qlara 0.1.0

package/dist/aws.cjs

@@ -0,0 +1,1054 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/aws.ts
+var aws_exports = {};
+__export(aws_exports, {
+  aws: () => aws
+});
+module.exports = __toCommonJS(aws_exports);
+
+// src/provider/aws/index.ts
+var import_client_cloudformation = require("@aws-sdk/client-cloudformation");
+var import_client_lambda = require("@aws-sdk/client-lambda");
+var import_client_iam = require("@aws-sdk/client-iam");
+var import_client_cloudfront = require("@aws-sdk/client-cloudfront");
+
+// src/provider/aws/s3.ts
+var import_client_s3 = require("@aws-sdk/client-s3");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript",
+  ".mjs": "application/javascript",
+  ".css": "text/css",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".txt": "text/plain",
+  ".xml": "application/xml",
+  ".webmanifest": "application/manifest+json",
+  ".map": "application/json"
+};
+function getContentType(filePath) {
+  const ext = (0, import_node_path.extname)(filePath).toLowerCase();
+  return CONTENT_TYPES[ext] || "application/octet-stream";
+}
+function getCacheControl(key) {
+  if (key.includes("_next/static/") || key.includes(".chunk.")) {
+    return "public, max-age=31536000, immutable";
+  }
+  if (key.endsWith(".html")) {
+    return "public, max-age=0, must-revalidate";
+  }
+  return "public, max-age=86400";
+}
+function createS3Client(region) {
+  return new import_client_s3.S3Client({ region });
+}
+function listFiles(dir) {
+  const files = [];
+  const entries = (0, import_node_fs.readdirSync)(dir);
+  for (const entry of entries) {
+    const fullPath = (0, import_node_path.join)(dir, entry);
+    const stat = (0, import_node_fs.statSync)(fullPath);
+    if (stat.isDirectory()) {
+      files.push(...listFiles(fullPath));
+    } else {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
+async function syncToS3(client, bucketName, buildDir) {
+  const files = listFiles(buildDir);
+  let uploaded = 0;
+  const batchSize = 10;
+  for (let i = 0; i < files.length; i += batchSize) {
+    const batch = files.slice(i, i + batchSize);
+    await Promise.all(
+      batch.map(async (filePath) => {
+        const key = (0, import_node_path.relative)(buildDir, filePath);
+        const body = (0, import_node_fs.readFileSync)(filePath);
+        const contentType = getContentType(filePath);
+        const cacheControl = getCacheControl(key);
+        await client.send(
+          new import_client_s3.PutObjectCommand({
+            Bucket: bucketName,
+            Key: key,
+            Body: body,
+            ContentType: contentType,
+            CacheControl: cacheControl
+          })
+        );
+        uploaded++;
+      })
+    );
+  }
+  return uploaded;
+}
+async function emptyBucket(client, bucketName) {
+  let continuationToken;
+  do {
+    const response = await client.send(
+      new import_client_s3.ListObjectsV2Command({
+        Bucket: bucketName,
+        ContinuationToken: continuationToken
+      })
+    );
+    if (response.Contents && response.Contents.length > 0) {
+      await client.send(
+        new import_client_s3.DeleteObjectsCommand({
+          Bucket: bucketName,
+          Delete: {
+            Objects: response.Contents.map((obj) => ({ Key: obj.Key }))
+          }
+        })
+      );
+    }
+    continuationToken = response.NextContinuationToken;
+  } while (continuationToken);
+}
+
+// src/provider/aws/cloudformation.ts
+function buildTemplate(config) {
+  return {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Description: `Qlara ISR infrastructure \u2014 ${config.stackName}`,
+    Resources: {
+      // ── S3 Bucket ──────────────────────────────────────────────
+      ContentBucket: {
+        Type: "AWS::S3::Bucket",
+        Properties: {
+          // No BucketName — let CloudFormation auto-generate a unique name
+          PublicAccessBlockConfiguration: {
+            BlockPublicAcls: true,
+            BlockPublicPolicy: true,
+            IgnorePublicAcls: true,
+            RestrictPublicBuckets: true
+          }
+        }
+      },
+      // ── S3 Bucket Policy (CloudFront OAC) ──────────────────────
+      ContentBucketPolicy: {
+        Type: "AWS::S3::BucketPolicy",
+        Properties: {
+          Bucket: { Ref: "ContentBucket" },
+          PolicyDocument: {
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: { Service: "cloudfront.amazonaws.com" },
+                Action: "s3:GetObject",
+                Resource: { "Fn::Sub": "${ContentBucket.Arn}/*" },
+                Condition: {
+                  StringEquals: {
+                    "AWS:SourceArn": {
+                      "Fn::Sub": "arn:aws:cloudfront::${AWS::AccountId}:distribution/${Distribution}"
+                    }
+                  }
+                }
+              }
+            ]
+          }
+        }
+      },
+      // ── CloudFront Origin Access Control ───────────────────────
+      OriginAccessControl: {
+        Type: "AWS::CloudFront::OriginAccessControl",
+        Properties: {
+          OriginAccessControlConfig: {
+            Name: { "Fn::Sub": "${AWS::StackName}-oac" },
+            OriginAccessControlOriginType: "s3",
+            SigningBehavior: "always",
+            SigningProtocol: "sigv4"
+          }
+        }
+      },
+      // ── CloudFront Function (URL rewriting) ────────────────────
+      // Rewrites /product/42 → /product/42.html to match Next.js static export convention.
