<?php
const TOOL_PASSWORD_DEFAULT = 'change-this-password-now';
const TOOL_LOGIN_USERNAME = 'cloudfront-media-tool';
const TOOL_AUTH_COOKIE_SECONDS = 43200; // 12 hours.
/**
 * CloudFront Media Behavior Automation - IIS/Web PHP Edition
 * WEB PHP EDITION VERSION: v161
 *
 * No AWS SDK required.
 * No Java required.
 * No Node required.
 * No PHP CLI required.
 *
 * Requirements:
 *   PHP 8+
 *   php-curl enabled
 *   openssl enabled
 *   dom/simplexml enabled
 *
 * SECURITY:
 *   This page can update CloudFront distributions.
 *   Do not put it on the public internet without strong protection.
 *
 * Recommended:
 *   - Run only on localhost / private IIS
 *   - Delete this file after use
 *   - Use temporary AWS access keys
 *   - Use an IAM user/role limited to CloudFront distribution/policy management
 */

const TOOL_VERSION = 'v161';
ini_set('display_errors', '0'); // v53: keep PHP warnings from breaking the browser view
error_reporting(E_ALL & ~E_DEPRECATED & ~E_NOTICE & ~E_WARNING);

const TOOL_BUILD_TIMESTAMP_UTC = '2026-05-21T11:45:00Z';
const TOOL_PACKAGE_NAME = 'cloudfront-media-behavior-automation-web-php-v161-polled-runlog';
const LOCAL_CONFIG_DEFAULT_PATH = __DIR__ . DIRECTORY_SEPARATOR . 'cloudfront-tool-local-config.php';

const CF_HOST = 'cloudfront.amazonaws.com';
const CF_VERSION = '2020-05-31';
const AWS_REGION = 'us-east-1';
const AWS_SERVICE = 'cloudfront';

// CloudFront can throttle distribution updates. The tool retries throttled
// requests with exponential backoff so users do not have to babysit temporary
// "Rate exceeded" errors.
const CF_MAX_RETRIES = 7;
const CF_BASE_RETRY_SLEEP_SECONDS = 2;

const MEDIA_CACHE_POLICY_NAME = 'MediaCacheLong1Year';
const JSON_CACHE_POLICY_NAME = 'JsonNearFresh';
const DEBUG_CACHE_POLICY_NAME = 'DebugNoCache';
const MEDIA_CORS_POLICY_NAME = 'PublicMediaCORSFromEverywhere';

const DEFAULT_MEDIA_PATTERNS_TEXT = "*.jpg\n*.jpeg\n*.png\n*.gif\n*.webp\n*.avif\n*.apng\n*.svg\n*.ico\n*.bmp\n*.tif\n*.tiff\n*.heic\n*.heif\n*.mp4\n*.webm\n*.mov\n*.m4v\n*.mkv\n*.ogv\n*.m3u8\n*.m4s\n*.mp3\n*.wav\n*.ogg\n*.oga\n*.m4a\n*.aac\n*.flac\n*.opus\n*.woff\n*.woff2\n*.ttf\n*.otf\n*.eot";


function mask_for_value(string $value): string {
    $len = strlen($value);
    if ($len <= 0) {
        return '';
    }
    return str_repeat('•', $len);
}

function send_json_response(array $payload): void {
    while (ob_get_level() > 0) {
        ob_end_clean();
    }
    header('Content-Type: application/json; charset=utf-8');
    echo json_encode($payload);
    exit;
}

function h(string $value): string {
    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

function friendly_distribution_label(string $distributionId, array $removedPublicFriendlyNameFallbacks = []): string {
    $id = trim($distributionId);
    $name = '';

    if (isset($removedPublicFriendlyNameFallbacks[$id])) {
        $name = trim((string)$removedPublicFriendlyNameFallbacks[$id]);
    }

    if ($name === '') {
        return $id;
    }

    if (strcasecmp($name, $id) === 0) {
        return $id;
    }

    return $id . ' (' . $name . ')';
}

function append_cloudfront_success_note(array &$out): void {
    $out[] = '';
    $out[] = 'What happens next: CloudFront accepted these distribution updates.';
    $out[] = 'CloudFront changes are not always visible immediately at every edge location.';
    $out[] = 'Wait for the distribution status to finish deploying. In many cases this is minutes, but it can take longer.';
    $out[] = 'Already-cached files may still be served until their cache TTL expires or you run an invalidation.';
    $out[] = 'New requests for matching paths will use the new behaviors after the distribution deployment reaches the edge. In the AWS Console, verify on the exact distribution ID shown above, on the Behaviors tab.';
}

function apply_friendly_distribution_names_to_output(array $lines, array $removedPublicFriendlyNameFallbacks): array {
    if (!$removedPublicFriendlyNameFallbacks) {
        return $lines;
    }

    foreach ($removedPublicFriendlyNameFallbacks as $id => $name) {
        $id = trim((string)$id);
        $name = trim((string)$name);
        if ($id === '' || $name === '' || strcasecmp($id, $name) === 0) {
            continue;
        }

        $label = $id . ' (' . $name . ')';
        foreach ($lines as &$line) {
            $line = preg_replace('/\b' . preg_quote($id, '/') . '\b(?!\s*\()/', $label, (string)$line);
        }
        unset($line);
    }

    return $lines;
}


function lines_to_array(string $text): array {
    return array_values(array_filter(array_map('trim', preg_split('/\R+/', $text))));
}

function require_extensions(): array {
    $missing = [];
    foreach (['curl', 'openssl', 'dom', 'simplexml'] as $ext) {
        if (!extension_loaded($ext)) {
            $missing[] = $ext;
        }
    }
    return $missing;
}

function hmac_sha256(string $key, string $data, bool $raw = true): string {
    return hash_hmac('sha256', $data, $key, $raw);
}

function signing_key(string $secret, string $date, string $region, string $service): string {
    $kDate = hmac_sha256('AWS4' . $secret, $date);
    $kRegion = hmac_sha256($kDate, $region);
    $kService = hmac_sha256($kRegion, $service);
    return hmac_sha256($kService, 'aws4_request');
}

function aws_percent_encode(string $value): string {
    return str_replace('%7E', '~', rawurlencode($value));
}

function canonical_query(array $query): string {
    ksort($query);
    $pairs = [];
    foreach ($query as $key => $value) {
        if (is_array($value)) {
            sort($value);
            foreach ($value as $v) {
                $pairs[] = aws_percent_encode((string)$key) . '=' . aws_percent_encode((string)$v);
            }
        } else {
            $pairs[] = aws_percent_encode((string)$key) . '=' . aws_percent_encode((string)$value);
        }
    }
    return implode('&', $pairs);
}


function is_cloudfront_throttle_response(int $status, string $body): bool {
    if (in_array($status, [429, 500, 502, 503, 504], true)) {
        return true;
    }

    return stripos($body, '<Code>Throttling</Code>') !== false
        || stripos($body, '<Code>TooManyRequests</Code>') !== false
        || stripos($body, 'Rate exceeded') !== false
        || stripos($body, 'Throttling') !== false;
}

function retry_sleep_seconds(int $attempt): int {
    $base = CF_BASE_RETRY_SLEEP_SECONDS * (2 ** max(0, $attempt - 1));
    $jitter = random_int(0, 2);
    return min(60, $base + $jitter);
}


function cloudfront_request(
    string $method,
    string $path,
    array $query,
    string $body,
    array $extraHeaders,
    array $creds
): array {
    $lastError = null;

    for ($attempt = 1; $attempt <= CF_MAX_RETRIES; $attempt++) {
        [$access, $secret, $token] = $creds;

