Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
//#region \0rolldown/runtime.js
var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
//#endregion
let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
let _aws_sdk_client_lambda = require("@aws-sdk/client-lambda");
let _smithy_util_retry = require("@smithy/util-retry");
//#endregion
//#region src/constants.ts
var import_constants = (/* @__PURE__ */ __commonJSMin(((exports) => {
	Object.defineProperty(exports, "__esModule", { value: true });
	exports.ENV_VAR_REGEX = exports.DEFAULT_HEALTH_CHECK_PORT = exports.DEFAULT_LOGS_PATH = exports.DEFAULT_VOLUME_PATH = exports.DEFAULT_VOLUME_NAME = exports.DEFAULT_SIDECAR_NAME = exports.SIDECAR_PORT = exports.SIDECAR_IMAGE = exports.SIDECAR_CONTAINER_NAME = exports.FLARE_PROJECT_FILES = exports.INSIGHTS_FILE_NAME = exports.ADDITIONAL_FILES_DIRECTORY = exports.PROJECT_FILES_DIRECTORY = exports.LOGS_DIRECTORY = exports.FLARE_OUTPUT_DIRECTORY = exports.EXTRA_TAGS_REG_EXP = exports.VERSION_ENV_VAR = exports.ENVIRONMENT_ENV_VAR = exports.SERVICE_ENV_VAR = exports.DD_SOURCE_ENV_VAR = exports.DD_TAGS_ENV_VAR = exports.DD_LLMOBS_AGENTLESS_ENABLED_ENV_VAR = exports.DD_LLMOBS_ML_APP_ENV_VAR = exports.DD_LLMOBS_ENABLED_ENV_VAR = exports.DD_TRACE_ENABLED_ENV_VAR = exports.DD_LOG_LEVEL_ENV_VAR = exports.HEALTH_PORT_ENV_VAR = exports.LOGS_PATH_ENV_VAR = exports.LOGS_INJECTION_ENV_VAR = exports.SITE_ENV_VAR = exports.CI_SITE_ENV_VAR = exports.CI_API_KEY_ENV_VAR = exports.API_KEY_ENV_VAR = void 0;
	exports.API_KEY_ENV_VAR = "DD_API_KEY";
	exports.CI_API_KEY_ENV_VAR = "DATADOG_API_KEY";
	exports.CI_SITE_ENV_VAR = "DATADOG_SITE";
	exports.SITE_ENV_VAR = "DD_SITE";
	exports.LOGS_INJECTION_ENV_VAR = "DD_LOGS_INJECTION";
	exports.LOGS_PATH_ENV_VAR = "DD_SERVERLESS_LOG_PATH";
	exports.HEALTH_PORT_ENV_VAR = "DD_HEALTH_PORT";
	exports.DD_LOG_LEVEL_ENV_VAR = "DD_LOG_LEVEL";
	exports.DD_TRACE_ENABLED_ENV_VAR = "DD_TRACE_ENABLED";
	exports.DD_LLMOBS_ENABLED_ENV_VAR = "DD_LLMOBS_ENABLED";
	exports.DD_LLMOBS_ML_APP_ENV_VAR = "DD_LLMOBS_ML_APP";
	exports.DD_LLMOBS_AGENTLESS_ENABLED_ENV_VAR = "DD_LLMOBS_AGENTLESS_ENABLED";
	exports.DD_TAGS_ENV_VAR = "DD_TAGS";
	exports.DD_SOURCE_ENV_VAR = "DD_SOURCE";
	exports.SERVICE_ENV_VAR = "DD_SERVICE";
	exports.ENVIRONMENT_ENV_VAR = "DD_ENV";
	exports.VERSION_ENV_VAR = "DD_VERSION";
	exports.EXTRA_TAGS_REG_EXP = /^(([a-zA-Z]+)[\w\-/.]*:[^,]+)+((,)([a-zA-Z]+)[\w\-/.]*:[^,]+)*$/g;
	exports.FLARE_OUTPUT_DIRECTORY = ".datadog-ci";
	exports.LOGS_DIRECTORY = "logs";
	exports.PROJECT_FILES_DIRECTORY = "project_files";
	exports.ADDITIONAL_FILES_DIRECTORY = "additional_files";
	exports.INSIGHTS_FILE_NAME = "INSIGHTS.md";
	exports.FLARE_PROJECT_FILES = [
		"datadog-cloudfomation-macro.yaml",
		"datadog-cloudfomation-macro.yml",
		"datadog-cloudformation-macro.json",
		"package.json",
		"package-lock.json",
		"yarn.lock",
		".nvmrc",
		"requirements.txt",
		"Pipfile",
		"Pipfile.lock",
		"pyproject.toml",
		"pom.xml",
		"build.gradle",
		"gradlew",
		"gradlew.bat",
