sst 2.0.0-rc.64 → 2.0.0-rc.65

package/cli/commands/dev.js

@@ -153,6 +153,7 @@ export const dev = (program) => program.command(["dev", "start"], "Work on your
                 deploy(assembly);
             }
             catch (ex) {
+                isWorking = false;
                 spinner.fail();
                 Colors.line(ex.stack
                     .split("\n")

package/cli/sst.js

@@ -38,8 +38,10 @@ consoleCommand(program);
 diff(program);
 version(program);
 telemetry(program);
-// @ts-expect-error
-process.setSourceMapsEnabled(true);
+if ("setSourceMapsEnabled" in process) {
+    // @ts-expect-error
+    process.setSourceMapsEnabled(true);
+}
 process.removeAllListeners("uncaughtException");
 process.on("uncaughtException", (err) => {
     Logger.debug(err);

package/constructs/ApiGatewayV1Api.d.ts

@@ -9,6 +9,7 @@ import * as apigV1AccessLog from "./util/apiGatewayV1AccessLog.js";
 import { Bucket } from "./Bucket.js";
 import { Duration } from "./util/duration.js";
 import { SSTConstruct } from "./Construct.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { Function as Fn, FunctionProps, FunctionInlineDefinition, FunctionDefinition } from "./Function.js";
 import { Permissions } from "./util/permission.js";
 export interface ApiGatewayV1ApiAccessLogProps extends apigV1AccessLog.AccessLogProps {
@@ -491,7 +492,7 @@ export declare class ApiGatewayV1Api<Authorizers extends Record<string, ApiGatew
         /**
          * The internally created certificate
          */
-        certificate?: acm.Certificate | acm.DnsValidatedCertificate;
+        certificate?: acm.Certificate | DnsValidatedCertificate;
     };
     private _deployment?;
     private _customDomainUrl?;

package/constructs/ApiGatewayV1Api.js

@@ -9,6 +9,7 @@ import * as apigV1AccessLog from "./util/apiGatewayV1AccessLog.js";
 import { Stack } from "./Stack.js";
 import { toCdkDuration } from "./util/duration.js";
 import { getFunctionRef, isCDKConstruct } from "./Construct.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { Function as Fn, } from "./Function.js";
 const allowedMethods = [
     "ANY",
@@ -447,7 +448,7 @@ export class ApiGatewayV1Api extends Construct {
         /////////////////////
         if (!apigDomainName && !certificate) {
             if (endpointType === "edge") {
-                certificate = new acm.DnsValidatedCertificate(this, "CrossRegionCertificate", {
+                certificate = new DnsValidatedCertificate(this, "CrossRegionCertificate", {
                     domainName: domainName,
                     hostedZone: hostedZone,
                     region: "us-east-1",

package/constructs/BaseSite.d.ts

@@ -1,6 +1,6 @@
-import * as route53 from "aws-cdk-lib/aws-route53";
-import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { ErrorResponse, DistributionProps, BehaviorOptions, IOrigin } from "aws-cdk-lib/aws-cloudfront";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 /**
  * The customDomain for this website. SST supports domains that are hosted either on [Route 53](https://aws.amazon.com/route53/) or externally.
  *
@@ -61,13 +61,13 @@ export interface BaseSiteDomainProps {
         /**
          * Import the underlying Route 53 hosted zone.
          */
-        hostedZone?: route53.IHostedZone;
+        hostedZone?: IHostedZone;
         /**
          * Import the certificate for the domain. By default, SST will create a certificate with the domain name. The certificate will be created in the `us-east-1`(N. Virginia) region as required by AWS CloudFront.
          *
          * Set this option if you have an existing certificate in the `us-east-1` region in AWS Certificate Manager you want to use.
          */
-        certificate?: acm.ICertificate;
+        certificate?: ICertificate;
     };
 }
 export interface BaseSiteEnvironmentOutputsInfo {
@@ -82,11 +82,11 @@ export interface BaseSiteReplaceProps {
     search: string;
     replace: string;
 }
-export declare function buildErrorResponsesForRedirectToIndex(indexPage: string): cloudfront.ErrorResponse[];
-export declare function buildErrorResponsesFor404ErrorPage(errorPage: string): cloudfront.ErrorResponse[];
-export interface BaseSiteCdkDistributionProps extends Omit<cloudfront.DistributionProps, "defaultBehavior"> {
-    defaultBehavior?: Omit<cloudfront.BehaviorOptions, "origin"> & {
-        origin?: cloudfront.IOrigin;
+export declare function buildErrorResponsesForRedirectToIndex(indexPage: string): ErrorResponse[];
+export declare function buildErrorResponsesFor404ErrorPage(errorPage: string): ErrorResponse[];
+export interface BaseSiteCdkDistributionProps extends Omit<DistributionProps, "defaultBehavior"> {
+    defaultBehavior?: Omit<BehaviorOptions, "origin"> & {
+        origin?: IOrigin;
     };
 }
 export declare function getBuildCmdEnvironment(siteEnvironment?: {

package/constructs/BaseSite.js

@@ -1,4 +1,4 @@
-import * as cdk from "aws-cdk-lib";
+import { Token } from "aws-cdk-lib";
 export function buildErrorResponsesForRedirectToIndex(indexPage) {
     return [
         {
@@ -35,7 +35,7 @@ export function getBuildCmdEnvironment(siteEnvironment) {
     //
     const buildCmdEnvironment = {};
     Object.entries(siteEnvironment || {}).forEach(([key, value]) => {
-        buildCmdEnvironment[key] = cdk.Token.isUnresolved(value)
+        buildCmdEnvironment[key] = Token.isUnresolved(value)
             ? `{{ ${key} }}`
             : value;
     });

package/constructs/EventBus.js

@@ -183,7 +183,7 @@ export class EventBus extends Construct {
                 eventBusName: this.cdk.eventBus.eventBusName,
                 rules: Object.entries(this.targetsData).map(([ruleName, rule]) => ({
                     key: ruleName,
-                    targets: Object.values(rule).map(getFunctionRef),
+                    targets: Object.values(rule).map(getFunctionRef).filter(Boolean),
                     targetNames: Object.keys(rule),
                 })),
             },

package/constructs/SsrSite.js

@@ -13,15 +13,15 @@ import { Function, Code, Runtime, FunctionUrlAuthType, } from "aws-cdk-lib/aws-l
 import { HostedZone, ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
 import { Asset } from "aws-cdk-lib/aws-s3-assets";
 import { Distribution, ViewerProtocolPolicy, AllowedMethods, CachedMethods, LambdaEdgeEventType, CachePolicy, CacheQueryStringBehavior, CacheHeaderBehavior, CacheCookieBehavior, } from "aws-cdk-lib/aws-cloudfront";
-import { DnsValidatedCertificate, } from "aws-cdk-lib/aws-certificatemanager";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { S3Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
 import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
-import { HttpsRedirect } from "aws-cdk-lib/aws-route53-patterns";
 import { Stack } from "./Stack.js";
 import { Logger } from "../logger.js";
 import { isCDKConstruct } from "./Construct.js";
 import { getBuildCmdEnvironment, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { attachPermissionsToRole } from "./util/permission.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { SiteEnv } from "../site-env.js";

package/constructs/StaticSite.js

@@ -7,17 +7,17 @@ import { Construct } from "constructs";
 import { Token, Duration, CfnOutput, RemovalPolicy, CustomResource, } from "aws-cdk-lib";
 import * as s3 from "aws-cdk-lib/aws-s3";
 import * as s3Assets from "aws-cdk-lib/aws-s3-assets";
-import * as acm from "aws-cdk-lib/aws-certificatemanager";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as route53 from "aws-cdk-lib/aws-route53";
-import * as route53Patterns from "aws-cdk-lib/aws-route53-patterns";
 import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
 import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import * as cfOrigins from "aws-cdk-lib/aws-cloudfront-origins";
 import { AwsCliLayer } from "aws-cdk-lib/lambda-layer-awscli";
 import { Stack } from "./Stack.js";
 import { getBuildCmdEnvironment, buildErrorResponsesFor404ErrorPage, buildErrorResponsesForRedirectToIndex, } from "./BaseSite.js";
+import { HttpsRedirect } from "./cdk/website-redirect.js";
+import { DnsValidatedCertificate } from "./cdk/dns-validated-certificate.js";
 import { isCDKConstruct } from "./Construct.js";
 import { ENVIRONMENT_PLACEHOLDER, getParameterPath, } from "./util/functionBinding.js";
 import { gray } from "colorette";
@@ -519,7 +519,7 @@ interface ImportMeta {
         // HostedZone is set for Route 53 domains
         if (this.hostedZone) {
             if (typeof customDomain === "string") {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain,
                     hostedZone: this.hostedZone,
                     region: "us-east-1",
@@ -529,7 +529,7 @@ interface ImportMeta {
                 acmCertificate = customDomain.cdk.certificate;
             }
             else {
-                acmCertificate = new acm.DnsValidatedCertificate(this, "Certificate", {
+                acmCertificate = new DnsValidatedCertificate(this, "Certificate", {
                     domainName: customDomain.domainName,
                     hostedZone: this.hostedZone,
                     region: "us-east-1",
@@ -568,7 +568,7 @@ interface ImportMeta {
         new route53.AaaaRecord(this, "AliasRecordAAAA", recordProps);
         // Create Alias redirect record
         if (domainAlias) {
-            new route53Patterns.HttpsRedirect(this, "Redirect", {
+            new HttpsRedirect(this, "Redirect", {
                 zone: this.hostedZone,
                 recordNames: [domainAlias],
                 targetDomain: recordName,

package/constructs/cdk/certificate-base.d.ts

@@ -0,0 +1,18 @@
+import { Metric, MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
+import { Resource } from "aws-cdk-lib";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export declare abstract class CertificateBase extends Resource implements ICertificate {
+    abstract readonly certificateArn: string;
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    protected readonly region?: string;
+    metricDaysToExpiry(props?: MetricOptions): Metric;
+}

package/constructs/cdk/certificate-base.js

@@ -0,0 +1,26 @@
+import { Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+import { Duration, Resource } from "aws-cdk-lib";
+/**
+ * Shared implementation details of ICertificate implementations.
+ *
+ * @internal
+ */
+export class CertificateBase extends Resource {
+    /**
+     * If the certificate is provisionned in a different region than the
+     * containing stack, this should be the region in which the certificate lives
+     * so we can correctly create `Metric` instances.
+     */
+    region;
+    metricDaysToExpiry(props) {
+        return new Metric({
+            period: Duration.days(1),
+            ...props,
+            dimensionsMap: { CertificateArn: this.certificateArn },
+            metricName: "DaysToExpiry",
+            namespace: "AWS/CertificateManager",
+            region: this.region,
+            statistic: Stats.MINIMUM,
+        });
+    }
+}

package/constructs/cdk/dns-validated-certificate.d.ts

@@ -0,0 +1,77 @@
+import { Construct } from "constructs";
+import { ITaggable, TagManager, RemovalPolicy } from "aws-cdk-lib";
+import { CertificateProps, ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import { CertificateBase } from "./certificate-base.js";
+/**
+ * Properties to create a DNS validated certificate managed by AWS Certificate Manager
+ *
+ */
+export interface DnsValidatedCertificateProps extends CertificateProps {
+    /**
+     * Route 53 Hosted Zone used to perform DNS validation of the request.  The zone
+     * must be authoritative for the domain name specified in the Certificate Request.
+     */
+    readonly hostedZone: route53.IHostedZone;
+    /**
+     * AWS region that will host the certificate. This is needed especially
+     * for certificates used for CloudFront distributions, which require the region
+     * to be us-east-1.
+     *
+     * @default the region the stack is deployed in.
+     */
+    readonly region?: string;
+    /**
+     * An endpoint of Route53 service, which is not necessary as AWS SDK could figure
+     * out the right endpoints for most regions, but for some regions such as those in
+     * aws-cn partition, the default endpoint is not working now, hence the right endpoint
+     * need to be specified through this prop.
+     *
+     * Route53 is not been officially launched in China, it is only available for AWS
+     * internal accounts now. To make DnsValidatedCertificate work for internal accounts
+     * now, a special endpoint needs to be provided.
+     *
+     * @default - The AWS SDK will determine the Route53 endpoint to use based on region
+     */
+    readonly route53Endpoint?: string;
+    /**
+     * Role to use for the custom resource that creates the validated certificate
+     *
+     * @default - A new role will be created
+     */
+    readonly customResourceRole?: iam.IRole;
+    /**
+     * When set to true, when the DnsValidatedCertificate is deleted,
+     * the associated Route53 validation records are removed.
+     *
+     * CAUTION: If multiple certificates share the same domains (and same validation records),
+     * this can cause the other certificates to fail renewal and/or not validate.
+     * Not recommended for production use.
+     *
+     * @default false
+     */
+    readonly cleanupRoute53Records?: boolean;
+}
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export declare class DnsValidatedCertificate extends CertificateBase implements ICertificate, ITaggable {
+    readonly certificateArn: string;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    readonly tags: TagManager;
+    protected readonly region?: string;
+    private normalizedZoneName;
+    private hostedZoneId;
+    private domainName;
+    private _removalPolicy?;
+    constructor(scope: Construct, id: string, props: DnsValidatedCertificateProps);
+    applyRemovalPolicy(policy: RemovalPolicy): void;
+    private validateDnsValidatedCertificate;
+}