+      // Rewrites /about/ → /about/index.html for directory-style paths.
+      URLRewriteFunction: {
+        Type: "AWS::CloudFront::Function",
+        Properties: {
+          Name: { "Fn::Sub": "${AWS::StackName}-url-rewrite" },
+          AutoPublish: true,
+          FunctionConfig: {
+            Comment: "Append .html or /index.html to directory-like paths",
+            Runtime: "cloudfront-js-2.0"
+          },
+          FunctionCode: [
+            "function handler(event) {",
+            "  var request = event.request;",
+            "  var uri = request.uri;",
+            '  if (uri === "/") {',
+            '    request.uri = "/index.html";',
+            '  } else if (uri.endsWith("/")) {',
+            '    request.uri += "index.html";',
+            '  } else if (!uri.includes(".")) {',
+            '    request.uri += ".html";',
+            "  }",
+            "  return request;",
+            "}"
+          ].join("\n")
+        }
+      },
+      // ── IAM Role for Lambda@Edge ───────────────────────────────
+      EdgeHandlerRole: {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: {
+                  Service: ["lambda.amazonaws.com", "edgelambda.amazonaws.com"]
+                },
+                Action: "sts:AssumeRole"
+              }
+            ]
+          },
+          ManagedPolicyArns: [
+            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          ],
+          Policies: [
+            {
+              PolicyName: "QlaraEdgePolicy",
+              PolicyDocument: {
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:GetObject"],
+                    Resource: { "Fn::Sub": "${ContentBucket.Arn}/*" }
+                  },
+                  {
+                    Effect: "Allow",
+                    Action: ["lambda:InvokeFunction"],
+                    Resource: { "Fn::GetAtt": ["RendererFunction", "Arn"] }
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      // ── Lambda@Edge Function ───────────────────────────────────
+      // Placeholder code — real handler is deployed via `qlara deploy`
+      EdgeHandlerFunction: {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          FunctionName: { "Fn::Sub": "${AWS::StackName}-edge-handler" },
+          Runtime: "nodejs20.x",
+          Handler: "edge-handler.handler",
+          Role: { "Fn::GetAtt": ["EdgeHandlerRole", "Arn"] },
+          Code: {
+            ZipFile: "exports.handler = async (event) => event.Records[0].cf.response;"
+          },
+          MemorySize: 128,
+          Timeout: 30
+        }
+      },
+      // Lambda@Edge requires a published version for CloudFront association
+      EdgeHandlerVersion: {
+        Type: "AWS::Lambda::Version",
+        Properties: {
+          FunctionName: { Ref: "EdgeHandlerFunction" },
+          Description: "Initial placeholder version"
+        }
+      },
+      // Permission for CloudFront/Lambda@Edge replication to invoke the function
+      EdgeHandlerPermission: {
+        Type: "AWS::Lambda::Permission",
+        Properties: {
+          FunctionName: { Ref: "EdgeHandlerFunction" },
+          Action: "lambda:GetFunction",
+          Principal: "edgelambda.amazonaws.com"
+        }
+      },
+      EdgeHandlerReplicationPermission: {
+        Type: "AWS::Lambda::Permission",
+        Properties: {
+          FunctionName: { Ref: "EdgeHandlerFunction" },
+          Action: "lambda:GetFunction",
+          Principal: "replicator.lambda.amazonaws.com"
+        }
+      },
+      // ── IAM Role for Renderer Lambda ───────────────────────────
+      RendererRole: {
+        Type: "AWS::IAM::Role",
+        Properties: {
+          AssumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: { Service: "lambda.amazonaws.com" },
+                Action: "sts:AssumeRole"
+              }
+            ]
+          },
+          ManagedPolicyArns: [
+            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+          ],
+          Policies: [
+            {
+              PolicyName: "QlaraRendererPolicy",
+              PolicyDocument: {
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:PutObject", "s3:GetObject"],
+                    Resource: { "Fn::Sub": "${ContentBucket.Arn}/*" }
+                  },
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket"],
+                    Resource: { "Fn::GetAtt": ["ContentBucket", "Arn"] }
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      // ── Renderer Lambda ────────────────────────────────────────
+      // Placeholder code — real handler is deployed via `qlara deploy`
+      RendererFunction: {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          FunctionName: { "Fn::Sub": "${AWS::StackName}-renderer" },
+          Runtime: "nodejs20.x",
+          Handler: "renderer.handler",
+          Role: { "Fn::GetAtt": ["RendererRole", "Arn"] },
+          Code: {
+            ZipFile: "exports.handler = async () => ({ statusCode: 200 });"
+          },
+          MemorySize: 256,
+          Timeout: 30
+        }
+      },
+      // ── CloudFront Cache Policy ──────────────────────────────────
+      // Custom policy with MinTTL=0 so CloudFront respects origin Cache-Control headers.
