blogwright 0.4.0-beta.3 → 0.4.0-beta.5

package/agent/server.js

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { createServer } from "node:http";
 import { spawn } from "node:child_process";
 import { createHash, createHmac, getRandomValues } from "node:crypto";
-import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, sep } from "node:path";
 import { ReadStream, fstatSync, lstatSync } from "node:fs";
@@ -64,14 +64,35 @@ var AwsError = class extends Error {
 	get isNotFound() {
 		return this.statusCode === 404 || /NotFound|NoSuchEntity|NoSuchBucket|NoSuchKey|ResourceNotFoundException/i.test(this.code);
 	}
+	/**
+	* True when AWS refused the request for its rate: the request was rejected
+	* before it was acted on, so retrying it is safe for any method - a create
+	* included. See {@link THROTTLING_CODE}.
+	*/
+	get isThrottling() {
+		return this.statusCode === 429 || THROTTLING_CODE.test(this.code);
+	}
 	/** True for "already exists" style conflicts that bootstrap can treat as success. */
 	get isAlreadyExists() {
 		return /AlreadyExists|BucketAlreadyOwnedByYou|EntityAlreadyExists|Conflict/i.test(this.code);
 	}
 };
+/**
+* The error codes AWS services use for a request refused for its rate, across
+* the protocols this repo speaks: CloudFront's and IAM's `Throttling` (HTTP
+* 400), the JSON services' `ThrottlingException` and `TooManyRequestsException`,
+* S3's `SlowDown` (HTTP 503), Route 53's `PriorRequestNotComplete`, and the
+* rest of the family. Matched whole, so a quota error such as
+* `LimitExceededException` - which waiting does not clear - is not retried.
+*/
+const THROTTLING_CODE = /^(?:Throttling|ThrottlingException|ThrottledException|Throttled|TooManyRequests|TooManyRequestsException|RequestLimitExceeded|RequestThrottled|RequestThrottledException|SlowDown|PriorRequestNotComplete|ProvisionedThroughputExceededException|BandwidthLimitExceeded|EC2ThrottledException)$/i;
+/** True when an error is AWS refusing a request for its rate. */
+function isThrottling(err) {
+	return err instanceof AwsError && err.isThrottling;
+}
 /** True for transient errors worth retrying with backoff. */
 function isRetryable(err) {
-	if (err instanceof AwsError) return err.statusCode >= 500 || err.statusCode === 429 || /Throttling|TooManyRequests|InternalError|ServiceUnavailable/i.test(err.code);
+	if (err instanceof AwsError) return err.isThrottling || err.statusCode >= 500 || /InternalError|ServiceUnavailable/i.test(err.code);
 	return err instanceof TypeError;
 }
 //#endregion
@@ -5711,6 +5732,7 @@ const SIGNING_NAMES = {
 	cloudfront: "cloudfront",
 	route53: "route53",
 	microvms: "lambda",
+	lambdaweb: "lambda",
 	secretsmanager: "secretsmanager"
 };
 /** Services that are global; they always sign in us-east-1. */
@@ -5761,6 +5783,7 @@ function canonicalHost(service, region) {
 		case "route53": return "route53.amazonaws.com";
 		case "s3": return `s3.${region}.amazonaws.com`;
 		case "microvms": return `lambda.${region}.amazonaws.com`;
+		case "lambdaweb": return `lambda.${region}.amazonaws.com`;
 		default: return `${service}.${region}.amazonaws.com`;
 	}
 }
@@ -5781,6 +5804,10 @@ function encodeTagQuery(tags) {
 function bodyChecksum(body) {
 	return createHash("sha256").update(body).digest("base64");
 }
+/** Base64 MD5 of a request body - DeleteObjects' required integrity header. */
+function bodyMd5(body) {
+	return createHash("md5").update(body).digest("base64");
+}
 /** Percent-encode an object key for a path-style URL, preserving '/' separators. */
 function encodeKey(key) {
 	return key.split("/").map((seg) => encodeURIComponent(seg).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
@@ -5853,7 +5880,7 @@ var S3Client = class {
 		});
 	}
 	async putObject(bucket, key, body, contentType = "application/octet-stream", tags) {
-		await this.client.send({
+		return (await this.client.send({
 			service: "s3",
 			method: "PUT",
 			path: this.objectPath(bucket, key),
@@ -5862,8 +5889,38 @@ var S3Client = class {
 				...tags && Object.keys(tags).length > 0 ? { "x-amz-tagging": encodeTagQuery(tags) } : {}
 			},
 			body
+		})).headers["x-amz-version-id"];
+	}
+	/** Enable or suspend bucket versioning. Never suspended once enabled (see the SSR contract). */
+	async putBucketVersioning(bucket, status) {
+		const body = `<?xml version="1.0" encoding="UTF-8"?><VersioningConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Status>${status}</Status></VersioningConfiguration>`;
+		await this.client.send({
+			service: "s3",
+			method: "PUT",
+			path: `/${bucket}`,
+			query: { versioning: "" },
+			headers: {
+				"content-type": "application/xml",
+				"x-amz-checksum-sha256": bodyChecksum(body)
+			},
+			body
 		});
 	}
+	/** Current versioning status of a bucket, or undefined when the API reports none. */
+	async getBucketVersioning(bucket) {
+		try {
+			const status = textTag((await this.client.send({
+				service: "s3",
+				method: "GET",
+				path: `/${bucket}`,
+				query: { versioning: "" }
+			})).text(), "Status");
+			return status === "Enabled" || status === "Suspended" ? status : void 0;
+		} catch (err) {
+			if (err instanceof AwsError && err.isNotFound) return void 0;
+			throw err;
+		}
+	}
 	/** Apply bucket tags (idempotent full replace). */
 	async putBucketTagging(bucket, tags) {
 		const body = `<?xml version="1.0" encoding="UTF-8"?><Tagging xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><TagSet>${Object.entries(tags).map(([k, v]) => `<Tag><Key>${encodeEntities(k)}</Key><Value>${encodeEntities(v)}</Value></Tag>`).join("")}</TagSet></Tagging>`;
@@ -5908,6 +5965,21 @@ var S3Client = class {
 			throw err;
 		}
 	}
+	/** True when one specific object version still exists (rollback's artifact check). */
+	async objectVersionExists(bucket, key, versionId) {
+		try {
+			await this.client.send({
+				service: "s3",
+				method: "HEAD",
+				path: this.objectPath(bucket, key),
+				query: { versionId }
+			});
+			return true;
+		} catch (err) {
+			if (err instanceof AwsError && err.isNotFound) return false;
+			throw err;
+		}
+	}
 	async deleteObject(bucket, key) {
 		await this.client.send({
 			service: "s3",
@@ -5963,6 +6035,88 @@ var S3Client = class {
 			body: policy
 		});
 	}
+	/** The bucket's current policy document, or undefined when it has none. */
+	async getBucketPolicy(bucket) {
+		try {
+			return (await this.client.send({
+				service: "s3",
+				method: "GET",
+				path: `/${bucket}`,
+				query: { policy: "" }
+			})).text();
+		} catch (err) {
+			if (err instanceof AwsError && err.isNotFound) return void 0;
+			throw err;
+		}
+	}
+	/**
+	* Every object version (and delete marker) under a prefix, following the
+	* ListObjectVersions key/version-id markers. Only the bucket node's teardown
+	* reads this - a plain `deletePrefix` cannot empty a versioned bucket.
