s3-ship 0.1.0

package/dist/cli.js

@@ -0,0 +1,1000 @@
+#!/usr/bin/env node
+
+// src/cli/run.ts
+import { readFileSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+import cac from "cac";
+
+// src/config/load.ts
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { extname, isAbsolute, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import YAML from "yaml";
+var SEARCH_ORDER = [
+  "s3-ship.config.ts",
+  "s3-ship.config.js",
+  "s3-ship.config.mjs",
+  "s3-ship.config.cjs",
+  "s3-ship.config.json",
+  "s3-ship.config.yml",
+  "s3-ship.config.yaml"
+];
+async function loadConfigFile(options) {
+  const sourcePath = options.configPath ? resolveExplicitPath(options.configPath, options.cwd) : findConfigInCwd(options.cwd);
+  if (!sourcePath) {
+    throw new Error(`[config] No s3-ship config file found in ${options.cwd}. Expected one of: ${SEARCH_ORDER.join(", ")}`);
+  }
+  const config = await readByExtension(sourcePath);
+  return { config, sourcePath };
+}
+function resolveExplicitPath(configPath, cwd) {
+  const abs = isAbsolute(configPath) ? configPath : resolve(cwd, configPath);
+  if (!existsSync(abs)) {
+    throw new Error(`[config] Config file not found: ${abs}`);
+  }
+  return abs;
+}
+function findConfigInCwd(cwd) {
+  for (const name of SEARCH_ORDER) {
+    const candidate = resolve(cwd, name);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return;
+}
+async function readByExtension(path) {
+  const ext = extname(path).toLowerCase();
+  switch (ext) {
+    case ".json":
+      return parseJson(path);
+    case ".yml":
+    case ".yaml":
+      return parseYaml(path);
+    case ".ts":
+    case ".js":
+    case ".mjs":
+    case ".cjs":
+      return importModule(path);
+    default:
+      throw new Error(`[config] Unsupported config file extension: ${ext}`);
+  }
+}
+async function parseJson(path) {
+  const raw = await readFile(path, "utf8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`[config] Failed to parse JSON config at ${path}: ${err.message}`);
+  }
+}
+async function parseYaml(path) {
+  const raw = await readFile(path, "utf8");
+  try {
+    const data = YAML.parse(raw);
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+      throw new Error("YAML root must be a mapping");
+    }
+    return data;
+  } catch (err) {
+    throw new Error(`[config] Failed to parse YAML config at ${path}: ${err.message}`);
+  }
+}
+async function importModule(path) {
+  const url = `${pathToFileURL(path).href}?t=${Date.now()}`;
+  const mod = await import(url);
+  if (mod.default == null) {
+    throw new Error(`[config] ${path} has no default export. Add: export default { ... } or module.exports = { ... }`);
+  }
+  if (typeof mod.default !== "object" || Array.isArray(mod.default)) {
+    throw new Error(`[config] ${path} default export must be a config object.`);
+  }
+  return mod.default;
+}
+
+// src/config/schema.ts
+import { z } from "zod";
+var redirectRuleSchema = z.object({
+  from: z.string().min(1, "redirect.from is required"),
+  to: z.string().min(1, "redirect.to is required"),
+  statusCode: z.union([z.literal(301), z.literal(302)]).optional()
+});
+var cacheRuleSchema = z.object({
+  match: z.string().min(1),
+  cacheControl: z.string().min(1)
+});
+var cloudfrontConfigSchema = z.object({
+  distributionId: z.string().min(1, "cloudfront.distributionId is required"),
+  invalidationPaths: z.array(z.string().min(1)).optional()
+});
+var baseConfigShape = {
+  source: z.string().min(1).optional(),
+  target: z.string().optional(),
+  bucket: z.string().min(1).optional(),
+  region: z.string().min(1).optional(),
+  profile: z.string().min(1).optional(),
+  cloudfront: cloudfrontConfigSchema.optional(),
+  syncDelete: z.boolean().optional(),
+  ignore: z.array(z.string()).optional(),
+  redirects: z.array(redirectRuleSchema).optional(),