package/constructs/cdk/dns-validated-certificate.js

@@ -0,0 +1,125 @@
+import url from "url";
+import * as path from "path";
+import { Token, TagManager, TagType, Duration, Stack, CustomResource, Lazy, } from "aws-cdk-lib";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import { CertificateBase } from "./certificate-base.js";
+const __dirname = url.fileURLToPath(new URL(".", import.meta.url));
+/**
+ * A certificate managed by AWS Certificate Manager.  Will be automatically
+ * validated using DNS validation against the specified Route 53 hosted zone.
+ *
+ * @resource AWS::CertificateManager::Certificate
+ */
+export class DnsValidatedCertificate extends CertificateBase {
+    certificateArn;
+    /**
+     * Resource Tags.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html#cfn-certificatemanager-certificate-tags
+     */
+    tags;
+    region;
+    normalizedZoneName;
+    hostedZoneId;
+    domainName;
+    _removalPolicy;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.region = props.region;
+        this.domainName = props.domainName;
+        // check if domain name is 64 characters or less
+        if (!Token.isUnresolved(props.domainName) && props.domainName.length > 64) {
+            throw new Error("Domain name must be 64 characters or less");
+        }
+        this.normalizedZoneName = props.hostedZone.zoneName;
+        // Remove trailing `.` from zone name
+        if (this.normalizedZoneName.endsWith(".")) {
+            this.normalizedZoneName = this.normalizedZoneName.substring(0, this.normalizedZoneName.length - 1);
+        }
+        // Remove any `/hostedzone/` prefix from the Hosted Zone ID
+        this.hostedZoneId = props.hostedZone.hostedZoneId.replace(/^\/hostedzone\//, "");
+        this.tags = new TagManager(TagType.MAP, "AWS::CertificateManager::Certificate");
+        let certificateTransparencyLoggingPreference;
+        if (props.transparencyLoggingEnabled !== undefined) {
+            certificateTransparencyLoggingPreference =
+                props.transparencyLoggingEnabled ? "ENABLED" : "DISABLED";
+        }
+        const requestorFunction = new lambda.Function(this, "CertificateRequestorFunction", {
+            code: lambda.Code.fromAsset(path.join(__dirname, "../../support/certificate-requestor")),
+            handler: "index.certificateRequestHandler",
+            runtime: lambda.Runtime.NODEJS_14_X,
+            timeout: Duration.minutes(15),
+            role: props.customResourceRole,
+        });
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: [
+                "acm:RequestCertificate",
+                "acm:DescribeCertificate",
+                "acm:DeleteCertificate",
+                "acm:AddTagsToCertificate",
+            ],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:GetChange"],
+            resources: ["*"],
+        }));
+        requestorFunction.addToRolePolicy(new iam.PolicyStatement({
+            actions: ["route53:changeResourceRecordSets"],
+            resources: [
+                `arn:${Stack.of(requestorFunction).partition}:route53:::hostedzone/${this.hostedZoneId}`,
+            ],
+            conditions: {
+                "ForAllValues:StringEquals": {
+                    "route53:ChangeResourceRecordSetsRecordTypes": ["CNAME"],
+                    "route53:ChangeResourceRecordSetsActions": props.cleanupRoute53Records ? ["UPSERT", "DELETE"] : ["UPSERT"],
+                },
+                "ForAllValues:StringLike": {
+                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+                        addWildcard(props.domainName),
+                        ...(props.subjectAlternativeNames ?? []).map((d) => addWildcard(d)),
+                    ],
+                },
+            },
+        }));
+        const certificate = new CustomResource(this, "CertificateRequestorResource", {
+            serviceToken: requestorFunction.functionArn,
+            properties: {
+                DomainName: props.domainName,
+                SubjectAlternativeNames: Lazy.list({ produce: () => props.subjectAlternativeNames }, { omitEmpty: true }),
+                CertificateTransparencyLoggingPreference: certificateTransparencyLoggingPreference,
+                HostedZoneId: this.hostedZoneId,
+                Region: props.region,
+                Route53Endpoint: props.route53Endpoint,
+                RemovalPolicy: Lazy.any({ produce: () => this._removalPolicy }),
+                // Custom resources properties are always converted to strings; might as well be explict here.
+                CleanupRecords: props.cleanupRoute53Records ? "true" : undefined,
+                Tags: Lazy.list({ produce: () => this.tags.renderTags() }),
+            },
+        });
+        this.certificateArn = certificate.getAtt("Arn").toString();
+        this.node.addValidation({
+            validate: () => this.validateDnsValidatedCertificate(),
+        });
+    }
+    applyRemovalPolicy(policy) {
+        this._removalPolicy = policy;
+    }
+    validateDnsValidatedCertificate() {
+        const errors = [];
+        // Ensure the zone name is a parent zone of the certificate domain name
+        if (!Token.isUnresolved(this.normalizedZoneName) &&
+            this.domainName !== this.normalizedZoneName &&
+            !this.domainName.endsWith("." + this.normalizedZoneName)) {
+            errors.push(`DNS zone ${this.normalizedZoneName} is not authoritative for certificate domain name ${this.domainName}`);
+        }
+        return errors;
+    }
+}
+// https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html
+function addWildcard(domainName) {
+    if (domainName.startsWith("*.")) {
+        return domainName;
+    }
+    return `*.${domainName}`;
+}

package/constructs/cdk/website-redirect.d.ts

@@ -0,0 +1,53 @@
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { IHostedZone } from "aws-cdk-lib/aws-route53";
+import { Construct } from "constructs";
+/**
+ * Properties to configure an HTTPS Redirect
+ */
+export interface HttpsRedirectProps {
+    /**
+     * Hosted zone of the domain which will be used to create alias record(s) from
+     * domain names in the hosted zone to the target domain. The hosted zone must
+     * contain entries for the domain name(s) supplied through `recordNames` that
+     * will redirect to the target domain.
+     *
+     * Domain names in the hosted zone can include a specific domain (example.com)
+     * and its subdomains (acme.example.com, zenith.example.com).
+     *
+     */
+    readonly zone: IHostedZone;
+    /**
+     * The redirect target fully qualified domain name (FQDN). An alias record
+     * will be created that points to your CloudFront distribution. Root domain
+     * or sub-domain can be supplied.
+     */
+    readonly targetDomain: string;
+    /**
+     * The domain names that will redirect to `targetDomain`
+     *
+     * @default - the domain name of the hosted zone
+     */
+    readonly recordNames?: string[];
+    /**
+     * The AWS Certificate Manager (ACM) certificate that will be associated with
+     * the CloudFront distribution that will be created. If provided, the certificate must be
+     * stored in us-east-1 (N. Virginia)
+     *
+     * @default - A new certificate is created in us-east-1 (N. Virginia)
+     */
+    readonly certificate?: ICertificate;
+}
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export declare class HttpsRedirect extends Construct {
+    constructor(scope: Construct, id: string, props: HttpsRedirectProps);
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    private createCertificate;
+}

package/constructs/cdk/website-redirect.js

@@ -0,0 +1,77 @@
+import { CloudFrontWebDistribution, OriginProtocolPolicy, PriceClass, ViewerCertificate, ViewerProtocolPolicy, } from "aws-cdk-lib/aws-cloudfront";
+import { ARecord, AaaaRecord, RecordTarget, } from "aws-cdk-lib/aws-route53";
+import { CloudFrontTarget } from "aws-cdk-lib/aws-route53-targets";
+import { BlockPublicAccess, Bucket, RedirectProtocol, } from "aws-cdk-lib/aws-s3";
+import { ArnFormat, RemovalPolicy, Stack, Token } from "aws-cdk-lib";
+import cdkHelpers from "aws-cdk-lib/core/lib/helpers-internal";
+import { Construct } from "constructs";
+import { DnsValidatedCertificate } from "./dns-validated-certificate.js";
+const { md5hash } = cdkHelpers;
+/**
+ * Allows creating a domainA -> domainB redirect using CloudFront and S3.
+ * You can specify multiple domains to be redirected.
+ */
+export class HttpsRedirect extends Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const domainNames = props.recordNames ?? [props.zone.zoneName];
+        if (props.certificate) {
+            const certificateRegion = Stack.of(this).splitArn(props.certificate.certificateArn, ArnFormat.SLASH_RESOURCE_NAME).region;
+            if (!Token.isUnresolved(certificateRegion) &&
+                certificateRegion !== "us-east-1") {
+                throw new Error(`The certificate must be in the us-east-1 region and the certificate you provided is in ${certificateRegion}.`);
+            }
+        }
+        const redirectCert = props.certificate ?? this.createCertificate(domainNames, props.zone);
+        const redirectBucket = new Bucket(this, "RedirectBucket", {
+            websiteRedirect: {
+                hostName: props.targetDomain,
+                protocol: RedirectProtocol.HTTPS,
+            },
+            removalPolicy: RemovalPolicy.DESTROY,
+            blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+        });
+        const redirectDist = new CloudFrontWebDistribution(this, "RedirectDistribution", {
+            defaultRootObject: "",
+            originConfigs: [
+                {
+                    behaviors: [{ isDefaultBehavior: true }],
+                    customOriginSource: {
+                        domainName: redirectBucket.bucketWebsiteDomainName,
+                        originProtocolPolicy: OriginProtocolPolicy.HTTP_ONLY,
+                    },
+                },
+            ],
+            viewerCertificate: ViewerCertificate.fromAcmCertificate(redirectCert, {
+                aliases: domainNames,
+            }),
+            comment: `Redirect to ${props.targetDomain} from ${domainNames.join(", ")}`,
+            priceClass: PriceClass.PRICE_CLASS_ALL,
+            viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        });
+        domainNames.forEach((domainName) => {
+            const hash = md5hash(domainName).slice(0, 6);
+            const aliasProps = {
+                recordName: domainName,
+                zone: props.zone,
+                target: RecordTarget.fromAlias(new CloudFrontTarget(redirectDist)),
+            };
+            new ARecord(this, `RedirectAliasRecord${hash}`, aliasProps);
+            new AaaaRecord(this, `RedirectAliasRecordSix${hash}`, aliasProps);
+        });
+    }
+    /**
+     * Creates a certificate.
+     *
+     * This is also safe to upgrade since the new certificate will be created and updated
+     * on the CloudFront distribution before the old one is deleted.
+     */
+    createCertificate(domainNames, zone) {
+        return new DnsValidatedCertificate(this, "RedirectCertificate", {
+            domainName: domainNames[0],
+            subjectAlternativeNames: domainNames,
+            hostedZone: zone,
+            region: "us-east-1",
+        });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sst",
-  "version": "2.0.0-rc.64",
+  "version": "2.0.0-rc.65",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -109,7 +109,7 @@
     "@types/ws": "^8.5.3",
     "@types/yargs": "^17.0.13",
     "tsx": "^3.12.1",
-    "vitest": "^0.15.1"
+    "vitest": "^0.28.3"
   },
   "peerDependencies": {
     "@sls-next/lambda-at-edge": "^3.7.0"

package/pothos.js

@@ -77,6 +77,7 @@ export async function extractSchema(opts) {
                                 if (!types.isMemberExpression(callPath.node.callee) ||
                                     !types.isIdentifier(callPath.node.callee.object) ||
                                     !types.isIdentifier(callPath.node.callee.property) ||
+                                    !schemaBuilder ||
                                     (callPath.node.callee.object.name !==
                                         schemaBuilder.node.id.name &&
                                         callPath.node.callee.property.name !== "implement")) {

package/sst.mjs

@@ -5556,7 +5556,7 @@ async function extractSchema(opts) {
                 }
               },
               CallExpression(callPath) {
-                if (!types.isMemberExpression(callPath.node.callee) || !types.isIdentifier(callPath.node.callee.object) || !types.isIdentifier(callPath.node.callee.property) || callPath.node.callee.object.name !== schemaBuilder.node.id.name && callPath.node.callee.property.name !== "implement") {
+                if (!types.isMemberExpression(callPath.node.callee) || !types.isIdentifier(callPath.node.callee.object) || !types.isIdentifier(callPath.node.callee.property) || !schemaBuilder || callPath.node.callee.object.name !== schemaBuilder.node.id.name && callPath.node.callee.property.name !== "implement") {
                   return;
                 }
                 callPath.traverse({
@@ -6357,6 +6357,7 @@ var dev = (program2) => program2.command(
           }
           deploy3(assembly);
         } catch (ex) {
+          isWorking = false;
           spinner.fail();
           Colors.line(
             ex.stack.split("\n").map((line) => "   " + line).join("\n")
@@ -7195,7 +7196,9 @@ consoleCommand(program);
 diff2(program);
 version(program);
 telemetry(program);
-process.setSourceMapsEnabled(true);
+if ("setSourceMapsEnabled" in process) {
+  process.setSourceMapsEnabled(true);
+}
 process.removeAllListeners("uncaughtException");
 process.on("uncaughtException", (err) => {
   Logger.debug(err);