+	*/
+	async listObjectVersions(bucket, prefix) {
+		const out = [];
+		let keyMarker;
+		let versionIdMarker;
+		for (;;) {
+			const xml = (await this.client.send({
+				service: "s3",
+				method: "GET",
+				path: `/${bucket}`,
+				query: {
+					versions: "",
+					prefix,
+					...keyMarker ? { "key-marker": keyMarker } : {},
+					...versionIdMarker ? { "version-id-marker": versionIdMarker } : {}
+				}
+			})).text();
+			for (const tag of ["Version", "DeleteMarker"]) for (const block of allTags(xml, tag)) {
+				const key = rawTextTag(block, "Key");
+				const versionId = textTag(block, "VersionId") ?? "";
+				if (key === void 0 || versionId === "") continue;
+				out.push({
+					key,
+					versionId,
+					isDeleteMarker: tag === "DeleteMarker",
+					size: Number(textTag(block, "Size") ?? "0")
+				});
+			}
+			if (textTag(xml, "IsTruncated") !== "true") break;
+			const nextKey = textTag(xml, "NextKeyMarker");
+			const nextVersion = textTag(xml, "NextVersionIdMarker");
+			if (!nextKey) break;
+			keyMarker = nextKey;
+			versionIdMarker = nextVersion;
+		}
+		return out;
+	}
+	/**
+	* Remove every version and delete marker under a prefix with batched
+	* DeleteObjects requests. Version-aware removal is deliberately NOT what
+	* `deletePrefix` does: no role that deletes a prefix today holds
+	* `s3:ListBucketVersions`/`s3:DeleteObjectVersion`, so only the bucket's own
+	* teardown may call this. Returns the number of entries removed.
+	*/
+	async deleteAllVersions(bucket, prefix) {
+		const versions = await this.listObjectVersions(bucket, prefix);
+		for (let i = 0; i < versions.length; i += 1e3) {
+			const body = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><Delete xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">" + versions.slice(i, i + 1e3).map((v) => `<Object><Key>${encodeEntities(v.key)}</Key><VersionId>${encodeEntities(v.versionId)}</VersionId></Object>`).join("") + "<Quiet>true</Quiet></Delete>";
+			const failures = allTags((await this.client.send({
+				service: "s3",
+				method: "POST",
+				path: `/${bucket}`,
+				query: { delete: "" },
+				headers: {
+					"content-type": "application/xml",
+					"content-md5": bodyMd5(body)
+				},
+				body
+			})).text(), "Error");
+			const first = failures[0];
+			if (first !== void 0) throw new Error(`could not delete ${failures.length} object version(s) under s3://${bucket}/${prefix}: ${textTag(first, "Code") ?? "error"} on ${rawTextTag(first, "Key") ?? "an entry"}${textTag(first, "Message") ? ` (${textTag(first, "Message")})` : ""}`);
+		}
+		return versions.length;
+	}
 	/** Build an S3 REST-XML error-free marker; exported for callers needing entity-safe values. */
 	static xmlValue(value) {
 		return encodeEntities(value);
@@ -7060,6 +7214,29 @@ var require_dist_cjs = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 //#endregion
 //#region ../core/dist/util.js
+/**
+* The fixed timestamp every reproducible zip in this repo stamps its entries
+* with, so identical input bytes always produce identical archive bytes.
+*
+* **Constructed from local parts on purpose, and the obvious `Date.UTC` form is
+* a bug.** A zip's DOS timestamp is *local* time, and `fflate` reads it with
+* `getFullYear()`/`getMonth()`/`getDate()`, so a `Date` fixed in UTC lands on a
+* different local date in every zone. Two things follow, and this repo shipped
+* both:
+*
+* - `new Date('1980-01-01T00:00:00Z')` is 1979-12-31 local anywhere west of
+*   Greenwich, and `fflate` throws `date not in range 1980-2099` outright -
+*   so `blogwright bootstrap`, `deploy` and `analytics bootstrap` all failed
+*   for most of the Americas while passing in CI, which runs `TZ=UTC`.
+* - Even where it did not throw, the encoded timestamp differed by zone, so
+*   the archive was *not* reproducible - the property the constant exists to
+*   provide. The crash was hiding that.
+*
+* A local-constructed 1980-01-02 is 1980-01-02 in every zone by construction:
+* in range everywhere, and byte-identical everywhere. The second of January
+* rather than the first so that no offset can push it below the 1980 floor.
+*/
+const REPRODUCIBLE_ZIP_MTIME = new Date(1980, 0, 2);
 function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -7075,7 +7252,8 @@ async function withRetry(fn, opts = {}) {
 	} catch (err) {
 		lastErr = err;
 		if (i === attempts - 1 || !retryable(err)) throw err;
-		await sleep(Math.min(max, base * 2 ** i));
+		const ceiling = Math.min(max, base * 2 ** i);
+		await sleep(opts.jitter ? ceiling / 2 + Math.random() * (ceiling / 2) : ceiling);
 	}
 	throw lastErr;
 }
@@ -7084,6 +7262,19 @@ async function withRetry(fn, opts = {}) {
 var import_main = require_main();
 var import_dist_cjs = require_dist_cjs();
 var import_dist_cjs$1 = require_dist_cjs$4();
+/**
+* Backoff for a request AWS refused for its rate. Eight attempts, doubling from
+* 1 second to a 20-second ceiling with jitter, wait roughly 36-71 seconds in all -
+* long enough to outlast a burst of throttling from parallel bootstraps against
+* one account. Other transient failures (5xx, network errors) keep the default
+* {@link withRetry} budget.