+  cacheControl: z.array(cacheRuleSchema).optional()
+};
+var environmentConfigSchema = z.object(baseConfigShape).strict();
+var configSchema = z.object({
+  ...baseConfigShape,
+  environments: z.record(z.string().min(1), environmentConfigSchema).optional()
+}).strict();
+function zodIssuesToErrors(issues) {
+  return issues.map((issue) => ({
+    path: issue.path.join("."),
+    message: issue.message
+  }));
+}
+function validateConfig(input) {
+  const parsed = configSchema.safeParse(input);
+  if (!parsed.success) {
+    return { ok: false, errors: zodIssuesToErrors(parsed.error.issues) };
+  }
+  const value = parsed.data;
+  const errors = [];
+  const envs = value.environments ?? {};
+  const envEntries = Object.entries(envs);
+  const topHasBucket = typeof value.bucket === "string" && value.bucket.length > 0;
+  if (!topHasBucket) {
+    if (envEntries.length === 0) {
+      errors.push({
+        path: "bucket",
+        message: "bucket is required at the top level or inside every environment"
+      });
+    } else {
+      for (const [name, env] of envEntries) {
+        const envHasBucket = typeof env.bucket === "string" && env.bucket.length > 0;
+        if (!envHasBucket) {
+          errors.push({
+            path: `environments.${name}.bucket`,
+            message: `bucket is required in environment "${name}" because no top-level bucket is set`
+          });
+        }
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return { ok: false, errors };
+  }
+  return { ok: true, value };
+}
+
+// src/aws/cloudfront-client.ts
+import { CloudFrontClient } from "@aws-sdk/client-cloudfront";
+import { fromIni } from "@aws-sdk/credential-providers";
+function createCloudFrontClient(options) {
+  return new CloudFrontClient({
+    region: options.region ?? "us-east-1",
+    credentials: options.profile ? fromIni({ profile: options.profile }) : undefined
+  });
+}
+
+// src/aws/s3-client.ts
+import { S3Client } from "@aws-sdk/client-s3";
+import { fromIni as fromIni2 } from "@aws-sdk/credential-providers";
+function createS3Client(options) {
+  return new S3Client({
+    region: options.region,
+    credentials: options.profile ? fromIni2({ profile: options.profile }) : undefined
+  });
+}
+function normalizeTargetPrefix(target) {
+  if (!target)
+    return "";
+  return target.endsWith("/") ? target : `${target}/`;
+}
+
+// src/config/merge.ts
+var DEFAULTS = {
+  source: "dist",
+  target: "",
+  syncDelete: false,
+  invalidationPaths: ["/*"]
+};
+function pickEnvironment(config, envName) {
+  if (!envName)
+    return;
+  const env = config.environments?.[envName];
+  if (!env) {
+    const available = Object.keys(config.environments ?? {}).join(", ") || "(none)";
+    throw new Error(`[config] environment "${envName}" not found. Available environments: ${available}`);
+  }
+  return env;
+}
+function resolveConfig(config, overrides) {
+  const env = pickEnvironment(config, overrides.env);
+  const envVars = overrides.envVars ?? {};
+  const layered = {
+    ...config,
+    ...env ?? {}
+  };
+  if (env?.cloudfront || config.cloudfront) {
+    layered.cloudfront = {
+      ...config.cloudfront ?? {},
+      ...env?.cloudfront ?? {}
+    };
+  }
+  const bucket = overrides.bucket ?? layered.bucket;
+  if (!bucket) {
+    throw new Error("[config] bucket is required (top-level, environment, or --bucket flag)");
+  }
+  const region = layered.region ?? envVars.AWS_REGION;
+  const profile = overrides.profile ?? layered.profile ?? envVars.AWS_PROFILE;
+  const cloudfront = layered.cloudfront ? {
+    distributionId: layered.cloudfront.distributionId,
+    invalidationPaths: layered.cloudfront.invalidationPaths ?? DEFAULTS.invalidationPaths
+  } : undefined;
+  const syncDelete = overrides.syncDelete ?? layered.syncDelete ?? DEFAULTS.syncDelete;
+  return {
+    source: overrides.source ?? layered.source ?? DEFAULTS.source,