+      // The edge handler sets max-age=0 for fallback responses (must always hit origin)
+      // and S3 objects have appropriate cache headers for static assets.
+      CachePolicy: {
+        Type: "AWS::CloudFront::CachePolicy",
+        Properties: {
+          CachePolicyConfig: {
+            Name: { "Fn::Sub": "${AWS::StackName}-cache-policy" },
+            Comment: "Qlara cache policy \u2014 respects origin Cache-Control headers",
+            MinTTL: 0,
+            DefaultTTL: 86400,
+            MaxTTL: 31536e3,
+            ParametersInCacheKeyAndForwardedToOrigin: {
+              CookiesConfig: { CookieBehavior: "none" },
+              HeadersConfig: { HeaderBehavior: "none" },
+              QueryStringsConfig: { QueryStringBehavior: "none" },
+              EnableAcceptEncodingGzip: true,
+              EnableAcceptEncodingBrotli: true
+            }
+          }
+        }
+      },
+      // ── CloudFront Distribution ────────────────────────────────
+      Distribution: {
+        Type: "AWS::CloudFront::Distribution",
+        Properties: {
+          DistributionConfig: {
+            Enabled: true,
+            DefaultRootObject: "index.html",
+            HttpVersion: "http2and3",
+            Origins: [
+              {
+                Id: "s3-origin",
+                DomainName: {
+                  "Fn::GetAtt": ["ContentBucket", "RegionalDomainName"]
+                },
+                S3OriginConfig: {
+                  OriginAccessIdentity: ""
+                  // Empty when using OAC
+                },
+                OriginAccessControlId: { Ref: "OriginAccessControl" }
+              }
+            ],
+            DefaultCacheBehavior: {
+              TargetOriginId: "s3-origin",
+              ViewerProtocolPolicy: "redirect-to-https",
+              Compress: true,
+              // Custom cache policy with MinTTL=0 — respects origin Cache-Control
+              CachePolicyId: { Ref: "CachePolicy" },
+              LambdaFunctionAssociations: [
+                {
+                  EventType: "origin-response",
+                  LambdaFunctionARN: { Ref: "EdgeHandlerVersion" },
+                  IncludeBody: false
+                }
+              ],
+              FunctionAssociations: [
+                {
+                  EventType: "viewer-request",
+                  FunctionARN: {
+                    "Fn::GetAtt": ["URLRewriteFunction", "FunctionARN"]
+                  }
+                }
+              ]
+            }
+            // No CustomErrorResponses — the edge handler manages 403/404
+          }
+        }
+      }
+    },
+    Outputs: {
+      BucketName: {
+        Value: { Ref: "ContentBucket" },
+        Description: "S3 bucket for static content"
+      },
+      DistributionId: {
+        Value: { Ref: "Distribution" },
+        Description: "CloudFront distribution ID"
+      },
+      DistributionDomain: {
+        Value: { "Fn::GetAtt": ["Distribution", "DomainName"] },
+        Description: "CloudFront distribution domain name"
+      },
+      EdgeFunctionArn: {
+        Value: { "Fn::GetAtt": ["EdgeHandlerFunction", "Arn"] },
+        Description: "Lambda@Edge function ARN"
+      },
+      RendererFunctionArn: {
+        Value: { "Fn::GetAtt": ["RendererFunction", "Arn"] },
+        Description: "Renderer Lambda function ARN"
+      }
+    }
+  };
+}
+
+// src/provider/aws/bundle.ts
+var import_esbuild = require("esbuild");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var import_node_url = require("url");
+var import_archiver = __toESM(require("archiver"), 1);
+var import_node_stream = require("stream");
+var import_meta = {};
+var BUNDLE_DIR = (0, import_node_path2.join)(".qlara", "bundles");
+function getModuleDir() {
+  if (typeof __dirname !== "undefined") {
+    return __dirname;
+  }
+  return (0, import_node_path2.dirname)((0, import_node_url.fileURLToPath)(import_meta.url));
+}
+function resolveEntry(name) {
+  const moduleDir = getModuleDir();
+  const sameDirTs = (0, import_node_path2.resolve)(moduleDir, `${name}.ts`);
+  if ((0, import_node_fs2.existsSync)(sameDirTs)) return sameDirTs;
+  const srcTs = (0, import_node_path2.resolve)(moduleDir, "..", "src", "provider", "aws", `${name}.ts`);