+*/
+const THROTTLE_RETRY = {
+	attempts: 8,
+	baseDelayMs: 1e3,
+	maxDelayMs: 2e4,
+	jitter: true
+};
 /** Default transport backed by the global fetch. */
 const fetchTransport = async (req) => {
 	const init = {
@@ -7168,7 +7359,13 @@ var SigningClient = class {
 		}).sign(request);
 		const qs = Object.keys(query).map((k) => `${escape(k)}=${escape(query[k])}`).join("&");
 		const url = `${ep.protocol}//${ep.host}${opts.path}${qs ? `?${qs}` : ""}`;
-		return withRetry(async () => {
+		const transient = [
+			"GET",
+			"HEAD",
+			"PUT",
+			"DELETE"
+		].includes(opts.method) ? isRetryable : (err) => err instanceof TypeError;
+		const attempt = async () => {
 			const response = await this.transport({
 				url,
 				method: opts.method,
@@ -7177,12 +7374,59 @@ var SigningClient = class {
 			});
 			if (response.statusCode >= 300) throw parseError(resolved.name, response);
 			return response;
-		}, { retryable: [
-			"GET",
-			"HEAD",
-			"PUT",
-			"DELETE"
-		].includes(opts.method) ? isRetryable : (err) => err instanceof TypeError });
+		};
+		return withRetry(() => withRetry(attempt, {
+			...THROTTLE_RETRY,
+			retryable: isThrottling
+		}), { retryable: (err) => !isThrottling(err) && transient(err) });
+	}
+	/**
+	* Sign and send a request to an explicit URL - an application endpoint, not
+	* an AWS service endpoint - with `x-amz-content-sha256` always present (a
+	* Lambda Web Function endpoint rejects a signed request without it).
+	*
+	* Unlike {@link send}, an HTTP error status is RETURNED rather than thrown:
+	* the Web Function probe needs the status and headers of a 403 or 5xx to
+	* tell an application answer from an authorization refusal, and neither is
+	* a transport failure. Network errors still throw.
+	*/
+	async sendToUrl(opts) {
+		const url = new URL(opts.url);
+		const contentHash = await sha256Hex(opts.body);
+		const headers = {
+			host: url.host,
+			"x-amz-content-sha256": contentHash,
+			...opts.headers
+		};
+		const request = new import_dist_cjs.HttpRequest({
+			protocol: url.protocol === "http:" ? "http:" : "https:",
+			hostname: url.hostname,
+			...url.port ? { port: Number(url.port) } : {},
+			method: opts.method,
+			path: url.pathname,
+			query: Object.fromEntries(url.searchParams.entries()),
+			headers,
+			...opts.body !== void 0 ? { body: opts.body } : {}
+		});
+		const signed = await new import_dist_cjs$1.SignatureV4({
+			service: opts.service,
+			region: this.region,
+			credentials: async () => {
+				const c = await this.credentials();
+				return {
+					accessKeyId: c.accessKeyId,
+					secretAccessKey: c.secretAccessKey,
+					...c.sessionToken ? { sessionToken: c.sessionToken } : {}
+				};
+			},
+			sha256: import_main.Sha256
+		}).sign(request);
+		return this.transport({
+			url: url.toString(),
+			method: opts.method,
+			headers: signed.headers,
+			body: opts.body
+		});
 	}
 };
 function parseError(service, response) {
@@ -7325,7 +7569,7 @@ var revfl = _a.r;
 fl[28] = 258, revfl[258] = 28;
 var _b = freb(fdeb, 0);
 var fd = _b.b;
-_b.r;
+var revfd = _b.r;
 var rev = new u16(32768);
 for (var i = 0; i < 32768; ++i) {
 	var x = (i & 43690) >> 1 | (i & 21845) << 1;
@@ -7363,7 +7607,9 @@ for (var i = 256; i < 280; ++i) flt[i] = 7;
 for (var i = 280; i < 288; ++i) flt[i] = 8;
 var fdt = new u8(32);
 for (var i = 0; i < 32; ++i) fdt[i] = 5;
+var flm = /*#__PURE__*/ hMap(flt, 9, 0);
 var flrm = /*#__PURE__*/ hMap(flt, 9, 1);
+var fdm = /*#__PURE__*/ hMap(fdt, 5, 0);
 var fdrm = /*#__PURE__*/ hMap(fdt, 5, 1);
 var max = function(a) {
 	var m = a[0];
@@ -7525,7 +7771,348 @@ var inflt = function(dat, st, buf, dict) {
 	} while (!final);
 	return bt != buf.length && noBuf ? slc(buf, 0, bt) : buf.subarray(0, bt);
 };
+var wbits = function(d, p, v) {
+	v <<= p & 7;
+	var o = p / 8 | 0;
+	d[o] |= v;
+	d[o + 1] |= v >> 8;
+};
+var wbits16 = function(d, p, v) {
+	v <<= p & 7;
+	var o = p / 8 | 0;
+	d[o] |= v;
+	d[o + 1] |= v >> 8;
+	d[o + 2] |= v >> 16;
+};
+var hTree = function(d, mb) {
+	var t = [];
+	for (var i = 0; i < d.length; ++i) if (d[i]) t.push({
+		s: i,
+		f: d[i]
+	});
+	var s = t.length;
+	var t2 = t.slice();
+	if (!s) return {
+		t: et,
+		l: 0
+	};
+	if (s == 1) {
+		var v = new u8(t[0].s + 1);
+		v[t[0].s] = 1;
+		return {
+			t: v,
+			l: 1
+		};
+	}
+	t.sort(function(a, b) {
+		return a.f - b.f;
+	});
+	t.push({
+		s: -1,
+		f: 25001
+	});
+	var l = t[0], r = t[1], i0 = 0, i1 = 1, i2 = 2;
+	t[0] = {
+		s: -1,
+		f: l.f + r.f,
+		l,
+		r
+	};
+	while (i1 != s - 1) {
+		l = t[t[i0].f < t[i2].f ? i0++ : i2++];
+		r = t[i0 != i1 && t[i0].f < t[i2].f ? i0++ : i2++];
+		t[i1++] = {
+			s: -1,
+			f: l.f + r.f,
+			l,
+			r
+		};
+	}
+	var maxSym = t2[0].s;
+	for (var i = 1; i < s; ++i) if (t2[i].s > maxSym) maxSym = t2[i].s;
+	var tr = new u16(maxSym + 1);