package/support/base-site-archiver.mjs

@@ -16,7 +16,7 @@ See: https://github.com/isaacs/node-glob/issues/167`);if(!(this instanceof be))r
 `));var r=e.pax;if(r)for(var i in r)t+=To(" "+i+"="+r[i]+`
 `);return Buffer.from(t)};br.decodePax=function(e){for(var t={};e.length;){for(var r=0;r<e.length&&e[r]!==32;)r++;var i=parseInt(e.slice(0,r).toString(),10);if(!i)return t;var n=e.slice(r+1,i-1).toString(),s=n.indexOf("=");if(s===-1)return t;t[n.slice(0,s)]=n.slice(s+1),e=e.slice(i)}return t};br.encode=function(e){var t=cE(512),r=e.name,i="";if(e.typeflag===5&&r[r.length-1]!=="/"&&(r+="/"),Buffer.byteLength(r)!==r.length)return null;for(;Buffer.byteLength(r)>100;){var n=r.indexOf("/");if(n===-1)return null;i+=i?"/"+r.slice(0,n):r.slice(0,n),r=r.slice(n+1)}return Buffer.byteLength(r)>100||Buffer.byteLength(i)>155||e.linkname&&Buffer.byteLength(e.linkname)>100?null:(t.write(r),t.write(wt(e.mode&mE,6),100),t.write(wt(e.uid,6),108),t.write(wt(e.gid,6),116),t.write(wt(e.size,11),124),t.write(wt(e.mtime.getTime()/1e3|0,11),136),t[156]=kd+wE(e.type),e.linkname&&t.write(e.linkname,157),Bd.copy(t,fi),gE.copy(t,xo),e.uname&&t.write(e.uname,265),e.gname&&t.write(e.gname,297),t.write(wt(e.devmajor||0,6),329),t.write(wt(e.devminor||0,6),337),i&&t.write(i,345),t.write(wt(Gd(t),6),148),t)};br.decode=function(e,t,r){var i=e[156]===0?0:e[156]-kd,n=_r(e,0,100,t),s=St(e,100,8),o=St(e,108,8),u=St(e,116,8),l=St(e,124,12),d=St(e,136,12),p=bE(i),m=e[157]===0?null:_r(e,157,100,t),g=_r(e,265,32),y=_r(e,297,32),b=St(e,329,8),A=St(e,337,8),E=Gd(e);if(E===8*32)return null;if(E!==St(e,148,8))throw new Error("Invalid tar header. Maybe the tar is corrupted or it needs to be gunzipped?");if(Bd.compare(e,fi,fi+6)===0)e[345]&&(n=_r(e,345,155,t)+"/"+n);else if(!(yE.compare(e,fi,fi+6)===0&&vE.compare(e,xo,xo+2)===0)){if(!r)throw new Error("Invalid tar header: unknown format.")}return i===0&&n&&n[n.length-1]==="/"&&(i=5),{name:n,mode:s,uid:o,gid:u,size:l,mtime:new Date(1e3*d),type:p,linkname:m,uname:g,gname:y,devmajor:b,devminor:A}}});var Qd=L((gx,Vd)=>{var Wd=D("util"),EE=jd(),li=Ro(),Hd=We().Writable,$d=We().PassThrough,Zd=a(function(){},"noop"),zd=a(function(e){return e&=511,e&&512-e},"overflow"),OE=a(function(e,t){var r=new Gn(e,t);return r.end(),r},"emptyStream"),TE=a(function(e,t){return t.path&&(e.name=t.path),t.linkpath&&(e.linkname=t.linkpath),t.size&&(e.size=parseInt(t.size,10)),e.pax=t,e},"mixinPax"),Gn=a(function(e,t){this._parent=e,this.offset=t,$d.call(this,{autoDestroy:!1})},"Source");Wd.inherits(Gn,$d);Gn.prototype.destroy=function(e){this._parent.destroy(e)};var it=a(function(e){if(!(this instanceof it))return new it(e);Hd.call(this,e),e=e||{},this._offset=0,this._buffer=EE(),this._missing=0,this._partial=!1,this._onparse=Zd,this._header=null,this._stream=null,this._overflow=null,this._cb=null,this._locked=!1,this._destroyed=!1,this._pax=null,this._paxGlobal=null,this._gnuLongPath=null,this._gnuLongLinkPath=null;var t=this,r=t._buffer,i=a(function(){t._continue()},"oncontinue"),n=a(function(g){if(t._locked=!1,g)return t.destroy(g);t._stream||i()},"onunlock"),s=a(function(){t._stream=null;var g=zd(t._header.size);g?t._parse(g,o):t._parse(512,m),t._locked||i()},"onstreamend"),o=a(function(){t._buffer.consume(zd(t._header.size)),t._parse(512,m),i()},"ondrain"),u=a(function(){var g=t._header.size;t._paxGlobal=li.decodePax(r.slice(0,g)),r.consume(g),s()},"onpaxglobalheader"),l=a(function(){var g=t._header.size;t._pax=li.decodePax(r.slice(0,g)),t._paxGlobal&&(t._pax=Object.assign({},t._paxGlobal,t._pax)),r.consume(g),s()},"onpaxheader"),d=a(function(){var g=t._header.size;this._gnuLongPath=li.decodeLongPath(r.slice(0,g),e.filenameEncoding),r.consume(g),s()},"ongnulongpath"),p=a(function(){var g=t._header.size;this._gnuLongLinkPath=li.decodeLongPath(r.slice(0,g),e.filenameEncoding),r.consume(g),s()},"ongnulonglinkpath"),m=a(function(){var g=t._offset,y;try{y=t._header=li.decode(r.slice(0,512),e.filenameEncoding,e.allowUnknownFormat)}catch(b){t.emit("error",b)}if(r.consume(512),!y){t._parse(512,m),i();return}if(y.type==="gnu-long-path"){t._parse(y.size,d),i();return}if(y.type==="gnu-long-link-path"){t._parse(y.size,p),i();return}if(y.type==="pax-global-header"){t._parse(y.size,u),i();return}if(y.type==="pax-header"){t._parse(y.size,l),i();return}if(t._gnuLongPath&&(y.name=t._gnuLongPath,t._gnuLongPath=null),t._gnuLongLinkPath&&(y.linkname=t._gnuLongLinkPath,t._gnuLongLinkPath=null),t._pax&&(t._header=y=TE(y,t._pax),t._pax=null),t._locked=!0,!y.size||y.type==="directory"){t._parse(512,m),t.emit("entry",y,OE(t,g),n);return}t._stream=new Gn(t,g),t.emit("entry",y,t._stream,n),t._parse(y.size,s),i()},"onheader");this._onheader=m,this._parse(512,m)},"Extract");Wd.inherits(it,Hd);it.prototype.destroy=function(e){this._destroyed||(this._destroyed=!0,e&&this.emit("error",e),this.emit("close"),this._stream&&this._stream.emit("close"))};it.prototype._parse=function(e,t){this._destroyed||(this._offset+=e,this._missing=e,t===this._onheader&&(this._partial=!1),this._onparse=t)};it.prototype._continue=function(){if(!this._destroyed){var e=this._cb;this._cb=Zd,this._overflow?this._write(this._overflow,void 0,e):e()}};it.prototype._write=function(e,t,r){if(!this._destroyed){var i=this._stream,n=this._buffer,s=this._missing;if(e.length&&(this._partial=!0),e.length<s)return this._missing-=e.length,this._overflow=null,i?i.write(e,r):(n.append(e),r());this._cb=r,this._missing=0;var o=null;e.length>s&&(o=e.slice(s),e=e.slice(0,s)),i?i.end(e):n.append(e),this._overflow=o,this._onparse()}};it.prototype._final=function(e){if(this._partial)return this.destroy(new Error("Unexpected end of data"));e()};Vd.exports=it});var Kd=L((vx,Yd)=>{Yd.exports=D("fs").constants||D("constants")});var ep=L((mx,Jd)=>{var xE=Yr(),RE=a(function(){},"noop"),AE=a(function(e){return e.setHeader&&typeof e.abort=="function"},"isRequest"),IE=a(function(e){return e.stdio&&Array.isArray(e.stdio)&&e.stdio.length===3},"isChildProcess"),Xd=a(function(e,t,r){if(typeof t=="function")return Xd(e,null,t);t||(t={}),r=xE(r||RE);var i=e._writableState,n=e._readableState,s=t.readable||t.readable!==!1&&e.readable,o=t.writable||t.writable!==!1&&e.writable,u=!1,l=a(function(){e.writable||d()},"onlegacyfinish"),d=a(function(){o=!1,s||r.call(e)},"onfinish"),p=a(function(){s=!1,o||r.call(e)},"onend"),m=a(function(E){r.call(e,E?new Error("exited with error code: "+E):null)},"onexit"),g=a(function(E){r.call(e,E)},"onerror"),y=a(function(){process.nextTick(b)},"onclose"),b=a(function(){if(!u){if(s&&!(n&&n.ended&&!n.destroyed))return r.call(e,new Error("premature close"));if(o&&!(i&&i.ended&&!i.destroyed))return r.call(e,new Error("premature close"))}},"onclosenexttick"),A=a(function(){e.req.on("finish",d)},"onrequest");return AE(e)?(e.on("complete",d),e.on("abort",y),e.req?A():e.on("request",A)):o&&!i&&(e.on("end",l),e.on("close",l)),IE(e)&&e.on("exit",m),e.on("end",p),e.on("finish",d),t.error!==!1&&e.on("error",g),e.on("close",y),function(){u=!0,e.removeListener("complete",d),e.removeListener("abort",y),e.removeListener("request",A),e.req&&e.req.removeListener("finish",d),e.removeListener("end",l),e.removeListener("close",l),e.removeListener("finish",d),e.removeListener("exit",m),e.removeListener("end",p),e.removeListener("error",g),e.removeListener("close",y)}},"eos");Jd.exports=Xd});var ap=L((bx,np)=>{var wr=Kd(),tp=ep(),Wn=Me(),LE=Buffer.alloc,rp=We().Readable,Sr=We().Writable,ME=D("string_decoder").StringDecoder,zn=Ro(),DE=parseInt("755",8),CE=parseInt("644",8),ip=LE(1024),Io=a(function(){},"noop"),Ao=a(function(e,t){t&=511,t&&e.push(ip.slice(0,512-t))},"overflow");function PE(e){switch(e&wr.S_IFMT){case wr.S_IFBLK:return"block-device";case wr.S_IFCHR:return"character-device";case wr.S_IFDIR:return"directory";case wr.S_IFIFO:return"fifo";case wr.S_IFLNK:return"symlink"}return"file"}a(PE,"modeToType");var Hn=a(function(e){Sr.call(this),this.written=0,this._to=e,this._destroyed=!1},"Sink");Wn(Hn,Sr);Hn.prototype._write=function(e,t,r){if(this.written+=e.length,this._to.push(e))return r();this._to._drain=r};Hn.prototype.destroy=function(){this._destroyed||(this._destroyed=!0,this.emit("close"))};var $n=a(function(){Sr.call(this),this.linkname="",this._decoder=new ME("utf-8"),this._destroyed=!1},"LinkSink");Wn($n,Sr);$n.prototype._write=function(e,t,r){this.linkname+=this._decoder.write(e),r()};$n.prototype.destroy=function(){this._destroyed||(this._destroyed=!0,this.emit("close"))};var hi=a(function(){Sr.call(this),this._destroyed=!1},"Void");Wn(hi,Sr);hi.prototype._write=function(e,t,r){r(new Error("No body allowed for this entry"))};hi.prototype.destroy=function(){this._destroyed||(this._destroyed=!0,this.emit("close"))};var Ye=a(function(e){if(!(this instanceof Ye))return new Ye(e);rp.call(this,e),this._drain=Io,this._finalized=!1,this._finalizing=!1,this._destroyed=!1,this._stream=null},"Pack");Wn(Ye,rp);Ye.prototype.entry=function(e,t,r){if(this._stream)throw new Error("already piping an entry");if(!