+  if ((0, import_node_fs2.existsSync)(srcTs)) return srcTs;
+  return (0, import_node_path2.resolve)(moduleDir, `${name}.js`);
+}
+async function createZip(filePath, entryName) {
+  return new Promise((resolvePromise, reject) => {
+    const chunks = [];
+    const converter = new import_node_stream.Writable({
+      write(chunk, _encoding, callback) {
+        chunks.push(chunk);
+        callback();
+      }
+    });
+    const archive = (0, import_archiver.default)("zip", { zlib: { level: 9 } });
+    archive.on("error", reject);
+    converter.on("finish", () => resolvePromise(Buffer.concat(chunks)));
+    archive.pipe(converter);
+    archive.file(filePath, { name: entryName });
+    archive.finalize();
+  });
+}
+async function bundleEdgeHandler(config) {
+  (0, import_node_fs2.mkdirSync)(BUNDLE_DIR, { recursive: true });
+  const outfile = (0, import_node_path2.join)(BUNDLE_DIR, "edge-handler.js");
+  await (0, import_esbuild.build)({
+    entryPoints: [resolveEntry("edge-handler")],
+    bundle: true,
+    platform: "node",
+    target: "node20",
+    format: "cjs",
+    outfile,
+    minify: true,
+    define: {
+      __QLARA_BUCKET_NAME__: JSON.stringify(config.bucketName),
+      __QLARA_RENDERER_ARN__: JSON.stringify(config.rendererArn),
+      __QLARA_REGION__: JSON.stringify(config.region)
+    },
+    // Bundle everything — Lambda@Edge must be self-contained
+    external: []
+  });
+  return createZip(outfile, "edge-handler.js");
+}
+async function bundleRenderer(routeFile) {
+  (0, import_node_fs2.mkdirSync)(BUNDLE_DIR, { recursive: true });
+  const outfile = (0, import_node_path2.join)(BUNDLE_DIR, "renderer.js");
+  const alias = {};
+  if (routeFile) {
+    alias["__qlara_routes__"] = (0, import_node_path2.resolve)(routeFile);
+  } else {
+    const noopPath = (0, import_node_path2.join)(BUNDLE_DIR, "__qlara_noop_routes.js");
+    const { writeFileSync: writeFileSync2 } = await import("fs");
+    writeFileSync2(noopPath, "module.exports = { default: [] };");
+    alias["__qlara_routes__"] = (0, import_node_path2.resolve)(noopPath);
+  }
+  await (0, import_esbuild.build)({
+    entryPoints: [resolveEntry("renderer")],
+    bundle: true,
+    platform: "node",
+    target: "node20",
+    format: "cjs",
+    outfile,
+    minify: true,
+    alias,
+    external: []
+  });
+  return createZip(outfile, "renderer.js");
+}
+
+// src/provider/aws/constants.ts
+var STACK_NAME_PREFIX = "qlara";
+
+// src/fallback.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+var FALLBACK_FILENAME = "_fallback.html";
+var FALLBACK_PLACEHOLDER = "__QLARA_FALLBACK__";
+function generateFallbackFromTemplate(templateHtml, routePattern) {
+  let fallback = templateHtml;
+  const paramNames = (routePattern.match(/:([^/]+)/g) || []).map((m) => m.slice(1));
+  fallback = fallback.replace(
+    /<title>[^<]*<\/title>/,
+    "<title>Loading...</title>"
+  );
+  fallback = fallback.replace(/<meta\s+(?:name|property)="(?:description|application-name|generator|creator|publisher|category|classification|abstract|referrer|keywords|author|robots|googlebot|og:[^"]*|twitter:[^"]*|fb:[^"]*|al:[^"]*|google-site-verification|y_key|yandex-verification|me|apple-mobile-web-app-[^"]*|format-detection|apple-itunes-app|pinterest-rich-pin)"\s+content="[^"]*"\s*\/?>/g, "");
+  fallback = fallback.replace(/<meta\s+content="[^"]*"\s+(?:name|property)="(?:description|application-name|generator|creator|publisher|category|classification|abstract|referrer|keywords|author|robots|googlebot|og:[^"]*|twitter:[^"]*|fb:[^"]*|al:[^"]*|google-site-verification|y_key|yandex-verification|me|apple-mobile-web-app-[^"]*|format-detection|apple-itunes-app|pinterest-rich-pin)"\s*\/?>/g, "");
+  fallback = fallback.replace(/<link\s+rel="(?:canonical|alternate|author|icon|shortcut icon|apple-touch-icon|apple-touch-startup-image|manifest|archives|assets|bookmarks|prev|next)"[^>]*\/?>/g, "");
+  fallback = fallback.replace(
+    /(<main[^>]*>)[\s\S]*?(<\/main>)/,
+    "$1<div>Loading...</div>$2"
+  );
+  const q = '\\\\"';
+  for (const param of paramNames) {
+    const propsRegex = new RegExp(
+      `\\{${q}${param}${q}:${q}[^"]+?${q}(,${q}initial${q}:(null|\\{[^}]*\\}))?\\}`,
+      "g"
+    );
+    fallback = fallback.replace(
+      propsRegex,