        $amzDate = gmdate('Ymd\THis\Z');
    $trace[] = 'aws_signing_amz_date=' . $amzDate;
        $date = gmdate('Ymd');
        $payloadHash = hash('sha256', $body);

        $headers = [
            'host' => CF_HOST,
            'x-amz-content-sha256' => $payloadHash,
            'x-amz-date' => $amzDate
        ];

        if ($token) {
            $headers['x-amz-security-token'] = $token;
        }

        foreach ($extraHeaders as $k => $v) {
            $headers[strtolower($k)] = trim((string)$v);
        }

        ksort($headers);

        $canonicalHeaders = '';
        $signedHeaderNames = [];

        foreach ($headers as $k => $v) {
            $canonicalHeaders .= strtolower($k) . ':' . preg_replace('/\s+/', ' ', trim((string)$v)) . "\n";
            $signedHeaderNames[] = strtolower($k);
        }

        $signedHeaders = implode(';', $signedHeaderNames);
        $canonicalQuery = canonical_query($query);

        $canonicalRequest = implode("\n", [
            strtoupper($method),
            $path,
            $canonicalQuery,
            $canonicalHeaders,
            $signedHeaders,
            $payloadHash
        ]);

        $credentialScope = "{$date}/" . AWS_REGION . "/" . AWS_SERVICE . "/aws4_request";

        $stringToSign = implode("\n", [
            'AWS4-HMAC-SHA256',
            $amzDate,
            $credentialScope,
            hash('sha256', $canonicalRequest)
        ]);

        $signature = hash_hmac('sha256', $stringToSign, signing_key($secret, $date, AWS_REGION, AWS_SERVICE));

        $authorization = 'AWS4-HMAC-SHA256 Credential=' . $access . '/' . $credentialScope .
            ', SignedHeaders=' . $signedHeaders .
            ', Signature=' . $signature;

        $url = 'https://' . CF_HOST . $path . ($canonicalQuery ? '?' . $canonicalQuery : '');

        $curlHeaders = [];
        foreach ($headers as $k => $v) {
            $curlHeaders[] = $k . ': ' . $v;
        }
        $curlHeaders[] = 'Authorization: ' . $authorization;

        $ch = curl_init($url);
        $curlOptionsMain = [
            CURLOPT_CUSTOMREQUEST => strtoupper($method),
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HEADER => true,
            CURLOPT_HTTPHEADER => $curlHeaders,
            CURLOPT_TIMEOUT => 12
        ];
        $curlTraceUnused = [];
        apply_cloudfront_tls_options($curlOptionsMain, $curlTraceUnused);
        curl_setopt_array($ch, $curlOptionsMain);

        if ($body !== '' || in_array(strtoupper($method), ['POST', 'PUT'], true)) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
        }

        $raw = curl_exec($ch);

        if ($raw === false) {
            $lastError = 'cURL error: ' . curl_error($ch);
            curl_close($ch);

            if ($attempt < CF_MAX_RETRIES) {
                sleep(retry_sleep_seconds($attempt));
                continue;
            }

            throw new RuntimeException($lastError);
        }

        $status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
        $headerSize = (int)curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        curl_close($ch);

        $rawHeaders = substr($raw, 0, $headerSize);
        $responseBody = substr($raw, $headerSize);

        $responseHeaders = [];
        foreach (explode("\r\n", trim($rawHeaders)) as $line) {
            if (strpos($line, ':') !== false) {
                [$k, $v] = explode(':', $line, 2);
                $responseHeaders[strtolower(trim($k))] = trim($v);
            }
        }

        if ($status >= 200 && $status < 300) {
            return [$status, $responseHeaders, $responseBody];
        }

        if (is_cloudfront_throttle_response($status, $responseBody) && $attempt < CF_MAX_RETRIES) {
            sleep(retry_sleep_seconds($attempt));
            continue;
        }

        $lastError = "AWS {$method} {$path} failed with HTTP {$status}\n{$responseBody}";
        break;
    }

    throw new RuntimeException($lastError ?: "AWS {$method} {$path} failed after retries.");
}


function ns_xpath(SimpleXMLElement $xml): SimpleXMLElement {
    $xml->registerXPathNamespace('cf', 'http://cloudfront.amazonaws.com/doc/2020-05-31/');
    return $xml;
}

function text_xml(string $value): string {
    return htmlspecialchars($value, ENT_XML1 | ENT_COMPAT, 'UTF-8');
}

function cache_policy_xml(string $name, string $comment, int $min, int $default, int $max, bool $compression = true): string {
    return '<?xml version="1.0" encoding="UTF-8"?>' . "\n" .
        '<CachePolicyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">' .
        '<Name>' . text_xml($name) . '</Name>' .
        '<Comment>' . text_xml($comment) . '</Comment>' .
        '<DefaultTTL>' . $default . '</DefaultTTL>' .
        '<MaxTTL>' . $max . '</MaxTTL>' .
        '<MinTTL>' . $min . '</MinTTL>' .
        '<ParametersInCacheKeyAndForwardedToOrigin>' .
        '<EnableAcceptEncodingGzip>' . ($compression ? 'true' : 'false') . '</EnableAcceptEncodingGzip>' .
        '<EnableAcceptEncodingBrotli>' . ($compression ? 'true' : 'false') . '</EnableAcceptEncodingBrotli>' .
        '<HeadersConfig><HeaderBehavior>none</HeaderBehavior></HeadersConfig>' .
        '<CookiesConfig><CookieBehavior>none</CookieBehavior></CookiesConfig>' .
        '<QueryStringsConfig><QueryStringBehavior>none</QueryStringBehavior></QueryStringsConfig>' .
        '</ParametersInCacheKeyAndForwardedToOrigin>' .
        '</CachePolicyConfig>';
}

function response_headers_policy_xml(): string {
    return '<?xml version="1.0" encoding="UTF-8"?>' . "\n" .
        '<ResponseHeadersPolicyConfig xmlns="http://cloudfront.amazonaws.com/doc/2020-05-31/">' .
        '<Name>' . MEDIA_CORS_POLICY_NAME . '</Name>' .
        '<Comment>Simple public CORS for cached image, audio, and video assets.</Comment>' .
        '<CorsConfig>' .
        '<AccessControlAllowOrigins><Quantity>1</Quantity><Items><Origin>*</Origin></Items></AccessControlAllowOrigins>' .
        '<AccessControlAllowHeaders><Quantity>1</Quantity><Items><Header>*</Header></Items></AccessControlAllowHeaders>' .
        '<AccessControlAllowMethods><Quantity>3</Quantity><Items><Method>GET</Method><Method>HEAD</Method><Method>OPTIONS</Method></Items></AccessControlAllowMethods>' .
        '<AccessControlAllowCredentials>false</AccessControlAllowCredentials>' .
        '<AccessControlExposeHeaders><Quantity>6</Quantity><Items>' .
        '<Header>Content-Length</Header>' .
        '<Header>Content-Type</Header>' .
        '<Header>ETag</Header>' .
        '<Header>Last-Modified</Header>' .
        '<Header>Accept-Ranges</Header>' .
        '<Header>Content-Range</Header>' .
        '</Items></AccessControlExposeHeaders>' .
        '<AccessControlMaxAgeSec>31536000</AccessControlMaxAgeSec>' .
        '<OriginOverride>true</OriginOverride>' .
        '</CorsConfig>' .
        '<CustomHeadersConfig><Quantity>0</Quantity></CustomHeadersConfig>' .
        '<RemoveHeadersConfig><Quantity>0</Quantity></RemoveHeadersConfig>' .
        '</ResponseHeadersPolicyConfig>';
}