(this._finalized||this._destroyed)){typeof t=="function"&&(r=t,t=null),r||(r=Io);var i=this;if((!e.size||e.type==="symlink")&&(e.size=0),e.type||(e.type=PE(e.mode)),e.mode||(e.mode=e.type==="directory"?DE:CE),e.uid||(e.uid=0),e.gid||(e.gid=0),e.mtime||(e.mtime=new Date),typeof t=="string"&&(t=Buffer.from(t)),Buffer.isBuffer(t)){e.size=t.length,this._encode(e);var n=this.push(t);return Ao(i,e.size),n?process.nextTick(r):this._drain=r,new hi}if(e.type==="symlink"&&!e.linkname){var s=new $n;return tp(s,function(u){if(u)return i.destroy(),r(u);e.linkname=s.linkname,i._encode(e),r()}),s}if(this._encode(e),e.type!=="file"&&e.type!=="contiguous-file")return process.nextTick(r),new hi;var o=new Hn(this);return this._stream=o,tp(o,function(u){if(i._stream=null,u)return i.destroy(),r(u);if(o.written!==e.size)return i.destroy(),r(new Error("size mismatch"));Ao(i,e.size),i._finalizing&&i.finalize(),r()}),o}};Ye.prototype.finalize=function(){if(this._stream){this._finalizing=!0;return}this._finalized||(this._finalized=!0,this.push(ip),this.push(null))};Ye.prototype.destroy=function(e){this._destroyed||(this._destroyed=!0,e&&this.emit("error",e),this.emit("close"),this._stream&&this._stream.destroy&&this._stream.destroy())};Ye.prototype._encode=function(e){if(!e.pax){var t=zn.encode(e);if(t){this.push(t);return}}this._encodePax(e)};Ye.prototype._encodePax=function(e){var t=zn.encodePax({name:e.name,linkname:e.linkname,pax:e.pax}),r={name:"PaxHeader",mode:e.mode,uid:e.uid,gid:e.gid,size:t.length,mtime:e.mtime,type:"pax-header",linkname:e.linkname&&"PaxHeader",uname:e.uname,gname:e.gname,devmajor:e.devmajor,devminor:e.devminor};this.push(zn.encode(r)),this.push(t),Ao(this,t.length),r.size=e.size,r.type=e.type,this.push(zn.encode(r))};Ye.prototype._read=function(e){var t=this._drain;this._drain=Io,t()};np.exports=Ye});var sp=L(Lo=>{Lo.extract=Qd();Lo.pack=ap()});var fp=L((Ex,up)=>{var NE=D("zlib"),qE=sp(),op=dr(),nt=a(function(e){if(!(this instanceof nt))return new nt(e);e=this.options=op.defaults(e,{gzip:!1}),typeof e.gzipOptions!="object"&&(e.gzipOptions={}),this.supports={directory:!0,symlink:!0},this.engine=qE.pack(e),this.compressor=!1,e.gzip&&(this.compressor=NE.createGzip(e.gzipOptions),this.compressor.on("error",this._onCompressorError.bind(this)))},"Tar");nt.prototype._onCompressorError=function(e){this.engine.emit("error",e)};nt.prototype.append=function(e,t,r){var i=this;t.mtime=t.date;function n(o,u){if(o){r(o);return}i.engine.entry(t,u,function(l){r(l,t)})}if(a(n,"append"),t.sourceType==="buffer")n(null,e);else if(t.sourceType==="stream"&&t.stats){t.size=t.stats.size;var s=i.engine.entry(t,function(o){r(o,t)});e.pipe(s)}else t.sourceType==="stream"&&op.collectStream(e,n)};nt.prototype.finalize=function(){this.engine.finalize()};nt.prototype.on=function(){return this.engine.on.apply(this.engine,arguments)};nt.prototype.pipe=function(e,t){return this.compressor?this.engine.pipe.apply(this.engine,[this.compressor]).pipe(e,t):this.engine.pipe.apply(this.engine,arguments)};nt.prototype.unpipe=function(){return this.compressor?this.compressor.unpipe.apply(this.compressor,arguments):this.engine.unpipe.apply(this.engine,arguments)};up.exports=nt});var dp=L((Tx,cp)=>{var FE=D("util").inherits,lp=We().Transform,jE=vo(),hp=dr(),Et=a(function(e){if(!(this instanceof Et))return new Et(e);e=this.options=hp.defaults(e,{}),lp.call(this,e),this.supports={directory:!0,symlink:!0},this.files=[]},"Json");FE(Et,lp);Et.prototype._transform=function(e,t,r){r(null,e)};Et.prototype._writeStringified=function(){var e=JSON.stringify(this.files);this.write(e)};Et.prototype.append=function(e,t,r){var i=this;t.crc32=0;function n(s,o){if(s){r(s);return}t.size=o.length||0,t.crc32=jE.unsigned(o),i.files.push(t),r(null,t)}a(n,"onend"),t.sourceType==="buffer"?n(null,e):t.sourceType==="stream"&&hp.collectStream(e,n)};Et.prototype.finalize=function(){this._writeStringified(),this.end()};cp.exports=Et});var gp=L((Rx,pp)=>{var kE=Jc(),ci={},Ot=a(function(e,t){return Ot.create(e,t)},"vending");Ot.create=function(e,t){if(ci[e]){var r=new kE(e,t);return r.setFormat(e),r.setModule(new ci[e](t)),r}else throw new Error("create("+e+"): format not registered")};Ot.registerFormat=function(e,t){if(ci[e])throw new Error("register("+e+"): format already registered");if(typeof t!="function")throw new Error("register("+e+"): format module invalid");if(typeof t.prototype.append!="function"||typeof t.prototype.finalize!="function")throw new Error("register("+e+"): format module missing methods");ci[e]=t};Ot.isRegisteredFormat=function(e){return!!ci[e]};Ot.registerFormat("zip",Pd());Ot.registerFormat("tar",fp());Ot.registerFormat("json",dp());pp.exports=Ot});var Do=L(Tt=>{Tt.setopts=HE;Tt.ownProp=yp;Tt.makeAbs=di;Tt.finish=$E;Tt.mark=ZE;Tt.isIgnored=mp;Tt.childrenIgnored=VE;function yp(e,t){return Object.prototype.hasOwnProperty.call(e,t)}a(yp,"ownProp");var BE=D("fs"),Wt=D("path"),UE=Mr(),vp=D("path").isAbsolute,Mo=UE.Minimatch;function GE(e,t){return e.localeCompare(t,"en")}a(GE,"alphasort");function zE(e,t){e.ignore=t.ignore||[],Array.isArray(e.ignore)||(e.ignore=[e.ignore]),e.ignore.length&&(e.ignore=e.ignore.map(WE))}a(zE,"setupIgnores");function WE(e){var t=null;if(e.slice(-3)==="/**"){var r=e.replace(/(\/\*\*)+$/,"");t=new Mo(r,{dot:!0})}return{matcher:new Mo(e,{dot:!0}),gmatcher:t}}a(WE,"ignoreMap");function HE(e,t,r){if(r||(r={}),r.matchBase&&t.indexOf("/")===-1){if(r.noglobstar)throw new Error("base matching requires globstar");t="**/"+t}e.silent=!!r.silent,e.pattern=t,e.strict=r.strict!==!1,e.realpath=!!r.realpath,e.realpathCache=r.realpathCache||Object.create(null),e.follow=!!r.follow,e.dot=!!r.dot,e.mark=!!r.mark,e.nodir=!!r.nodir,e.nodir&&(e.mark=!0),e.sync=!!r.sync,e.nounique=!!r.nounique,e.nonull=!!r.nonull,e.nosort=!!r.nosort,e.nocase=!!r.nocase,e.stat=!!r.stat,e.noprocess=!!r.noprocess,e.absolute=!!r.absolute,e.fs=r.fs||BE,e.maxLength=r.maxLength||1/0,e.cache=r.cache||Object.create(null),e.statCache=r.statCache||Object.create(null),e.symlinks=r.symlinks||Object.create(null),zE(e,r),e.changedCwd=!1;var i=process.cwd();yp(r,"cwd")?(e.cwd=Wt.resolve(r.cwd),e.changedCwd=e.cwd!==i):e.cwd=Wt.resolve(i),e.root=r.root||Wt.resolve(e.cwd,"/"),e.root=Wt.resolve(e.root),e.cwdAbs=vp(e.cwd)?e.cwd:di(e,e.cwd),e.nomount=!!r.nomount,process.platform==="win32"&&(e.root=e.root.replace(/\\/g,"/"),e.cwd=e.cwd.replace(/\\/g,"/"),e.cwdAbs=e.cwdAbs.replace(/\\/g,"/")),r.nonegate=!0,r.nocomment=!0,r.allowWindowsEscape=!0,e.minimatch=new Mo(t,r),e.options=e.minimatch.options}a(HE,"setopts");function $E(e){for(var t=e.nounique,r=t?[]:Object.create(null),i=0,n=e.matches.length;i<n;i++){var s=e.matches[i];if(!s||Object.keys(s).length===0){if(e.nonull){var o=e.minimatch.globSet[i];t?r.push(o):r[o]=!0}}else{var u=Object.keys(s);t?r.push.apply(r,u):u.forEach(function(l){r[l]=!0})}}if(t||(r=Object.keys(r)),e.nosort||(r=r.sort(GE)),e.mark){for(var i=0;i<r.length;i++)r[i]=e._mark(r[i]);e.nodir&&(r=r.filter(function(l){var d=!/\/$/.test(l),p=e.cache[l]||e.cache[di(e,l)];return d&&p&&(d=p!=="DIR"&&!Array.isArray(p)),d}))}e.ignore.length&&(r=r.filter(function(l){return!mp(e,l)})),e.found=r}a($E,"finish");function ZE(e,t){var r=di(e,t),i=e.cache[r],n=t;if(i){var s=i==="DIR"||Array.isArray(i),o=t.slice(-1)==="/";if(s&&!o?n+="/":!s&&o&&(n=n.slice(0,-1)),n!==t){var u=di(e,n);e.statCache[u]=e.statCache[r],e.cache[u]=e.cache[r]}}return n}a(ZE,"mark");function di(e,t){var r=t;return t.charAt(0)==="/"?r=Wt.join(e.root,t):vp(t)||t===""?r=t:e.changedCwd?r=Wt.resolve(e.cwd,t):r=Wt.resolve(t),process.platform==="win32"&&(r=r.replace(/\\/g,"/")),r}a(di,"makeAbs");function mp(e,t){return e.ignore.length?e.ignore.some(function(r){return r.matcher.match(t)||!!(r.gmatcher&&r.gmatcher.match(t))}):!1}a(mp,"isIgnored");function VE(e,t){return e.ignore.length?e.ignore.some(function(r){return!!(r.gmatcher&&r.gmatcher.match(t))}):!1}a(VE,"childrenIgnored")});var Ep=L((Px,Sp)=>{Sp.exports=wp;wp.GlobSync=we;var QE=Zr(),_p=Mr(),Mx=_p.Minimatch,Dx=No().Glob,Cx=D("util"),Co=D("path"),bp=D("assert"),Zn=D("path").isAbsolute,Ht=Do(),YE=Ht.setopts,Po=Ht.ownProp,KE=Ht.childrenIgnored,XE=Ht.isIgnored;function wp(e,t){if(typeof t=="function"||arguments.length===3)throw new TypeError(`callback provided to sync glob
 See: https://github.com/isaacs/node-glob/issues/167`);return new we(e,t).found}a(wp,"globSync");function we(e,t){if(!e)throw new Error("must provide pattern");if(typeof t=="function"||arguments.length===3)throw new TypeError(`callback provided to sync glob