+      `{\\"${param}\\":\\"${FALLBACK_PLACEHOLDER}\\"}`
+    );
+  }
+  for (const param of paramNames) {
+    const segmentRegex = new RegExp(
+      `\\[${q}${param}${q},${q}[^"]+${q},${q}d${q}\\]`,
+      "g"
+    );
+    fallback = fallback.replace(
+      segmentRegex,
+      `[\\"${param}\\",\\"${FALLBACK_PLACEHOLDER}\\",\\"d\\"]`
+    );
+  }
+  const routeParts = routePattern.split("/").filter((p) => !p.startsWith(":"));
+  if (routeParts.length > 0) {
+    const prefix = routeParts.map((p) => `${q}${p}${q}`).join(",");
+    const urlSegmentRegex = new RegExp(
+      `(${q}c${q}:\\[${prefix},)${q}[^"]*${q}\\]`,
+      "g"
+    );
+    fallback = fallback.replace(
+      urlSegmentRegex,
+      `$1\\"${FALLBACK_PLACEHOLDER}\\"]`
+    );
+  }
+  fallback = fallback.replace(
+    /8:\{\\"metadata\\":\[[\s\S]*?\],\\"error\\":null,\\"digest\\":\\"?\$undefined\\?"\}/,
+    '8:{\\"metadata\\":[[\\"$\\",\\"title\\",\\"0\\",{\\"children\\":\\"Loading...\\"}]],\\"error\\":null,\\"digest\\":\\"$undefined\\"}'
+  );
+  return fallback;
+}
+function generateFallbacks(buildDir, routes) {
+  const generated = [];
+  for (const route of routes) {
+    const parts = route.pattern.replace(/^\//, "").split("/");
+    const dirParts = parts.filter((p) => !p.startsWith(":"));
+    const routeDir = (0, import_node_path3.join)(buildDir, ...dirParts);
+    if (!(0, import_node_fs3.existsSync)(routeDir)) {
+      console.warn(
+        `[qlara] Warning: No output directory for route ${route.pattern} at ${routeDir}`
+      );
+      continue;
+    }
+    const files = (0, import_node_fs3.readdirSync)(routeDir).filter(
+      (f) => f.endsWith(".html") && f !== FALLBACK_FILENAME
+    );
+    if (files.length === 0) {
+      console.warn(
+        `[qlara] Warning: No HTML files in ${routeDir} to create fallback template`
+      );
+      continue;
+    }
+    const templatePath = (0, import_node_path3.join)(routeDir, files[0]);
+    const templateHtml = (0, import_node_fs3.readFileSync)(templatePath, "utf-8");
+    const fallbackHtml = generateFallbackFromTemplate(templateHtml, route.pattern);
+    const fallbackPath = (0, import_node_path3.join)(routeDir, FALLBACK_FILENAME);
+    (0, import_node_fs3.writeFileSync)(fallbackPath, fallbackHtml);
+    const relativePath = (0, import_node_path3.join)(...dirParts, FALLBACK_FILENAME);
+    generated.push(relativePath);
+    console.log(`[qlara] Generated fallback: ${relativePath}`);
+  }
+  return generated;
+}
+
+// src/provider/aws/index.ts
+async function getStackOutputs(cfn, stackName) {
+  const result = await cfn.send(
+    new import_client_cloudformation.DescribeStacksCommand({ StackName: stackName })
+  );
+  const stack = result.Stacks?.[0];
+  if (!stack || !stack.Outputs) {
+    throw new Error(
+      `[qlara/aws] Stack ${stackName} not found or has no outputs`
+    );
+  }
+  const outputs = {};
+  for (const output of stack.Outputs) {
+    if (output.OutputKey && output.OutputValue) {
+      outputs[output.OutputKey] = output.OutputValue;
+    }
+  }
+  return outputs;
+}
+function outputsToResources(stackName, region, outputs) {
+  return {
+    provider: "aws",
+    region,
+    stackName,
+    bucketName: outputs.BucketName,
+    distributionId: outputs.DistributionId,
+    distributionDomain: outputs.DistributionDomain,
+    edgeFunctionArn: outputs.EdgeFunctionArn,
+    rendererFunctionArn: outputs.RendererFunctionArn
+  };
+}
+var CACHING_OPTIMIZED_POLICY_ID = "658327ea-f89d-4fab-a63d-7e88639e58f6";
+var QLARA_CACHE_POLICY_NAME = "qlara-cache-policy";
+async function ensureCachePolicy(cf) {
+  const listResult = await cf.send(
+    new import_client_cloudfront.ListCachePoliciesCommand({ Type: "custom" })
+  );
+  const existing = listResult.CachePolicyList?.Items?.find(
+    (item) => item.CachePolicy?.CachePolicyConfig?.Name === QLARA_CACHE_POLICY_NAME
+  );
+  if (existing?.CachePolicy?.Id) {
+    return existing.CachePolicy.Id;
+  }
+  const createResult = await cf.send(
+    new import_client_cloudfront.CreateCachePolicyCommand({
+      CachePolicyConfig: {
+        Name: QLARA_CACHE_POLICY_NAME,
+        Comment: "Qlara cache policy \u2014 MinTTL=0, respects origin Cache-Control",
+        MinTTL: 0,
+        DefaultTTL: 86400,
+        MaxTTL: 31536e3,