+	var mbt = ln(t[i1 - 1], tr, 0);
+	if (mbt > mb) {
+		var i = 0, dt = 0;
+		var lft = mbt - mb, cst = 1 << lft;
+		t2.sort(function(a, b) {
+			return tr[b.s] - tr[a.s] || a.f - b.f;
+		});
+		for (; i < s; ++i) {
+			var i2_1 = t2[i].s;
+			if (tr[i2_1] > mb) {
+				dt += cst - (1 << mbt - tr[i2_1]);
+				tr[i2_1] = mb;
+			} else break;
+		}
+		dt >>= lft;
+		while (dt > 0) {
+			var i2_2 = t2[i].s;
+			if (tr[i2_2] < mb) dt -= 1 << mb - tr[i2_2]++ - 1;
+			else ++i;
+		}
+		for (; i >= 0 && dt; --i) {
+			var i2_3 = t2[i].s;
+			if (tr[i2_3] == mb) {
+				--tr[i2_3];
+				++dt;
+			}
+		}
+		mbt = mb;
+	}
+	return {
+		t: new u8(tr),
+		l: mbt
+	};
+};
+var ln = function(n, l, d) {
+	return n.s == -1 ? Math.max(ln(n.l, l, d + 1), ln(n.r, l, d + 1)) : l[n.s] = d;
+};
+var lc = function(c) {
+	var s = c.length;
+	while (s && !c[--s]);
+	var cl = new u16(++s);
+	var cli = 0, cln = c[0], cls = 1;
+	var w = function(v) {
+		cl[cli++] = v;
+	};
+	for (var i = 1; i <= s; ++i) if (c[i] == cln && i != s) ++cls;
+	else {
+		if (!cln && cls > 2) {
+			for (; cls > 138; cls -= 138) w(32754);
+			if (cls > 2) {
+				w(cls > 10 ? cls - 11 << 5 | 28690 : cls - 3 << 5 | 12305);
+				cls = 0;
+			}
+		} else if (cls > 3) {
+			w(cln), --cls;
+			for (; cls > 6; cls -= 6) w(8304);
+			if (cls > 2) w(cls - 3 << 5 | 8208), cls = 0;
+		}
+		while (cls--) w(cln);
+		cls = 1;
+		cln = c[i];
+	}
+	return {
+		c: cl.subarray(0, cli),
+		n: s
+	};
+};
+var clen = function(cf, cl) {
+	var l = 0;
+	for (var i = 0; i < cl.length; ++i) l += cf[i] * cl[i];
+	return l;
+};
+var wfblk = function(out, pos, dat) {
+	var s = dat.length;
+	var o = shft(pos + 2);
+	out[o] = s & 255;
+	out[o + 1] = s >> 8;
+	out[o + 2] = out[o] ^ 255;
+	out[o + 3] = out[o + 1] ^ 255;
+	for (var i = 0; i < s; ++i) out[o + i + 4] = dat[i];
+	return (o + 4 + s) * 8;
+};
+var wblk = function(dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
+	wbits(out, p++, final);
+	++lf[256];
+	var _a = hTree(lf, 15), dlt = _a.t, mlb = _a.l;
+	var _b = hTree(df, 15), ddt = _b.t, mdb = _b.l;
+	var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
+	var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
+	var lcfreq = new u16(19);
+	for (var i = 0; i < lclt.length; ++i) ++lcfreq[lclt[i] & 31];
+	for (var i = 0; i < lcdt.length; ++i) ++lcfreq[lcdt[i] & 31];
+	var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
+	var nlcc = 19;
+	for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc);
+	var flen = bl + 5 << 3;
+	var ftlen = clen(lf, flt) + clen(df, fdt) + eb;
+	var dtlen = clen(lf, dlt) + clen(df, ddt) + eb + 14 + 3 * nlcc + clen(lcfreq, lct) + 2 * lcfreq[16] + 3 * lcfreq[17] + 7 * lcfreq[18];
+	if (bs >= 0 && flen <= ftlen && flen <= dtlen) return wfblk(out, p, dat.subarray(bs, bs + bl));
+	var lm, ll, dm, dl;
+	wbits(out, p, 1 + (dtlen < ftlen)), p += 2;
+	if (dtlen < ftlen) {
+		lm = hMap(dlt, mlb, 0), ll = dlt, dm = hMap(ddt, mdb, 0), dl = ddt;
+		var llm = hMap(lct, mlcb, 0);
+		wbits(out, p, nlc - 257);
+		wbits(out, p + 5, ndc - 1);
+		wbits(out, p + 10, nlcc - 4);
+		p += 14;
+		for (var i = 0; i < nlcc; ++i) wbits(out, p + 3 * i, lct[clim[i]]);
+		p += 3 * nlcc;
+		var lcts = [lclt, lcdt];
+		for (var it = 0; it < 2; ++it) {
+			var clct = lcts[it];
+			for (var i = 0; i < clct.length; ++i) {
+				var len = clct[i] & 31;
+				wbits(out, p, llm[len]), p += lct[len];
+				if (len > 15) wbits(out, p, clct[i] >> 5 & 127), p += clct[i] >> 12;
+			}
+		}
+	} else lm = flm, ll = flt, dm = fdm, dl = fdt;
+	for (var i = 0; i < li; ++i) {
+		var sym = syms[i];
+		if (sym > 255) {
+			var len = sym >> 18 & 31;
+			wbits16(out, p, lm[len + 257]), p += ll[len + 257];
+			if (len > 7) wbits(out, p, sym >> 23 & 31), p += fleb[len];
+			var dst = sym & 31;
+			wbits16(out, p, dm[dst]), p += dl[dst];
+			if (dst > 3) wbits16(out, p, sym >> 5 & 8191), p += fdeb[dst];
+		} else wbits16(out, p, lm[sym]), p += ll[sym];
+	}
+	wbits16(out, p, lm[256]);
+	return p + ll[256];
+};
+var deo = /*#__PURE__*/ new i32([
+	65540,
+	131080,
+	131088,
+	131104,
+	262176,
+	1048704,
+	1048832,
+	2114560,
+	2117632
+]);
 var et = /*#__PURE__*/ new u8(0);
+var dflt = function(dat, lvl, plvl, pre, post, st) {
+	var s = st.z || dat.length;
+	var o = new u8(pre + s + 5 * (1 + Math.ceil(s / 7e3)) + post);
+	var w = o.subarray(pre, o.length - post);
+	var lst = st.l;
+	var pos = (st.r || 0) & 7;
+	if (lvl) {
+		if (pos) w[0] = st.r >> 3;
+		var opt = deo[lvl - 1];
+		var n = opt >> 13, c = opt & 8191;
+		var msk_1 = (1 << plvl) - 1;
+		var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
+		var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
+		var hsh = function(i) {
+			return (dat[i] ^ dat[i + 1] << bs1_1 ^ dat[i + 2] << bs2_1) & msk_1;
+		};
+		var syms = new i32(25e3);