-See: https://github.com/isaacs/node-glob/issues/167`);if(!(this instanceof we))return new we(e,t);if(YE(this,e,t),this.noprocess)return this;var r=this.minimatch.set.length;this.matches=new Array(r);for(var i=0;i<r;i++)this._process(this.minimatch.set[i],i,!1);this._finish()}a(we,"GlobSync");we.prototype._finish=function(){if(bp.ok(this instanceof we),this.realpath){var e=this;this.matches.forEach(function(t,r){var i=e.matches[r]=Object.create(null);for(var n in t)try{n=e._makeAbs(n);var s=QE.realpathSync(n,e.realpathCache);i[s]=!0}catch(o){if(o.syscall==="stat")i[e._makeAbs(n)]=!0;else throw o}})}Ht.finish(this)};we.prototype._process=function(e,t,r){bp.ok(this instanceof we);for(var i=0;typeof e[i]=="string";)i++;var n;switch(i){case e.length:this._processSimple(e.join("/"),t);return;case 0:n=null;break;default:n=e.slice(0,i).join("/");break}var s=e.slice(i),o;n===null?o=".":((Zn(n)||Zn(e.map(function(d){return typeof d=="string"?d:"[*]"}).join("/")))&&(!n||!Zn(n))&&(n="/"+n),o=n);var u=this._makeAbs(o);if(!KE(this,o)){var l=s[0]===_p.GLOBSTAR;l?this._processGlobStar(n,o,u,s,t,r):this._processReaddir(n,o,u,s,t,r)}};we.prototype._processReaddir=function(e,t,r,i,n,s){var o=this._readdir(r,s);if(o){for(var u=i[0],l=!!this.minimatch.negate,d=u._glob,p=this.dot||d.charAt(0)===".",m=[],g=0;g<o.length;g++){var y=o[g];if(y.charAt(0)!=="."||p){var b;l&&!e?b=!y.match(u):b=y.match(u),b&&m.push(y)}}var A=m.length;if(A!==0){if(i.length===1&&!this.mark&&!this.stat){this.matches[n]||(this.matches[n]=Object.create(null));for(var g=0;g<A;g++){var y=m[g];e&&(e.slice(-1)!=="/"?y=e+"/"+y:y=e+y),y.charAt(0)==="/"&&!this.nomount&&(y=Co.join(this.root,y)),this._emitMatch(n,y)}return}i.shift();for(var g=0;g<A;g++){var y=m[g],E;e?E=[e,y]:E=[y],this._process(E.concat(i),n,s)}}}};we.prototype._emitMatch=function(e,t){if(!XE(this,t)){var r=this._makeAbs(t);if(this.mark&&(t=this._mark(t)),this.absolute&&(t=r),!this.matches[e][t]){if(this.nodir){var i=this.cache[r];if(i==="DIR"||Array.isArray(i))return}this.matches[e][t]=!0,this.stat&&this._stat(t)}}};we.prototype._readdirInGlobStar=function(e){if(this.follow)return this._readdir(e,!1);var t,r,i;try{r=this.fs.lstatSync(e)}catch(s){if(s.code==="ENOENT")return null}var n=r&&r.isSymbolicLink();return this.symlinks[e]=n,!n&&r&&!r.isDirectory()?this.cache[e]="FILE":t=this._readdir(e,!1),t};we.prototype._readdir=function(e,t){var r;if(t&&!Po(this.symlinks,e))return this._readdirInGlobStar(e);if(Po(this.cache,e)){var i=this.cache[e];if(!i||i==="FILE")return null;if(Array.isArray(i))return i}try{return this._readdirEntries(e,this.fs.readdirSync(e))}catch(n){return this._readdirError(e,n),null}};we.prototype._readdirEntries=function(e,t){if(!this.mark&&!this.stat)for(var r=0;r<t.length;r++){var i=t[r];e==="/"?i=e+i:i=e+"/"+i,this.cache[i]=!0}return this.cache[e]=t,t};we.prototype._readdirError=function(e,t){switch(t.code){case"ENOTSUP":case"ENOTDIR":var r=this._makeAbs(e);if(this.cache[r]="FILE",r===this.cwdAbs){var i=new Error(t.code+" invalid cwd "+this.cwd);throw i.path=this.cwd,i.code=t.code,i}break;case"ENOENT":case"ELOOP":case"ENAMETOOLONG":case"UNKNOWN":this.cache[this._makeAbs(e)]=!1;break;default:if(this.cache[this._makeAbs(e)]=!1,this.strict)throw t;this.silent||console.error("glob error",t);break}};we.prototype._processGlobStar=function(e,t,r,i,n,s){var o=this._readdir(r,s);if(o){var u=i.slice(1),l=e?[e]:[],d=l.concat(u);this._process(d,n,!1);var p=o.length,m=this.symlinks[r];if(!(m&&s))for(var g=0;g<p;g++){var y=o[g];if(!(y.charAt(0)==="."&&!this.dot)){var b=l.concat(o[g],u);this._process(b,n,!0);var A=l.concat(o[g],i);this._process(A,n,!0)}}}};we.prototype._processSimple=function(e,t){var r=this._stat(e);if(this.matches[t]||(this.matches[t]=Object.create(null)),!!r){if(e&&Zn(e)&&!this.nomount){var i=/[\/\\]$/.test(e);e.charAt(0)==="/"?e=Co.join(this.root,e):(e=Co.resolve(this.root,e),i&&(e+="/"))}process.platform==="win32"&&(e=e.replace(/\\/g,"/")),this._emitMatch(t,e)}};we.prototype._stat=function(e){var t=this._makeAbs(e),r=e.slice(-1)==="/";if(e.length>this.maxLength)return!1;if(!this.stat&&Po(this.cache,t)){var o=this.cache[t];if(Array.isArray(o)&&(o="DIR"),!r||o==="DIR")return o;if(r&&o==="FILE")return!1}var i,n=this.statCache[t];if(!n){var s;try{s=this.fs.lstatSync(t)}catch(u){if(u&&(u.code==="ENOENT"||u.code==="ENOTDIR"))return this.statCache[t]=!1,!1}if(s&&s.isSymbolicLink())try{n=this.fs.statSync(t)}catch{n=s}else n=s}this.statCache[t]=n;var o=!0;return n&&(o=n.isDirectory()?"DIR":"FILE"),this.cache[t]=this.cache[t]||o,r&&o==="FILE"?!1:o};we.prototype._mark=function(e){return Ht.mark(this,e)};we.prototype._makeAbs=function(e){return Ht.makeAbs(this,e)}});var No=L((jx,Tp)=>{Tp.exports=$t;var JE=Zr(),Op=Mr(),qx=Op.Minimatch,e1=Me(),t1=D("events").EventEmitter,qo=D("path"),Fo=D("assert"),pi=D("path").isAbsolute,ko=Ep(),Zt=Do(),r1=Zt.setopts,jo=Zt.ownProp,Bo=Ss(),Fx=D("util"),i1=Zt.childrenIgnored,n1=Zt.isIgnored,a1=Yr();function $t(e,t,r){if(typeof t=="function"&&(r=t,t={}),t||(t={}),t.sync){if(r)throw new TypeError("callback provided to sync glob");return ko(e,t)}return new le(e,t,r)}a($t,"glob");$t.sync=ko;var s1=$t.GlobSync=ko.GlobSync;$t.glob=$t;function o1(e,t){if(t===null||typeof t!="object")return e;for(var r=Object.keys(t),i=r.length;i--;)e[r[i]]=t[r[i]];return e}a(o1,"extend");$t.hasMagic=function(e,t){var r=o1({},t);r.noprocess=!0;var i=new le(e,r),n=i.minimatch.set;if(!e)return!1;if(n.length>1)return!0;for(var s=0;s<n[0].length;s++)if(typeof n[0][s]!="string")return!0;return!1};$t.Glob=le;e1(le,t1);function le(e,t,r){if(typeof t=="function"&&(r=t,t=null),t&&t.sync){if(r)throw new TypeError("callback provided to sync glob");return new s1(e,t)}if(!(this instanceof le))return new le(e,t,r);r1(this,e,t),this._didRealPath=!1;var i=this.minimatch.set.length;this.matches=new Array(i),typeof r=="function"&&(r=a1(r),this.on("error",r),this.on("end",function(l){r(null,l)}));var n=this;if(this._processing=0,this._emitQueue=[],this._processQueue=[],this.paused=!1,this.noprocess)return this;if(i===0)return u();for(var s=!0,o=0;o<i;o++)this._process(this.minimatch.set[o],o,!1,u);s=!1;function u(){--n._processing,n._processing<=0&&(s?process.nextTick(function(){n._finish()}):n._finish())}a(u,"done")}a(le,"Glob");le.prototype._finish=function(){if(Fo(this instanceof le),!this.aborted){if(this.realpath&&!this._didRealpath)return this._realpath();Zt.finish(this),this.emit("end",this.found)}};le.prototype._realpath=function(){if(this._didRealpath)return;this._didRealpath=!0;var e=this.matches.length;if(e===0)return this._finish();for(var t=this,r=0;r<this.matches.length;r++)this._realpathSet(r,i);function i(){--e===0&&t._finish()}a(i,"next")};le.prototype._realpathSet=function(e,t){var r=this.matches[e];if(!r)return t();var i=Object.keys(r),n=this,s=i.length;if(s===0)return t();var o=this.matches[e]=Object.create(null);i.forEach(function(u,l){u=n._makeAbs(u),JE.realpath(u,n.realpathCache,function(d,p){d?d.syscall==="stat"?o[u]=!0:n.emit("error",d):o[p]=!0,--s===0&&(n.matches[e]=o,t())})})};le.prototype._mark=function(e){return Zt.mark(this,e)};le.prototype._makeAbs=function(e){return Zt.makeAbs(this,e)};le.prototype.abort=function(){this.aborted=!0,this.emit("abort")};le.prototype.pause=function(){this.paused||(this.paused=!0,this.emit("pause"))};le.prototype.resume=function(){if(this.paused){if(this.emit("resume"),this.paused=!1,this._emitQueue.length){var e=this._emitQueue.slice(0);this._emitQueue.length=0;for(var t=0;t<e.length;t++){var r=e[t];this._emitMatch(r[0],r[1])}}if(this._processQueue.length){var i=this._processQueue.slice(0);this._processQueue.length=0;for(var t=0;t<i.length;t++){var n=i[t];this._processing--,this._process(n[0],n[1],n[2],n[3])}}}};le.prototype._process=function(e,t,r,i){if(Fo(this instanceof le),Fo(typeof i=="function"),!this.aborted){if(this._processing++,this.paused){this._processQueue.push([e,t,r,i]);return}for(var n=0;typeof e[n]=="string";)n++;var s;switch(n){case e.length:this._processSimple(e.join("/"),t,i);return;case 0:s=null;break;default:s=e.slice(0,n).join("/");break}var o=e.slice(n),u;s===null?u=".":((pi(s)||pi(e.map(function(p){return typeof p=="string"?p:"[*]"}).join("/")))&&(!s||!pi(s))&&(s="/"+s),u=s);var l=this._makeAbs(u);if(i1(this,u))return i();var d=o[0]===Op.GLOBSTAR;d?this._processGlobStar(s,u,l,o,t,r,i):this._processReaddir(s,u,l,o,t,r,i)}};le.prototype._processReaddir=function(e,t,r,i,n,s,o){var u=this;this._readdir(r,s,function(l,d){return u._processReaddir2(e,t,r,i,n,s,d,o)})};le.prototype._processReaddir2=function(e,t,r,i,n,s,o,u){if(!o)return u();for(var l=i[0],d=!!this.minimatch.negate,p=l._glob,m=this.dot||p.charAt(0)===".",g=[],y=0;y<o.length;y++){var b=o[y];if(b.charAt(0)!=="."||m){var A;d&&!e?A=!b.match(l):A=b.match(l),A&&g.push(b)}}var E=g.length;if(E===0)return u();if(i.length===1&&!this.mark&&!this.stat){this.matches[n]||(this.matches[n]=Object.create(null));for(var y=0;y<E;y++){var b=g[y];e&&(e!=="/"?b=e+"/"+b:b=e+b),b.charAt(0)==="/"&&!this.nomount&&(b=qo.join(this.root,b)),this._emitMatch(n,b)}return u()}i.shift();for(var y=0;y<E;y++){var b=g[y],x;e&&(e!=="/"?b=e+"/"+b:b=e+b),this._process([b].concat(i),n,s,u)}u()};le.prototype._emitMatch=function(e,t){if(!this.aborted&&!n1(this,t)){if(this.paused){this._emitQueue.push([e,t]);return}var r=pi(t)?t:this._makeAbs(t);if(this.mark&&(t=this._mark(t)),this.absolute&&(t=r),!this.matches[e][t]){if(this.nodir){var i=this.cache[r];if(i==="DIR"||Array.isArray(i))return}this.matches[e][t]=!0;var n=this.statCache[r];n&&this.emit("stat",t,n),this.emit("match",t)}}};le.prototype._readdirInGlobStar=function(e,t){if(this.aborted)return;if(this.follow)return this._readdir(e,!1,t);var r="lstat\0"+e,i=this,n=Bo(r,s);n&&i.fs.lstat(e,n);function s(o,u){if(o&&o.code==="ENOENT")return t();var l=u&&u.isSymbolicLink();i.symlinks[e]=l,!l&&u&&!u.isDirectory()?