+    target: overrides.target ?? layered.target ?? DEFAULTS.target,
+    bucket,
+    region,
+    profile,
+    cloudfront,
+    syncDelete,
+    ignore: layered.ignore ?? [],
+    redirects: layered.redirects ?? [],
+    cacheControl: layered.cacheControl ?? [],
+    environment: overrides.env
+  };
+}
+
+// src/stages/diff.ts
+function prefixed(prefix, key) {
+  return prefix ? `${prefix}${key}` : key;
+}
+function sortByKey(items) {
+  return [...items].sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+}
+function computeDiff(input) {
+  const prefix = normalizeTargetPrefix(input.target);
+  const plannedRedirects = input.redirects.map((r) => ({
+    ...r,
+    fullKey: prefixed(prefix, r.from)
+  }));
+  const redirectKeys = new Set(plannedRedirects.map((r) => r.fullKey));
+  const localFull = input.localFiles.map((f) => ({ ...f, key: prefixed(prefix, f.key) })).filter((f) => !redirectKeys.has(f.key));
+  const localKeys = new Set(localFull.map((f) => f.key));
+  const remoteByKey = new Map(input.remoteObjects.map((r) => [r.key, r]));
+  const toUpload = [];
+  const toUpdate = [];
+  const toSkip = [];
+  for (const file of localFull) {
+    const remote = remoteByKey.get(file.key);
+    if (!remote) {
+      toUpload.push(file);
+      continue;
+    }
+    if (remote.etag.includes("-")) {
+      toUpdate.push(file);
+      continue;
+    }
+    if (remote.etag === file.hash) {
+      toSkip.push(file);
+    } else {
+      toUpdate.push(file);
+    }
+  }
+  let toDelete = [];
+  if (input.syncDelete) {
+    for (const remote of input.remoteObjects) {
+      if (localKeys.has(remote.key))
+        continue;
+      if (redirectKeys.has(remote.key))
+        continue;
+      toDelete.push(remote.key);
+    }
+    toDelete = toDelete.sort();
+  }
+  return {
+    bucket: input.bucket,
+    target: input.target,
+    toUpload: sortByKey(toUpload),
+    toUpdate: sortByKey(toUpdate),
+    toSkip: sortByKey(toSkip),
+    toDelete,
+    redirects: plannedRedirects,
+    cloudfront: input.cloudfront
+  };
+}
+
+// src/util/parallel-limit.ts
+async function parallelLimit(items, limit, worker) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  async function next() {
+    while (true) {
+      const index = cursor++;
+      if (index >= items.length)
+        return;
+      const item = items[index];
+      try {
+        const value = await worker(item, index);
+        results[index] = { ok: true, value, item };
+      } catch (error) {
+        results[index] = { ok: false, error, item };
+      }
+    }
+  }
+  const workers = Array.from({ length: Math.min(limit, items.length) }, () => next());
+  await Promise.all(workers);
+  return results;
+}
+
+// src/stages/delete-stale.ts
+import { DeleteObjectsCommand } from "@aws-sdk/client-s3";
+
+// src/util/retry.ts
+async function withRetry(fn, options) {
+  let lastErr;
+  for (let i = 0;i < options.attempts; i++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (i < options.attempts - 1) {
+        await new Promise((resolve2) => setTimeout(resolve2, options.baseMs * 4 ** i));
+      }
+    }
+  }
+  throw lastErr;
+}
+
+// src/stages/delete-stale.ts
+var MAX_KEYS_PER_BATCH = 1000;
+async function deleteStale(input) {
+  if (input.keys.length === 0)
+    return;
+  for (let i = 0;i < input.keys.length; i += MAX_KEYS_PER_BATCH) {
+    const batch = input.keys.slice(i, i + MAX_KEYS_PER_BATCH);
+    const command = new DeleteObjectsCommand({
+      Bucket: input.bucket,
+      Delete: {
+        Objects: batch.map((Key) => ({ Key })),
+        Quiet: true
+      }
+    });
+    await withRetry(() => input.client.send(command), input.retry);
+  }
+}
+
+// src/stages/invalidate.ts
+import {
+  CreateInvalidationCommand
+} from "@aws-sdk/client-cloudfront";
+async function invalidateCloudFront(input) {