+		var lf = new u16(288), df = new u16(32);
+		var lc_1 = 0, eb = 0, i = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
+		for (; i + 2 < s; ++i) {
+			var hv = hsh(i);
+			var imod = i & 32767, pimod = head[hv];
+			prev[imod] = pimod;
+			head[hv] = imod;
+			if (wi <= i) {
+				var rem = s - i;
+				if ((lc_1 > 7e3 || li > 24576) && (rem > 423 || !lst)) {
+					pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i - bs, pos);
+					li = lc_1 = eb = 0, bs = i;
+					for (var j = 0; j < 286; ++j) lf[j] = 0;
+					for (var j = 0; j < 30; ++j) df[j] = 0;
+				}
+				var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
+				if (rem > 2 && hv == hsh(i - dif)) {
+					var maxn = Math.min(n, rem) - 1;
+					var maxd = Math.min(32767, i);
+					var ml = Math.min(258, rem);
+					while (dif <= maxd && --ch_1 && imod != pimod) {
+						if (dat[i + l] == dat[i + l - dif]) {
+							var nl = 0;
+							for (; nl < ml && dat[i + nl] == dat[i + nl - dif]; ++nl);
+							if (nl > l) {
+								l = nl, d = dif;
+								if (nl > maxn) break;
+								var mmd = Math.min(dif, nl - 2);
+								var md = 0;
+								for (var j = 0; j < mmd; ++j) {
+									var ti = i - dif + j & 32767;
+									var cd = ti - prev[ti] & 32767;
+									if (cd > md) md = cd, pimod = ti;
+								}
+							}
+						}
+						imod = pimod, pimod = prev[imod];
+						dif += imod - pimod & 32767;
+					}
+				}
+				if (d) {
+					syms[li++] = 268435456 | revfl[l] << 18 | revfd[d];
+					var lin = revfl[l] & 31, din = revfd[d] & 31;
+					eb += fleb[lin] + fdeb[din];
+					++lf[257 + lin];
+					++df[din];
+					wi = i + l;
+					++lc_1;
+				} else {
+					syms[li++] = dat[i];
+					++lf[dat[i]];
+				}
+			}
+		}
+		for (i = Math.max(i, wi); i < s; ++i) {
+			syms[li++] = dat[i];
+			++lf[dat[i]];
+		}
+		pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i - bs, pos);
+		if (!lst) {
+			st.r = pos & 7 | w[pos / 8 | 0] << 3;
+			pos -= 7;
+			st.h = head, st.p = prev, st.i = i, st.w = wi;
+		}
+	} else {
+		for (var i = st.w || 0; i < s + lst; i += 65535) {
+			var e = i + 65535;
+			if (e >= s) {
+				w[pos / 8 | 0] = lst;
+				e = s;
+			}
+			pos = wfblk(w, pos + 1, dat.subarray(i, e));
+		}
+		st.i = s;
+	}
+	return slc(o, 0, pre + shft(pos) + post);
+};
+var crct = /*#__PURE__*/ (function() {
+	var t = /* @__PURE__ */ new Int32Array(256);
+	for (var i = 0; i < 256; ++i) {
+		var c = i, k = 9;
+		while (--k) c = (c & 1 && -306674912) ^ c >>> 1;
+		t[i] = c;
+	}
+	return t;
+})();
+var crc = function() {
+	var c = -1;
+	return {
+		p: function(d) {
+			var cr = c;
+			for (var i = 0; i < d.length; ++i) cr = crct[cr & 255 ^ d[i]] ^ cr >>> 8;
+			c = cr;
+		},
+		d: function() {
+			return ~c;
+		}
+	};
+};
+var dopt = function(dat, opt, pre, post, st) {
+	if (!st) {
+		st = { l: 1 };
+		if (opt.dictionary) {
+			var dict = opt.dictionary.subarray(-32768);
+			var newDat = new u8(dict.length + dat.length);
+			newDat.set(dict);
+			newDat.set(dat, dict.length);
+			dat = newDat;
+			st.w = dict.length;
+		}
+	}
+	return dflt(dat, opt.level == null ? 6 : opt.level, opt.mem == null ? st.l ? Math.ceil(Math.max(8, Math.min(13, Math.log(dat.length))) * 1.5) : 20 : 12 + opt.mem, pre, post, st);
+};
+var mrg = function(a, b) {
+	var o = {};
+	for (var k in a) o[k] = a[k];
+	for (var k in b) o[k] = b[k];
+	return o;
+};
 var b2 = function(d, b) {
 	return d[b] | d[b + 1] << 8;
 };
@@ -7535,9 +8122,33 @@ var b4 = function(d, b) {
 var b8 = function(d, b) {
 	return b4(d, b) + b4(d, b + 4) * 4294967296;
 };
+var wbytes = function(d, b, v) {
+	for (; v; ++b) d[b] = v, v >>>= 8;
+};
+/**
+* Compresses data with DEFLATE without any wrapper
+* @param data The data to compress
+* @param opts The compression options
+* @returns The deflated version of the data
+*/
+function deflateSync(data, opts) {
+	return dopt(data, opts || {}, 0, 0);
+}
 function inflateSync(data, opts) {
 	return inflt(data, { i: 2 }, opts && opts.out, opts && opts.dictionary);
 }
+var fltn = function(d, p, t, o) {
+	for (var k in d) {
+		var val = d[k], n = p + k, op = o;
+		if (Array.isArray(val)) op = mrg(o, val[1]), val = val[0];
+		if (ArrayBuffer.isView(val)) t[n] = [val, op];
+		else {
+			t[n += "/"] = [new u8(0), op];
+			fltn(val, n, t, o);
+		}
+	}
+};
+var te = typeof TextEncoder != "undefined" && /*#__PURE__*/ new TextEncoder();
 var td = typeof TextDecoder != "undefined" && /*#__PURE__*/ new TextDecoder();
 try {
 	td.decode(et, { stream: true });
@@ -7557,6 +8168,40 @@ var dutf8 = function(d) {
 	}
 };
 /**
+* Converts a string into a Uint8Array for use with compression/decompression methods
+* @param str The string to encode
+* @param latin1 Whether or not to interpret the data as Latin-1. This should
+*               not need to be true unless decoding a binary string.