+        ParametersInCacheKeyAndForwardedToOrigin: {
+          CookiesConfig: { CookieBehavior: "none" },
+          HeadersConfig: { HeaderBehavior: "none" },
+          QueryStringsConfig: { QueryStringBehavior: "none" },
+          EnableAcceptEncodingGzip: true,
+          EnableAcceptEncodingBrotli: true
+        }
+      }
+    })
+  );
+  const policyId = createResult.CachePolicy?.Id;
+  if (!policyId) {
+    throw new Error("[qlara/aws] Failed to create cache policy");
+  }
+  return policyId;
+}
+async function updateCloudFrontEdgeVersion(cf, distributionId, newVersionArn) {
+  const getResult = await cf.send(
+    new import_client_cloudfront.GetDistributionConfigCommand({ Id: distributionId })
+  );
+  const config = getResult.DistributionConfig;
+  const etag = getResult.ETag;
+  if (!config || !etag) {
+    throw new Error("[qlara/aws] Could not get distribution config");
+  }
+  const lambdaAssociations = config.DefaultCacheBehavior?.LambdaFunctionAssociations;
+  if (lambdaAssociations?.Items) {
+    for (const assoc of lambdaAssociations.Items) {
+      if (assoc.EventType === "origin-response") {
+        assoc.LambdaFunctionARN = newVersionArn;
+      }
+    }
+  }
+  const currentPolicyId = config.DefaultCacheBehavior?.CachePolicyId;
+  if (currentPolicyId === CACHING_OPTIMIZED_POLICY_ID) {
+    console.log("[qlara/aws] Replacing CachingOptimized with Qlara cache policy (MinTTL=0)...");
+    const qlaraPolicyId = await ensureCachePolicy(cf);
+    config.DefaultCacheBehavior.CachePolicyId = qlaraPolicyId;
+  }
+  await cf.send(
+    new import_client_cloudfront.UpdateDistributionCommand({
+      Id: distributionId,
+      DistributionConfig: config,
+      IfMatch: etag
+    })
+  );
+}
+function isByoi(config) {
+  return !!(config.bucketName && config.distributionId && config.distributionDomain && config.edgeFunctionArn && config.rendererFunctionArn);
+}
+function byoiResources(config) {
+  return {
+    provider: "aws",
+    region: "us-east-1",
+    stackName: "",
+    // No stack — externally managed
+    bucketName: config.bucketName,
+    distributionId: config.distributionId,
+    distributionDomain: config.distributionDomain,
+    edgeFunctionArn: config.edgeFunctionArn,
+    rendererFunctionArn: config.rendererFunctionArn
+  };
+}
+function aws(awsConfig = {}) {
+  const region = "us-east-1";
+  const byoi = isByoi(awsConfig);
+  const stackName = byoi ? "" : awsConfig.stackName || STACK_NAME_PREFIX;
+  return {
+    name: "aws",
+    config: { ...awsConfig },
+    async setup(_config) {
+      if (byoi) {
+        console.log("[qlara/aws] Using existing infrastructure (BYOI mode)");
+        return byoiResources(awsConfig);
+      }
+      const template = buildTemplate({ stackName, region });
+      const cfn = new import_client_cloudformation.CloudFormationClient({ region });
+      let stackExists = false;
+      try {
+        const existing = await cfn.send(
+          new import_client_cloudformation.DescribeStacksCommand({ StackName: stackName })
+        );
+        const status = existing.Stacks?.[0]?.StackStatus;
+        if (status === "ROLLBACK_COMPLETE" || status === "DELETE_FAILED") {
+          console.log(
+            `[qlara/aws] Found failed stack (${status}). Deleting before retry...`
+          );
+          await cfn.send(new import_client_cloudformation.DeleteStackCommand({ StackName: stackName }));
+          await (0, import_client_cloudformation.waitUntilStackDeleteComplete)(
+            { client: cfn, maxWaitTime: 300 },
+            { StackName: stackName }
+          );
+          console.log("[qlara/aws] Old stack deleted");
+        } else if (status) {
+          stackExists = true;
+        }
+      } catch {
+      }
+      if (stackExists) {
+        console.log(`[qlara/aws] Stack ${stackName} already exists`);
+      } else {
+        console.log(`[qlara/aws] Creating CloudFormation stack: ${stackName}`);
+        await cfn.send(
+          new import_client_cloudformation.CreateStackCommand({
+            StackName: stackName,
+            TemplateBody: JSON.stringify(template),
+            Capabilities: ["CAPABILITY_IAM"]
+          })
+        );
+        console.log(
+          "[qlara/aws] Waiting for stack creation (this may take a few minutes)..."