(i.cache[e]="FILE",t()):i._readdir(e,!1,t)}a(s,"lstatcb_")};le.prototype._readdir=function(e,t,r){if(!this.aborted&&(r=Bo("readdir\0"+e+"\0"+t,r),!!r)){if(t&&!jo(this.symlinks,e))return this._readdirInGlobStar(e,r);if(jo(this.cache,e)){var i=this.cache[e];if(!i||i==="FILE")return r();if(Array.isArray(i))return r(null,i)}var n=this;n.fs.readdir(e,u1(this,e,r))}};function u1(e,t,r){return function(i,n){i?e._readdirError(t,i,r):e._readdirEntries(t,n,r)}}a(u1,"readdirCb");le.prototype._readdirEntries=function(e,t,r){if(!this.aborted){if(!this.mark&&!this.stat)for(var i=0;i<t.length;i++){var n=t[i];e==="/"?n=e+n:n=e+"/"+n,this.cache[n]=!0}return this.cache[e]=t,r(null,t)}};le.prototype._readdirError=function(e,t,r){if(!this.aborted){switch(t.code){case"ENOTSUP":case"ENOTDIR":var i=this._makeAbs(e);if(this.cache[i]="FILE",i===this.cwdAbs){var n=new Error(t.code+" invalid cwd "+this.cwd);n.path=this.cwd,n.code=t.code,this.emit("error",n),this.abort()}break;case"ENOENT":case"ELOOP":case"ENAMETOOLONG":case"UNKNOWN":this.cache[this._makeAbs(e)]=!1;break;default:this.cache[this._makeAbs(e)]=!1,this.strict&&(this.emit("error",t),this.abort()),this.silent||console.error("glob error",t);break}return r()}};le.prototype._processGlobStar=function(e,t,r,i,n,s,o){var u=this;this._readdir(r,s,function(l,d){u._processGlobStar2(e,t,r,i,n,s,d,o)})};le.prototype._processGlobStar2=function(e,t,r,i,n,s,o,u){if(!o)return u();var l=i.slice(1),d=e?[e]:[],p=d.concat(l);this._process(p,n,!1,u);var m=this.symlinks[r],g=o.length;if(m&&s)return u();for(var y=0;y<g;y++){var b=o[y];if(!(b.charAt(0)==="."&&!this.dot)){var A=d.concat(o[y],l);this._process(A,n,!0,u);var E=d.concat(o[y],i);this._process(E,n,!0,u)}}u()};le.prototype._processSimple=function(e,t,r){var i=this;this._stat(e,function(n,s){i._processSimple2(e,t,n,s,r)})};le.prototype._processSimple2=function(e,t,r,i,n){if(this.matches[t]||(this.matches[t]=Object.create(null)),!i)return n();if(e&&pi(e)&&!this.nomount){var s=/[\/\\]$/.test(e);e.charAt(0)==="/"?e=qo.join(this.root,e):(e=qo.resolve(this.root,e),s&&(e+="/"))}process.platform==="win32"&&(e=e.replace(/\\/g,"/")),this._emitMatch(t,e),n()};le.prototype._stat=function(e,t){var r=this._makeAbs(e),i=e.slice(-1)==="/";if(e.length>this.maxLength)return t();if(!this.stat&&jo(this.cache,r)){var n=this.cache[r];if(Array.isArray(n)&&(n="DIR"),!i||n==="DIR")return t(null,n);if(i&&n==="FILE")return t()}var s,o=this.statCache[r];if(o!==void 0){if(o===!1)return t(null,o);var u=o.isDirectory()?"DIR":"FILE";return i&&u==="FILE"?t():t(null,u,o)}var l=this,d=Bo("stat\0"+r,p);d&&l.fs.lstat(r,d);function p(m,g){if(g&&g.isSymbolicLink())return l.fs.stat(r,function(y,b){y?l._stat2(e,r,null,g,t):l._stat2(e,r,y,b,t)});l._stat2(e,r,m,g,t)}a(p,"lstatcb_")};le.prototype._stat2=function(e,t,r,i,n){if(r&&(r.code==="ENOENT"||r.code==="ENOTDIR"))return this.statCache[t]=!1,n();var s=e.slice(-1)==="/";if(this.statCache[t]=i,t.slice(-1)==="/"&&i&&!i.isDirectory())return n(null,!1,i);var o=!0;return i&&(o=i.isDirectory()?"DIR":"FILE"),this.cache[t]=this.cache[t]||o,s&&o==="FILE"?n():n(null,o,i)}});var p1=L(()=>{process.on("unhandledRejection",e=>{throw e});var Vn=D("path"),Qn=D("fs/promises"),f1=D("fs"),l1=gp(),h1=No(),Uo=process.argv.slice(2),Ip=Uo[0],xp=Uo[1],Lp=Uo[2],Rp=Lp*1024*1024,c1={dot:!0,nodir:!0,follow:!0,cwd:Ip},Ap=h1.sync("**",c1);d1().catch(()=>{process.exit(1)});function d1(){return new Promise(async(e,t)=>{let r,i,n,s=[];async function o(){let l=s.length,d=Vn.join(xp,`part${l}.zip`);await Qn.mkdir(Vn.dirname(d),{recursive:!0}),r=f1.createWriteStream(d),i=l1("zip"),n=0,s.push({output:r,archive:i,isOutputClosed:!1}),i.on("warning",t),i.on("error",t),r.once("close",()=>{s[l].isOutputClosed=!0,s.every(({isOutputClosed:p})=>p)&&e()}),i.pipe(r)}a(o,"openZip"),await o();for(let l of Ap){let d=Vn.join(Ip,l),[p,m]=await Promise.all([Qn.readFile(d),Qn.stat(d)]),g=m.size;if(g>Rp)throw new Error(`Cannot package file "${d}". The file is larger than ${Lp}MB.`);n+g>Rp&&(await i.finalize(),o()),i.append(p,{name:l,date:new Date("1980-01-01T00:00:00.000Z"),mode:m.mode}),n+=g}await i.finalize();let u=Vn.join(xp,"filenames");await Qn.writeFile(u,Ap.join(`
+See: https://github.com/isaacs/node-glob/issues/167`);if(!(this instanceof we))return new we(e,t);if(YE(this,e,t),this.noprocess)return this;var r=this.minimatch.set.length;this.matches=new Array(r);for(var i=0;i<r;i++)this._process(this.minimatch.set[i],i,!1);this._finish()}a(we,"GlobSync");we.prototype._finish=function(){if(bp.ok(this instanceof we),this.realpath){var e=this;this.matches.forEach(function(t,r){var i=e.matches[r]=Object.create(null);for(var n in t)try{n=e._makeAbs(n);var s=QE.realpathSync(n,e.realpathCache);i[s]=!0}catch(o){if(o.syscall==="stat")i[e._makeAbs(n)]=!0;else throw o}})}Ht.finish(this)};we.prototype._process=function(e,t,r){bp.ok(this instanceof we);for(var i=0;typeof e[i]=="string";)i++;var n;switch(i){case e.length:this._processSimple(e.join("/"),t);return;case 0:n=null;break;default:n=e.slice(0,i).join("/");break}var s=e.slice(i),o;n===null?o=".":((Zn(n)||Zn(e.map(function(d){return typeof d=="string"?d:"[*]"}).join("/")))&&(!n||!Zn(n))&&(n="/"+n),o=n);var u=this._makeAbs(o);if(!KE(this,o)){var l=s[0]===_p.GLOBSTAR;l?this._processGlobStar(n,o,u,s,t,r):this._processReaddir(n,o,u,s,t,r)}};we.prototype._processReaddir=function(e,t,r,i,n,s){var o=this._readdir(r,s);if(o){for(var u=i[0],l=!!this.minimatch.negate,d=u._glob,p=this.dot||d.charAt(0)===".",m=[],g=0;g<o.length;g++){var y=o[g];if(y.charAt(0)!=="."||p){var b;l&&!e?b=!y.match(u):b=y.match(u),b&&m.push(y)}}var A=m.length;if(A!==0){if(i.length===1&&!this.mark&&!this.stat){this.matches[n]||(this.matches[n]=Object.create(null));for(var g=0;g<A;g++){var y=m[g];e&&(e.slice(-1)!=="/"?y=e+"/"+y:y=e+y),y.charAt(0)==="/"&&!this.nomount&&(y=Co.join(this.root,y)),this._emitMatch(n,y)}return}i.shift();for(var g=0;g<A;g++){var y=m[g],E;e?E=[e,y]:E=[y],this._process(E.concat(i),n,s)}}}};we.prototype._emitMatch=function(e,t){if(!XE(this,t)){var r=this._makeAbs(t);if(this.mark&&(t=this._mark(t)),this.absolute&&(t=r),!this.matches[e][t]){if(this.nodir){var i=this.cache[r];if(i==="DIR"||Array.isArray(i))return}this.matches[e][t]=!0,this.stat&&this._stat(t)}}};we.prototype._readdirInGlobStar=function(e){if(this.follow)return this._readdir(e,!1);var t,r,i;try{r=this.fs.lstatSync(e)}catch(s){if(s.code==="ENOENT")return null}var n=r&&r.isSymbolicLink();return this.symlinks[e]=n,!n&&r&&!r.isDirectory()?this.cache[e]="FILE":t=this._readdir(e,!1),t};we.prototype._readdir=function(e,t){var r;if(t&&!Po(this.symlinks,e))return this._readdirInGlobStar(e);if(Po(this.cache,e)){var i=this.cache[e];if(!i||i==="FILE")return null;if(Array.isArray(i))return i}try{return this._readdirEntries(e,this.fs.readdirSync(e))}catch(n){return this._readdirError(e,n),null}};we.prototype._readdirEntries=function(e,t){if(!this.mark&&!this.stat)for(var r=0;r<t.length;r++){var i=t[r];e==="/"?i=e+i:i=e+"/"+i,this.cache[i]=!0}return this.cache[e]=t,t};we.prototype._readdirError=function(e,t){switch(t.code){case"ENOTSUP":case"ENOTDIR":var r=this._makeAbs(e);if(this.cache[r]="FILE",r===this.cwdAbs){var i=new Error(t.code+" invalid cwd "+this.cwd);throw i.path=this.cwd,i.code=t.code,i}break;case"ENOENT":case"ELOOP":case"ENAMETOOLONG":case"UNKNOWN":this.cache[this._makeAbs(e)]=!1;break;default:if(this.cache[this._makeAbs(e)]=!1,this.strict)throw t;this.silent||console.error("glob error",t);break}};we.prototype._processGlobStar=function(e,t,r,i,n,s){var o=this._readdir(r,s);if(o){var u=i.slice(1),l=e?[e]:[],d=l.concat(u);this._process(d,n,!1);var p=o.length,m=this.symlinks[r];if(!(m&&s))for(var g=0;g<p;g++){var y=o[g];if(!(y.charAt(0)==="."&&!this.dot)){var b=l.concat(o[g],u);this._process(b,n,!0);var A=l.concat(o[g],i);this._process(A,n,!0)}}}};we.prototype._processSimple=function(e,t){var r=this._stat(e);if(this.matches[t]||(this.matches[t]=Object.create(null)),!!r){if(e&&Zn(e)&&!this.nomount){var i=/[\/\\]$/.test(e);e.charAt(0)==="/"?e=Co.join(this.root,e):(e=Co.resolve(this.root,e),i&&(e+="/"))}process.platform==="win32"&&(e=e.replace(/\\/g,"/")),this._emitMatch(t,e)}};we.prototype._stat=function(e){var t=this._makeAbs(e),r=e.slice(-1)==="/";if(e.length>this.maxLength)return!1;if(!this.stat&&Po(this.cache,t)){var o=this.cache[t];if(Array.isArray(o)&&(o="DIR"),!r||o==="DIR")return o;if(r&&o==="FILE")return!1}var i,n=this.statCache[t];if(!n){var s;try{s=this.fs.lstatSync(t)}catch(u){if(u&&(u.code==="ENOENT"||u.code==="ENOTDIR"))return this.statCache[t]=!1,!1}if(s&&s.isSymbolicLink())try{n=this.fs.statSync(t)}catch{n=s}else n=s}this.statCache[t]=n;var o=!0;return n&&(o=n.isDirectory()?"DIR":"FILE"),this.cache[t]=this.cache[t]||o,r&&o==="FILE"?!1:o};we.prototype._mark=function(e){return Ht.mark(this,e)};we.prototype._makeAbs=function(e){return Ht.makeAbs(this,e)}});var No=L((jx,Tp)=>{Tp.exports=$t;var JE=Zr(),Op=Mr(),qx=Op.Minimatch,e1=Me(),t1=D("events").EventEmitter,qo=D("path"),Fo=D("assert"),pi=D("path").isAbsolute,ko=Ep(),Zt=Do(),r1=Zt.setopts,jo=Zt.ownProp,Bo=Ss(),Fx=D("util"),i1=Zt.childrenIgnored,n1=Zt.isIgnored,a1=Yr();function $t(e,t,r){if(typeof t=="function"&&(r=t,t={}),t||(t={}),t.sync){if(r)throw new TypeError("callback provided to sync glob");return ko(e,t)}return new le(e,t,r)}a($t,"glob");$t.sync=ko;var s1=$t.GlobSync=ko.GlobSync;$t.glob=$t;function o1(e,t){if(t===null||typeof t!