","eu-north-1":"Z23TAZ6LKFMNIO","sa-east-1":"Z2P70J7HTTTPLU"};static APIGatewayHostedZoneIds={"us-east-1":"Z1UJRXOUMOOFQ8","us-east-2":"ZOJJZC49E0EPZ","us-west-1":"Z2MUQ32089INYE","us-west-2":"Z2OJLYMUO9EFXC","ap-east-1":"Z3FD1VL90ND7K5","ap-south-1":"Z3VO1THU9YC4UR","ap-northeast-1":"Z1YSHQZHG15GKL","ap-northeast-2":"Z20JF4UZKIW1U8","ap-northeast-3":"Z2YQB5RD63NC85","ap-southeast-1":"ZL327KTPIQFUL","ap-southeast-2":"Z2RPCDW04V8134","ca-central-1":"Z19DQILCV0OWEC","eu-central-1":"Z1U9ULNL0V5AJ3","eu-west-1":"ZLY8HYME6SFDD","eu-west-2":"ZJ5UAJN8Y3Z2Q","eu-west-3":"Z3KY65QIEKYHQQ","eu-north-1":"Z3UWIKFBOOGXPP","sa-east-1":"ZCMLWB8V5SYIT"}}
+export{d as mg};

package/dist/bin/chunk-c2b6nk0q.js

@@ -0,0 +1,37 @@
+var u={mode:"detection",paranoiaLevel:1,inboundThreshold:5,outboundThreshold:4,maxBodyBytes:13107200,rejectOversizedBody:!0,auditLogPath:"/var/log/ts-cloud/waf-audit.log",blockStatus:403},p={bypassBase:1e5,exclusionBase:101000,rateLimitBase:102000,customBase:109000};function l(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/[\r\n]+/g," ")}function g(e){if(e.length>1000)return!1;if(/\([^)]*[+*]\)[+*]/.test(e))return!1;if(/\[[^\]]*\][+*]\{/.test(e))return!1;try{return new RegExp(e),!0}catch{return!1}}function S(e,r){let t=[],o=[],s=r;for(let n of e){if(n.enabled===!1)continue;if(n.key&&(n.key.source==="cookie"||n.key.source==="header")&&!n.key.name){o.push({ruleId:n.id,reason:"The rule keys on a header or cookie but names none."});continue}let d=n.path?R(n.path):".*";if(!g(d)){o.push({ruleId:n.id,reason:"The path pattern compiles to an unsafe regular expression."});continue}let c=[`SecRule REQUEST_URI "@rx ${l(d)}"`];if(n.methods?.length)c.push(`  "chain,id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${l(n.id)}'"`);else c.push(`  "id:${s},phase:1,pass,nolog,setvar:'tx.ts_cloud_ratelimit=${l(n.id)}'"`);if(t.push(`# Marks requests governed by the ts-cloud rate limit "${l(n.id)}".`),t.push(c.join(" \\\n")),n.methods?.length)t.push(`  SecRule REQUEST_METHOD "@within ${l(n.methods.join(" ").toUpperCase())}" "t:none"`);t.push(""),s++}return{lines:t,unmapped:o}}function R(e){return`^${e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*\*/g,"\x01").replace(/\*/g,"[^/]*").replace(/\u0001/g,".*")}$`}function v(e={},r=[]){let t=e.mode??u.mode,o=[],s=e.paranoiaLevel??u.paranoiaLevel,n=e.inboundThreshold??u.inboundThreshold,d=e.outboundThreshold??u.outboundThreshold,c=e.maxBodyBytes??u.maxBodyBytes,m=e.rejectOversizedBody!==!1;if(t==="blocking"&&s>=3)o.push(`Paranoia level ${s} blocks legitimate traffic on most applications until it is tuned. Run it in detection mode first.`);if(t==="blocking")o.push("zig-waf is pre-alpha. Blocking mode makes it a failure path for every request.");if(!m)o.push("Oversized bodies are passed through uninspected, so padding a request bypasses every rule.");if(e.bypassPaths?.length)o.push(`${e.bypassPaths.length} path(s) bypass inspection entirely.`);let i=["# Managed by ts-cloud. Edits are overwritten on the next deploy.",`# Mode: ${t}. Paranoia level: ${s}.`,""];if(t==="off")return i.push("SecRuleEngine Off",""),{config:`${i.join(`
+`)}
+`,unmappedRateLimits:[],warnings:o,mode:t};i.push(`SecRuleEngine ${t==="blocking"?"On":"DetectionOnly"}`,"SecRequestBodyAccess On","SecResponseBodyAccess Off",`SecRequestBodyLimit ${c}`,`SecRequestBodyNoFilesLimit ${Math.min(c,131072)}`,`SecRequestBodyLimitAction ${m?"Reject":"ProcessPartial"}`,"SecRequestBodyInMemoryLimit 131072",`SecAuditEngine ${t==="blocking"?"RelevantOnly":"On"}`,"SecAuditLogParts ABIJDEFHZ",`SecAuditLog ${l(e.auditLogPath??u.auditLogPath)}`,"SecAuditLogType Serial",`SecDefaultAction "phase:1,log,auditlog,${t==="blocking"?`deny,status:${e.blockStatus??u.blockStatus}`:"pass"}"`,"","# CRS anomaly scoring setup.",`SecAction "id:900000,phase:1,pass,nolog,t:none,setvar:tx.paranoia_level=${s}"`,`SecAction "id:900001,phase:1,pass,nolog,t:none,setvar:tx.inbound_anomaly_score_threshold=${n}"`,`SecAction "id:900002,phase:1,pass,nolog,t:none,setvar:tx.outbound_anomaly_score_threshold=${d}"`,'SecAction "id:900003,phase:1,pass,nolog,t:none,setvar:tx.critical_anomaly_score=5,setvar:tx.error_anomaly_score=4,setvar:tx.warning_anomaly_score=3,setvar:tx.notice_anomaly_score=2"','SecAction "id:900004,phase:1,pass,nolog,t:none,setvar:tx.anomaly_score=0"',"");let f=p.bypassBase;for(let a of e.bypassPaths??[]){let x=R(a);if(!g(x)){o.push(`Bypass path "${a}" was dropped: it compiles to an unsafe regular expression.`);continue}i.push(`# Inspection bypass for ${l(a)}. Every bypass is an unguarded route.`,`SecRule REQUEST_URI "@rx ${l(x)}" "id:${f},phase:1,pass,nolog,ctl:ruleEngine=Off"`,""),f++}let y=p.exclusionBase;for(let a of e.exclusions??[]){if(!Number.isInteger(a.ruleId)||a.ruleId<=0){o.push(`Exclusion with rule id "${a.ruleId}" was dropped: the id is not a positive integer.`);continue}if(i.push(`# ${l(a.reason)}`),a.pathPattern){if(!g(a.pathPattern)){o.push(`Exclusion for rule ${a.ruleId} was dropped: its path pattern is unsafe.`);continue}i.push(`SecRule REQUEST_URI "@rx ${l(a.pathPattern)}" "id:${y},phase:1,pass,nolog,ctl:ruleRemoveById=${a.ruleId}"`),y++}else i.push(`SecRuleRemoveById ${a.ruleId}`);i.push("")}let h=S(r,p.rateLimitBase);if(h.lines.length>0)i.push("# Rate-limit route markers. SecLang has no counters, so the tag is set","# here and the counting stays in the ts-cloud limiter.",...h.lines);let b=p.customBase;for(let a of e.customRules??[])i.push(`# Operator-supplied rule ${b}.`,a.trim(),""),b++;if(t==="blocking")i.push("# Blocking decision: one rule, at the end, on the accumulated score.",`SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:949110,phase:2,deny,status:${e.blockStatus??u.blockStatus},log,msg:'Inbound anomaly score exceeded (total: %{tx.anomaly_score})'"`,"");return{config:`${i.join(`
+`)}
+`,unmappedRateLimits:h.unmapped,warnings:o,mode:t}}function I(e={},r=[],t={}){let o=t.binary??"/usr/local/bin/zig-waf",s=t.configPath??"/etc/ts-cloud/waf.conf",n=v(e,r);return`#!/usr/bin/env bash
+# Managed by ts-cloud. Installs the zig-waf ruleset.
+set -euo pipefail
+
+if [ ! -x "${o}" ]; then
+  echo "ts-cloud: ${o} is not installed; skipping WAF configuration" >&2
+  exit 0
+fi
+
+install -d -m 0755 "$(dirname "${s}")"
+install -d -m 0750 /var/log/ts-cloud
+
+cat > "${s}.new" <<'WAF_EOF'
+${n.config}WAF_EOF
+
+# Compile the config before it goes live. A config that does not validate
+# would leave the engine with no rules while still reporting itself enabled.