function find_cache_policy_id(string $name, array $creds): ?string {
    foreach (['custom', 'managed'] as $type) {
        [$status, $headers, $body] = cloudfront_request('GET', '/' . CF_VERSION . '/cache-policy', ['Type' => $type], '', [], $creds);
        $xml = ns_xpath(simplexml_load_string($body));
        $items = $xml->xpath('//cf:CachePolicySummary');

        foreach ($items ?: [] as $summary) {
            $summary = ns_xpath($summary);
            $names = $summary->xpath('.//cf:CachePolicyConfig/cf:Name');
            $ids = $summary->xpath('.//cf:Id');
            if ($names && $ids && (string)$names[0] === $name) {
                return (string)$ids[0];
            }
        }
    }
    return null;
}

function find_response_headers_policy_id(string $name, array $creds): ?string {
    foreach (['custom', 'managed'] as $type) {
        [$status, $headers, $body] = cloudfront_request('GET', '/' . CF_VERSION . '/response-headers-policy', ['Type' => $type], '', [], $creds);
        $xml = ns_xpath(simplexml_load_string($body));
        $items = $xml->xpath('//cf:ResponseHeadersPolicySummary');

        foreach ($items ?: [] as $summary) {
            $summary = ns_xpath($summary);
            $names = $summary->xpath('.//cf:ResponseHeadersPolicyConfig/cf:Name');
            $ids = $summary->xpath('.//cf:Id');
            if ($names && $ids && (string)$names[0] === $name) {
                return (string)$ids[0];
            }
        }
    }
    return null;
}

function ensure_cache_policy(string $name, string $xml, array $creds, bool $apply, array &$log): string {
    $existing = find_cache_policy_id($name, $creds);
    if ($existing) {
        $log[] = "Cache policy exists: {$name} → {$existing}";
        return $existing;
    }

    if (!$apply) {
        $log[] = "DRY RUN: would create cache policy {$name}";
        return 'DRY-RUN-' . $name;
    }

    [$status, $headers, $body] = cloudfront_request('POST', '/' . CF_VERSION . '/cache-policy', [], $xml, ['content-type' => 'application/xml'], $creds);
    $doc = ns_xpath(simplexml_load_string($body));
    $ids = $doc->xpath('//cf:Id');

    if (!$ids) {
        throw new RuntimeException("Created policy {$name}, but could not parse returned Id.");
    }

    $log[] = "Created cache policy: {$name} → {$ids[0]}";
    return (string)$ids[0];
}

function ensure_response_headers_policy(string $name, string $xml, array $creds, bool $apply, array &$log): string {
    $existing = find_response_headers_policy_id($name, $creds);
    if ($existing) {
        $log[] = "Response headers policy exists: {$name} → {$existing}";
        return $existing;
    }

    if (!$apply) {
        $log[] = "DRY RUN: would create response headers policy {$name}";
        return 'DRY-RUN-' . $name;
    }

    [$status, $headers, $body] = cloudfront_request('POST', '/' . CF_VERSION . '/response-headers-policy', [], $xml, ['content-type' => 'application/xml'], $creds);
    $doc = ns_xpath(simplexml_load_string($body));
    $ids = $doc->xpath('//cf:Id');

    if (!$ids) {
        throw new RuntimeException("Created response headers policy {$name}, but could not parse returned Id.");
    }

    $log[] = "Created response headers policy: {$name} → {$ids[0]}";
    return (string)$ids[0];
}

function dom_xpath(DOMDocument $doc): DOMXPath {
    $xp = new DOMXPath($doc);
    $xp->registerNamespace('cf', 'http://cloudfront.amazonaws.com/doc/2020-05-31/');
    return $xp;
}

function set_child_text(DOMDocument $doc, DOMElement $parent, string $localName, string $value): void {
    $xp = dom_xpath($doc);
    $nodes = $xp->query('./cf:' . $localName, $parent);

    if ($nodes && $nodes->length) {
        $nodes->item(0)->nodeValue = $value;
        return;
    }

    $el = $doc->createElementNS('http://cloudfront.amazonaws.com/doc/2020-05-31/', $localName, $value);
    $parent->appendChild($el);
}

function ensure_empty_associations(DOMDocument $doc, DOMElement $behavior, string $name): void {
    $ns = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';
    $xp = dom_xpath($doc);
    $nodes = $xp->query('./cf:' . $name, $behavior);

    if ($nodes && $nodes->length) {
        $node = $nodes->item(0);
        while ($node->firstChild) {
            $node->removeChild($node->firstChild);
        }
    } else {
        $node = $doc->createElementNS($ns, $name);
        $behavior->appendChild($node);
    }

    $node->appendChild($doc->createElementNS($ns, 'Quantity', '0'));
}

function first_child_text(DOMDocument $doc, DOMElement $parent, string $localName, ?string $fallback = null): ?string {
    $xp = dom_xpath($doc);
    $nodes = $xp->query('./cf:' . $localName, $parent);

    if ($nodes && $nodes->length) {
        return $nodes->item(0)->textContent;
    }

    return $fallback;
}

function clone_child_if_exists(DOMDocument $doc, DOMElement $from, DOMElement $to, string $localName): void {
    $xp = dom_xpath($doc);
    $nodes = $xp->query('./cf:' . $localName, $from);

    if ($nodes && $nodes->length) {
        $to->appendChild($doc->importNode($nodes->item(0), true));
    }
}

function restore_edge_associations_from_default(DOMDocument $doc, DOMElement $default, DOMElement $behavior): void
{
    $xp = dom_xpath($doc);

    foreach (['LambdaFunctionAssociations', 'FunctionAssociations'] as $name) {
        $existing = $xp->query('./cf:' . $name, $behavior);
        if ($existing) {
            foreach (iterator_to_array($existing) as $node) {
                if ($node instanceof DOMNode) {
                    $behavior->removeChild($node);
                }
            }
        }

        $source = $xp->query('./cf:' . $name, $default)->item(0);
        if ($source instanceof DOMElement) {
            $behavior->appendChild($doc->importNode($source, true));
        } else {
            ensure_empty_associations($doc, $behavior, $name);
        }
    }
}


function append_get_head_options_allowed_methods(DOMDocument $doc, DOMElement $to): void {
    $ns = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';

    $allowed = $doc->createElementNS($ns, 'AllowedMethods');
    $allowed->appendChild($doc->createElementNS($ns, 'Quantity', '3'));

    $items = $doc->createElementNS($ns, 'Items');
    $items->appendChild($doc->createElementNS($ns, 'Method', 'GET'));
    $items->appendChild($doc->createElementNS($ns, 'Method', 'HEAD'));
    $items->appendChild($doc->createElementNS($ns, 'Method', 'OPTIONS'));
    $allowed->appendChild($items);

    $cached = $doc->createElementNS($ns, 'CachedMethods');
    $cached->appendChild($doc->createElementNS($ns, 'Quantity', '2'));

    $cachedItems = $doc->createElementNS($ns, 'Items');
    $cachedItems->appendChild($doc->createElementNS($ns, 'Method', 'GET'));
    $cachedItems->appendChild($doc->createElementNS($ns, 'Method', 'HEAD'));
    $cached->appendChild($cachedItems);

    $allowed->appendChild($cached);
    $to->appendChild($allowed);
}

function ensure_allowed_methods(DOMDocument $doc, DOMElement $behavior): void {
    $xp = dom_xpath($doc);
    $nodes = $xp->query('./cf:AllowedMethods', $behavior);

    if ($nodes && $nodes->length) {
        return;
    }

    append_get_head_options_allowed_methods($doc, $behavior);
}

function clone_default_as_behavior(DOMDocument $doc, DOMElement $default, string $pathPattern): DOMElement {
    $ns = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';
    $behavior = $doc->createElementNS($ns, 'CacheBehavior');