="object")return e;for(var r=Object.keys(t),i=r.length;i--;)e[r[i]]=t[r[i]];return e}a(o1,"extend");$t.hasMagic=function(e,t){var r=o1({},t);r.noprocess=!0;var i=new le(e,r),n=i.minimatch.set;if(!e)return!1;if(n.length>1)return!0;for(var s=0;s<n[0].length;s++)if(typeof n[0][s]!="string")return!0;return!1};$t.Glob=le;e1(le,t1);function le(e,t,r){if(typeof t=="function"&&(r=t,t=null),t&&t.sync){if(r)throw new TypeError("callback provided to sync glob");return new s1(e,t)}if(!(this instanceof le))return new le(e,t,r);r1(this,e,t),this._didRealPath=!1;var i=this.minimatch.set.length;this.matches=new Array(i),typeof r=="function"&&(r=a1(r),this.on("error",r),this.on("end",function(l){r(null,l)}));var n=this;if(this._processing=0,this._emitQueue=[],this._processQueue=[],this.paused=!1,this.noprocess)return this;if(i===0)return u();for(var s=!0,o=0;o<i;o++)this._process(this.minimatch.set[o],o,!1,u);s=!1;function u(){--n._processing,n._processing<=0&&(s?process.nextTick(function(){n._finish()}):n._finish())}a(u,"done")}a(le,"Glob");le.prototype._finish=function(){if(Fo(this instanceof le),!this.aborted){if(this.realpath&&!this._didRealpath)return this._realpath();Zt.finish(this),this.emit("end",this.found)}};le.prototype._realpath=function(){if(this._didRealpath)return;this._didRealpath=!0;var e=this.matches.length;if(e===0)return this._finish();for(var t=this,r=0;r<this.matches.length;r++)this._realpathSet(r,i);function i(){--e===0&&t._finish()}a(i,"next")};le.prototype._realpathSet=function(e,t){var r=this.matches[e];if(!r)return t();var i=Object.keys(r),n=this,s=i.length;if(s===0)return t();var o=this.matches[e]=Object.create(null);i.forEach(function(u,l){u=n._makeAbs(u),JE.realpath(u,n.realpathCache,function(d,p){d?d.syscall==="stat"?o[u]=!0:n.emit("error",d):o[p]=!0,--s===0&&(n.matches[e]=o,t())})})};le.prototype._mark=function(e){return Zt.mark(this,e)};le.prototype._makeAbs=function(e){return Zt.makeAbs(this,e)};le.prototype.abort=function(){this.aborted=!0,this.emit("abort")};le.prototype.pause=function(){this.paused||(this.paused=!0,this.emit("pause"))};le.prototype.resume=function(){if(this.paused){if(this.emit("resume"),this.paused=!1,this._emitQueue.length){var e=this._emitQueue.slice(0);this._emitQueue.length=0;for(var t=0;t<e.length;t++){var r=e[t];this._emitMatch(r[0],r[1])}}if(this._processQueue.length){var i=this._processQueue.slice(0);this._processQueue.length=0;for(var t=0;t<i.length;t++){var n=i[t];this._processing--,this._process(n[0],n[1],n[2],n[3])}}}};le.prototype._process=function(e,t,r,i){if(Fo(this instanceof le),Fo(typeof i=="function"),!this.aborted){if(this._processing++,this.paused){this._processQueue.push([e,t,r,i]);return}for(var n=0;typeof e[n]=="string";)n++;var s;switch(n){case e.length:this._processSimple(e.join("/"),t,i);return;case 0:s=null;break;default:s=e.slice(0,n).join("/");break}var o=e.slice(n),u;s===null?u=".":((pi(s)||pi(e.map(function(p){return typeof p=="string"?p:"[*]"}).join("/")))&&(!s||!pi(s))&&(s="/"+s),u=s);var l=this._makeAbs(u);if(i1(this,u))return i();var d=o[0]===Op.GLOBSTAR;d?this._processGlobStar(s,u,l,o,t,r,i):this._processReaddir(s,u,l,o,t,r,i)}};le.prototype._processReaddir=function(e,t,r,i,n,s,o){var u=this;this._readdir(r,s,function(l,d){return u._processReaddir2(e,t,r,i,n,s,d,o)})};le.prototype._processReaddir2=function(e,t,r,i,n,s,o,u){if(!o)return u();for(var l=i[0],d=!!this.minimatch.negate,p=l._glob,m=this.dot||p.charAt(0)===".",g=[],y=0;y<o.length;y++){var b=o[y];if(b.charAt(0)!=="."||m){var A;d&&!e?A=!b.match(l):A=b.match(l),A&&g.push(b)}}var E=g.length;if(E===0)return u();if(i.length===1&&!this.mark&&!this.stat){this.matches[n]||(this.matches[n]=Object.create(null));for(var y=0;y<E;y++){var b=g[y];e&&(e!=="/"?b=e+"/"+b:b=e+b),b.charAt(0)==="/"&&!this.nomount&&(b=qo.join(this.root,b)),this._emitMatch(n,b)}return u()}i.shift();for(var y=0;y<E;y++){var b=g[y],x;e&&(e!=="/"?b=e+"/"+b:b=e+b),this._process([b].concat(i),n,s,u)}u()};le.prototype._emitMatch=function(e,t){if(!this.aborted&&!n1(this,t)){if(this.paused){this._emitQueue.push([e,t]);return}var r=pi(t)?t:this._makeAbs(t);if(this.mark&&(t=this._mark(t)),this.absolute&&(t=r),!this.matches[e][t]){if(this.nodir){var i=this.cache[r];if(i==="DIR"||Array.isArray(i))return}this.matches[e][t]=!0;var n=this.statCache[r];n&&this.emit("stat",t,n),this.emit("match",t)}}};le.prototype._readdirInGlobStar=function(e,t){if(this.aborted)return;if(this.follow)return this._readdir(e,!1,t);var r="lstat\0"+e,i=this,n=Bo(r,s);n&&i.fs.lstat(e,n);function s(o,u){if(o&&o.code==="ENOENT")return t();var l=u&&u.isSymbolicLink();i.symlinks[e]=l,!l&&u&&!u.isDirectory()?(i.cache[e]="FILE",t()):i._readdir(e,!1,t)}a(s,"lstatcb_")};le.prototype._readdir=function(e,t,r){if(!this.aborted&&(r=Bo("readdir\0"+e+"\0"+t,r),!!r)){if(t&&!jo(this.symlinks,e))return this._readdirInGlobStar(e,r);if(jo(this.cache,e)){var i=this.cache[e];if(!i||i==="FILE")return r();if(Array.isArray(i))return r(null,i)}var n=this;n.fs.readdir(e,u1(this,e,r))}};function u1(e,t,r){return function(i,n){i?e._readdirError(t,i,r):e._readdirEntries(t,n,r)}}a(u1,"readdirCb");le.prototype._readdirEntries=function(e,t,r){if(!this.aborted){if(!this.mark&&!this.stat)for(var i=0;i<t.length;i++){var n=t[i];e==="/"?n=e+n:n=e+"/"+n,this.cache[n]=!0}return this.cache[e]=t,r(null,t)}};le.prototype._readdirError=function(e,t,r){if(!this.aborted){switch(t.code){case"ENOTSUP":case"ENOTDIR":var i=this._makeAbs(e);if(this.cache[i]="FILE",i===this.cwdAbs){var n=new Error(t.code+" invalid cwd "+this.cwd);n.path=this.cwd,n.code=t.code,this.emit("error",n),this.abort()}break;case"ENOENT":case"ELOOP":case"ENAMETOOLONG":case"UNKNOWN":this.cache[this._makeAbs(e)]=!1;break;default:this.cache[this._makeAbs(e)]=!1,this.strict&&(this.emit("error",t),this.abort()),this.silent||console.error("glob error",t);break}return r()}};le.prototype._processGlobStar=function(e,t,r,i,n,s,o){var u=this;this._readdir(r,s,function(l,d){u._processGlobStar2(e,t,r,i,n,s,d,o)})};le.prototype._processGlobStar2=function(e,t,r,i,n,s,o,u){if(!o)return u();var l=i.slice(1),d=e?[e]:[],p=d.concat(l);this._process(p,n,!1,u);var m=this.symlinks[r],g=o.length;if(m&&s)return u();for(var y=0;y<g;y++){var b=o[y];if(!(b.charAt(0)==="."&&!this.dot)){var A=d.concat(o[y],l);this._process(A,n,!0,u);var E=d.concat(o[y],i);this._process(E,n,!0,u)}}u()};le.prototype._processSimple=function(e,t,r){var i=this;this._stat(e,function(n,s){i._processSimple2(e,t,n,s,r)})};le.prototype._processSimple2=function(e,t,r,i,n){if(this.matches[t]||(this.matches[t]=Object.create(null)),!i)return n();if(e&&pi(e)&&!this.nomount){var s=/[\/\\]$/.test(e);e.charAt(0)==="/"?e=qo.join(this.root,e):(e=qo.resolve(this.root,e),s&&(e+="/"))}process.platform==="win32"&&(e=e.replace(/\\/g,"/")),this._emitMatch(t,e),n()};le.prototype._stat=function(e,t){var r=this._makeAbs(e),i=e.slice(-1)==="/";if(e.length>this.maxLength)return t();if(!this.stat&&jo(this.cache,r)){var n=this.cache[r];if(Array.isArray(n)&&(n="DIR"),!i||n==="DIR")return t(null,n);if(i&&n==="FILE")return t()}var s,o=this.statCache[r];if(o!==void 0){if(o===!1)return t(null,o);var u=o.isDirectory()?"DIR":"FILE";return i&&u==="FILE"?t():t(null,u,o)}var l=this,d=Bo("stat\0"+r,p);d&&l.fs.lstat(r,d);function p(m,g){if(g&&g.isSymbolicLink())return l.fs.stat(r,function(y,b){y?l._stat2(e,r,null,g,t):l._stat2(e,r,y,b,t)});l._stat2(e,r,m,g,t)}a(p,"lstatcb_")};le.prototype._stat2=function(e,t,r,i,n){if(r&&(r.code==="ENOENT"||r.code==="ENOTDIR"))return this.statCache[t]=!1,n();var s=e.slice(-1)==="/";if(this.statCache[t]=i,t.slice(-1)==="/"&&i&&!i.isDirectory())return n(null,!1,i);var o=!0;return i&&(o=i.isDirectory()?"DIR":"FILE"),this.cache[t]=this.cache[t]||o,s&&o==="FILE"?n():n(null,o,i)}});var p1=L(()=>{process.on("unhandledRejection",e=>{throw e});var Vn=D("path"),Qn=D("fs/promises"),f1=D("fs"),l1=gp(),h1=No(),Uo=process.argv.slice(2),Ip=Uo[0],xp=Uo[1],Lp=Uo[2],Rp=Lp*1024*1024,c1={dot:!0,nodir:!0,follow:!0,cwd:Ip},Ap=h1.sync("**",c1);d1().catch(()=>{process.exit(1)});function d1(){return new Promise(async(e,t)=>{let r,i,n,s=[];async function o(){let l=s.length,d=Vn.join(xp,`part${l}.zip`);await Qn.mkdir(Vn.dirname(d),{recursive:!0}),r=f1.createWriteStream(d),i=l1("zip"),n=0,s.push({output:r,archive:i,isOutputClosed:!1}),i.on("warning",t),i.on("error",t),r.once("close",()=>{s[l].isOutputClosed=!0,s.every(({isOutputClosed:p})=>p)&&e()}),i.pipe(r)}a(o,"openZip"),await o();for(let l of Ap){let d=Vn.join(Ip,l),[p,m]=await Promise.all([Qn.readFile(d),Qn.stat(d)]),g=m.size;if(g>Rp)throw new Error(`Cannot package file "${d}". The file is larger than ${Lp}MB.`);n+g>Rp&&(await i.finalize(),await o()),i.append(p,{name:l,date:new Date("1980-01-01T00:00:00.000Z"),mode:m.mode}),n+=g}await i.finalize();let u=Vn.join(xp,"filenames");await Qn.writeFile(u,Ap.join(`
 `))})}a(d1,"generateZips")});export default p1();
 /*! Bundled license information:
 