		"Makefile",
		"go.mod",
		"go.sum",
		"Gopkg.toml",
		"gomod.sh",
		"Gemfile",
		"Gemfile.lock",
		"project.json",
		"packages.config",
		"PackageReference",
		"global.json",
		"Dockerfile",
		"docker-compose.yaml",
		"docker-compose.yml",
		"webpack.config.js",
		".babelrc",
		"tsconfig.json",
		"esbuild.config.js"
	];
	/**
	* Shared constants for serverless instrumentation
	*/
	exports.SIDECAR_CONTAINER_NAME = "datadog-sidecar";
	exports.SIDECAR_IMAGE = "index.docker.io/datadog/serverless-init:latest";
	exports.SIDECAR_PORT = 8126;
	exports.DEFAULT_SIDECAR_NAME = "datadog-sidecar";
	exports.DEFAULT_VOLUME_NAME = "shared-volume";
	exports.DEFAULT_VOLUME_PATH = "/shared-volume";
	exports.DEFAULT_LOGS_PATH = "/shared-volume/logs/*.log";
	exports.DEFAULT_HEALTH_CHECK_PORT = 5555;
	/**
	* Regular expression for parsing environment variables in KEY=VALUE format
	*/
	exports.ENV_VAR_REGEX = /^([\w.]+)=(.*)$/;
})))();
let RuntimeType = /* @__PURE__ */ function(RuntimeType) {
	RuntimeType["DOTNET"] = "dotnet";
	RuntimeType["CUSTOM"] = "custom";
	RuntimeType["JAVA"] = "java";
	RuntimeType["NODE"] = "node";
	RuntimeType["PYTHON"] = "python";
	RuntimeType["RUBY"] = "ruby";
	return RuntimeType;
}({});
RuntimeType.DOTNET, RuntimeType.DOTNET, RuntimeType.DOTNET, RuntimeType.JAVA, RuntimeType.JAVA, RuntimeType.JAVA, RuntimeType.JAVA, RuntimeType.JAVA, RuntimeType.NODE, RuntimeType.NODE, RuntimeType.NODE, RuntimeType.NODE, RuntimeType.NODE, RuntimeType.CUSTOM, RuntimeType.CUSTOM, RuntimeType.PYTHON, RuntimeType.PYTHON, RuntimeType.PYTHON, RuntimeType.PYTHON, RuntimeType.PYTHON, RuntimeType.PYTHON, RuntimeType.PYTHON, RuntimeType.RUBY, RuntimeType.RUBY, RuntimeType.RUBY, RuntimeType.RUBY;
let DeploymentFrameworks = /* @__PURE__ */ function(DeploymentFrameworks) {
	DeploymentFrameworks["ServerlessFramework"] = "Serverless Framework";
	DeploymentFrameworks["AwsCdk"] = "AWS CDK";
	DeploymentFrameworks["AwsCloudFormation"] = "AWS CloudFormation";
	DeploymentFrameworks["Unknown"] = "Unknown";
	return DeploymentFrameworks;
}({});
const FRAMEWORK_FILES_MAPPING = new Map([
	["serverless.yaml", DeploymentFrameworks.ServerlessFramework],
	["serverless.yml", DeploymentFrameworks.ServerlessFramework],
	["serverless.js", DeploymentFrameworks.ServerlessFramework],
	["cdk.json", DeploymentFrameworks.AwsCdk],
	[".cdk.json", DeploymentFrameworks.AwsCdk],
	["template.yaml", DeploymentFrameworks.AwsCloudFormation],
	["template.yml", DeploymentFrameworks.AwsCloudFormation],
	["template.json", DeploymentFrameworks.AwsCloudFormation]
]);
[...import_constants.FLARE_PROJECT_FILES, ...FRAMEWORK_FILES_MAPPING.keys()];
new _smithy_util_retry.ConfiguredRetryStrategy(4, (attempt) => 1e3 * 2 ** (attempt - 1));
new _smithy_util_retry.AdaptiveRetryStrategy(() => Promise.resolve(3));
//#endregion
//#region src/functions/cloudwatch.ts
const DENY_POLICY_NAME = "DenyCloudWatchLogs";
const getDenyPolicyDocument = (logGroups) => JSON.stringify({
	Version: "2012-10-17",
	Statement: [{
		Effect: "Deny",
		Action: [