+if ! "${o}" validate "${s}.new"; then
+  echo "ts-cloud: generated WAF config failed validation, keeping the previous one" >&2
+  rm -f "${s}.new"
+  exit 1
+fi
+
+if [ -f "${s}" ] && cmp -s "${s}.new" "${s}"; then
+  rm -f "${s}.new"
+  echo "ts-cloud: WAF config unchanged"
+  exit 0
+fi
+
+mv "${s}.new" "${s}"
+echo "ts-cloud: WAF config installed (mode: ${n.mode})"
+`}function _(e,r){return e.map((t)=>({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"event",source:"zig-waf",name:t.action==="blocked"?"waf.blocked":"waf.matched",timestamp:t.timestamp,value:1,host:t.host,pathTemplate:t.path,method:t.method,attributes:{ruleId:t.ruleId??null,anomalyScore:t.anomalyScore,action:t.action,messages:t.messages.slice(0,5)}}))}
+export{l as We,g as Xe,R as Ye,v as Ze,I as _e,_ as $e};

package/dist/bin/chunk-ckxpgwxw.js

@@ -0,0 +1,3 @@
+import{Zd as b}from"./chunk-pjpa4x52.js";import{hg as Z}from"./chunk-6eat8ezk.js";import{og as P}from"./chunk-d6zzgvtn.js";import{Jg as V,Kg as ne,Lg as U,Ng as R,Og as m,Pg as M,Wg as ie}from"./chunk-1v6bt68w.js";import{bh as se}from"./chunk-ey9fagrr.js";import{$h as ce,Wo as pe,Zh as ae,_h as oe,ap as fe,ho as le,io as ue,ko as ge,mo as de,no as me}from"./chunk-anm3ae6z.js";import{mp as Q}from"./chunk-b2ymh8k0.js";import{existsSync as Ae,readdirSync as Te,readFileSync as be,statSync as ke}from"node:fs";import{join as Se,relative as Ee}from"node:path";class _{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new se}async createSecret(e){let t={Name:e.Name};if(e.Description)t.Description=e.Description;if(e.KmsKeyId)t.KmsKeyId=e.KmsKeyId;if(e.SecretBinary)t.SecretBinary=e.SecretBinary;if(e.SecretString)t.SecretString=e.SecretString;if(e.Tags&&e.Tags.length>0)t.Tags=e.Tags;if(e.AddReplicaRegions&&e.AddReplicaRegions.length>0)t.AddReplicaRegions=e.AddReplicaRegions;if(e.ForceOverwriteReplicaSecret!==void 0)t.ForceOverwriteReplicaSecret=e.ForceOverwriteReplicaSecret;t.ClientRequestToken=e.ClientRequestToken||crypto.randomUUID();let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CreateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,VersionId:r.VersionId,ReplicationStatus:r.ReplicationStatus}}async updateSecret(e){let t={SecretId:e.SecretId};if(e.Description)t.Description=e.Description;if(e.KmsKeyId)t.KmsKeyId=e.KmsKeyId;if(e.SecretBinary)t.SecretBinary=e.SecretBinary;if(e.SecretString)t.SecretString=e.SecretString;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UpdateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,VersionId:r.VersionId}}async putSecretValue(e){let t={SecretId:e.SecretId};if(e.SecretBinary)t.SecretBinary=e.SecretBinary;if(e.SecretString)t.SecretString=e.SecretString;if(e.VersionStages&&e.VersionStages.length>0)t.VersionStages=e.VersionStages;if(e.ClientRequestToken)t.ClientRequestToken=e.ClientRequestToken;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,VersionId:r.VersionId,VersionStages:r.VersionStages}}async getSecretValue(e){let t={SecretId:e.SecretId};if(e.VersionId)t.VersionId=e.VersionId;if(e.VersionStage)t.VersionStage=e.VersionStage;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetSecretValue","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,VersionId:r.VersionId,SecretBinary:r.SecretBinary,SecretString:r.SecretString,VersionStages:r.VersionStages,CreatedDate:r.CreatedDate}}async describeSecret(e){let t={SecretId:e},r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DescribeSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return this.parseSecret(r)}async listSecrets(e){let t={};if(e?.MaxResults)t.MaxResults=e.MaxResults;if(e?.NextToken)t.NextToken=e.NextToken;if(e?.Filters&&e.Filters.length>0)t.Filters=e.Filters;if(e?.SortOrder)t.SortOrder=e.SortOrder;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.ListSecrets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{SecretList:r.SecretList?.map((s)=>this.parseSecret(s)),NextToken:r.NextToken}}async deleteSecret(e){let t={SecretId:e.SecretId};if(e.RecoveryWindowInDays!==void 0)t.RecoveryWindowInDays=e.RecoveryWindowInDays;if(e.ForceDeleteWithoutRecovery!==void 0)t.ForceDeleteWithoutRecovery=e.ForceDeleteWithoutRecovery;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,DeletionDate:r.DeletionDate}}async restoreSecret(e){let t={SecretId:e},r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RestoreSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name}}async rotateSecret(e){let t={SecretId:e.SecretId};if(e.ClientRequestToken)t.ClientRequestToken=e.ClientRequestToken;if(e.RotationLambdaARN)t.RotationLambdaARN=e.RotationLambdaARN;if(e.RotationRules)t.RotationRules=e.RotationRules;if(e.RotateImmediately!==void 0)t.RotateImmediately=e.RotateImmediately;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.RotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,VersionId:r.VersionId}}async cancelRotateSecret(e){let t={SecretId:e},r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.CancelRotateSecret","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name}}async getResourcePolicy(e){let t={SecretId:e},r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.GetResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name,ResourcePolicy:r.ResourcePolicy}}async putResourcePolicy(e){let t={SecretId:e.SecretId,ResourcePolicy:e.ResourcePolicy};if(e.BlockPublicPolicy!==void 0)t.BlockPublicPolicy=e.BlockPublicPolicy;let r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.PutResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name}}async deleteResourcePolicy(e){let t={SecretId:e},r=await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.DeleteResourcePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)});return{ARN:r.ARN,Name:r.Name}}async tagResource(e){let t={SecretId:e.SecretId,Tags:e.Tags};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async untagResource(e){let t={SecretId:e.SecretId,TagKeys:e.TagKeys};await this.client.request({service:"secretsmanager",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"secretsmanager.UntagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async setString(e,t,r){try{let s=await this.putSecretValue({SecretId:e,SecretString:t});return{ARN:s.ARN,VersionId:s.VersionId}}catch(s){if(s.code==="ResourceNotFoundException"){let n=await this.createSecret({Name:e,SecretString:t,Description:r?.description,KmsKeyId:r?.kmsKeyId,Tags:r?.tags});return{ARN:n.ARN,VersionId:n.VersionId}}throw s}}async setJson(e,t,r){return this.setString(e,JSON.stringify(t),r)}async getString(e){return(await this.getSecretValue({SecretId:e})).SecretString}async getJson(e){let t=await this.getString(e);if(t)return JSON.parse(t);return}async listAll(){let e=[],t;do{let r=await this.listSecrets({NextToken:t});if(r.SecretList)e.push(...r.SecretList);t=r.NextToken}while(t);return e}parseSecret(e){return{ARN:e.ARN,Name:e.Name,Description:e.Description,KmsKeyId:e.KmsKeyId,RotationEnabled:e.RotationEnabled,RotationLambdaARN:e.RotationLambdaARN,RotationRules:e.RotationRules,LastRotatedDate:e.LastRotatedDate,LastChangedDate:e.LastChangedDate,LastAccessedDate:e.LastAccessedDate,DeletedDate:e.DeletedDate,NextRotationDate:e.NextRotationDate,Tags:e.Tags,SecretVersionsToStages:e.SecretVersionsToStages,CreatedDate:e.CreatedDate,PrimaryRegion:e.PrimaryRegion}}}function v(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let s=e.project.slug,n=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:s,region:n,stackName:ae(e,t),artifactBucket:oe(s,t),assetsBucket:ce(s,t)}}function He(e,t){let r=v(e,t),s=`${r.slug}-${t}`;return{region:r.region,slug:r.slug,stackName:r.stackName,functions:{http:`${s}-http`,queue:`${s}-queue`,cli:`${s}-cli`}}}async function D(e,t=8){let r;for(let s=0;s<t;s++)try{return await e()}catch(n){let i=n?.code||n?.name||"",a=String(n?.message||"");if(i==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(a)){r=n,await new Promise((o)=>setTimeout(o,3000));continue}throw n}throw r}var ye=(e,t)=>`releases/${e}/${t}/current.json`;async function J(e,t,r,s){try{return await e.getObjectJson(t,ye(r,s))}catch{return null}}async function Re(e,t,r,s,n){await e.putObjectJson(t,ye(r,s),n)}async function Ie(e,t){if(!e.secrets)return{};let r=new _(t),s={},n=Array.isArray(e.secrets)?e.secrets.map((i)=>({envName:i.