+  const callerReference = `s3-ship-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+  const command = new CreateInvalidationCommand({
+    DistributionId: input.distributionId,
+    InvalidationBatch: {
+      CallerReference: callerReference,
+      Paths: {
+        Quantity: input.paths.length,
+        Items: input.paths
+      }
+    }
+  });
+  const response = await input.client.send(command);
+  return response.Invalidation?.Id;
+}
+
+// src/stages/redirects.ts
+import { PutObjectCommand } from "@aws-sdk/client-s3";
+async function putRedirect(input) {
+  const command = new PutObjectCommand({
+    Bucket: input.bucket,
+    Key: input.redirect.fullKey,
+    Body: "",
+    ContentType: "text/html; charset=utf-8",
+    WebsiteRedirectLocation: input.redirect.to,
+    ChecksumAlgorithm: "CRC32"
+  });
+  await withRetry(() => input.client.send(command), input.retry);
+}
+
+// src/stages/upload.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { PutObjectCommand as PutObjectCommand2 } from "@aws-sdk/client-s3";
+
+// src/util/content-type.ts
+import { extname as extname2 } from "node:path";
+var MAP = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".xml": "application/xml; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".bmp": "image/bmp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".pdf": "application/pdf",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg",
+  ".wasm": "application/wasm",
+  ".zip": "application/zip",
+  ".gz": "application/gzip"
+};
+function inferContentType(filename) {
+  const ext = extname2(filename).toLowerCase();
+  return MAP[ext] ?? "application/octet-stream";
+}
+
+// src/stages/upload.ts
+async function uploadFile(input) {
+  const body = await readFile2(input.file.localPath);
+  const contentType = inferContentType(input.file.localPath);
+  const cacheControl = input.cacheControlFor(input.file.key);
+  const command = new PutObjectCommand2({
+    Bucket: input.bucket,
+    Key: input.file.key,
+    Body: body,
+    ContentType: contentType,
+    CacheControl: cacheControl,
+    ChecksumAlgorithm: "CRC32"
+  });
+  await withRetry(() => input.client.send(command), input.retry);
+}
+
+// src/stages/execute.ts
+async function runUploads(files, input) {
+  const results = await parallelLimit(files, input.concurrency, (file) => uploadFile({
+    client: input.s3Client,
+    bucket: input.plan.bucket,
+    file,
+    cacheControlFor: input.cacheControlFor,
+    retry: input.retry
+  }));
+  const ok = results.filter((r) => r.ok).length;
+  const failures = results.filter((r) => !r.ok).map((r) => ({ key: r.item.key, error: r.error }));
+  return { ok, failures };
+}
+async function executePlan(input) {
+  const failures = [];
+  const uploadResult = await runUploads(input.plan.toUpload, input);
+  failures.push(...uploadResult.failures);
+  const updateResult = await runUploads(input.plan.toUpdate, input);
+  failures.push(...updateResult.failures);
+  const redirectResults = await parallelLimit(input.plan.redirects, input.concurrency, (redirect) => putRedirect({
+    client: input.s3Client,
+    bucket: input.plan.bucket,
+    redirect,
+    retry: input.retry
+  }));
+  const redirected = redirectResults.filter((r) => r.ok).length;
+  for (const r of redirectResults) {
+    if (!r.ok) {
+      failures.push({ key: r.item.fullKey, error: r.error });
+    }
+  }
+  let deleted = 0;
+  if (input.plan.toDelete.length > 0) {
+    try {
+      await deleteStale({
+        client: input.s3Client,
+        bucket: input.plan.bucket,
+        keys: input.plan.toDelete,
+        retry: input.retry
+      });
+      deleted = input.plan.toDelete.length;
+    } catch (error) {
+      failures.push({ key: "<delete-batch>", error });
+    }
+  }
+  let invalidationId;
+  if (!input.skipInvalidate && input.plan.cloudfront && input.cfClient) {
+    try {