package/support/certificate-requestor/index.js

@@ -0,0 +1,549 @@
+"use strict";
+
+const aws = require("aws-sdk");
+
+const defaultSleep = function (ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+};
+
+// These are used for test purposes only
+let defaultResponseURL;
+let waiter;
+let sleep = defaultSleep;
+let random = Math.random;
+let maxAttempts = 10;
+
+/**
+ * Upload a CloudFormation response object to S3.
+ *
+ * @param {object} event the Lambda event payload received by the handler function
+ * @param {object} context the Lambda context received by the handler function
+ * @param {string} responseStatus the response status, either 'SUCCESS' or 'FAILED'
+ * @param {string} physicalResourceId CloudFormation physical resource ID
+ * @param {object} [responseData] arbitrary response data object
+ * @param {string} [reason] reason for failure, if any, to convey to the user
+ * @returns {Promise} Promise that is resolved on success, or rejected on connection error or HTTP error response
+ */
+let report = function (
+  event,
+  context,
+  responseStatus,
+  physicalResourceId,
+  responseData,
+  reason
+) {
+  return new Promise((resolve, reject) => {
+    const https = require("https");
+    const { URL } = require("url");
+
+    var responseBody = JSON.stringify({
+      Status: responseStatus,
+      Reason: reason,
+      PhysicalResourceId: physicalResourceId || context.logStreamName,
+      StackId: event.StackId,
+      RequestId: event.RequestId,
+      LogicalResourceId: event.LogicalResourceId,
+      Data: responseData,
+    });
+
+    const parsedUrl = new URL(event.ResponseURL || defaultResponseURL);
+    const options = {
+      hostname: parsedUrl.hostname,
+      port: 443,
+      path: parsedUrl.pathname + parsedUrl.search,
+      method: "PUT",
+      headers: {
+        "Content-Type": "",
+        "Content-Length": responseBody.length,
+      },
+    };
+
+    https
+      .request(options)
+      .on("error", reject)
+      .on("response", (res) => {
+        res.resume();
+        if (res.statusCode >= 400) {
+          reject(
+            new Error(
+              `Server returned error ${res.statusCode}: ${res.statusMessage}`
+            )
+          );
+        } else {
+          resolve();
+        }
+      })
+      .end(responseBody, "utf8");
+  });
+};
+
+/**
+ * Adds tags to an existing certificate
+ *
+ * @param {string} certificateArn the ARN of the certificate to add tags to
+ * @param {string} region the region the certificate exists in
+ * @param {map} tags Tags to add to the requested certificate
+ */
+const addTags = async function (certificateArn, region, tags) {
+  const result = Array.from(Object.entries(tags)).map(([Key, Value]) => ({
+    Key,
+    Value,
+  }));
+  const acm = new aws.ACM({ region });
+
+  await acm
+    .addTagsToCertificate({
+      CertificateArn: certificateArn,
+      Tags: result,
+    })
+    .promise();
+};
+
+/**
+ * Requests a public certificate from AWS Certificate Manager, using DNS validation.
+ * The hosted zone ID must refer to a **public** Route53-managed DNS zone that is authoritative
+ * for the suffix of the certificate's Common Name (CN).  For example, if the CN is
+ * `*.example.com`, the hosted zone ID must point to a Route 53 zone authoritative
+ * for `example.com`.
+ *
+ * @param {string} requestId the CloudFormation request ID
+ * @param {string} domainName the Common Name (CN) field for the requested certificate
+ * @param {string} hostedZoneId the Route53 Hosted Zone ID
+ * @returns {string} Validated certificate ARN
+ */
+const requestCertificate = async function (
+  requestId,
+  domainName,
+  subjectAlternativeNames,
+  certificateTransparencyLoggingPreference,
+  hostedZoneId,
+  region,
+  route53Endpoint
+) {
+  const crypto = require("crypto");
+  const acm = new aws.ACM({ region });
+  const route53 = route53Endpoint
+    ? new aws.Route53({ endpoint: route53Endpoint })
+    : new aws.Route53();
+  if (waiter) {
+    // Used by the test suite, since waiters aren't mockable yet
+    route53.waitFor = acm.waitFor = waiter;
+  }
+
+  console.log(`Requesting certificate for ${domainName}`);
+
+  const reqCertResponse = await acm
+    .requestCertificate({
+      DomainName: domainName,
+      SubjectAlternativeNames: subjectAlternativeNames,
+      Options: {
+        CertificateTransparencyLoggingPreference:
+          certificateTransparencyLoggingPreference,
+      },
+      IdempotencyToken: crypto
+        .createHash("sha256")
+        .update(requestId)
+        .digest("hex")
+        .slice(0, 32),
+      ValidationMethod: "DNS",
+    })
+    .promise();
+
+  console.log(`Certificate ARN: ${reqCertResponse.CertificateArn}`);
+
+  console.log("Waiting for ACM to provide DNS records for validation...");
+
+  let records = [];
+  for (let attempt = 0; attempt < maxAttempts && !records.length; attempt++) {
+    const { Certificate } = await acm
+      .describeCertificate({
+        CertificateArn: reqCertResponse.CertificateArn,
+      })
+      .promise();
+
+    records = getDomainValidationRecords(Certificate);
+    if (!records.length) {
+      // Exponential backoff with jitter based on 200ms base
+      // component of backoff fixed to ensure minimum total wait time on
+      // slow targets.
+      const base = Math.pow(2, attempt);
+      await sleep(random() * base * 50 + base * 150);
+    }
+  }
+  if (!records.length) {
+    throw new Error(
+      `Response from describeCertificate did not contain DomainValidationOptions after ${maxAttempts} attempts.`
+    );
+  }
+
+  console.log(
+    `Upserting ${records.length} DNS records into zone ${hostedZoneId}:`
+  );
+
+  await commitRoute53Records(route53, records, hostedZoneId);
+
+  console.log("Waiting for validation...");
+  await acm
+    .waitFor("certificateValidated", {
+      // Wait up to 9 minutes and 30 seconds
+      $waiter: {
+        delay: 30,
+        maxAttempts: 19,
+      },
+      CertificateArn: reqCertResponse.CertificateArn,
+    })
+    .promise();
+
+  return reqCertResponse.CertificateArn;
+};
+
+/**
+ * Deletes a certificate from AWS Certificate Manager (ACM) by its ARN.
+ * If the certificate does not exist, the function will return normally.
+ *
+ * @param {string} arn The certificate ARN
+ */
+const deleteCertificate = async function (
+  arn,
+  region,
+  hostedZoneId,
+  route53Endpoint,
+  cleanupRecords
+) {
+  const acm = new aws.ACM({ region });
+  const route53 = route53Endpoint
+    ? new aws.Route53({ endpoint: route53Endpoint })
+    : new aws.Route53();
+  if (waiter) {
+    // Used by the test suite, since waiters aren't mockable yet
+    route53.waitFor = acm.waitFor = waiter;
+  }
+
+  try {
+    console.log(`Waiting for certificate ${arn} to become unused`);
+
+    let inUseByResources;
+    let records = [];
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      const { Certificate } = await acm
+        .describeCertificate({
+          CertificateArn: arn,
+        })
+        .promise();
+
+      if (cleanupRecords) {
+        records = getDomainValidationRecords(Certificate);
+      }
+      inUseByResources = Certificate.InUseBy || [];
+
+      if (inUseByResources.length || !records.length) {
+        // Exponential backoff with jitter based on 200ms base
+        // component of backoff fixed to ensure minimum total wait time on
+        // slow targets.
+        const base = Math.pow(2, attempt);
+        await sleep(random() * base * 50 + base * 150);
+      } else {
+        break;
+      }
+    }
+
+    if (inUseByResources.length) {
+      throw new Error(
+        `Response from describeCertificate did not contain an empty InUseBy list after ${maxAttempts} attempts.`
+      );
+    }
+    if (cleanupRecords && !records.length) {
+      throw new Error(
+        `Response from describeCertificate did not contain DomainValidationOptions after ${maxAttempts} attempts.`
+      );
+    }
+
+    console.log(`Deleting certificate ${arn}`);
+
+    await acm
+      .deleteCertificate({
+        CertificateArn: arn,
+      })
+      .promise();
+
+    if (cleanupRecords) {
+      console.log(
+        `Deleting ${records.length} DNS records from zone ${hostedZoneId}:`
+      );
+
+      await commitRoute53Records(route53, records, hostedZoneId, "DELETE");
+    }
+  } catch (err) {
+    if (err.name !== "ResourceNotFoundException") {
+      throw err;
+    }
+  }
+};
+
+/**
+ * Retrieve the unique domain validation options as records to be upserted (or deleted) from Route53.
+ *
+ * Returns an empty array ([]) if the domain validation options is empty or the records are not yet ready.
+ */
+function getDomainValidationRecords(certificate) {
+  const options = certificate.DomainValidationOptions || [];
+  // Ensure all records are ready; there is (at least a theory there's) a chance of a partial response here in rare cases.
+  if (
+    options.length > 0 &&
+    options.every((opt) => opt && !!opt.ResourceRecord)
+  ) {
+    // some alternative names will produce the same validation record
+    // as the main domain (eg. example.com + *.example.com)
+    // filtering duplicates to avoid errors with adding the same record
+    // to the route53 zone twice
+    const unique = options
+      .map((val) => val.ResourceRecord)
+      .reduce((acc, cur) => {
+        acc[cur.Name] = cur;
+        return acc;
+      }, {});
+    return Object.keys(unique)
+      .sort()
+      .map((key) => unique[key]);
+  }
+  return [];
+}
+
+/**
+ * Execute Route53 ChangeResourceRecordSets for a set of records within a Hosted Zone,
+ * and wait for the records to commit. Defaults to an 'UPSERT' action.
+ */
+async function commitRoute53Records(
+  route53,
+  records,
+  hostedZoneId,
+  action = "UPSERT"
+) {
+  const changeBatch = await route53
+    .changeResourceRecordSets({
+      ChangeBatch: {
+        Changes: records.map((record) => {
+          console.log(`${record.Name} ${record.Type} ${record.Value}`);
+          return {
+            Action: action,
+            ResourceRecordSet: {
+              Name: record.Name,
+              Type: record.Type,
+              TTL: 60,
+              ResourceRecords: [
+                {
+                  Value: record.Value,
+                },
+              ],
+            },
+          };
+        }),
+      },
+      HostedZoneId: hostedZoneId,
+    })
+    .promise();
+
+  console.log("Waiting for DNS records to commit...");
+  await route53
+    .waitFor("resourceRecordSetsChanged", {
+      // Wait up to 5 minutes
+      $waiter: {
+        delay: 30,
+        maxAttempts: 10,
+      },
+      Id: changeBatch.ChangeInfo.Id,
+    })
+    .promise();
+}
+
+/**
+ * Determines whether an update request should request a new certificate
+ *
+ * @param {map} oldParams the previously process request parameters
+ * @param {map} newParams the current process request parameters
+ * @param {string} physicalResourceId the physicalResourceId
+ * @returns {boolean} whether or not to request a new certificate
+ */
+function shouldUpdate(oldParams, newParams, physicalResourceId) {
+  if (!oldParams) return true;
+  if (oldParams.DomainName !== newParams.DomainName) return true;
+  if (oldParams.SubjectAlternativeNames !== newParams.SubjectAlternativeNames)
+    return true;
+  if (
+    oldParams.CertificateTransparencyLoggingPreference !==
+    newParams.CertificateTransparencyLoggingPreference
+  )
+    return true;
+  if (oldParams.HostedZoneId !== newParams.HostedZoneId) return true;
+  if (oldParams.Region !== newParams.Region) return true;
+  if (!physicalResourceId || !physicalResourceId.startsWith("arn:"))
+    return true;
+  return false;
+}
+
+/**
+ * Main handler, invoked by Lambda
+ */
+exports.certificateRequestHandler = async function (event, context) {
+  var responseData = {};
+  var physicalResourceId;
+  var certificateArn;
+  async function processRequest() {
+    certificateArn = await requestCertificate(
+      event.RequestId,
+      event.ResourceProperties.DomainName,
+      event.ResourceProperties.SubjectAlternativeNames,
+      event.ResourceProperties.CertificateTransparencyLoggingPreference,
+      event.ResourceProperties.HostedZoneId,
+      event.ResourceProperties.Region,
+      event.ResourceProperties.Route53Endpoint
+    );
+    responseData.Arn = physicalResourceId = certificateArn;
+  }
+
+  try {
+    switch (event.RequestType) {
+      case "Create":
+        await processRequest();
+        if (
+          event.ResourceProperties.Tags &&
+          physicalResourceId.startsWith("arn:")
+        ) {
+          await addTags(
+            physicalResourceId,
+            event.ResourceProperties.Region,
+            event.ResourceProperties.Tags
+          );
+        }
+        break;
+      case "Update":
+        if (
+          shouldUpdate(
+            event.OldResourceProperties,
+            event.ResourceProperties,
+            event.PhysicalResourceId
+          )
+        ) {
+          await processRequest();
+        } else {
+          responseData.Arn = physicalResourceId = event.PhysicalResourceId;
+        }
+        if (
+          event.ResourceProperties.Tags &&
+          physicalResourceId.startsWith("arn:")
+        ) {
+          await addTags(
+            physicalResourceId,
+            event.ResourceProperties.Region,
+            event.ResourceProperties.Tags
+          );
+        }
+        break;
+      case "Delete":
+        physicalResourceId = event.PhysicalResourceId;
+        const removalPolicy =
+          event.ResourceProperties.RemovalPolicy ?? "destroy";
+        // If the resource didn't create correctly, the physical resource ID won't be the
+        // certificate ARN, so don't try to delete it in that case.
+        if (
+          physicalResourceId.startsWith("arn:") &&
+          removalPolicy === "destroy"
+        ) {
+          await deleteCertificate(
+            physicalResourceId,
+            event.ResourceProperties.Region,
+            event.ResourceProperties.HostedZoneId,
+            event.ResourceProperties.Route53Endpoint,
+            event.ResourceProperties.CleanupRecords === "true"
+          );
+        }
+        break;
+      default:
+        throw new Error(`Unsupported request type ${event.RequestType}`);
+    }
+
+    console.log(`Uploading SUCCESS response to S3...`);
+    await report(event, context, "SUCCESS", physicalResourceId, responseData);
+    console.log("Done.");
+  } catch (err) {
+    console.log(`Caught error ${err}. Uploading FAILED message to S3.`);
+    await report(
+      event,
+      context,
+      "FAILED",
+      physicalResourceId,
+      null,
+      err.message
+    );
+  }
+};
+
+/**
+ * @private
+ */
+exports.withReporter = function (reporter) {
+  report = reporter;
+};
+
+/**
+ * @private
+ */
+exports.withDefaultResponseURL = function (url) {
+  defaultResponseURL = url;
+};
+
+/**
+ * @private
+ */
+exports.withWaiter = function (w) {
+  waiter = w;
+};
+
+/**
+ * @private
+ */
+exports.resetWaiter = function () {
+  waiter = undefined;
+};
+
+/**
+ * @private
+ */
+exports.withSleep = function (s) {
+  sleep = s;
+};
+
+/**
+ * @private
+ */
+exports.resetSleep = function () {
+  sleep = defaultSleep;
+};
+
+/**
+ * @private
+ */
+exports.withRandom = function (r) {
+  random = r;
+};
+
+/**
+ * @private
+ */
+exports.resetRandom = function () {
+  random = Math.random;
+};
+
+/**
+ * @private
+ */
+exports.withMaxAttempts = function (ma) {
+  maxAttempts = ma;
+};
+
+/**
+ * @private
+ */
+exports.resetMaxAttempts = function () {
+  maxAttempts = 10;
+};