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:i})):Object.entries(e.secrets).map(([i,a])=>({envName:i,secretId:a}));if(Array.isArray(e.secrets)){let i=new Map;for(let{envName:o,secretId:c}of n)i.set(o,[...i.get(o)??[],c]);let a=[...i.entries()].filter(([,o])=>o.length>1);if(a.length){let o=a.map(([c,u])=>`${c} ← ${u.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${o}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:i,secretId:a}of n){let c=(await r.getSecretValue({SecretId:a})).SecretString??"";try{let u=JSON.parse(c);if(u&&typeof u==="object"&&!Array.isArray(u)){for(let[p,d]of Object.entries(u))s[p]=String(d);continue}}catch{}s[i]=c}return s}function De(e,t){let r={},s=t.DbProxyEndpoint||t.DbEndpoint;if(s)r.DB_CONNECTION="mysql",r.DB_HOST=s,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function Y(e,t,r,s,n,i,a,o={}){let c=e.kind==="php"?pe({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:s,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...c,...o,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...a?{TSCLOUD_QUEUE:a,SQS_QUEUE:a}:{},...i?{ASSET_URL:i}:{},...e.env??{},...n}}function Pe(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*he(e){for(let t of Te(e)){let r=Se(e,t);if(ke(r).isDirectory())yield*he(r);else yield r}}async function $e(e,t,r,s,n=!1){let i=0;for(let a of he(r)){let o=Ee(r,a).replace(/\\/g,"/");if(!n&&o.split("/").some((c)=>c.startsWith(".")))continue;await e.putObject({bucket:t,key:`${s}/${o}`,body:be(a),contentType:Pe(a),cacheControl:"public, max-age=31536000, immutable"}),i++}return i}function Oe(e,t){let r=Object.entries(t).reduce((s,[n,i])=>s+Buffer.byteLength(`${n}=${i}`,"utf8"),0);if(r>4096){let s=Object.entries(t).map(([n,i])=>[n,Buffer.byteLength(`${n}=${i}`,"utf8")]).sort((n,i)=>i[1]-n[1]).slice(0,5).map(([n,i])=>`${n} (${i}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${s}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function F(e,t,r,s){Oe(t,r),await D(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let n=s.kind==="image"?{FunctionName:t,ImageUri:s.imageUri}:{FunctionName:t,S3Bucket:s.bucket,S3Key:s.key};await D(()=>e.updateFunctionCode(n)),await e.waitForFunctionActive(t,120)}async function z(e,t){let s=(await D(()=>e.publishVersion({FunctionName:t}))).Version;if(!s)throw Error(`publishVersion returned no version for ${t}`);return await D(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:s})),s}async function We(e,t,r={}){let s=v(e,t),{app:n,slug:i,region:a,stackName:o,artifactBucket:c}=s,u=r.projectRoot??process.cwd();M(`Deploying serverless app: ${i} (${t})`),R(`Stack: ${o}`),R(`Region: ${a}`);let p=new P(a),d=new Z(a),y=new b(a),C=n.kind==="php",A=n.packaging==="image",g=ge(n),k,N,h,H,L=[];if(A&&g.usesLayer&&g.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${g.kind}${g.kind==="node"?` ${g.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(A){m("Building + pushing container image");let{buildAndPushServerlessImage:l}=await import("./chunk-tna7ay8d.js"),f=await l({app:n,projectRoot:u,region:a,repository:`${i}-${t}`,skipBuild:r.skipBuild,onStep:(w)=>R(`  ${w}`)});k=f.handlers,N={kind:"image",imageUri:f.imageUri},h=f.tag,L.push({ParameterKey:"ImageUri",ParameterValue:f.imageUri})}else{m("Packaging application");let l=C?fe({projectRoot:u,app:n,skipBuild:r.skipBuild,onStep:(T)=>R(`  ${T}`)}):await ue({projectRoot:u,app:n,skipBuild:r.skipBuild,onStep:(T)=>R(`  ${T}`)}),f=le(i,t,l.sha256);if(R(`Artifact: ${l.sha256.slice(0,12)} (${(l.zip.length/1024).toFixed(0)} KB)`),k=l.handlers,h=l.sha256,g.usesLayer){let T=g.layerEnvVar?process.env[g.layerEnvVar]:void 0;if(H=n.layers??(T?[T]:void 0),!H?.length){let Ce=g.layerKind==="php"?"serverless:build-php-layer":g.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${g.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${g.layerEnvVar} env var (build one with \`cloud ${Ce}\`)${g.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await p.bucketExists(c))m(`Creating artifact bucket ${c}`),await p.createBucket(c);if(await p.headObject(c,f).then((T)=>T!==null).catch(()=>!1))R("Artifact already uploaded — reusing");else m("Uploading artifact"),await p.putObject({bucket:c,key:f,body:l.zip,contentType:"application/zip"});N={kind:"zip",bucket:c,key:f},L.push({ParameterKey:"ArtifactBucket",ParameterValue:c},{ParameterKey:"ArtifactKey",ParameterValue:f})}let S=me({config:e,environment:t,app:n,handlers:k,runtimeLayers:H}),ee=JSON.stringify(S.template),te=["CAPABILITY_NAMED_IAM"],O=await d.describeStacks({stackName:o}).then((l)=>l.Stacks[0]?.StackStatus).catch(()=>{return}),q=O!==void 0;if(O&&/DELETE_IN_PROGRESS/.test(O))m("Waiting for an in-progress stack delete to finish"),await d.waitForStack(o,"stack-delete-complete").catch(()=>{}),q=!1;else if(O&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(O))m(`Deleting unusable stack (status ${O}) before recreate`),await d.deleteStack(o),await d.waitForStack(o,"stack-delete-complete").catch(()=>{}),q=!1;m(q?"Updating infrastructure stack":"Creating infrastructure stack");try{if(q)await d.updateStack({stackName:o,templateBody:ee,parameters:L,capabilities:te}),await d.waitForStack(o,"stack-update-complete");else await d.createStack({stackName:o,templateBody:ee,parameters:L,capabilities:te,onFailure:"DELETE"}),await d.waitForStack(o,"stack-create-complete")}catch(l){if(/No updates are to be performed/i.test(String(l?.message)))R("No infrastructure changes");else throw l}let W=await d.getStackOutputs(o).catch(()=>({})),E;if(n.assets){let l=Se(u,n.assets);if(Ae(l)){let f=n.assetDomain||W.AssetsCdnDomain;E=f?`https://${f}/${h}`:void 0,m(`Syncing assets from ${n.assets}`);let w=await $e(p,s.assetsBucket,l,h,n.dotFilesAsAssets);R(`Uploaded ${w} asset(s)${E?` → ${E}`:""}`)}else U(`Assets directory not found: ${l}`)}m("Resolving secrets");let B=await Ie(n,a);if(n.database?.connection==="aurora-serverless")try{let f=await new _(a).getSecretValue({SecretId:`${i}/${t}/db`}),w=JSON.parse(f.SecretString??"{}");if(w.username)B.DB_USERNAME=w.username;if(w.password)B.DB_PASSWORD=w.password}catch(l){U(`Could not resolve Aurora DB credentials: ${l.message}`)}if(!await p.bucketExists(c))await p.createBucket(c);let K=await J(p,c,i,t),I={},X=S.queueNames[0],G=De(n,W);if(m("Activating functions"),I.http=Y(n,s,t,"http",B,E,X,G),await F(y,S.functionNames.http,I.http,N),I.cli=Y(n,s,t,"cli",B,E,X,G),await F(y,S.functionNames.cli,I.cli,N),S.queueNames.length)I.queue=Y(n,s,t,"queue",B,E,X,G),await F(y,S.functionNames.queue,I.queue,N);let re=(n.provisionedConcurrency??0)>0,j={};if(re){if(m("Publishing versions + flipping live alias"),j.http=await z(y,S.functionNames.http),j.cli=await z(y,S.functionNames.cli),S.queueNames.length)j.queue=await z(y,S.functionNames.queue)}if(await Re(p,c,i,t,{sha:h,code:N,previousSha:K?.sha,previousCode:K?.code,previousFunctionEnv:K?.functionEnv,...re?{functionVersions:j,previousFunctionVersions:K?.functionVersions}:{},functionEnv:I,functionNames:{http:S.functionNames.http,cli:S.functionNames.cli,...S.queueNames.length?{queue:S.functionNames.queue}:{}},assetUrl:E,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&n.deploy?.length){m("Running deploy hooks");for(let l of n.deploy){R(`  deploy: ${l}`);let f=await y.invoke({FunctionName:S.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:l},LogType:"Tail"});if(f.FunctionError)throw ne("Deploy hook failed — the new build is ALREADY LIVE."),R(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${l}): ${f.Payload}`)}}let x=W.HttpApiEndpoint;if(!r.skipHealthCheck&&x){m("Health check");try{let l=await fetch(x,{method:"GET"});R(`GET ${x} → ${l.status}`)}catch(l){U(`Health check could not reach ${x}: ${l.message}`)}}ie(["Serverless deploy complete","",x?`URL:   ${x}`:"",`Stack: ${o}`,`Build: ${h.slice(0,12)}`].filter(Boolean).join(`