+      invalidationId = await invalidateCloudFront({
+        client: input.cfClient,
+        distributionId: input.plan.cloudfront.distributionId,
+        paths: input.plan.cloudfront.invalidationPaths
+      });
+    } catch (error) {
+      failures.push({ key: "<cloudfront-invalidation>", error });
+    }
+  }
+  return {
+    uploaded: uploadResult.ok,
+    updated: updateResult.ok,
+    skipped: input.plan.toSkip.length,
+    deleted,
+    redirected,
+    invalidationId,
+    failures
+  };
+}
+
+// src/stages/list-remote.ts
+import { ListObjectsV2Command } from "@aws-sdk/client-s3";
+async function listRemoteFiles(input) {
+  const prefix = normalizeTargetPrefix(input.target);
+  const results = [];
+  let continuationToken;
+  do {
+    const command = new ListObjectsV2Command({
+      Bucket: input.bucket,
+      Prefix: prefix || undefined,
+      ContinuationToken: continuationToken
+    });
+    const response = await input.client.send(command);
+    for (const item of response.Contents ?? []) {
+      if (!item.Key)
+        continue;
+      results.push({
+        key: item.Key,
+        size: item.Size ?? 0,
+        etag: stripQuotes(item.ETag ?? "")
+      });
+    }
+    continuationToken = response.NextContinuationToken;
+  } while (continuationToken);
+  return results;
+}
+function stripQuotes(etag) {
+  return etag.replace(/^"+|"+$/g, "");
+}
+
+// src/stages/scan.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync2, statSync } from "node:fs";
+import { readFile as readFile3 } from "node:fs/promises";
+import { sep } from "node:path";
+import { glob } from "tinyglobby";
+var ALWAYS_IGNORE = ["**/.DS_Store", "**/Thumbs.db", "**/.git/**", "**/*.swp"];
+async function scanLocalFiles(input) {
+  if (!existsSync2(input.source) || !statSync(input.source).isDirectory()) {
+    throw new Error(`[scan] source directory does not exist: ${input.source}`);
+  }
+  const ignore = [...ALWAYS_IGNORE, ...input.ignore];
+  const paths = await glob(["**/*"], {
+    cwd: input.source,
+    dot: true,
+    onlyFiles: true,
+    ignore,
+    absolute: true
+  });
+  const files = await Promise.all(paths.map(async (absPath) => {
+    const buf = await readFile3(absPath);
+    const hash = createHash("md5").update(buf).digest("hex");
+    const rel = absPath.slice(input.source.length).replace(/^[\\/]/, "");
+    const key = rel.split(sep).join("/");
+    return { key, localPath: absPath, size: buf.byteLength, hash };
+  }));
+  files.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+  return files;
+}
+
+// src/util/glob-match.ts
+function escapeRegex(s) {
+  return s.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+}
+function globToRegex(pattern) {
+  let out = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") {
+      if (pattern[i + 1] === "*") {
+        out += ".*";
+        i += 2;
+        if (pattern[i] === "/")
+          i++;
+      } else {
+        out += "[^/]*";
+        i++;
+      }
+    } else if (c === "?") {
+      out += "[^/]";
+      i++;
+    } else {
+      out += escapeRegex(c);
+      i++;
+    }
+  }
+  return new RegExp(`^${out}$`);
+}
+function matchGlob(key, pattern) {
+  return globToRegex(pattern).test(key);
+}
+
+// src/deploy.ts
+var DEFAULT_RETRY = { attempts: 3, baseMs: 200 };
+var DEFAULT_CONCURRENCY = 10;
+async function deploy(options) {
+  const loaded = await loadConfigFile({ cwd: options.cwd, configPath: options.configPath });
+  const validation = validateConfig(loaded.config);
+  if (!validation.ok) {
+    const summary = validation.errors.map((e) => `  - [${e.path || "<root>"}] ${e.message}`).join(`
+`);
+    throw new Error(`[config] Invalid config (${loaded.sourcePath}):
+${summary}`);
+  }
+  const resolvedConfig = resolveConfig(validation.value, {
+    env: options.env,
+    profile: options.profile,
+    bucket: options.bucket,