+* @returns The string encoded in UTF-8/Latin-1 binary
+*/
+function strToU8(str, latin1) {
+	if (latin1) {
+		var ar_1 = new u8(str.length);
+		for (var i = 0; i < str.length; ++i) ar_1[i] = str.charCodeAt(i);
+		return ar_1;
+	}
+	if (te) return te.encode(str);
+	var l = str.length;
+	var ar = new u8(str.length + (str.length >> 1));
+	var ai = 0;
+	var w = function(v) {
+		ar[ai++] = v;
+	};
+	for (var i = 0; i < l; ++i) {
+		if (ai + 5 > ar.length) {
+			var n = new u8(ai + 8 + (l - i << 1));
+			n.set(ar);
+			ar = n;
+		}
+		var c = str.charCodeAt(i);
+		if (c < 128 || latin1) w(c);
+		else if (c < 2048) w(192 | c >> 6), w(128 | c & 63);
+		else if (c > 55295 && c < 57344) c = 65536 + (c & 1047552) | str.charCodeAt(++i) & 1023, w(240 | c >> 18), w(128 | c >> 12 & 63), w(128 | c >> 6 & 63), w(128 | c & 63);
+		else w(224 | c >> 12), w(128 | c >> 6 & 63), w(128 | c & 63);
+	}
+	return slc(ar, 0, ai);
+}
+/**
 * Converts a Uint8Array to a string
 * @param dat The data to decode to string
 * @param latin1 Whether or not to interpret the data as Latin-1. This should
@@ -7609,6 +8254,104 @@ var z64hs = function(d, b, l, z, sc, su, off) {
 		0
 	];
 };
+var exfl = function(ex) {
+	var le = 0;
+	if (ex) for (var k in ex) {
+		var l = ex[k].length;
+		if (l > 65535) err(9);
+		le += l + 4;
+	}
+	return le;
+};
+var wzh = function(d, b, f, fn, u, c, ce, co) {
+	var fl = fn.length, ex = f.extra, col = co && co.length;
+	var exl = exfl(ex);
+	wbytes(d, b, ce != null ? 33639248 : 67324752), b += 4;
+	if (ce != null) d[b++] = 20, d[b++] = f.os;
+	d[b] = 20, b += 2;
+	d[b++] = f.flag << 1 | (c < 0 && 8), d[b++] = u && 8;
+	d[b++] = f.compression & 255, d[b++] = f.compression >> 8;
+	var dt = new Date(f.mtime == null ? Date.now() : f.mtime), y = dt.getFullYear() - 1980;
+	if (y < 0 || y > 119) err(10);
+	wbytes(d, b, y << 25 | dt.getMonth() + 1 << 21 | dt.getDate() << 16 | dt.getHours() << 11 | dt.getMinutes() << 5 | dt.getSeconds() >> 1), b += 4;
+	if (c != -1) {
+		wbytes(d, b, f.crc);
+		wbytes(d, b + 4, c < 0 ? -c - 2 : c);
+		wbytes(d, b + 8, f.size);
+	}
+	wbytes(d, b + 12, fl);
+	wbytes(d, b + 14, exl), b += 16;
+	if (ce != null) {
+		wbytes(d, b, col);
+		wbytes(d, b + 6, f.attrs);
+		wbytes(d, b + 10, ce), b += 14;
+	}
+	d.set(fn, b);
+	b += fl;
+	if (exl) for (var k in ex) {
+		var exf = ex[k], l = exf.length;
+		wbytes(d, b, +k);
+		wbytes(d, b + 2, l);
+		d.set(exf, b + 4), b += 4 + l;
+	}
+	if (col) d.set(co, b), b += col;
+	return b;
+};
+var wzf = function(o, b, c, d, e) {
+	wbytes(o, b, 101010256);
+	wbytes(o, b + 8, c);
+	wbytes(o, b + 10, c);
+	wbytes(o, b + 12, d);
+	wbytes(o, b + 16, e);
+};
+/**
+* Synchronously creates a ZIP file. Prefer using `zip` for better performance
+* with more than one file.
+* @param data The directory structure for the ZIP archive
+* @param opts The main options, merged with per-file options
+* @returns The generated ZIP archive
+*/
+function zipSync(data, opts) {
+	if (!opts) opts = {};
+	var r = {};
+	var files = [];
+	fltn(data, "", r, opts);
+	var o = 0;
+	var tot = 0;
+	for (var fn in r) {
+		var _a = r[fn], file = _a[0], p = _a[1];
+		var compression = p.level == 0 ? 0 : 8;
+		var f = strToU8(fn), s = f.length;
+		var com = p.comment, m = com && strToU8(com), ms = m && m.length;
+		var exl = exfl(p.extra);
+		if (s > 65535) err(11);
+		var d = compression ? deflateSync(file, p) : file, l = d.length;
+		var c = crc();
+		c.p(file);
+		files.push(mrg(p, {
+			size: file.length,
+			crc: c.d(),
+			c: d,
+			f,
+			m,
+			u: s != fn.length || m && com.length != ms,
+			o,
+			compression
+		}));
+		o += 30 + s + exl + l;
+		tot += 76 + 2 * (s + exl) + (ms || 0) + l;
+	}
+	var out = new u8(tot + 22), oe = o, cdl = tot - o;
+	for (var i = 0; i < files.length; ++i) {
+		var f = files[i];
+		wzh(out, f.o, f, f.f, f.u, f.c.length);
+		var badd = 30 + f.f.length + exfl(f.extra);
+		out.set(f.c, f.o + badd);
+		wzh(out, o, f, f.f, f.u, f.c.length, f.o, f.m), o += 16 + badd + (f.m ? f.m.length : 0);
+	}
+	wzf(out, o, files.length, cdl, oe);
+	return out;
+}
 /**
 * Synchronously decompresses a ZIP archive. Prefer using `unzip` for better
 * performance with more than one file.
@@ -7875,6 +8618,177 @@ async function walkFiles(dir) {
 	}
 	return out;
 }
+/** The unzipped package size bound Lambda enforces. */
+const MAX_PACKAGE_BYTES = 512 * 1024 * 1024;
+/**
+* A package that must be self-contained: Lambda loads nothing outside the
+* archive, and pnpm's default `node_modules` is a symlink tree, so a symlink
+* anywhere in the package means the app cannot load once deployed. Fail the
+* build naming the path rather than archiving a tree that cannot run.