    $targetOriginId = first_child_text($doc, $default, 'TargetOriginId');
    $viewerProtocolPolicy = first_child_text($doc, $default, 'ViewerProtocolPolicy', 'redirect-to-https');

    if (!$targetOriginId) {
        throw new RuntimeException('DefaultCacheBehavior is missing TargetOriginId; refusing to build derived behavior.');
    }

    if (!$viewerProtocolPolicy) {
        throw new RuntimeException('DefaultCacheBehavior is missing ViewerProtocolPolicy; refusing to build derived behavior.');
    }

    $behavior->appendChild($doc->createElementNS($ns, 'PathPattern', $pathPattern));
    $behavior->appendChild($doc->createElementNS($ns, 'TargetOriginId', $targetOriginId));

    clone_child_if_exists($doc, $default, $behavior, 'TrustedSigners');
    clone_child_if_exists($doc, $default, $behavior, 'TrustedKeyGroups');

    $behavior->appendChild($doc->createElementNS($ns, 'ViewerProtocolPolicy', $viewerProtocolPolicy));

    append_get_head_options_allowed_methods($doc, $behavior);

    $smoothStreaming = first_child_text($doc, $default, 'SmoothStreaming', 'false');
    $behavior->appendChild($doc->createElementNS($ns, 'SmoothStreaming', $smoothStreaming ?: 'false'));

    $behavior->appendChild($doc->createElementNS($ns, 'Compress', 'true'));

    clone_child_if_exists($doc, $default, $behavior, 'LambdaFunctionAssociations');
    clone_child_if_exists($doc, $default, $behavior, 'FunctionAssociations');

    // CloudFront requires these association containers to be present.
    if (!dom_xpath($doc)->query('./cf:LambdaFunctionAssociations', $behavior)->length) {
        ensure_empty_associations($doc, $behavior, 'LambdaFunctionAssociations');
    }
    if (!dom_xpath($doc)->query('./cf:FunctionAssociations', $behavior)->length) {
        ensure_empty_associations($doc, $behavior, 'FunctionAssociations');
    }

    $fieldLevelEncryptionId = first_child_text($doc, $default, 'FieldLevelEncryptionId', '');
    $behavior->appendChild($doc->createElementNS($ns, 'FieldLevelEncryptionId', $fieldLevelEncryptionId ?? ''));

    clone_child_if_exists($doc, $default, $behavior, 'RealtimeLogConfigArn');
    clone_child_if_exists($doc, $default, $behavior, 'OriginRequestPolicyId');
    clone_child_if_exists($doc, $default, $behavior, 'ResponseHeadersPolicyId');

    return $behavior;
}

function configure_behavior(DOMDocument $doc, DOMElement $behavior, string $cachePolicyId, ?string $responseHeadersPolicyId, bool $keepEdgeCode): void {
    set_child_text($doc, $behavior, 'CachePolicyId', $cachePolicyId);
    if ($responseHeadersPolicyId) {
        set_child_text($doc, $behavior, 'ResponseHeadersPolicyId', $responseHeadersPolicyId);
    }
    if (!$keepEdgeCode) {
        ensure_empty_associations($doc, $behavior, 'LambdaFunctionAssociations');
        ensure_empty_associations($doc, $behavior, 'FunctionAssociations');
    }
    set_child_text($doc, $behavior, 'Compress', 'true');
    ensure_allowed_methods($doc, $behavior);
}

function behavior_priority(string $pattern, array $mediaPatterns): int {
    if ($pattern === '*debug*') return 0;
    if ($pattern === '*.json') return 1;
    if (in_array($pattern, $mediaPatterns, true)) return 2;
    return 9;
}

function rebuild_cache_behaviors(DOMDocument $doc, array $behaviors, array $mediaPatterns): void {
    $xp = dom_xpath($doc);
    $ns = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';
    $config = $xp->query('/cf:DistributionConfig')->item(0);

    $old = $xp->query('/cf:DistributionConfig/cf:CacheBehaviors')->item(0);
    if ($old) {
        $config->removeChild($old);
    }

    usort($behaviors, function (DOMElement $a, DOMElement $b) use ($doc, $mediaPatterns): int {
        $xp = dom_xpath($doc);
        $pa = $xp->query('./cf:PathPattern', $a)->item(0)->nodeValue;
        $pb = $xp->query('./cf:PathPattern', $b)->item(0)->nodeValue;
        $priorityA = behavior_priority($pa, $mediaPatterns);
        $priorityB = behavior_priority($pb, $mediaPatterns);
        return $priorityA === $priorityB ? strcmp($pa, $pb) : ($priorityA <=> $priorityB);
    });

    $cacheBehaviors = $doc->createElementNS($ns, 'CacheBehaviors');
    $cacheBehaviors->appendChild($doc->createElementNS($ns, 'Quantity', (string)count($behaviors)));

    if ($behaviors) {
        $items = $doc->createElementNS($ns, 'Items');
        foreach ($behaviors as $behavior) {
            $items->appendChild($behavior);
        }
        $cacheBehaviors->appendChild($items);
    }

    $default = $xp->query('/cf:DistributionConfig/cf:DefaultCacheBehavior')->item(0);
    if ($default && $default->nextSibling) {
        $config->insertBefore($cacheBehaviors, $default->nextSibling);
    } else {
        $config->appendChild($cacheBehaviors);
    }
}


function element_to_stable_xml(DOMDocument $doc, DOMElement $element): string {
    $clone = new DOMDocument('1.0', 'UTF-8');
    $clone->preserveWhiteSpace = false;
    $clone->formatOutput = false;
    $clone->appendChild($clone->importNode($element, true));
    return trim($clone->saveXML($clone->documentElement));
}

function restore_default_cache_behavior_from_snapshot(DOMDocument $doc, string $snapshotXml): void {
    $xp = dom_xpath($doc);
    $current = $xp->query('/cf:DistributionConfig/cf:DefaultCacheBehavior')->item(0);
    if (!$current instanceof DOMElement) {
        throw new RuntimeException('SAFETY STOP: DefaultCacheBehavior disappeared while generating candidate XML. Refusing to update CloudFront.');
    }

    $snapshotDoc = new DOMDocument('1.0', 'UTF-8');
    $snapshotDoc->preserveWhiteSpace = false;
    if (!$snapshotDoc->loadXML($snapshotXml) || !$snapshotDoc->documentElement) {
        throw new RuntimeException('SAFETY STOP: Could not reload DefaultCacheBehavior safety snapshot. Refusing to update CloudFront.');
    }

    $imported = $doc->importNode($snapshotDoc->documentElement, true);
    $current->parentNode->replaceChild($imported, $current);
}

function assert_default_cache_behavior_unchanged(DOMDocument $doc, string $snapshotXml): void {
    $xp = dom_xpath($doc);
    $current = $xp->query('/cf:DistributionConfig/cf:DefaultCacheBehavior')->item(0);
    if (!$current instanceof DOMElement) {
        throw new RuntimeException('SAFETY STOP: DefaultCacheBehavior missing after candidate XML generation. Refusing to update CloudFront.');
    }

    $currentXml = element_to_stable_xml($doc, $current);
    if ($currentXml !== trim($snapshotXml)) {
        throw new RuntimeException('SAFETY STOP: DefaultCacheBehavior changed during candidate XML generation. Refusing to update CloudFront.');
    }
}

function summarize_default_edge_state(DOMDocument $doc, DOMElement $default): string {
    $xp = dom_xpath($doc);
    $rhs = first_child_text($doc, $default, 'ResponseHeadersPolicyId', 'none');
    $lambdaQty = first_child_text($doc, $xp->query('./cf:LambdaFunctionAssociations', $default)->item(0) ?: $default, 'Quantity', '0');
    $funcQty = first_child_text($doc, $xp->query('./cf:FunctionAssociations', $default)->item(0) ?: $default, 'Quantity', '0');
    return 'Default lock captured: ResponseHeadersPolicyId=' . ($rhs ?: 'none') . ', LambdaFunctionAssociations=' . ($lambdaQty ?: '0') . ', FunctionAssociations=' . ($funcQty ?: '0');
}

function normalize_required_association_blocks(DOMDocument $doc): void {
    $xp = dom_xpath($doc);

    // v159 safety rule: NEVER mutate DefaultCacheBehavior. The directory browser,
    // inline-text function, and default response headers live there and must survive
    // every run byte-for-byte. Only ordered CacheBehavior items are normalized.