+        );
+        try {
+          await (0, import_client_cloudformation.waitUntilStackCreateComplete)(
+            { client: cfn, maxWaitTime: 600 },
+            { StackName: stackName }
+          );
+        } catch {
+          const events = await cfn.send(
+            new import_client_cloudformation.DescribeStackEventsCommand({ StackName: stackName })
+          );
+          const failures = (events.StackEvents || []).filter((e) => e.ResourceStatus?.includes("FAILED")).map((e) => `  ${e.LogicalResourceId}: ${e.ResourceStatusReason}`).slice(0, 5);
+          if (failures.length) {
+            console.error("[qlara/aws] Stack creation failed:");
+            failures.forEach((f) => console.error(f));
+          }
+          throw new Error("CloudFormation stack creation failed");
+        }
+        console.log("[qlara/aws] Stack created successfully");
+      }
+      const outputs = await getStackOutputs(cfn, stackName);
+      return outputsToResources(stackName, region, outputs);
+    },
+    async deploy(config, resources) {
+      const res = resources;
+      const buildDir = config.outputDir;
+      console.log("[qlara/aws] Generating fallback pages...");
+      const fallbacks = generateFallbacks(buildDir, config.routes);
+      console.log(`[qlara/aws] Generated ${fallbacks.length} fallback page(s)`);
+      console.log("[qlara/aws] Syncing build output to S3...");
+      const s3 = createS3Client(res.region);
+      const fileCount = await syncToS3(s3, res.bucketName, buildDir);
+      console.log(`[qlara/aws] Uploaded ${fileCount} files to S3`);
+      console.log("[qlara/aws] Bundling edge handler...");
+      const edgeZip = await bundleEdgeHandler({
+        bucketName: res.bucketName,
+        rendererArn: res.rendererFunctionArn,
+        region: res.region
+      });
+      const lambda = new import_client_lambda.LambdaClient({ region: res.region });
+      console.log("[qlara/aws] Waiting for edge handler to be ready...");
+      await (0, import_client_lambda.waitUntilFunctionUpdatedV2)(
+        { client: lambda, maxWaitTime: 120 },
+        { FunctionName: res.edgeFunctionArn }
+      );
+      await lambda.send(
+        new import_client_lambda.UpdateFunctionConfigurationCommand({
+          FunctionName: res.edgeFunctionArn,
+          Timeout: 30
+        })
+      );
+      await (0, import_client_lambda.waitUntilFunctionUpdatedV2)(
+        { client: lambda, maxWaitTime: 120 },
+        { FunctionName: res.edgeFunctionArn }
+      );
+      console.log("[qlara/aws] Deploying edge handler...");
+      await lambda.send(
+        new import_client_lambda.UpdateFunctionCodeCommand({
+          FunctionName: res.edgeFunctionArn,
+          ZipFile: edgeZip
+        })
+      );
+      await (0, import_client_lambda.waitUntilFunctionUpdatedV2)(
+        { client: lambda, maxWaitTime: 120 },
+        { FunctionName: res.edgeFunctionArn }
+      );
+      const versionResult = await lambda.send(
+        new import_client_lambda.PublishVersionCommand({
+          FunctionName: res.edgeFunctionArn
+        })
+      );
+      const newVersionArn = versionResult.FunctionArn;
+      if (!newVersionArn) {
+        throw new Error(
+          "[qlara/aws] Failed to publish new edge handler version"
+        );
+      }
+      console.log(
+        `[qlara/aws] Published edge handler version: ${newVersionArn}`
+      );
+      try {
+        await lambda.send(
+          new import_client_lambda.AddPermissionCommand({
+            FunctionName: res.edgeFunctionArn,
+            Qualifier: versionResult.Version,
+            StatementId: `CloudFrontInvoke-${versionResult.Version}`,
+            Action: "lambda:GetFunction",
+            Principal: "edgelambda.amazonaws.com"
+          })
+        );
+      } catch (err) {
+        if (!err.message?.includes("already exists")) {
+          throw err;
+        }
+      }
+      try {
+        await lambda.send(
+          new import_client_lambda.AddPermissionCommand({
+            FunctionName: res.edgeFunctionArn,
+            Qualifier: versionResult.Version,
+            StatementId: `ReplicatorInvoke-${versionResult.Version}`,
+            Action: "lambda:GetFunction",
+            Principal: "replicator.lambda.amazonaws.com"
+          })
+        );
+      } catch (err) {
+        if (!err.message?.includes("already exists")) {
+          throw err;
+        }
+      }
+      console.log("[qlara/aws] Updating CloudFront distribution...");
+      const cf = new import_client_cloudfront.CloudFrontClient({ region: res.region });
+      await updateCloudFrontEdgeVersion(cf, res.distributionId, newVersionArn);
+      console.log("[qlara/aws] Bundling renderer...");
+      const rendererZip = await bundleRenderer(config.routeFile);
+      await (0, import_client_lambda.waitUntilFunctionUpdatedV2)(
+        { client: lambda, maxWaitTime: 120 },