+`),"green")}async function Xe(e,t){let r=v(e,t),s=new P(r.region),n=new b(r.region),i=await J(s,r.artifactBucket,r.slug,t);if(!i)throw Error("No previous release to redeploy. Run a full deploy first.");M(`Redeploying ${r.slug} (${t}) — build ${i.sha.slice(0,12)}`);for(let[a,o]of Object.entries(i.functionNames)){if(!o)continue;m(`Re-activating ${a} (${o})`),await F(n,o,i.functionEnv[a]??{},i.code);let c=i.functionVersions?.[a];if(c)await D(()=>n.updateAlias({FunctionName:o,Name:"live",FunctionVersion:c}))}V("Redeploy complete")}async function Ge(e,t){let r=v(e,t),s=new P(r.region),n=new b(r.region),i=await J(s,r.artifactBucket,r.slug,t);if(!i?.previousCode)throw Error("No previous release to roll back to.");M(`Rolling back ${r.slug} (${t}) → ${i.previousSha?.slice(0,12)}`);for(let[a,o]of Object.entries(i.functionNames)){if(!o)continue;m(`Restoring ${a} (${o})`);let c=i.previousFunctionEnv?.[a]??i.functionEnv[a]??{};await F(n,o,c,i.previousCode);let u=i.previousFunctionVersions?.[a];if(u)await D(()=>n.updateAlias({FunctionName:o,Name:"live",FunctionVersion:u}))}await Re(s,r.artifactBucket,r.slug,t,{...i,sha:i.previousSha??i.sha,code:i.previousCode,functionEnv:i.previousFunctionEnv??i.functionEnv,functionVersions:i.previousFunctionVersions??i.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),V("Rollback complete")}async function Ye(e,t,r,s){let n=v(e,t),i=new b(n.region),a=`${n.slug}-${t}-http`,c={...(await i.getFunction(a)).Configuration?.Environment?.Variables??{}};if(c.MAINTENANCE_MODE=r?"1":"0",r&&s)c.MAINTENANCE_BYPASS_SECRET=s;if(!r)delete c.MAINTENANCE_BYPASS_SECRET;if(await D(()=>i.updateFunctionConfiguration({FunctionName:a,Environment:{Variables:c}})),(n.app.provisionedConcurrency??0)>0)await i.waitForFunctionActive(a,120),await z(i,a);V(r?"Application is now in maintenance mode (503)":"Application is live")}async function xe(e,t,r){let s=v(e,t),n=new b(s.region),i=`${s.slug}-${t}-cli`,a=await n.invoke({FunctionName:i,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(a.FunctionError)throw Error(`Command failed: ${a.Payload}`);return a.Payload??""}var ve=(e,t)=>`commands/${e}/${t}/history.json`,Ve=50;async function Ne(e,t,r,s){try{return(await e.getObjectJson(t,ve(r,s)))?.records??[]}catch{return[]}}async function Qe(e,t,r){let s=v(e,t),n=new b(s.region),i=`${s.slug}-${t}-cli`,a=await n.invoke({FunctionName:i,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"}),o=a.Payload??"",c=a.FunctionError?"error":"ok",u=-1;try{let p=new P(s.region);if(await p.bucketExists(s.artifactBucket)){let d=await Ne(p,s.artifactBucket,s.slug,t);u=d.reduce((y,C)=>Math.max(y,C.id),0)+1,d.push({id:u,command:r,timestamp:new Date().toISOString(),status:c,output:o.slice(0,4000)}),await p.putObjectJson(s.artifactBucket,ve(s.slug,t),{records:d.slice(-Ve)})}}catch{}if(a.FunctionError)throw Error(`Command failed${u>0?` (#${u})`:""}: ${o}`);return{id:u,status:c,output:o}}async function Be(e,t){let r=v(e,t),s=new P(r.region);return Ne(s,r.artifactBucket,r.slug,t)}async function Ze(e,t,r){let s=await Be(e,t);if(!s.length)return;return r==null?s[s.length-1]:s.find((n)=>n.id===r)}async function et(e,t,r){let s=Buffer.from(r,"utf-8").toString("base64");return xe(e,t,`tscloud:db-query --sql-base64=${s}`)}async function tt(e,t){let r=v(e,t),s=new Z(r.region),n=new b(r.region),i=new P(r.region),a="not deployed",o={};try{let{Stacks:A}=await s.describeStacks({stackName:r.stackName});a=A?.[0]?.StackStatus??a;for(let g of A?.[0]?.Outputs??[])if(g.OutputKey)o[g.OutputKey]=g.OutputValue??""}catch{}let c=de(r.app,r.slug,t),u=r.app.provisionedConcurrency??0,p=["http","cli",...c.length?["queue"]:[]],d=`${r.slug}-${t}`,y=[];for(let A of p){let g=`${d}-${A}`,k={mode:A,name:g,version:"$LATEST"};if(u>0){let N=await n.getAlias(g,"live").catch(()=>null);if(N?.FunctionVersion){k.version=N.FunctionVersion;let h=await n.getProvisionedConcurrencyConfig(g,"live").catch(()=>null);if(h)k.provisioned={status:h.Status??"-",allocated:h.AllocatedProvisionedConcurrentExecutions??0,requested:h.RequestedProvisionedConcurrentExecutions??0}}}y.push(k)}let C=await J(i,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:a,endpoint:o.HttpApiEndpoint,assetUrl:C?.assetUrl,scheduler:r.app.scheduler??"on",queues:c,provisionedConcurrency:u,functions:y,lastRelease:C?{sha:C.sha,timestamp:C.timestamp}:void 0}}function we(e,t){return`${e}-${t}-db`}async function rt(e,t,r,s){let n=v(e,t);if(n.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:i}=await import("./chunk-tp4c2mv1.js"),a=new i(n.region),o=we(n.slug,t);m(`Scaling ${o} → ${r}–${s} ACUs`),await a.modifyDBCluster({DBClusterIdentifier:o,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:s},ApplyImmediately:!0}),V(`Scaling applied to ${o} (takes effect shortly).`)}async function st(e,t,r){let s=v(e,t);if(s.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");if(!r.toTime&&!r.latest)throw Error("Specify a restore point: --to <ISO timestamp> or --latest.");let{RDSClient:n}=await import("./chunk-tp4c2mv1.js"),i=new n(s.region),a=we(s.slug,t),o=r.latest?"latest":r.toTime.toISOString().replace(/[^0-9]/g,"").slice(0,14),c=r.target??`${a}-restore-${o}`;m(`Restoring ${a} → new cluster ${c} (${r.latest?"latest restorable time":r.toTime.toISOString()})`),await i.restoreDBClusterToPointInTime({DBClusterIdentifier:c,SourceDBClusterIdentifier:a,RestoreToTime:r.toTime,UseLatestRestorableTime:r.latest}),m("Waiting for the restored cluster to be ready");for(let u=0;u<120;u++){let{DBClusters:p}=await i.describeDBClusters({DBClusterIdentifier:c}),d=p?.[0]?.Status;if(d&&d!=="creating")break;await new Promise((y)=>setTimeout(y,15000))}return m("Adding a writer instance"),await i.createDBInstance({DBInstanceIdentifier:`${c}-1`,DBClusterIdentifier:c,Engine:"aurora-mysql",DBInstanceClass:"db.serverless"}),V(`Restore complete → cluster ${c} with writer ${c}-1. Point an env's database at it once available.`),c}
+export{_ as Hd,He as Id,Ie as Jd,De as Kd,Y as Ld,Oe as Md,We as Nd,Xe as Od,Ge as Pd,Ye as Qd,xe as Rd,Qe as Sd,Be as Td,Ze as Ud,et as Vd,tt as Wd,rt as Xd,st as Yd};

package/dist/bin/chunk-d6zzgvtn.js

@@ -0,0 +1,92 @@
+import{ah as U,bh as L}from"./chunk-ey9fagrr.js";import{mp as K}from"./chunk-b2ymh8k0.js";import*as c from"node:crypto";import{readFileSync as D}from"node:fs";import{readdir as z}from"node:fs/promises";import{join as M}from"node:path";function R(e){if(e){let r=O(e);if(!r)throw Error(`AWS profile '${e}' not found in ~/.aws/credentials`);return r}let t=process.env.AWS_ACCESS_KEY_ID,s=process.env.AWS_SECRET_ACCESS_KEY;if(t&&s)return{accessKeyId:t,secretAccessKey:s,sessionToken:process.env.AWS_SESSION_TOKEN};return O(process.env.AWS_PROFILE||"default")??{accessKeyId:"",secretAccessKey:""}}function O(e){let{existsSync:t,readFileSync:s}=K("node:fs"),{homedir:r}=K("node:os"),{join:n}=K("node:path"),i=process.env.AWS_SHARED_CREDENTIALS_FILE||n(r(),".aws","credentials");if(!t(i))return null;let o=s(i,"utf-8"),a=null,g,l,u;for(let d of o.split(`