+*/
+async function walkPackageFiles(dir, prefix = "") {
+	const out = [];
+	const entries = await readdir(dir, { withFileTypes: true });
+	entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		const rel = `${prefix}${entry.name}`;
+		if (entry.isSymbolicLink()) throw new Error(`SSR package contains a symbolic link at ${rel}: Lambda loads nothing that is not in the archive, so the package must be self-contained (copy production dependencies in as real files instead of relying on pnpm's symlinked node_modules)`);
+		if (entry.isDirectory()) out.push(...await walkPackageFiles(full, `${rel}/`));
+		else if (entry.isFile()) out.push({
+			path: full,
+			rel,
+			size: (await stat(full)).size
+		});
+	}
+	return out;
+}
+/**
+* Zip the built package with its contents at the archive root and a fixed
+* timestamp, so identical output produces identical bytes. A generated entry
+* shim is added to the archive only; the build output on disk is untouched.
+*/
+async function packageWebFunction(packageDir, entryPoint, shim) {
+	const entryPath = join(packageDir, ...entryPoint.split("/"));
+	let entry;
+	try {
+		entry = await lstat(entryPath);
+	} catch {
+		throw new Error(`SSR package entry point "${entryPoint}" does not exist under ${packageDir}; ` + (shim ? "the build must emit it (with ssr.shim set, it is the framework's server entry the generated shim imports)" : "the build must emit it (a consumer-owned entry shim, or ssr.shim, is the usual way)"));
+	}
+	if (!entry.isFile()) throw new Error(`SSR package entry point "${entryPoint}" is not a file`);
+	const files = await walkPackageFiles(packageDir);
+	const shimBytes = shim ? new TextEncoder().encode(shim.source) : void 0;
+	if (shim && files.some((file) => file.rel === shim.path)) throw new Error(`SSR package already contains ${shim.path}, the path of the entry shim generated from config.ssr.shim: remove the build step that emits it, or drop ssr.shim and point ssr.entryPoint at your own shim`);
+	const unzipped = files.reduce((total, file) => total + file.size, 0) + (shimBytes?.byteLength ?? 0);
+	if (unzipped > 536870912) throw new Error(`SSR package is ${(unzipped / (1024 * 1024)).toFixed(1)} MB unzipped, over Lambda's ${MAX_PACKAGE_BYTES / (1024 * 1024)} MB limit`);
+	const entries = {};
+	for (const file of files) entries[file.rel] = new Uint8Array(await readFile(file.path));
+	if (shim && shimBytes) entries[shim.path] = shimBytes;
+	return {
+		zip: zipSync(entries, {
+			level: 6,
+			mtime: REPRODUCIBLE_ZIP_MTIME
+		}),
+		size: unzipped
+	};
+}
+/**
+* Upload the files under `rootDir` to the site prefix, comparing each file's
+* MD5 to the existing object's ETag so only genuinely changed content is
+* re-uploaded. Returns the keys this build wrote and - when `deleteStale` is
+* false, which is the SSR mode - the keys left behind, which only the CLI may
+* remove, after a revision is verified.
+*/
+async function publishFiles(opts) {
+	const { s3, log } = opts;
+	const existing = new Map((await s3.listObjects(opts.bucket, opts.prefix)).map((o) => [o.key, o.etag]));
+	const uploadSiteFile = createSiteUploader(s3, log);
+	const uploaded = /* @__PURE__ */ new Set();
+	const changedKeys = /* @__PURE__ */ new Set();
+	const unmapped = /* @__PURE__ */ new Set();
+	if (opts.refresh) log("refresh: re-uploading every file (metadata - content type, tags - may have changed)");
+	for (const file of opts.files) {
+		const key = opts.prefix + relative(opts.rootDir, file).split("\\").join("/");
+		uploaded.add(key);
+		const content = await readFile(file);
+		const md5 = createHash("md5").update(content).digest("hex");
+		const type = contentType(key);
+		const ext = extensionOf(key);
+		if (type === "application/octet-stream" && ext !== void 0) unmapped.add(ext);
+		if (!shouldUpload(existing.get(key), md5, opts.refresh)) continue;
+		await uploadSiteFile(opts.bucket, key, content, type, opts.objectTags);
+		changedKeys.add(key);
+	}
+	if (unmapped.size > 0) log(`warning: no content type mapped for extension(s) ${[...unmapped].sort().join(", ")} - serving them as ${DEFAULT_CONTENT_TYPE}`);
+	const staleKeys = [];
+	for (const key of existing.keys()) {
+		if (uploaded.has(key)) continue;
+		if (opts.deleteStale) {
+			await s3.deleteObject(opts.bucket, key);
+			changedKeys.add(key);
+		} else staleKeys.push(key);
+	}
+	return {
+		changedKeys,
+		staleKeys,
+		count: opts.files.length
+	};
+}
+/** Write the changed-paths manifest the CLI reads for a targeted invalidation. */
+async function writeChangedPaths(s3, log, bucket, hash, changedKeys, prefix) {
+	const changedPaths = [...new Set([...changedKeys].flatMap((k) => invalidationPaths(k, prefix)))];
+	try {
+		await s3.putObject(bucket, `build/changed/${hash}.json`, JSON.stringify({ paths: changedPaths }), "application/json");
+	} catch (err) {
+		log(`warning: could not write changed-paths manifest (${err.message})`);
+	}
+}
+/**
+* Publish the built static assets and, for an SSR environment, package the
+* server output and upload it as the revision artifact. Returns the number of
+* published static files and the changed keys.