    $items = $xp->query('/cf:DistributionConfig/cf:CacheBehaviors/cf:Items/cf:CacheBehavior');
    if ($items) {
        foreach ($items as $behavior) {
            if ($behavior instanceof DOMElement) {
                ensure_empty_associations_if_missing($doc, $behavior, 'LambdaFunctionAssociations');
                ensure_empty_associations_if_missing($doc, $behavior, 'FunctionAssociations');
            }
        }
    }
}

function ensure_empty_associations_if_missing(DOMDocument $doc, DOMElement $behavior, string $name): void {
    $xp = dom_xpath($doc);
    $nodes = $xp->query('./cf:' . $name, $behavior);

    if ($nodes && $nodes->length) {
        return;
    }

    ensure_empty_associations($doc, $behavior, $name);
}

function validate_required_behavior_fields(DOMDocument $doc): array {
    $xp = dom_xpath($doc);
    $errors = [];

    $default = $xp->query('/cf:DistributionConfig/cf:DefaultCacheBehavior')->item(0);
    if ($default instanceof DOMElement) {
        foreach (['TargetOriginId', 'ViewerProtocolPolicy', 'LambdaFunctionAssociations', 'FunctionAssociations'] as $field) {
            $value = first_child_text($doc, $default, $field);
            if ($value === null || trim($value) === '') {
                $errors[] = "DefaultCacheBehavior missing {$field}";
            }
        }
    } else {
        $errors[] = 'DistributionConfig missing DefaultCacheBehavior';
    }

    $items = $xp->query('/cf:DistributionConfig/cf:CacheBehaviors/cf:Items/cf:CacheBehavior');
    if ($items) {
        foreach ($items as $idx => $behavior) {
            if ($behavior instanceof DOMElement) {
                foreach (['PathPattern', 'TargetOriginId', 'ViewerProtocolPolicy', 'AllowedMethods', 'LambdaFunctionAssociations', 'FunctionAssociations'] as $field) {
                    $value = first_child_text($doc, $behavior, $field);
                    if ($value === null || trim($value) === '') {
                        $errors[] = "CacheBehavior item {$idx} missing {$field}";
                    }
                }
            }
        }
    }

    return $errors;
}


function validate_association_quantities(DOMDocument $doc): array {
    $xp = dom_xpath($doc);
    $errors = [];

    $nodes = $xp->query('//cf:DefaultCacheBehavior | //cf:CacheBehavior');
    if ($nodes) {
        foreach ($nodes as $idx => $behavior) {
            if ($behavior instanceof DOMElement) {
                foreach (['LambdaFunctionAssociations', 'FunctionAssociations'] as $name) {
                    $assoc = $xp->query('./cf:' . $name, $behavior)->item(0);
                    if (!$assoc instanceof DOMElement) {
                        $errors[] = "Behavior {$idx} missing {$name}";
                        continue;
                    }
                    $qty = $xp->query('./cf:Quantity', $assoc)->item(0);
                    if (!$qty || trim($qty->textContent) === '') {
                        $errors[] = "Behavior {$idx} {$name} missing Quantity";
                    }
                }
            }
        }
    }

    return $errors;
}


function config_behavior_patterns_from_xml(string $xml): array {
    $patterns = [];
    $previous = libxml_use_internal_errors(true);
    try {
        $doc = new DOMDocument();
        if ($doc->loadXML($xml)) {
            $xpath = new DOMXPath($doc);
            foreach ($xpath->query('//*[local-name()="CacheBehaviors"]/*[local-name()="Items"]/*[local-name()="CacheBehavior"]/*[local-name()="PathPattern"]') as $node) {
                $patterns[] = trim($node->textContent);
            }
            foreach ($xpath->query('//*[local-name()="DefaultCacheBehavior"]') as $node) {
                if (!in_array('Default (*)', $patterns, true)) {
                    array_unshift($patterns, 'Default (*)');
                }
                break;
            }
        }
    } catch (Throwable $e) {
        // Caller logs verification failure.
    }
    libxml_clear_errors();
    libxml_use_internal_errors($previous);
    return array_values(array_unique(array_filter($patterns, static fn($v) => $v !== '')));
}


// PUBLIC MANUAL FALLBACKS DISABLED in v110: only loaded grid checkbox selections are public.
function append_known_target_warning(array &$log, string $id, string $label): void {
    $needle = strtolower($label . ' ' . $id);
    if (strpos($needle, 'media.define.com') !== false && $id !== 'E38Z4BOCM2WWK2') {
        $log[] = "TARGET WARNING: media.define.com is expected to be distribution E38Z4BOCM2WWK2 from the AWS console screenshot, but this run is targeting " . distribution_display_name($id, $label) . ".";
    }
}

function append_post_update_distribution_verification(array &$log, string $id, string $label, array $creds): void {
    $display = distribution_display_name($id, $label);

    try {
        [$status, $body] = cloudfront_request(
            'GET',
            '/' . CF_VERSION . '/distribution/' . rawurlencode($id) . '/config',
            [],
            null,
            $creds
        );

        if ($status < 200 || $status >= 300) {
            $log[] = "VERIFY PENDING for {$display}: CloudFront accepted the update, but the immediate verification read returned HTTP {$status}. This does not mean the apply failed.";
            $log[] = "VERIFY NOTE for {$display}: verification is advisory. Check the exact distribution ID in the AWS Console Behaviors tab after CloudFront finishes processing the update.";
            return;
        }

        $patterns = config_behavior_patterns_from_xml($body);
        $behaviorCount = max(0, count($patterns) - (in_array('Default (*)', $patterns, true) ? 1 : 0));

        if ($patterns) {
            $log[] = "VERIFY READBACK for {$display}: CloudFront returned {$behaviorCount} ordered cache behavior(s) plus the default behavior.";
            $log[] = "VERIFY behavior patterns for {$display}: " . implode(', ', $patterns);
        } else {
            $log[] = "VERIFY PENDING for {$display}: CloudFront accepted the update, but the immediate verification read did not return readable behavior patterns.";
            $log[] = "VERIFY NOTE for {$display}: verification is advisory while CloudFront is still processing the distribution update.";
        }
    } catch (Throwable $e) {
        $log[] = "VERIFY PENDING for {$display}: CloudFront accepted the update, but immediate verification could not complete. " . $e->getMessage();
        $log[] = "VERIFY NOTE for {$display}: verification is advisory. Check the exact distribution ID in the AWS Console Behaviors tab after the update finishes processing.";
    }
}

function update_distribution(string $id, string $label, array $config, array $policyIds, array $creds, bool $apply, array &$log, ?callable $progress = null): void {
    $log[] = "=== Distribution " . distribution_display_name($id, $label) . " ===";
    $emit = function (string $message, string $kind = 'wait') use ($progress): void {
        if ($progress) {
            $progress($message, $kind);
        }
    };
    $emit('Reading CloudFront config for ' . distribution_display_name($id, $label) . '.', 'wait');
        append_known_target_warning($log, $id, $label);
$addedCount = 0;
    $updatedCount = 0;