+`)){let y=d.trim();if(!y||y.startsWith("#")||y.startsWith(";"))continue;let h=y.match(/^\[([^\]]+)\]$/);if(h){if(a===e&&g&&l)return{accessKeyId:g,secretAccessKey:l,sessionToken:u};a=h[1],g=void 0,l=void 0,u=void 0;continue}if(a===e){let[S,...m]=y.split("="),p=m.join("=").trim();switch(S.trim().toLowerCase()){case"aws_access_key_id":g=p;break;case"aws_secret_access_key":l=p;break;case"aws_session_token":u=p;break}}}if(a===e&&g&&l)return{accessKeyId:g,secretAccessKey:l,sessionToken:u};return null}function B(e){let{buffer:t,byteOffset:s,byteLength:r}=e;if(t instanceof ArrayBuffer)return t.slice(s,s+r);let n=new ArrayBuffer(r);return new Uint8Array(n).set(new Uint8Array(e)),n}class V{client;region;explicitProfile;endpoint;endpointProtocol="https";forcePathStyle;explicitCredentials;constructor(e="us-east-1",t,s){let r=typeof e==="string"?s:e,n=typeof e==="string"?e:e.region??"us-east-1",i=typeof e==="string"?t:e.profile,o=r?.endpoint?U({region:n,path:"/",endpoint:r.endpoint}):void 0;this.region=n,this.explicitProfile=i,this.endpoint=o?.host,this.endpointProtocol=o?.protocol??"https",this.forcePathStyle=r?.forcePathStyle,this.explicitCredentials=r?.credentials,this.client=new L(r?.credentials,{profile:i,endpoint:r?.endpoint,forcePathStyle:r?.forcePathStyle})}getCredentials(){if(this.explicitCredentials?.accessKeyId&&this.explicitCredentials.secretAccessKey)return this.explicitCredentials;let e=R(this.explicitProfile);if(e.accessKeyId&&e.secretAccessKey)return e;throw Error("S3 credentials not found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or pass explicit credentials/profile), or configure ~/.aws/credentials.")}s3BaseHost(){return this.endpoint||`s3.${this.region}.amazonaws.com`}s3VirtualHost(e){return this.forcePathStyle?this.s3BaseHost():`${e}.${this.s3BaseHost()}`}objectPath(e,t){return this.forcePathStyle?`/${e}/${t}`:`/${t}`}objectUrl(e,t){return`${this.endpointProtocol}://${this.s3VirtualHost(e)}${this.objectPath(e,t)}`}async listBuckets(){let e=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/"}),t=[],r=(e?.ListAllMyBucketsResult??e)?.Buckets?.Bucket;if(r){let n=Array.isArray(r)?r:[r];for(let i of n)t.push({Name:i.Name,CreationDate:i.CreationDate})}return{Buckets:t}}async createBucket(e,t){let s={};if(t?.acl)s["x-amz-acl"]=t.acl;let r;if(this.region!=="us-east-1"&&!this.endpoint)r=`<?xml version="1.0" encoding="UTF-8"?>
+<CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <LocationConstraint>${this.region}</LocationConstraint>
+</CreateBucketConfiguration>`,s["Content-Type"]="application/xml";await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,headers:s,body:r})}async deleteBucket(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`})}async emptyAndDeleteBucket(e){let t=!0;while(t){let s=await this.listAllObjects({bucket:e});if(s.length===0){t=!1;break}let r=s.map((n)=>n.Key);for(let n=0;n<r.length;n+=1000){let i=r.slice(n,n+1000);await this.deleteObjects(e,i)}}await this.deleteBucket(e)}async listAllObjects(e){let t=[],s;do{let r={"list-type":"2","max-keys":"1000"};if(e.prefix)r.prefix=e.prefix;if(s)r["continuation-token"]=s;let n=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`,queryParams:r}),i=n?.ListBucketResult??n,o=i?.Contents;if(o){let g=Array.isArray(o)?o:[o];for(let l of g)t.push({Key:l.Key,LastModified:l.LastModified||"",Size:Number.parseInt(l.Size||"0"),ETag:l.ETag})}let a=i?.IsTruncated;s=a==="true"||a===!0?i?.NextContinuationToken:void 0}while(s);return t}async list(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e.bucket}`}),s=[],n=(t?.ListBucketResult??t)?.Contents;if(n){let i=Array.isArray(n)?n:[n];for(let o of i){if(e.prefix&&!o.Key?.startsWith(e.prefix))continue;if(s.push({Key:o.Key||"",LastModified:o.LastModified||"",Size:Number.parseInt(o.Size||"0"),ETag:o.ETag}),e.maxKeys&&s.length>=e.maxKeys)break}}return s}async putObject(e){let t={};if(e.acl)t["x-amz-acl"]=e.acl;if(e.cacheControl)t["Cache-Control"]=e.cacheControl;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[n,i]of Object.entries(e.metadata))t[`x-amz-meta-${n}`]=i;let s=e.key.split("/").map((n)=>encodeURIComponent(n)).join("/"),r=e.body instanceof Uint8Array&&!Buffer.isBuffer(e.body)?Buffer.from(e.body):e.body;if(Buffer.isBuffer(r)||r instanceof Uint8Array){let n=Buffer.isBuffer(r)?r:Buffer.from(r),{accessKeyId:i,secretAccessKey:o,sessionToken:a}=this.getCredentials(),g=this.s3VirtualHost(e.bucket),l=this.objectPath(e.bucket,s),u=this.objectUrl(e.bucket,s),d=new Date,y=d.toISOString().replace(/[:-]|\.\d{3}/g,""),h=d.toISOString().slice(0,10).replace(/-/g,""),S=c.createHash("sha256").update(n).digest("hex"),m={host:g,"x-amz-date":y,"x-amz-content-sha256":S,...t};if(a)m["x-amz-security-token"]=a;let p=Object.keys(m).sort().map((f)=>`${f.toLowerCase()}:${m[f].trim()}
+`).join(""),C=Object.keys(m).sort().map((f)=>f.toLowerCase()).join(";"),P=["PUT",l,"",p,C,S].join(`
+`),k="AWS4-HMAC-SHA256",b=`${h}/${this.region}/s3/aws4_request`,v=[k,y,b,c.createHash("sha256").update(P).digest("hex")].join(`
+`),q=c.createHmac("sha256",`AWS4${o}`).update(h).digest(),H=c.createHmac("sha256",q).update(this.region).digest(),E=c.createHmac("sha256",H).update("s3").digest(),w=c.createHmac("sha256",E).update("aws4_request").digest(),x=c.createHmac("sha256",w).update(v).digest("hex"),T=`${k} Credential=${i}/${b}, SignedHeaders=${C}, Signature=${x}`,A=await fetch(u,{method:"PUT",headers:{...m,Authorization:T},body:B(n)});if(!A.ok){let f=await A.text();throw Error(`S3 PUT failed: ${A.status} ${f}`)}return}await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${s}`,bucket:e.bucket,headers:t,body:e.body})}async getObject(e,t){let s=t.split("/").map((n)=>encodeURIComponent(n)).join("/");return await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${s}`,bucket:e,rawResponse:!0})}async getObjectBytes(e,t){let{accessKeyId:s,secretAccessKey:r,sessionToken:n}=this.getCredentials(),i=this.s3VirtualHost(e),o=t.split("/").map((f)=>encodeURIComponent(f)).join("/"),a=this.objectPath(e,o),g=this.objectUrl(e,o),l=new Date,u=l.toISOString().replace(/[:-]|\.\d{3}/g,""),d=l.toISOString().slice(0,10).replace(/-/g,""),y=c.createHash("sha256").update("").digest("hex"),h={host:i,"x-amz-date":u,"x-amz-content-sha256":y};if(n)h["x-amz-security-token"]=n;let S=Object.keys(h).sort().map((f)=>`${f.toLowerCase()}:${h[f].trim()}
+`).join(""),m=Object.keys(h).sort().map((f)=>f.toLowerCase()).join(";"),p=["GET",a,"",S,m,y].join(`
+`),C="AWS4-HMAC-SHA256",P=`${d}/${this.region}/s3/aws4_request`,k=[C,u,P,c.createHash("sha256").update(p).digest("hex")].join(`
+`),b=c.createHmac("sha256",`AWS4${r}`).update(d).digest(),v=c.createHmac("sha256",b).update(this.region).digest(),q=c.createHmac("sha256",v).update("s3").digest(),H=c.createHmac("sha256",q).update("aws4_request").digest(),E=c.createHmac("sha256",H).update(k).digest("hex"),w=`${C} Credential=${s}/${P}, SignedHeaders=${m}, Signature=${E}`,x=await fetch(g,{method:"GET",headers:{...h,Authorization:w}});if(!x.ok){let f=await x.text();throw Error(`S3 GET failed: ${x.status} ${f}`)}let T=await x.arrayBuffer(),A=x.headers.get("content-length");return{body:new Uint8Array(T),contentType:x.headers.get("content-type")??void 0,contentLength:A?Number.parseInt(A,10):void 0}}async copyObject(e){let t={"x-amz-copy-source":`/${e.sourceBucket}/${e.sourceKey}`};if(e.metadataDirective)t["x-amz-metadata-directive"]=e.metadataDirective;if(e.contentType)t["Content-Type"]=e.contentType;if(e.metadata)for(let[s,r]of Object.entries(e.metadata))t[`x-amz-meta-${s}`]=r;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e.destinationBucket}/${e.destinationKey}`,headers:t})}async deleteObject(e,t){let s=t.split("/").map((r)=>encodeURIComponent(r)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${s}`,bucket:e})}async deleteObjects(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+<Delete>
+  ${t.map((n)=>`<Object><Key>${n}</Key></Object>`).join(`
+  `)}