			"logs:CreateLogGroup",
			"logs:CreateLogStream",
			"logs:PutLogEvents"
		],
		Resource: logGroups.map((lg) => `arn:aws:logs:*:*:log-group:${lg}:*`)
	}]
});
const getFunctionDetails = async (lambdaClient, functionIdentifier) => {
	const resp = await lambdaClient.send(new _aws_sdk_client_lambda.GetFunctionCommand({ FunctionName: functionIdentifier }));
	const roleArn = resp.Configuration?.Role;
	if (!roleArn) throw new Error(`Could not determine execution role for function ${functionIdentifier}`);
	const functionName = resp.Configuration?.FunctionName;
	if (!functionName) throw new Error(`Could not determine function name for ${functionIdentifier}`);
	return {
		roleName: roleArn.split("/").pop(),
		functionName,
		logGroup: resp.Configuration?.LoggingConfig?.LogGroup ?? `/aws/lambda/${functionName}`,
		hasExtensionLayer: resp.Configuration?.Layers?.some((l) => l.Arn?.includes("Datadog-Extension")) ?? false
	};
};
const LOG_GROUP_RESOURCE_PATTERN = /^arn:aws:logs:\*:\*:log-group:(.+):\*$/;
const getExistingDeniedLogGroups = async (iamClient, roleName) => {
	try {
		const resp = await iamClient.send(new _aws_sdk_client_iam.GetRolePolicyCommand({
			RoleName: roleName,
			PolicyName: DENY_POLICY_NAME
		}));
		const resource = JSON.parse(decodeURIComponent(resp.PolicyDocument)).Statement?.[0]?.Resource;
		if (!resource) return [];
		return (Array.isArray(resource) ? resource : [resource]).map((r) => LOG_GROUP_RESOURCE_PATTERN.exec(r)?.[1]).filter((lg) => lg !== void 0);
	} catch (err) {
		if (err instanceof Error && err.name === "NoSuchEntityException") return [];
		throw err;
	}
};
const disableCloudwatchLogs = async (iamClient, roleName, logGroups) => {
	const existing = await getExistingDeniedLogGroups(iamClient, roleName);
	const merged = [...new Set([...existing, ...logGroups])];
	await iamClient.send(new _aws_sdk_client_iam.PutRolePolicyCommand({
		RoleName: roleName,
		PolicyName: DENY_POLICY_NAME,
		PolicyDocument: getDenyPolicyDocument(merged)
	}));
};
const enableCloudwatchLogs = async (iamClient, roleName, logGroups) => {
	const remaining = (await getExistingDeniedLogGroups(iamClient, roleName)).filter((lg) => !logGroups.includes(lg));
	if (remaining.length === 0) try {
		await iamClient.send(new _aws_sdk_client_iam.DeleteRolePolicyCommand({
			RoleName: roleName,
			PolicyName: DENY_POLICY_NAME
		}));
	} catch (err) {
		if (err instanceof Error && err.name === "NoSuchEntityException") return;
		throw err;
	}
	else await iamClient.send(new _aws_sdk_client_iam.PutRolePolicyCommand({
		RoleName: roleName,
		PolicyName: DENY_POLICY_NAME,
		PolicyDocument: getDenyPolicyDocument(remaining)
	}));
};
//#endregion
exports.DENY_POLICY_NAME = DENY_POLICY_NAME;
exports.disableCloudwatchLogs = disableCloudwatchLogs;
exports.enableCloudwatchLogs = enableCloudwatchLogs;
exports.getDenyPolicyDocument = getDenyPolicyDocument;
exports.getExistingDeniedLogGroups = getExistingDeniedLogGroups;
exports.getFunctionDetails = getFunctionDetails;

//# sourceMappingURL=cloudwatch.js.map