    [$status, $headers, $body] = cloudfront_request('GET', '/' . CF_VERSION . '/distribution/' . rawurlencode($id) . '/config', [], '', [], $creds);
    $etag = $headers['etag'] ?? null;

    if (!$etag) {
        throw new RuntimeException("No ETag returned for distribution {$id}.");
    }

    $doc = new DOMDocument('1.0', 'UTF-8');
    $doc->preserveWhiteSpace = false;
    $doc->formatOutput = true;
    $doc->loadXML($body);

    $xp = dom_xpath($doc);
    $default = $xp->query('/cf:DistributionConfig/cf:DefaultCacheBehavior')->item(0);

    if (!$default instanceof DOMElement) {
        throw new RuntimeException("Could not find DefaultCacheBehavior in distribution {$id}.");
    }

    // v159 hard safety lock: capture DefaultCacheBehavior before any generated changes.
    // The app may update ordered media CacheBehaviors only. It must never change
    // the Default behavior's response headers policy, CloudFront Function, or Lambda@Edge.
    $defaultSnapshotXml = element_to_stable_xml($doc, $default);
    $log[] = summarize_default_edge_state($doc, $default);
    $log[] = "SAFETY LOCK: Default (*) will be restored from snapshot and verified unchanged before upload.";
    $emit('Default behavior safety snapshot captured for ' . distribution_display_name($id, $label) . '.', 'good');

    $existingNodes = $xp->query('/cf:DistributionConfig/cf:CacheBehaviors/cf:Items/cf:CacheBehavior');
    $behaviors = [];
    if ($existingNodes) {
        foreach ($existingNodes as $node) {
            if ($node instanceof DOMElement) {
                $behaviors[] = $node->cloneNode(true);
            }
        }
    }

    $upsert = function (string $pattern, string $cachePolicyId, ?string $responsePolicyId, bool $keepEdgeCode, bool $restoreDefaultEdgeCode = false) use ($doc, $default, &$behaviors, &$log, &$addedCount, &$updatedCount): void {
        $foundIndex = null;
        $xp = dom_xpath($doc);

        foreach ($behaviors as $idx => $behavior) {
            $pathNode = $xp->query('./cf:PathPattern', $behavior)->item(0);
            if ($pathNode && $pathNode->nodeValue === $pattern) {
                $foundIndex = $idx;
                break;
            }
        }

        if ($foundIndex === null) {
            $behavior = clone_default_as_behavior($doc, $default, $pattern);
            if ($restoreDefaultEdgeCode) {
                restore_edge_associations_from_default($doc, $default, $behavior);
            }
            configure_behavior($doc, $behavior, $cachePolicyId, $responsePolicyId, $keepEdgeCode);
            $behaviors[] = $behavior;
            $addedCount++;
            $log[] = "added {$pattern}";
            if ($restoreDefaultEdgeCode) {
                $log[] = "preserved default edge code for {$pattern}";
            }
        } else {
            if ($restoreDefaultEdgeCode) {
                restore_edge_associations_from_default($doc, $default, $behaviors[$foundIndex]);
            }
            configure_behavior($doc, $behaviors[$foundIndex], $cachePolicyId, $responsePolicyId, $keepEdgeCode);
            $updatedCount++;
            $log[] = "updated {$pattern}";
            if ($restoreDefaultEdgeCode) {
                $log[] = "restored default edge code for {$pattern}";
            }
        }
    };

    if (!empty($config['addDebugBehavior'])) {
        $upsert('*debug*', $policyIds['debug'], null, true, true);
    }

    if (!empty($config['addJsonBehavior'])) {
        $log[] = "skipped *.json: JSON directory-index behavior is intentionally left untouched";
    }

    if (!empty($config['addMediaBehaviors'])) {
        foreach ($config['mediaPatterns'] as $pattern) {
            // Media behaviors need the public CORS response headers policy and long cache.
            // They intentionally do NOT inherit the Default behavior edge code:
            // - no directory-browser Lambda@Edge for images/video/audio/fonts
            // - no force-UTF8 / inline-text CloudFront Function for binary media
            $upsert($pattern, $policyIds['media'], $policyIds['cors'], false, false);
            $log[] = "media CORS-only behavior for {$pattern}: no Default edge Lambda or CloudFront Function copied";
        }
    }

    rebuild_cache_behaviors($doc, $behaviors, $config['mediaPatterns']);

    normalize_required_association_blocks($doc);

    // Restore and verify Default behavior after all generated behavior changes.
    restore_default_cache_behavior_from_snapshot($doc, $defaultSnapshotXml);
    assert_default_cache_behavior_unchanged($doc, $defaultSnapshotXml);
    $log[] = "SAFETY LOCK PASSED: Default (*) is byte-for-byte unchanged in the candidate XML.";
    $emit('SAFETY LOCK PASSED for ' . distribution_display_name($id, $label) . ': Default (*) unchanged.', 'good');

    $doc->insertBefore($doc->createComment(' Generated by ' . TOOL_PACKAGE_NAME . ' ' . TOOL_VERSION . ' built ' . TOOL_BUILD_TIMESTAMP_UTC . ' at ' . gmdate('c') . ' '), $doc->documentElement);
    $candidateXml = $doc->saveXML();
    $log[] = "summary for " . distribution_display_name($id, $label) . ": added {$addedCount}, updated {$updatedCount}";
    $log[] = "candidate XML kept in memory for " . distribution_display_name($id, $label) . "; use Copy results or Download results.";

    $validationErrors = array_merge(validate_required_behavior_fields($doc), validate_association_quantities($doc));
    if ($validationErrors) {
        throw new RuntimeException("Generated CloudFront XML failed local validation before upload:\n" . implode("\n", $validationErrors));
    }

    if (!$apply) {
        $log[] = "DRY RUN ONLY for " . distribution_display_name($id, $label) . ": no update sent.";
        $emit('Dry run complete for ' . distribution_display_name($id, $label) . ': no update sent.', 'good');
        $log[] = "----- BEGIN CANDIDATE XML " . distribution_display_name($id, $label) . " -----";
        $log[] = $candidateXml;
        $log[] = "----- END CANDIDATE XML " . distribution_display_name($id, $label) . " -----";
        return;
    }

    [$putStatus] = cloudfront_request(
        'PUT',
        '/' . CF_VERSION . '/distribution/' . rawurlencode($id) . '/config',
        [],
        $candidateXml,
        [
            'content-type' => 'application/xml',
            'if-match' => $etag
        ],
        $creds
    );

    $log[] = "updated distribution " . distribution_display_name($id, $label) . "; HTTP {$putStatus}";
    $emit('CloudFront accepted update for ' . distribution_display_name($id, $label) . '; HTTP ' . $putStatus . '.', 'good');
    
            if ($putStatus >= 200 && $putStatus < 300) {
                $log[] = "UPDATE ACCEPTED for " . distribution_display_name($id, $label) . ": CloudFront accepted the new distribution config. Console visibility can lag while the distribution update deploys.";
            }
append_post_update_distribution_verification($log, $id, $label, $creds);
}


function parse_distribution_pairs(string $idsText, string $labelsText): array {
    $ids = lines_to_array($idsText);
    $labels = lines_to_array($labelsText);
    $out = [];

    foreach ($ids as $i => $line) {
        // Backward compatibility: accept DISTRIBUTION_ID|friendly name in the ID box.
        $parts = array_map('trim', explode('|', $line, 2));
        $id = $parts[0] ?? '';
        $inlineLabel = $parts[1] ?? '';
        $label = $inlineLabel !== '' ? $inlineLabel : ($labels[$i] ?? '');

        if ($id !== '') {
            $out[] = [
                'id' => $id,
                'label' => $label !== '' ? $label : $id
            ];
        }
    }