+</Delete>`,r=c.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":r}})}async bucketExists(e){try{return await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`}),!0}catch{return!1}}async copy(e){let t=D(e.source);await this.putObject({bucket:e.bucket,key:e.key,body:t,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}async sync(e){let t=await this.listFilesRecursive(e.source);for(let s of t){if(e.exclude&&e.exclude.some((i)=>s.includes(i)))continue;if(e.include&&!e.include.some((i)=>s.includes(i)))continue;let r=s.substring(e.source.length+1),n=e.prefix?`${e.prefix}/${r}`:r;if(!e.dryRun){let i=D(s);await this.putObject({bucket:e.bucket,key:n,body:i,acl:e.acl,cacheControl:e.cacheControl,contentType:e.contentType,metadata:e.metadata})}}}async delete(e,t){await this.deleteObject(e,t)}async deletePrefix(e,t){let r=(await this.list({bucket:e,prefix:t})).map((n)=>n.Key);if(r.length>0)await this.deleteObjects(e,r)}async getBucketSize(e,t){return(await this.list({bucket:e,prefix:t})).reduce((r,n)=>r+n.Size,0)}async listFilesRecursive(e){let t=[],s=await z(e,{withFileTypes:!0});for(let r of s){let n=M(e,r.name);if(r.isDirectory()){let i=await this.listFilesRecursive(n);t.push(...i)}else t.push(n)}return t}async putBucketPolicy(e,t){let{accessKeyId:s,secretAccessKey:r,sessionToken:n}=this.getCredentials(),i=this.s3BaseHost(),o=typeof t==="string"?t:JSON.stringify(t),a=new Date,g=a.toISOString().replace(/[:-]|\.\d{3}/g,""),l=a.toISOString().slice(0,10).replace(/-/g,""),u=c.createHash("sha256").update(o).digest("hex"),d="/"+e,y="policy=",h={host:i,"x-amz-date":g,"x-amz-content-sha256":u,"content-type":"application/json"};if(n)h["x-amz-security-token"]=n;let S=Object.keys(h).sort().map((A)=>`${A.toLowerCase()}:${h[A].trim()}
+`).join(""),m=Object.keys(h).sort().map((A)=>A.toLowerCase()).join(";"),p=["PUT",d,"policy=",S,m,u].join(`
+`),C="AWS4-HMAC-SHA256",P=`${l}/${this.region}/s3/aws4_request`,k=[C,g,P,c.createHash("sha256").update(p).digest("hex")].join(`
+`),b=c.createHmac("sha256","AWS4"+r).update(l).digest(),v=c.createHmac("sha256",b).update(this.region).digest(),q=c.createHmac("sha256",v).update("s3").digest(),H=c.createHmac("sha256",q).update("aws4_request").digest(),E=c.createHmac("sha256",H).update(k).digest("hex"),w=`${C} Credential=${s}/${P}, SignedHeaders=${m}, Signature=${E}`,x=`${this.endpointProtocol}://${i}${d}?policy=`,T=await fetch(x,{method:"PUT",headers:{...h,Authorization:w},body:o});if(!T.ok){let A=await T.text();throw Error(`Failed to put bucket policy: ${T.status} ${A}`)}}async getBucketPolicy(e){let{accessKeyId:t,secretAccessKey:s,sessionToken:r}=this.getCredentials(),n=this.s3BaseHost(),i=new Date,o=i.toISOString().replace(/[:-]|\.\d{3}/g,""),a=i.toISOString().slice(0,10).replace(/-/g,""),g=c.createHash("sha256").update("").digest("hex"),l="/"+e,u="policy=",d={host:n,"x-amz-date":o,"x-amz-content-sha256":g};if(r)d["x-amz-security-token"]=r;let y=Object.keys(d).sort().map((T)=>`${T.toLowerCase()}:${d[T].trim()}
+`).join(""),h=Object.keys(d).sort().map((T)=>T.toLowerCase()).join(";"),S=["GET",l,"policy=",y,h,g].join(`
+`),m="AWS4-HMAC-SHA256",p=`${a}/${this.region}/s3/aws4_request`,C=[m,o,p,c.createHash("sha256").update(S).digest("hex")].join(`
+`),P=c.createHmac("sha256","AWS4"+s).update(a).digest(),k=c.createHmac("sha256",P).update(this.region).digest(),b=c.createHmac("sha256",k).update("s3").digest(),v=c.createHmac("sha256",b).update("aws4_request").digest(),q=c.createHmac("sha256",v).update(C).digest("hex"),H=`${m} Credential=${t}/${p}, SignedHeaders=${h}, Signature=${q}`,E=`${this.endpointProtocol}://${n}${l}?policy=`,w=await fetch(E,{method:"GET",headers:{...d,Authorization:H}});if(w.status===404)return null;if(!w.ok){let T=await w.text();throw Error(`Failed to get bucket policy: ${w.status} ${T}`)}let x=await w.text();return JSON.parse(x)}async deleteBucketPolicy(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{policy:""}})}async headBucket(e){try{return{exists:!0,region:(await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}`,returnHeaders:!0}))?.headers?.["x-amz-bucket-region"]}}catch(t){if(t.statusCode===404)return{exists:!1};throw t}}async headObject(e,t){try{let s=await this.client.request({service:"s3",region:this.region,method:"HEAD",path:`/${e}/${t}`,returnHeaders:!0});return{ContentLength:s?.headers?.["content-length"]?parseInt(s.headers["content-length"]):void 0,ContentType:s?.headers?.["content-type"],ETag:s?.headers?.etag,LastModified:s?.headers?.["last-modified"]}}catch(s){if(s.statusCode===404)return null;throw s}}async getObjectBuffer(e,t){let s=await this.getObject(e,t);return Buffer.from(s)}async getObjectJson(e,t){let s=await this.getObject(e,t);return JSON.parse(s)}async putObjectJson(e,t,s,r){await this.putObject({bucket:e,key:t,body:JSON.stringify(s),contentType:"application/json",...r})}async getBucketVersioning(e){return{Status:(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{versioning:""}}))?.VersioningConfiguration?.Status}}async putBucketVersioning(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+<VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Status>${t}</Status>
+</VersioningConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{versioning:""},headers:{"Content-Type":"application/xml"},body:s})}async getBucketLifecycleConfiguration(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{lifecycle:""}}))?.LifecycleConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketLifecycleConfiguration(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
+<LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${t.map((n)=>{let i=`<Rule><ID>${n.ID}</ID><Status>${n.Status}</Status>`;if(n.Filter)i+=`<Filter><Prefix>${n.Filter.Prefix||""}</Prefix></Filter>`;else i+="<Filter><Prefix></Prefix></Filter>";if(n.Expiration){if(n.Expiration.Days)i+=`<Expiration><Days>${n.Expiration.Days}</Days></Expiration>`;else if(n.Expiration.Date)i+=`<Expiration><Date>${n.Expiration.Date}</Date></Expiration>`}if(n.Transitions)for(let o of n.Transitions)i+=`<Transition><Days>${o.Days}</Days><StorageClass>${o.StorageClass}</StorageClass></Transition>`;if(n.NoncurrentVersionExpiration)i+=`<NoncurrentVersionExpiration><NoncurrentDays>${n.NoncurrentVersionExpiration.NoncurrentDays}</NoncurrentDays></NoncurrentVersionExpiration>`;return i+="</Rule>",i}).join("")}
+</LifecycleConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{lifecycle:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketLifecycleConfiguration(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{lifecycle:""}})}async getBucketCors(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{cors:""}}))?.CORSConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketCors(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
+<CORSConfiguration>
+  ${t.map((n)=>{let i="<CORSRule>";for(let o of n.AllowedOrigins)i+=`<AllowedOrigin>${o}</AllowedOrigin>`;for(let o of n.AllowedMethods)i+=`<AllowedMethod>${o}</AllowedMethod>`;if(n.AllowedHeaders)for(let o of n.AllowedHeaders)i+=`<AllowedHeader>${o}</AllowedHeader>`;if(n.ExposeHeaders)for(let o of n.ExposeHeaders)i+=`<ExposeHeader>${o}</ExposeHeader>`;if(n.MaxAgeSeconds)i+=`<MaxAgeSeconds>${n.MaxAgeSeconds}</MaxAgeSeconds>`;return i+="</CORSRule>",i}).join("")}
+</CORSConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{cors:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketCors(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{cors:""}})}async getBucketEncryption(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{encryption:""}}))?.ServerSideEncryptionConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketEncryption(e,t,s){let r=`<ApplyServerSideEncryptionByDefault><SSEAlgorithm>${t}</SSEAlgorithm>`;if(s)r+=`<KMSMasterKeyID>${s}</KMSMasterKeyID>`;r+="</ApplyServerSideEncryptionByDefault>";let n=`<?xml version="1.0" encoding="UTF-8"?>
+<ServerSideEncryptionConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Rule>${r}</Rule>