+*/
+async function publishBuild(s3, payload, workDir, distDir, log) {
+	const prefix = payload.sitePrefix.endsWith("/") ? payload.sitePrefix : `${payload.sitePrefix}/`;
+	const job = payload.webFunction;
+	if (!job) {
+		const built = await walkFiles(distDir);
+		log(`uploading ${built.length} files to site/`);
+		const published = await publishFiles({
+			s3,
+			log,
+			bucket: payload.bucket,
+			prefix,
+			rootDir: distDir,
+			files: built,
+			objectTags: payload.objectTags,
+			refresh: payload.refresh,
+			deleteStale: true
+		});
+		log(`published ${built.length} files (${published.changedKeys.size} changed) to s3://${payload.bucket}/${prefix}`);
+		return published;
+	}
+	const { zip, size } = await packageWebFunction(resolveWithin(workDir, job.packageDir, "packageDir"), job.entryPoint, job.shim);
+	if (job.shim) log(`added entry shim ${job.shim.path} (starts ${job.entryPoint})`);
+	const digest = createHash("sha256").update(zip).digest("hex");
+	const versionId = await s3.putObject(payload.bucket, job.artifactKey, zip, "application/zip");
+	log(`uploaded SSR package ${job.artifactKey} (${(zip.byteLength / 1024).toFixed(0)} KiB zipped, ${(size / (1024 * 1024)).toFixed(1)} MB unzipped, sha256 ${digest.slice(0, 12)}…)`);
+	let changedKeys = /* @__PURE__ */ new Set();
+	let staleKeys = [];
+	if (job.staticDir) {
+		const staticDir = resolveWithin(workDir, job.staticDir, "staticDir");
+		const assets = await walkFiles(staticDir);
+		log(`publishing ${assets.length} static asset(s) from ${job.staticDir} to site/`);
+		const published = await publishFiles({
+			s3,
+			log,
+			bucket: payload.bucket,
+			prefix,
+			rootDir: staticDir,
+			files: assets,
+			objectTags: payload.objectTags,
+			refresh: payload.refresh,
+			deleteStale: false
+		});
+		changedKeys = published.changedKeys;
+		staleKeys = published.staleKeys;
+		log(`published ${assets.length} static asset(s) (${changedKeys.size} changed) to s3://${payload.bucket}/${prefix}`);
+	} else log("no ssr.staticDir configured - leaving site/ untouched");
+	const result = {
+		artifactKey: job.artifactKey,
+		artifactVersionId: versionId ?? "null",
+		artifactSha256: digest,
+		artifactSize: zip.byteLength,
+		staleStaticKeys: staleKeys
+	};
+	await s3.putObject(payload.bucket, job.resultKey, JSON.stringify(result, null, 2), "application/json");
+	log(`wrote ${job.resultKey} (${staleKeys.length} stale site key(s) left for the CLI)`);
+	return {
+		changedKeys,
+		count: 0
+	};
+}
 function escapeXml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
@@ -7899,7 +8813,10 @@ async function generateSitemap(distDir, base) {
 }
 /**
 * The build pipeline that runs inside the MicroVM: download the source zip, install
-* dependencies, build the Astro site, and sync dist/ to the bucket's site/ prefix.
+* dependencies, build the site, and publish it. In SSR mode the built package is
+* zipped and uploaded as a revision artifact, `site/` receives only `staticDir`, and
+* robots.txt/sitemap.xml generation is skipped because the application owns those
+* routes.
 */
 async function runBuild(s3, payload, log) {
 	const workDir = join(tmpdir(), `build-${payload.hash}`);
@@ -7926,48 +8843,20 @@ async function runBuild(s3, payload, log) {
 	], appDir, log);
 	await exec("pnpm", ["run", "build"], appDir, log);
 	const distDir = resolveWithin(workDir, payload.distDir ?? "dist", "distDir");
-	if (payload.robots !== void 0) {
-		await writeFile(join(distDir, "robots.txt"), payload.robots);
-		log("wrote robots.txt");
-	}
-	if (payload.sitemapBaseUrl) {
-		const xml = await generateSitemap(distDir, payload.sitemapBaseUrl);
-		await writeFile(join(distDir, "sitemap.xml"), xml);
-		log("wrote sitemap.xml");
+	if (!payload.webFunction) {
+		if (payload.robots !== void 0) {
+			await writeFile(join(distDir, "robots.txt"), payload.robots);
+			log("wrote robots.txt");
+		}
+		if (payload.sitemapBaseUrl) {
+			const xml = await generateSitemap(distDir, payload.sitemapBaseUrl);
+			await writeFile(join(distDir, "sitemap.xml"), xml);
+			log("wrote sitemap.xml");
+		}
 	}
-	const built = await walkFiles(distDir);
-	log(`uploading ${built.length} files to site/`);
 	const prefix = payload.sitePrefix.endsWith("/") ? payload.sitePrefix : `${payload.sitePrefix}/`;
-	const existing = new Map((await s3.listObjects(payload.bucket, prefix)).map((o) => [o.key, o.etag]));
-	const uploadSiteFile = createSiteUploader(s3, log);
-	const uploaded = /* @__PURE__ */ new Set();
-	const changedKeys = /* @__PURE__ */ new Set();
-	const unmapped = /* @__PURE__ */ new Set();
-	if (payload.refresh) log("refresh: re-uploading every file (metadata - content type, tags - may have changed)");
-	for (const file of built) {
-		const key = prefix + relative(distDir, file).split("\\").join("/");
-		uploaded.add(key);
-		const content = await readFile(file);
-		const md5 = createHash("md5").update(content).digest("hex");
-		const type = contentType(key);
-		const ext = extensionOf(key);
-		if (type === "application/octet-stream" && ext !== void 0) unmapped.add(ext);
-		if (!shouldUpload(existing.get(key), md5, payload.refresh)) continue;
-		await uploadSiteFile(payload.bucket, key, content, type, payload.objectTags);
-		changedKeys.add(key);
-	}
-	if (unmapped.size > 0) log(`warning: no content type mapped for extension(s) ${[...unmapped].sort().join(", ")} - serving them as ${DEFAULT_CONTENT_TYPE}`);
-	for (const key of existing.keys()) if (!uploaded.has(key)) {
-		await s3.deleteObject(payload.bucket, key);
-		changedKeys.add(key);
-	}
-	const changedPaths = [...new Set([...changedKeys].flatMap((k) => invalidationPaths(k, prefix)))];
-	try {
-		await s3.putObject(payload.bucket, `build/changed/${payload.hash}.json`, JSON.stringify({ paths: changedPaths }), "application/json");
-	} catch (err) {
-		log(`warning: could not write changed-paths manifest (${err.message})`);
-	}
-	log(`published ${built.length} files (${changedKeys.size} changed) to s3://${payload.bucket}/${prefix}`);
+	const published = await publishBuild(s3, payload, workDir, distDir, log);
+	await writeChangedPaths(s3, log, payload.bucket, payload.hash, published.changedKeys, prefix);
 	await rm(workDir, {
 		recursive: true,
 		force: true
@@ -8048,7 +8937,8 @@ async function poll() {
 			robots: next.robots,
 			sitemapBaseUrl: next.sitemapBaseUrl,
 			objectTags: next.objectTags,
-			refresh: next.refresh
+			refresh: next.refresh,
+			...next.webFunction ? { webFunction: next.webFunction } : {}
 		});
 	} finally {
 		polling = false;