    return $out;
}

function parse_distribution_lines(string $text): array {
    $out = [];
    foreach (lines_to_array($text) as $line) {
        $parts = array_map('trim', explode('|', $line, 2));
        $id = $parts[0] ?? '';
        $label = $parts[1] ?? '';

        if ($id !== '') {
            $out[] = [
                'id' => $id,
                'label' => $label !== '' ? $label : $id
            ];
        }
    }
    return $out;
}

function distribution_display_name(string $id, string $label): string {
    return $label && $label !== $id ? "{$id} ({$label})" : $id;
}


function distribution_friendly_name(array $dist): string {
    $aliases = $dist['aliases'] ?? [];
    $comment = trim((string)($dist['comment'] ?? ''));
    $domain = trim((string)($dist['domain'] ?? ''));
    $id = trim((string)($dist['id'] ?? ''));

    if ($aliases) {
        return $aliases[0];
    }

    if ($comment !== '') {
        return $comment;
    }

    if ($domain !== '') {
        return $domain;
    }

    return $id;
}

function parse_distribution_list_xml(string $body): array {
    $xml = ns_xpath(simplexml_load_string($body));
    $items = $xml->xpath('//cf:DistributionSummary');
    $out = [];

    foreach ($items ?: [] as $item) {
        $item = ns_xpath($item);

        $idNode = $item->xpath('./cf:Id');
        $domainNode = $item->xpath('./cf:DomainName');
        $commentNode = $item->xpath('./cf:Comment');
        $statusNode = $item->xpath('./cf:Status');
        $enabledNode = $item->xpath('./cf:Enabled');

        $aliases = [];
        $aliasNodes = $item->xpath('./cf:Aliases/cf:Items/cf:CNAME');
        foreach ($aliasNodes ?: [] as $alias) {
            $aliases[] = (string)$alias;
        }

        if ($idNode) {
            $dist = [
                'id' => (string)$idNode[0],
                'domain' => $domainNode ? (string)$domainNode[0] : '',
                'comment' => $commentNode ? (string)$commentNode[0] : '',
                'status' => $statusNode ? (string)$statusNode[0] : '',
                'enabled' => $enabledNode ? (string)$enabledNode[0] : '',
                'aliases' => $aliases
            ];
            $dist['friendly'] = distribution_friendly_name($dist);
            $out[] = $dist;
        }
    }

    usort($out, function ($a, $b) {
        return strcasecmp($a['friendly'], $b['friendly']);
    });

    return $out;
}

function discover_distributions(array $creds): array {
    $all = [];
    $marker = '';

    do {
        $query = $marker !== '' ? ['Marker' => $marker] : [];
        [$status, $headers, $body] = cloudfront_request('GET', '/' . CF_VERSION . '/distribution', $query, '', [], $creds);

        $batch = parse_distribution_list_xml($body);
        $all = array_merge($all, $batch);

        $xml = ns_xpath(simplexml_load_string($body));
        $isTruncated = $xml->xpath('//cf:IsTruncated');
        $nextMarker = $xml->xpath('//cf:NextMarker');

        $marker = ($isTruncated && (string)$isTruncated[0] === 'true' && $nextMarker)
            ? (string)$nextMarker[0]
            : '';
    } while ($marker !== '');

    return $all;
}

function encode_selected_distribution(array $dist): string {
    return base64_encode(json_encode([
        'id' => $dist['id'],
        'label' => $dist['friendly']
    ], JSON_UNESCAPED_SLASHES));
}

function decode_selected_distributions(array $encoded): array {
    $out = [];

    foreach ($encoded as $value) {
        $json = base64_decode((string)$value, true);
        if ($json === false) {
            continue;
        }

        $row = json_decode($json, true);
        if (is_array($row) && !empty($row['id'])) {
            $out[] = [
                'id' => (string)$row['id'],
                'label' => !empty($row['label']) ? (string)$row['label'] : (string)$row['id']
            ];
        }
    }

    return $out;
}


function load_local_config_file(string $path): array {
    $path = trim($path);

    if ($path === '') {
        $path = LOCAL_CONFIG_DEFAULT_PATH;
    }

    if (!is_file($path)) {
        throw new RuntimeException('LOCAL_CONFIG_NOT_FOUND');
    }

    $config = require $path;

    if (!is_array($config)) {
        throw new RuntimeException('LOCAL_CONFIG_NOT_ARRAY');
    }

    return $config;
}

function local_config_value(array $config, string $key, string $default = ''): string {
    $value = $config[$key] ?? $default;
    return is_scalar($value) ? (string)$value : $default;
}


function looks_like_placeholder_key(string $value): bool {
    $value = trim($value);

    if ($value === '') {
        return true;
    }

    return stripos($value, 'PASTE_') !== false
        || stripos($value, 'YOUR_') !== false
        || stripos($value, 'HERE') !== false
        || stripos($value, 'EXAMPLE') !== false;
}

function masked_key_hint(string $value): string {
    $value = trim($value);
    if ($value === '') {
        return '';
    }

    if (strlen($value) <= 8) {
        return 'configured';
    }

    return substr($value, 0, 4) . '…' . substr($value, -4);
}


function local_config_session_token(array $config): string {
    $token = local_config_value($config, 'awsSessionToken');
    if ($token === '') {
        $token = local_config_value($config, 'sessionToken');
    }
    if ($token === '') {
        $token = local_config_value($config, 'aws_session_token');
    }
    return $token;
}

function credentials_from_local_config_file_if_available(string $path): array {
    $path = trim($path);
    if ($path === '') {
        $path = LOCAL_CONFIG_DEFAULT_PATH;
    }

    if (!is_file($path)) {
        return [
            'found' => false,
            'path' => $path,
            'config' => [],
            'message' => 'Local config file not found. Manual AWS key entry is available.'
        ];
    }

    try {
        $config = load_local_config_file($path);
    } catch (Throwable $e) {
        $reason = $e->getMessage() === 'LOCAL_CONFIG_NOT_ARRAY'
            ? 'Local config file found, but it did not return a PHP array.'
            : 'Local config file found, but it could not be read.';
        return [
            'found' => true,
            'path' => $path,
            'config' => [],
            'message' => $reason,
            'error' => true
        ];
    }

    $access = local_config_value($config, 'awsAccessKeyId');
    $secret = local_config_value($config, 'awsSecretAccessKey');
    $token = local_config_session_token($config);

    $issues = [];
    if ($access === '') {
        $issues[] = 'awsAccessKeyId is missing';
    } elseif (looks_like_placeholder_key($access)) {
        $issues[] = 'awsAccessKeyId is still a placeholder';
    }

    if ($secret === '') {
        $issues[] = 'awsSecretAccessKey is missing';
    } elseif (looks_like_placeholder_key($secret)) {
        $issues[] = 'awsSecretAccessKey is still a placeholder';
    }

    if ($issues) {
        return [
            'found' => true,
            'path' => $path,
            'config' => $config,
            'message' => 'Local config file found, but ' . implode(' and ', $issues) . '.',
            'configured' => false
        ];
    }

    return [
        'found' => true,
        'path' => $path,
        'config' => $config,
        'access' => $access,
        'secret' => $secret,
        'token' => $token,
        'configured' => true,
        'message' => 'Local config file found. Credentials loaded.'
    ];
}


function aws_sigv4_headers(string $method, string $host, string $path, array $query, string $body, string $accessKey, string $secretKey, ?string $sessionToken = null): array {
    ksort($query);
    $canonicalQuery = http_build_query($query, '', '&', PHP_QUERY_RFC3986);

    $amzDate = gmdate('Ymd\THis\Z');
    $dateStamp = gmdate('Ymd');
    $trace[] = 'aws_signing_date_stamp=' . $dateStamp;