+</ServerSideEncryptionConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{encryption:""},headers:{"Content-Type":"application/xml"},body:n})}async deleteBucketEncryption(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{encryption:""}})}async getBucketTagging(e){try{let s=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!s)return[];return Array.isArray(s)?s:[s]}catch(t){if(t.statusCode===404)return[];throw t}}async putBucketTagging(e,t){let r=`<?xml version="1.0" encoding="UTF-8"?>
+<Tagging>
+  <TagSet>${t.map((n)=>`<Tag><Key>${n.Key}</Key><Value>${n.Value}</Value></Tag>`).join("")}</TagSet>
+</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketTagging(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{tagging:""}})}async getObjectTagging(e,t){try{let r=(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{tagging:""}}))?.Tagging?.TagSet?.Tag;if(!r)return[];return Array.isArray(r)?r:[r]}catch(s){if(s.statusCode===404)return[];throw s}}async putObjectTagging(e,t,s){let n=`<?xml version="1.0" encoding="UTF-8"?>
+<Tagging>
+  <TagSet>${s.map((i)=>`<Tag><Key>${i.Key}</Key><Value>${i.Value}</Value></Tag>`).join("")}</TagSet>
+</Tagging>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{tagging:""},headers:{"Content-Type":"application/xml"},body:n})}async deleteObjectTagging(e,t){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}/${t}`,queryParams:{tagging:""}})}async getBucketAcl(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putBucketAcl(e,t){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{acl:""},headers:{"x-amz-acl":t}})}async getObjectAcl(e,t){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}/${t}`,queryParams:{acl:""}}))?.AccessControlPolicy}async putObjectAcl(e,t,s){await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}/${t}`,queryParams:{acl:""},headers:{"x-amz-acl":s}})}async getBucketLocation(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{location:""}}))?.LocationConstraint||"us-east-1"}async getBucketLogging(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{logging:""}}))?.BucketLoggingStatus}async putBucketLogging(e,t,s){let r=`<?xml version="1.0" encoding="UTF-8"?>
+<BucketLoggingStatus xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <LoggingEnabled>
+    <TargetBucket>${t}</TargetBucket>
+    <TargetPrefix>${s}</TargetPrefix>
+  </LoggingEnabled>
+</BucketLoggingStatus>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{logging:""},headers:{"Content-Type":"application/xml"},body:r})}async getBucketNotificationConfiguration(e){return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{notification:""}}))?.NotificationConfiguration}async putBucketNotificationConfiguration(e,t){let s="";if(t.LambdaFunctionConfigurations)for(let n of t.LambdaFunctionConfigurations){if(s+="<CloudFunctionConfiguration>",n.Id)s+=`<Id>${n.Id}</Id>`;s+=`<CloudFunction>${n.LambdaFunctionArn}</CloudFunction>`;for(let i of n.Events)s+=`<Event>${i}</Event>`;if(n.Filter?.Key?.FilterRules){s+="<Filter><S3Key>";for(let i of n.Filter.Key.FilterRules)s+=`<FilterRule><Name>${i.Name}</Name><Value>${i.Value}</Value></FilterRule>`;s+="</S3Key></Filter>"}s+="</CloudFunctionConfiguration>"}if(t.TopicConfigurations)for(let n of t.TopicConfigurations){if(s+="<TopicConfiguration>",n.Id)s+=`<Id>${n.Id}</Id>`;s+=`<Topic>${n.TopicArn}</Topic>`;for(let i of n.Events)s+=`<Event>${i}</Event>`;s+="</TopicConfiguration>"}if(t.QueueConfigurations)for(let n of t.QueueConfigurations){if(s+="<QueueConfiguration>",n.Id)s+=`<Id>${n.Id}</Id>`;s+=`<Queue>${n.QueueArn}</Queue>`;for(let i of n.Events)s+=`<Event>${i}</Event>`;s+="</QueueConfiguration>"}let r=`<?xml version="1.0" encoding="UTF-8"?>
+<NotificationConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${s}
+</NotificationConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{notification:""},headers:{"Content-Type":"application/xml"},body:r})}async getBucketWebsite(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{website:""}}))?.WebsiteConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putBucketWebsite(e,t){let s="";if(t.RedirectAllRequestsTo)s=`<RedirectAllRequestsTo>
+        <HostName>${t.RedirectAllRequestsTo.HostName}</HostName>
+        ${t.RedirectAllRequestsTo.Protocol?`<Protocol>${t.RedirectAllRequestsTo.Protocol}</Protocol>`:""}
+      </RedirectAllRequestsTo>`;else if(s=`<IndexDocument><Suffix>${t.IndexDocument}</Suffix></IndexDocument>`,t.ErrorDocument)s+=`<ErrorDocument><Key>${t.ErrorDocument}</Key></ErrorDocument>`;let r=`<?xml version="1.0" encoding="UTF-8"?>
+<WebsiteConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  ${s}
+</WebsiteConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{website:""},headers:{"Content-Type":"application/xml"},body:r})}async deleteBucketWebsite(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{website:""}})}async getBucketReplication(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{replication:""}}))?.ReplicationConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async deleteBucketReplication(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{replication:""}})}async getPublicAccessBlock(e){try{return(await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${e}`,queryParams:{publicAccessBlock:""}}))?.PublicAccessBlockConfiguration}catch(t){if(t.statusCode===404)return null;throw t}}async putPublicAccessBlock(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+<PublicAccessBlockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <BlockPublicAcls>${t.BlockPublicAcls??!0}</BlockPublicAcls>
+  <IgnorePublicAcls>${t.IgnorePublicAcls??!0}</IgnorePublicAcls>
+  <BlockPublicPolicy>${t.BlockPublicPolicy??!0}</BlockPublicPolicy>
+  <RestrictPublicBuckets>${t.RestrictPublicBuckets??!0}</RestrictPublicBuckets>
+</PublicAccessBlockConfiguration>`;await this.client.request({service:"s3",region:this.region,method:"PUT",path:`/${e}`,queryParams:{publicAccessBlock:""},headers:{"Content-Type":"application/xml"},body:s})}async deletePublicAccessBlock(e){await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${e}`,queryParams:{publicAccessBlock:""}})}generatePresignedGetUrl(e,t,s=3600){let{accessKeyId:r,secretAccessKey:n}=this.getCredentials(),i=this.s3VirtualHost(e),o=new Date,a=o.toISOString().replace(/[:-]|\.\d{3}/g,""),g=o.toISOString().slice(0,10).replace(/-/g,""),l=`${g}/${this.region}/s3/aws4_request`,u=`${r}/${l}`,d=t.split("/").map((b)=>encodeURIComponent(b)).join("/"),y=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":u,"X-Amz-Date":a,"X-Amz-Expires":s.toString(),"X-Amz-SignedHeaders":"host"}),h=["GET",this.objectPath(e,d),y.toString(),`host:${i}
+`,"host","UNSIGNED-PAYLOAD"].join(`
+`),S=["AWS4-HMAC-SHA256",a,l,c.createHash("sha256").update(h).digest("hex")].join(`
+`),m=c.createHmac("sha256",`AWS4${n}`).update(g).digest(),p=c.createHmac("sha256",m).update(this.region).digest(),C=c.createHmac("sha256",p).update("s3").digest(),P=c.createHmac("sha256",C).update("aws4_request").digest(),k=c.createHmac("sha256",P).update(S).digest("hex");return y.append("X-Amz-Signature",k),`${this.endpointProtocol}://${i}${this.objectPath(e,d)}?${y.toString()}`}generatePresignedPutUrl(e,t,s,r=3600){let{accessKeyId:n,secretAccessKey:i}=this.getCredentials(),o=this.s3VirtualHost(e),a=new Date,g=a.toISOString().replace(/[:-]|\.\d{3}/g,""),l=a.toISOString().slice(0,10).replace(/-/g,""),u=`${l}/${this.region}/s3/aws4_request`,d=`${n}/${u}`,y=t.split("/").map((v)=>encodeURIComponent(v)).join("/"),h=new URLSearchParams({"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":d,"X-Amz-Date":g,"X-Amz-Expires":r.toString(),"X-Amz-SignedHeaders":"content-type;host"}),S=["PUT",this.objectPath(e,y),h.toString(),`content-type:${s}
+host:${o}
+`,"content-type;host","UNSIGNED-PAYLOAD"].join(`
+`),m=["AWS4-HMAC-SHA256",g,u,c.createHash("sha256").update(S).digest("hex")].join(`