+    target: options.target,
+    source: options.source,
+    syncDelete: options.syncDelete,
+    envVars: options.envVars
+  });
+  const s3Factory = options.s3ClientFactory ?? createS3Client;
+  const cfFactory = options.cfClientFactory ?? createCloudFrontClient;
+  const s3Client = s3Factory({
+    region: resolvedConfig.region,
+    profile: resolvedConfig.profile
+  });
+  const cfClient = resolvedConfig.cloudfront ? cfFactory({
+    region: resolvedConfig.region,
+    profile: resolvedConfig.profile
+  }) : undefined;
+  const sourcePath = resolveSourcePath(options.cwd, resolvedConfig.source);
+  const [localFiles, remoteObjects] = await Promise.all([
+    scanLocalFiles({ source: sourcePath, ignore: resolvedConfig.ignore }),
+    listRemoteFiles({
+      client: s3Client,
+      bucket: resolvedConfig.bucket,
+      target: resolvedConfig.target
+    })
+  ]);
+  const plan = computeDiff({
+    bucket: resolvedConfig.bucket,
+    target: resolvedConfig.target,
+    localFiles,
+    remoteObjects,
+    redirects: resolvedConfig.redirects,
+    syncDelete: resolvedConfig.syncDelete,
+    cloudfront: resolvedConfig.cloudfront
+  });
+  if (options.dryRun) {
+    return { resolvedConfig, plan, dryRun: true, configPath: loaded.sourcePath };
+  }
+  const cacheControlFor = buildCacheControlMatcher(resolvedConfig.cacheControl);
+  const report = await executePlan({
+    plan,
+    s3Client,
+    cfClient,
+    cacheControlFor,
+    retry: DEFAULT_RETRY,
+    concurrency: options.concurrency ?? DEFAULT_CONCURRENCY,
+    skipInvalidate: options.skipInvalidate
+  });
+  return { resolvedConfig, plan, report, dryRun: false, configPath: loaded.sourcePath };
+}
+function resolveSourcePath(cwd, source) {
+  if (source.startsWith("/"))
+    return source;
+  return `${cwd}/${source}`;
+}
+function buildCacheControlMatcher(rules) {
+  if (rules.length === 0)
+    return () => {
+      return;
+    };
+  return (key) => {
+    for (const rule of rules) {
+      if (matchGlob(key, rule.match))
+        return rule.cacheControl;
+    }
+    return;
+  };
+}
+
+// src/reporter.ts
+var MAX_LISTED = 20;
+function formatBytes(n) {
+  if (n < 1024)
+    return `${n} B`;
+  if (n < 1024 * 1024)
+    return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(2)} MB`;
+}
+function totalSize(files) {
+  return files.reduce((acc, f) => acc + f.size, 0);
+}
+function listSection(label, items, verbose) {
+  if (items.length === 0)
+    return "";
+  const limit = verbose ? items.length : MAX_LISTED;
+  const shown = items.slice(0, limit);
+  const overflow = items.length - shown.length;
+  const lines = [`  ${label}:`, ...shown.map((k) => `    + ${k}`)];
+  if (overflow > 0)
+    lines.push(`    … and ${overflow} more`);
+  return `${lines.join(`
+`)}
+`;
+}
+function fileLine(f, verbose) {
+  return verbose ? `${f.key}  (${formatBytes(f.size)})` : f.key;
+}
+function formatPlan(plan, options = {}) {
+  const verbose = options.verbose === true;
+  const total = plan.toUpload.length + plan.toUpdate.length + plan.toDelete.length + plan.redirects.length;
+  const lines = [];
+  const targetLabel = plan.target || "(bucket root)";
+  lines.push(`Plan for s3://${plan.bucket}/${plan.target ? plan.target : ""}`);
+  lines.push(`  target: ${targetLabel}`);
+  if (total === 0 && plan.toSkip.length === 0) {
+    lines.push("  no changes");
+  } else if (total === 0) {
+    lines.push(`  no changes (${plan.toSkip.length} files already in sync)`);
+  } else {
+    lines.push(`  upload: ${plan.toUpload.length} (${formatBytes(totalSize(plan.toUpload))})`);
+    lines.push(`  update: ${plan.toUpdate.length} (${formatBytes(totalSize(plan.toUpdate))})`);
+    lines.push(`  skip:   ${plan.toSkip.length}`);
+    lines.push(`  delete: ${plan.toDelete.length}`);
+    lines.push(`  redirect: ${plan.redirects.length}`);
+  }
+  if (plan.cloudfront) {