+        { FunctionName: res.rendererFunctionArn }
+      );
+      console.log("[qlara/aws] Deploying renderer...");
+      await lambda.send(
+        new import_client_lambda.UpdateFunctionCodeCommand({
+          FunctionName: res.rendererFunctionArn,
+          ZipFile: rendererZip
+        })
+      );
+      await (0, import_client_lambda.waitUntilFunctionUpdatedV2)(
+        { client: lambda, maxWaitTime: 120 },
+        { FunctionName: res.rendererFunctionArn }
+      );
+      console.log("[qlara/aws] Configuring renderer...");
+      await lambda.send(
+        new import_client_lambda.UpdateFunctionConfigurationCommand({
+          FunctionName: res.rendererFunctionArn,
+          Layers: [],
+          MemorySize: 256,
+          Timeout: 30,
+          Environment: {
+            Variables: config.env ?? {}
+          }
+        })
+      );
+      await (0, import_client_lambda.waitUntilFunctionUpdatedV2)(
+        { client: lambda, maxWaitTime: 120 },
+        { FunctionName: res.rendererFunctionArn }
+      );
+      console.log("[qlara/aws] Ensuring renderer permissions...");
+      try {
+        const cfn = new import_client_cloudformation.CloudFormationClient({ region: res.region });
+        const stackResources = await cfn.send(
+          new import_client_cloudformation.ListStackResourcesCommand({ StackName: res.stackName })
+        );
+        const rendererRole = stackResources.StackResourceSummaries?.find(
+          (r) => r.LogicalResourceId === "RendererRole"
+        );
+        const contentBucket = stackResources.StackResourceSummaries?.find(
+          (r) => r.LogicalResourceId === "ContentBucket"
+        );
+        if (rendererRole?.PhysicalResourceId && contentBucket?.PhysicalResourceId) {
+          const iam = new import_client_iam.IAMClient({ region: res.region });
+          const bucketArn = `arn:aws:s3:::${contentBucket.PhysicalResourceId}`;
+          await iam.send(
+            new import_client_iam.PutRolePolicyCommand({
+              RoleName: rendererRole.PhysicalResourceId,
+              PolicyName: "QlaraRendererS3Policy",
+              PolicyDocument: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:GetObject", "s3:PutObject"],
+                    Resource: `${bucketArn}/*`
+                  },
+                  {
+                    Effect: "Allow",
+                    Action: ["s3:ListBucket"],
+                    Resource: bucketArn
+                  }
+                ]
+              })
+            })
+          );
+          console.log("[qlara/aws] Renderer S3 permissions applied");
+        }
+      } catch (err) {
+        console.warn(
+          `[qlara/aws] Could not update renderer permissions: ${err.message}`
+        );
+      }
+      console.log("[qlara/aws] Invalidating CloudFront cache...");
+      await cf.send(
+        new import_client_cloudfront.CreateInvalidationCommand({
+          DistributionId: res.distributionId,
+          InvalidationBatch: {
+            CallerReference: `qlara-${Date.now()}`,
+            Paths: {
+              Quantity: 1,
+              Items: ["/*"]
+            }
+          }
+        })
+      );
+      console.log("[qlara/aws] Deploy complete!");
+      console.log(
+        `[qlara/aws] Site available at: https://${res.distributionDomain}`
+      );
+    },
+    async exists(_config) {
+      if (byoi) {
+        return byoiResources(awsConfig);
+      }
+      try {
+        const cfn = new import_client_cloudformation.CloudFormationClient({ region });
+        const outputs = await getStackOutputs(cfn, stackName);
+        return outputsToResources(stackName, region, outputs);
+      } catch {
+        return null;
+      }
+    },
+    async teardown(resources) {
+      const res = resources;
+      if (byoi) {
+        console.log(
+          "[qlara/aws] Infrastructure is externally managed (BYOI mode)."
+        );
+        console.log(
+          "[qlara/aws] Skipping teardown \u2014 delete these resources manually."
+        );
+        return;
+      }
+      console.log("[qlara/aws] Emptying S3 bucket...");
+      const s3 = createS3Client(res.region);
+      await emptyBucket(s3, res.bucketName);
+      console.log("[qlara/aws] Deleting CloudFormation stack...");
+      const cfn = new import_client_cloudformation.CloudFormationClient({ region: res.region });
+      await cfn.send(new import_client_cloudformation.DeleteStackCommand({ StackName: res.stackName }));
+      console.log(
+        "[qlara/aws] Waiting for stack deletion (this may take a few minutes)..."
+      );
+      await (0, import_client_cloudformation.waitUntilStackDeleteComplete)(
+        { client: cfn, maxWaitTime: 600 },
+        { StackName: res.stackName }
+      );
+      console.log("[qlara/aws] Infrastructure deleted");
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  aws
+});