+`),p=c.createHmac("sha256",`AWS4${i}`).update(l).digest(),C=c.createHmac("sha256",p).update(this.region).digest(),P=c.createHmac("sha256",C).update("s3").digest(),k=c.createHmac("sha256",P).update("aws4_request").digest(),b=c.createHmac("sha256",k).update(m).digest("hex");return h.append("X-Amz-Signature",b),`${this.endpointProtocol}://${o}${this.objectPath(e,y)}?${h.toString()}`}async createMultipartUpload(e,t,s){let r={};if(s?.contentType)r["Content-Type"]=s.contentType;if(s?.metadata)for(let[a,g]of Object.entries(s.metadata))r[`x-amz-meta-${a}`]=g;let n=t.split("/").map((a)=>encodeURIComponent(a)).join("/"),i=await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${n}`,bucket:e,queryParams:{uploads:""},headers:r});return{UploadId:(i?.InitiateMultipartUploadResult??i)?.UploadId}}async uploadPart(e,t,s,r,n){let{accessKeyId:i,secretAccessKey:o,sessionToken:a}=this.getCredentials(),g=this.s3VirtualHost(e),l=t.split("/").map((j)=>encodeURIComponent(j)).join("/"),u=this.objectPath(e,l),d=`${this.objectUrl(e,l)}?partNumber=${r}&uploadId=${encodeURIComponent(s)}`,y=new Date,h=y.toISOString().replace(/[:-]|\.\d{3}/g,""),S=y.toISOString().slice(0,10).replace(/-/g,""),m=c.createHash("sha256").update(n).digest("hex"),p={host:g,"x-amz-date":h,"x-amz-content-sha256":m};if(a)p["x-amz-security-token"]=a;let C=Object.keys(p).sort().map((j)=>`${j.toLowerCase()}:${p[j].trim()}
+`).join(""),P=Object.keys(p).sort().map((j)=>j.toLowerCase()).join(";"),k=["PUT",u,`partNumber=${r}&uploadId=${encodeURIComponent(s)}`,C,P,m].join(`
+`),b="AWS4-HMAC-SHA256",v=`${S}/${this.region}/s3/aws4_request`,q=[b,h,v,c.createHash("sha256").update(k).digest("hex")].join(`
+`),H=c.createHmac("sha256",`AWS4${o}`).update(S).digest(),E=c.createHmac("sha256",H).update(this.region).digest(),w=c.createHmac("sha256",E).update("s3").digest(),x=c.createHmac("sha256",w).update("aws4_request").digest(),T=c.createHmac("sha256",x).update(q).digest("hex"),A=`${b} Credential=${i}/${v}, SignedHeaders=${P}, Signature=${T}`,f=await fetch(d,{method:"PUT",headers:{...p,Authorization:A},body:B(n)});if(!f.ok){let j=await f.text();throw Error(`Upload part failed: ${f.status} ${j}`)}return{ETag:f.headers.get("etag")||""}}async completeMultipartUpload(e,t,s,r){let n=t.split("/").map((a)=>encodeURIComponent(a)).join("/"),o=`<?xml version="1.0" encoding="UTF-8"?>
+<CompleteMultipartUpload>${r.sort((a,g)=>a.PartNumber-g.PartNumber).map((a)=>`<Part><PartNumber>${a.PartNumber}</PartNumber><ETag>${a.ETag}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${n}`,bucket:e,queryParams:{uploadId:s},headers:{"Content-Type":"application/xml"},body:o})}async abortMultipartUpload(e,t,s){let r=t.split("/").map((n)=>encodeURIComponent(n)).join("/");await this.client.request({service:"s3",region:this.region,method:"DELETE",path:`/${r}`,bucket:e,queryParams:{uploadId:s}})}async listMultipartUploads(e){let t=await this.client.request({service:"s3",region:this.region,method:"GET",path:"/",bucket:e,queryParams:{uploads:""}}),s=(t?.ListMultipartUploadsResult??t)?.Upload;if(!s)return[];return(Array.isArray(s)?s:[s]).map((n)=>({Key:n.Key,UploadId:n.UploadId,Initiated:n.Initiated}))}async restoreObject(e,t,s,r="Standard"){let n=`<?xml version="1.0" encoding="UTF-8"?>
+<RestoreRequest>
+  <Days>${s}</Days>
+  <GlacierJobParameters>
+    <Tier>${r}</Tier>
+  </GlacierJobParameters>
+</RestoreRequest>`;await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{restore:""},headers:{"Content-Type":"application/xml"},body:n})}async selectObjectContent(e,t,s,r,n="JSON"){let i="";if(r==="CSV")i="<CSV><FileHeaderInfo>USE</FileHeaderInfo></CSV>";else if(r==="JSON")i="<JSON><Type>DOCUMENT</Type></JSON>";else i="<Parquet/>";let o="";if(n==="CSV")o="<CSV/>";else o="<JSON/>";let a=`<?xml version="1.0" encoding="UTF-8"?>
+<SelectObjectContentRequest>
+  <Expression>${s}</Expression>
+  <ExpressionType>SQL</ExpressionType>
+  <InputSerialization>${i}</InputSerialization>
+  <OutputSerialization>${o}</OutputSerialization>
+</SelectObjectContentRequest>`;return await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}/${t}`,queryParams:{select:"","select-type":"2"},headers:{"Content-Type":"application/xml"},body:a,rawResponse:!0})}async getSignedUrl(e){let{bucket:t,key:s,expiresIn:r=3600,operation:n="getObject"}=e,{accessKeyId:i,secretAccessKey:o,sessionToken:a}=this.getCredentials(),g=new Date,l=g.toISOString().replace(/[:-]|\.\d{3}/g,""),u=g.toISOString().slice(0,10).replace(/-/g,""),d=this.s3VirtualHost(t),y=n==="putObject"?"PUT":"GET",h="AWS4-HMAC-SHA256",S=`${u}/${this.region}/s3/aws4_request`,p={"X-Amz-Algorithm":"AWS4-HMAC-SHA256","X-Amz-Credential":`${i}/${S}`,"X-Amz-Date":l,"X-Amz-Expires":r.toString(),"X-Amz-SignedHeaders":"host"};if(a)p["X-Amz-Security-Token"]=a;let P=Object.keys(p).sort().map((I)=>`${encodeURIComponent(I)}=${encodeURIComponent(p[I])}`).join("&"),k=s.split("/").map((I)=>encodeURIComponent(I)).join("/"),b=this.objectPath(t,k),v=`host:${d}
+`,E=[y,b,P,v,"host","UNSIGNED-PAYLOAD"].join(`
+`),w=["AWS4-HMAC-SHA256",l,S,c.createHash("sha256").update(E).digest("hex")].join(`
+`),x=c.createHmac("sha256",`AWS4${o}`).update(u).digest(),T=c.createHmac("sha256",x).update(this.region).digest(),A=c.createHmac("sha256",T).update("s3").digest(),f=c.createHmac("sha256",A).update("aws4_request").digest(),j=c.createHmac("sha256",f).update(w).digest("hex");return`${this.endpointProtocol}://${d}${b}?${P}&X-Amz-Signature=${j}`}async listObjects(e){let{bucket:t,prefix:s,maxKeys:r=1000,continuationToken:n}=e,i={"list-type":"2","max-keys":r.toString()};if(s)i.prefix=s;if(n)i["continuation-token"]=n;let o=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:i}),a=[],g=o?.ListBucketResult??o;if(g?.Contents){let l=Array.isArray(g.Contents)?g.Contents:[g.Contents];for(let u of l)a.push({Key:u.Key||"",LastModified:u.LastModified||"",Size:Number.parseInt(u.Size||"0"),ETag:u.ETag})}return{objects:a,nextContinuationToken:g?.NextContinuationToken}}async emptyBucket(e){let t=0,s=await this.listAllObjects({bucket:e});if(s.length>0)for(let r=0;r<s.length;r+=1000){let i=s.slice(r,r+1000).map((o)=>o.Key);await this.deleteObjects(e,i),t+=i.length}try{let r,n;do{let i=await this.listObjectVersions({bucket:e,keyMarker:r,versionIdMarker:n,maxKeys:1000}),o=[];if(i.versions)for(let a of i.versions)o.push({Key:a.Key,VersionId:a.VersionId});if(i.deleteMarkers)for(let a of i.deleteMarkers)o.push({Key:a.Key,VersionId:a.VersionId});if(o.length>0)await this.deleteObjectVersions(e,o),t+=o.length;r=i.nextKeyMarker,n=i.nextVersionIdMarker}while(r)}catch{}return{deletedCount:t}}async listObjectVersions(e){let{bucket:t,prefix:s,keyMarker:r,versionIdMarker:n,maxKeys:i=1000}=e,o={versions:"","max-keys":i.toString()};if(s)o.prefix=s;if(r)o["key-marker"]=r;if(n)o["version-id-marker"]=n;let a=await this.client.request({service:"s3",region:this.region,method:"GET",path:`/${t}`,queryParams:o}),g=[],l=[];if(a.Version){let u=Array.isArray(a.Version)?a.Version:[a.Version];for(let d of u)g.push({Key:d.Key,VersionId:d.VersionId,IsLatest:d.IsLatest==="true"})}if(a.DeleteMarker){let u=Array.isArray(a.DeleteMarker)?a.DeleteMarker:[a.DeleteMarker];for(let d of u)l.push({Key:d.Key,VersionId:d.VersionId,IsLatest:d.IsLatest==="true"})}return{versions:g,deleteMarkers:l,nextKeyMarker:a.NextKeyMarker,nextVersionIdMarker:a.NextVersionIdMarker}}async deleteObjectVersions(e,t){let s=`<?xml version="1.0" encoding="UTF-8"?>
+<Delete>
+  <Quiet>true</Quiet>
+  ${t.map((n)=>`<Object><Key>${n.Key}</Key>${n.VersionId?`<VersionId>${n.VersionId}</VersionId>`:""}</Object>`).join(`
+  `)}
+</Delete>`,r=c.createHash("md5").update(s).digest("base64");await this.client.request({service:"s3",region:this.region,method:"POST",path:`/${e}`,queryParams:{delete:""},body:s,headers:{"Content-Type":"application/xml","Content-MD5":r}})}}
+export{R as ng,V as og};