+    lines.push(`  cloudfront: ${plan.cloudfront.distributionId} (${plan.cloudfront.invalidationPaths.join(", ")})`);
+  }
+  let out = `${lines.join(`
+`)}
+`;
+  out += listSection("upload", plan.toUpload.map((f) => fileLine(f, verbose)), verbose);
+  out += listSection("update", plan.toUpdate.map((f) => fileLine(f, verbose)), verbose);
+  out += listSection("delete", plan.toDelete, verbose);
+  out += listSection("redirect", plan.redirects.map((r) => `${r.fullKey} -> ${r.to}`), verbose);
+  if (verbose) {
+    out += listSection("skip", plan.toSkip.map((f) => f.key), verbose);
+  }
+  return out;
+}
+function formatReport(report, options = {}) {
+  const verbose = options.verbose === true;
+  const lines = ["Deploy complete"];
+  lines.push(`  uploaded: ${report.uploaded}`);
+  lines.push(`  updated:  ${report.updated}`);
+  lines.push(`  skipped:  ${report.skipped}`);
+  lines.push(`  deleted:  ${report.deleted}`);
+  lines.push(`  redirected: ${report.redirected}`);
+  if (report.invalidationId) {
+    lines.push(`  invalidation: ${report.invalidationId}`);
+  }
+  if (report.failures.length > 0) {
+    lines.push(`  failures: ${report.failures.length}`);
+    const limit = verbose ? report.failures.length : MAX_LISTED;
+    for (const f of report.failures.slice(0, limit)) {
+      const msg = f.error instanceof Error ? f.error.message : String(f.error);
+      lines.push(`    ! ${f.key}: ${msg}`);
+    }
+    if (report.failures.length > limit) {
+      lines.push(`    … and ${report.failures.length - limit} more`);
+    }
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+
+// src/cli/init.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var TEMPLATES = {
+  ts: {
+    filename: "s3-ship.config.ts",
+    content: `import { defineConfig } from 's3-ship'
+
+export default defineConfig({
+  source: 'dist',
+  bucket: 'my-bucket-name',
+  region: 'us-east-1',
+
+  // Uncomment to invalidate CloudFront after every deploy
+  // cloudfront: { distributionId: 'EXXXXXXX' },
+
+  // Uncomment to delete S3 keys not present locally (bounded to target prefix)
+  // syncDelete: true,
+
+  // redirects: [
+  //   { from: 'old.html', to: '/new.html' },
+  // ],
+
+  // cacheControl: [
+  //   { match: 'assets/**', cacheControl: 'public, max-age=31536000, immutable' },
+  //   { match: '*.html', cacheControl: 'public, max-age=0, must-revalidate' },
+  // ],
+
+  // environments: {
+  //   production: { bucket: 'prod-bucket', cloudfront: { distributionId: 'EPROD' } },
+  //   staging:    { bucket: 'staging-bucket' },
+  // },
+})
+`
+  },
+  js: {
+    filename: "s3-ship.config.js",
+    content: `/** @type {import('s3-ship').Config} */
+export default {
+  source: 'dist',
+  bucket: 'my-bucket-name',
+  region: 'us-east-1',
+}
+`
+  },
+  mjs: {
+    filename: "s3-ship.config.mjs",
+    content: `/** @type {import('s3-ship').Config} */
+export default {
+  source: 'dist',
+  bucket: 'my-bucket-name',
+  region: 'us-east-1',
+}
+`
+  },
+  json: {
+    filename: "s3-ship.config.json",
+    content: `${JSON.stringify({
+      source: "dist",
+      bucket: "my-bucket-name",
+      region: "us-east-1"
+    }, null, 2)}
+`
+  },
+  yml: {
+    filename: "s3-ship.config.yml",
+    content: `source: dist
+bucket: my-bucket-name
+region: us-east-1
+# cloudfront:
+#   distributionId: EXXXXXXX
+# syncDelete: true
+# redirects:
+#   - { from: old.html, to: /new.html }
+# environments:
+#   production:
+#     bucket: prod-bucket
+#   staging:
+#     bucket: staging-bucket
+`
+  },
+  yaml: {
+    filename: "s3-ship.config.yaml",
+    content: `source: dist
+bucket: my-bucket-name
+region: us-east-1
+`
+  }
+};
+async function initConfig(options) {
+  const format = options.format ?? "ts";
+  const template = TEMPLATES[format];
+  if (!template) {
+    throw new Error(`[init] Unsupported format "${format}". Use one of: ${Object.keys(TEMPLATES).join(", ")}`);
