Authored-By: OpenAI (GPT-5) <noreply@openai.com>

@@ -62,0 +95,4 @@
+    try:
+        # Sync the complete bucket authority so moving a route prefix also
+        # deletes objects under its old prefix instead of leaving them public.
+        run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{sync_source}/", bucket_destination,

@@ -151,2 +486,2 @@
-    run(f"git -C {apps_dir} commit -m '{message}'")
-    run(f"git -C {apps_dir} push")
+    run(["git", "-C", str(apps_dir), "commit", "-m", message])
+    run(["git", "-C", str(apps_dir), "push"])

@@ -62,0 +95,4 @@
+    try:
+        # Sync the complete bucket authority so moving a route prefix also
+        # deletes objects under its old prefix instead of leaving them public.
+        run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{sync_source}/", bucket_destination,

@@ -105,0 +343,4 @@
+        if len(used_by) != 1:
+            raise ConfigError(f"artifact {name} must be referenced by exactly one route")
+    buckets, authorities, credential_owners = {}, {}, {}
+    for route in routes:

@@ -102,0 +249,4 @@
+        value = credentials.get(key)
+        if not isinstance(value, str) or not ENV_RE.fullmatch(value):
+            raise ConfigError(f"{label}.publish.credentials.{key} must name an environment variable")
+        normalized_credentials[key] = value

@@ -102,0 +271,4 @@
+        raise ConfigError(f"{label}.cache.rules must declare a '/' default")
+    cache_rules.sort(key=lambda rule: (len(PurePosixPath(rule["path"]).parts), rule["path"]))
+    authority = _hostname(
+        publish.get("website_authority", f"{bucket}.{DEFAULT_WEBSITE_SUFFIX}"),

@@ -62,0 +95,4 @@
+    try:
+        # Sync the complete bucket authority so moving a route prefix also
+        # deletes objects under its old prefix instead of leaving them public.
+        run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{sync_source}/", bucket_destination,

@@ -151,2 +486,2 @@
-    run(f"git -C {apps_dir} commit -m '{message}'")
-    run(f"git -C {apps_dir} push")
+    run(["git", "-C", str(apps_dir), "commit", "-m", message])
+    run(["git", "-C", str(apps_dir), "push"])

@@ -62,0 +199,4 @@
+            *(arg for pattern in artifact["excludes"]
+              for arg in ("--exclude", f"{object_prefix}/{pattern}")),
+            *(arg for path in immutable_paths
+              for arg in ("--exclude", f"{object_prefix}/{path}/*")),

@@ -42,0 +89,4 @@
+    keys = json.loads(result.stdout) or []
+    immutable = []
+    for key in keys:
+        info = _immutable_head(endpoint, bucket, key, aws_env)

@@ -42,0 +195,4 @@
+    destination = f"{bucket_destination}{object_prefix + '/' if object_prefix else ''}"
+    default_cache = next(rule["cache_control"] for rule in artifact["cache_rules"] if not rule["path"])
+    immutable_paths = [rule["path"] for rule in artifact["cache_rules"] if _is_immutable(rule)]
+    existing_immutable = _existing_immutable_keys(endpoint, bucket, aws_env)

@@ -42,0 +195,4 @@
+    destination = f"{bucket_destination}{object_prefix + '/' if object_prefix else ''}"
+    default_cache = next(rule["cache_control"] for rule in artifact["cache_rules"] if not rule["path"])
+    immutable_paths = [rule["path"] for rule in artifact["cache_rules"] if _is_immutable(rule)]
+    existing_immutable = _existing_immutable_keys(endpoint, bucket, aws_env)

@@ -42,0 +195,4 @@
+    destination = f"{bucket_destination}{object_prefix + '/' if object_prefix else ''}"
+    default_cache = next(rule["cache_control"] for rule in artifact["cache_rules"] if not rule["path"])
+    immutable_paths = [rule["path"] for rule in artifact["cache_rules"] if _is_immutable(rule)]
+    existing_immutable = _existing_immutable_keys(endpoint, bucket, aws_env)

@@ -42,0 +102,4 @@
+    }
+    immutable_paths = [rule["path"] for rule in artifact["cache_rules"] if _is_immutable(rule)]
+    stale = []
+    for key in _list_object_keys(endpoint, bucket, aws_env):

@@ -42,0 +106,4 @@
+        if prefix and not key.startswith(prefix):
+            continue
+        relative = key[len(prefix):]
+        if key in expected or _has_publication_address(key):

@@ -60,1 +237,3 @@
-        f"{exclude_flags}".rstrip()
+    sync_excludes = [*exclude_args,
+                     *(arg for path in immutable_paths for arg in ("--exclude", f"{path}/*"))]
+    run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{html_dir}/", destination,

@@ -61,1 +195,3 @@
-    )
+    sync_excludes = [*exclude_args,
+                     *(arg for path in immutable_paths for arg in ("--exclude", f"{path}/*"))]
+    run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{html_dir}/", destination,

@@ -137,0 +297,4 @@
+    for artifact in cfg["artifacts"]:
+        validate_artifact_output(site_dir, artifact)
+    for route in cfg["routes"]:
+        s3_sync(artifact_by_name[route["artifact"]], route, site_dir, credential_env_names)

@@ -23,3 +22,4 @@
+        print(f"Copying artifact {artifact['name']} from {src}")
         with tempfile.TemporaryDirectory() as tmp:
             tmp_path = Path(tmp) / "html"
             shutil.copytree(src, tmp_path, dirs_exist_ok=True)