+  }
+  const path = join(options.cwd, template.filename);
+  if (existsSync3(path)) {
+    throw new Error(`[init] ${template.filename} already exists at ${path}`);
+  }
+  await writeFile(path, template.content, "utf8");
+  return { path, format };
+}
+
+// src/cli/run.ts
+function readVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const candidates = [join2(here, "..", "..", "package.json"), join2(here, "..", "package.json")];
+    for (const c of candidates) {
+      try {
+        const raw = readFileSync(c, "utf8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name === "s3-ship" && pkg.version)
+          return pkg.version;
+      } catch {}
+    }
+  } catch {}
+  return "0.0.0";
+}
+async function runCli(argv, options = {}) {
+  const cli = cac("s3-ship");
+  const deployFn = options.deployFn ?? deploy;
+  cli.command("deploy", "Deploy the local source directory to S3").option("--env <name>", "Environment name from config.environments").option("--profile <name>", "Override AWS profile").option("--bucket <name>", "Override target bucket").option("--target <prefix>", "Override target prefix").option("--source <dir>", "Override local source directory").option("--dry-run", "Show plan without executing").option("--sync-delete", "Delete remote keys absent locally (bounded to target). Pass --no-sync-delete to disable.").option("--no-invalidate", "Skip CloudFront invalidation").option("--config <path>", "Path to config file").option("--verbose", "Verbose output").action(async (flags) => {
+    const result = await deployFn({
+      cwd: process.cwd(),
+      envVars: process.env,
+      env: flags.env,
+      configPath: flags.config,
+      profile: flags.profile,
+      bucket: flags.bucket,
+      target: flags.target,
+      source: flags.source,
+      dryRun: flags.dryRun,
+      syncDelete: flags.syncDelete,
+      skipInvalidate: flags.invalidate === false
+    });
+    const verbose = flags.verbose === true;
+    process.stdout.write(formatPlan(result.plan, { verbose }));
+    if (result.dryRun) {
+      process.stdout.write(`
+(dry-run; no changes applied)
+`);
+      return;
+    }
+    if (result.report) {
+      process.stdout.write(`
+${formatReport(result.report, { verbose })}`);
+      if (result.report.failures.length > 0) {
+        process.exitCode = 2;
+      }
+    }
+  });
+  cli.command("init", "Create a starter s3-ship config file").option("--format <fmt>", "Config format: ts | js | mjs | json | yml | yaml", {
+    default: "ts"
+  }).action(async (flags) => {
+    const result = await initConfig({
+      cwd: process.cwd(),
+      format: flags.format ?? "ts"
+    });
+    process.stdout.write(`Created ${result.path}
+`);
+  });
+  cli.command("validate", "Validate the config file without contacting AWS").option("--config <path>", "Path to config file").action(async (flags) => {
+    const loaded = await loadConfigFile({
+      cwd: process.cwd(),
+      configPath: flags.config
+    });
+    const result = validateConfig(loaded.config);
+    if (!result.ok) {
+      process.stderr.write(`[config] Invalid config (${loaded.sourcePath}):
+`);
+      for (const err of result.errors) {
+        process.stderr.write(`  - [${err.path || "<root>"}] ${err.message}
+`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(`OK ${loaded.sourcePath}
+`);
+  });
+  cli.help();
+  cli.version(readVersion());
+  try {
+    cli.parse(argv, { run: false });
+    await cli.runMatchedCommand();
+    const code = process.exitCode;
+    return typeof code === "number" ? code : code ? 1 : 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`${message}
+`);
+    if (/\[config\]/.test(message))
+      return 1;
+    return 2;
+  }
+}
+
+// src/cli.ts
+runCli(process.argv).catch((err) => {
+  console.error(err);
+  process.exit(1);
+});