    $payloadHash = hash('sha256', $body);
    $canonicalHeaders = 'host:' . $host . "\n" . 'x-amz-content-sha256:' . $payloadHash . "\n" . 'x-amz-date:' . $amzDate . "\n";
    $signedHeaders = 'host;x-amz-content-sha256;x-amz-date';

    if ($sessionToken !== null && $sessionToken !== '') {
        $canonicalHeaders .= 'x-amz-security-token:' . trim($sessionToken) . "\n";
        $signedHeaders .= ';x-amz-security-token';
    }

    $canonicalRequest = implode("\n", [
        strtoupper($method),
        $path,
        $canonicalQuery,
        $canonicalHeaders,
        $signedHeaders,
        $payloadHash
    ]);

    $credentialScope = $dateStamp . '/' . AWS_REGION . '/' . AWS_SERVICE . '/aws4_request';
    $stringToSign = implode("\n", [
        'AWS4-HMAC-SHA256',
        $amzDate,
        $credentialScope,
        hash('sha256', $canonicalRequest)
    ]);

    $kDate = hash_hmac('sha256', $dateStamp, 'AWS4' . $secretKey, true);
    $kRegion = hash_hmac('sha256', AWS_REGION, $kDate, true);
    $kService = hash_hmac('sha256', AWS_SERVICE, $kRegion, true);
    $kSigning = hash_hmac('sha256', 'aws4_request', $kService, true);
    $signature = hash_hmac('sha256', $stringToSign, $kSigning);

    $headers = [
        'Host' => $host,
        'X-Amz-Date' => $amzDate,
        'X-Amz-Content-Sha256' => $payloadHash,
        'Authorization' => 'AWS4-HMAC-SHA256 Credential=' . $accessKey . '/' . $credentialScope . ', SignedHeaders=' . $signedHeaders . ', Signature=' . $signature,
    ];

    if ($sessionToken !== null && $sessionToken !== '') {
        $headers['X-Amz-Security-Token'] = trim($sessionToken);
    }

    return $headers;
}


function apply_cloudfront_tls_options(array &$curlOptions, array &$trace = []): void {
    $curlOptions[CURLOPT_SSL_VERIFYPEER] = true;
    $curlOptions[CURLOPT_SSL_VERIFYHOST] = 2;

    $curlCaInfo = ini_get('curl.cainfo');
    if (is_string($curlCaInfo) && trim($curlCaInfo) !== '') {
        $trace[] = 'tls_ca=php curl.cainfo configured';
        return;
    }

    $opensslCaFile = ini_get('openssl.cafile');
    if (is_string($opensslCaFile) && trim($opensslCaFile) !== '') {
        $trace[] = 'tls_ca=php openssl.cafile configured';
        return;
    }

    if (defined('CURLOPT_SSL_OPTIONS') && defined('CURLSSLOPT_NATIVE_CA')) {
        $curlOptions[CURLOPT_SSL_OPTIONS] = CURLSSLOPT_NATIVE_CA;
        $trace[] = 'tls_ca=windows native CA requested';
        return;
    }

    $trace[] = 'tls_ca=no native CA support detected';
}

function explain_curl_ssl_error(int $errno, string $error): string {
    if ($errno === 60 || stripos($error, 'issuer certificate') !== false || stripos($error, 'certificate') !== false) {
        return 'Local PHP/cURL SSL trust is broken. Run this tool from a normal HTTPS host, or install/use a Windows PHP/cURL build that supports the Windows certificate store.';
    }

    return 'CloudFront network/TLS test failed: ' . ($error ?: ('cURL errno ' . $errno));
}


function aws_error_details_from_body(string $responseBody): array {
    $body = trim($responseBody);
    if ($body === '') {
        return ['', '', ''];
    }

    $code = '';
    $message = '';
    $requestId = '';

    $previous = libxml_use_internal_errors(true);
    try {
        $xml = simplexml_load_string($body);
        if ($xml !== false) {
            $code = trim((string)($xml->Code ?? $xml->Error->Code ?? ''));
            $message = trim((string)($xml->Message ?? $xml->Error->Message ?? ''));
            $requestId = trim((string)($xml->RequestId ?? $xml->RequestID ?? ''));
        }
    } catch (Throwable $e) {
        // Keep fallback parsing below.
    }
    libxml_clear_errors();
    libxml_use_internal_errors($previous);

    if ($code === '' && preg_match('/<Code>\s*([^<]+)\s*<\/Code>/i', $body, $m)) {
        $code = trim(html_entity_decode($m[1], ENT_QUOTES | ENT_XML1, 'UTF-8'));
    }

    if ($message === '' && preg_match('/<Message>\s*([^<]+)\s*<\/Message>/i', $body, $m)) {
        $message = trim(html_entity_decode($m[1], ENT_QUOTES | ENT_XML1, 'UTF-8'));
    }

    if ($requestId === '' && preg_match('/<RequestId>\s*([^<]+)\s*<\/RequestId>/i', $body, $m)) {
        $requestId = trim(html_entity_decode($m[1], ENT_QUOTES | ENT_XML1, 'UTF-8'));
    }

    return [$code, $message, $requestId];
}

function one_line_snippet(string $value, int $limit = 500): string {
    $value = trim(preg_replace('/\s+/', ' ', strip_tags($value)));
    if (strlen($value) > $limit) {
        return substr($value, 0, $limit) . '...';
    }
    return $value;
}


function safe_credential_fingerprint(string $value, bool $isSecret = false): array {
    $raw = $value;
    $trimmed = trim($value);
    $len = strlen($raw);
    $trimmedLen = strlen($trimmed);
    $changedByTrim = ($raw !== $trimmed);

    if ($isSecret) {
        return [
            'length' => $len,
            'trimmed_length' => $trimmedLen,
            'trim_changed' => $changedByTrim ? 'yes' : 'no',
            'sha256_8' => $trimmed === '' ? '' : substr(hash('sha256', $trimmed), 0, 8),
        ];
    }

    $prefix = $trimmed === '' ? '' : substr($trimmed, 0, min(4, strlen($trimmed)));
    $suffix = strlen($trimmed) <= 4 ? '' : substr($trimmed, -4);

    return [
        'length' => $len,
        'trimmed_length' => $trimmedLen,
        'trim_changed' => $changedByTrim ? 'yes' : 'no',
        'prefix' => $prefix,
        'suffix' => $suffix,
        'sha256_8' => $trimmed === '' ? '' : substr(hash('sha256', $trimmed), 0, 8),
    ];
}

function append_safe_credential_trace(array &$trace, array $creds): void {
    $accessValue = (string)($creds['accessKeyId'] ?? $creds['access'] ?? $creds[0] ?? '');
    $secretValue = (string)($creds['secretAccessKey'] ?? $creds['secret'] ?? $creds[1] ?? '');
    $tokenValue = (string)($creds['sessionToken'] ?? $creds['token'] ?? $creds[2] ?? '');
    $sourceValue = (string)($creds['source'] ?? 'runtime signer credentials');

    $access = safe_credential_fingerprint($accessValue, false);
    $secret = safe_credential_fingerprint($secretValue, true);
    $token = safe_credential_fingerprint($tokenValue, true);

    $trace[] = 'credential_source=' . $sourceValue;
    $trace[] = 'credential_config_path=' . LOCAL_CONFIG_DEFAULT_PATH;
    $trace[] = 'credential_array_shape=' . (array_key_exists(0, $creds) ? 'numeric' : 'named');
    $trace[] = 'access_key_length=' . $access['length'];
    $trace[] = 'access_key_trimmed_length=' . $access['trimmed_length'];
    $trace[] = 'access_key_trim_changed=' . $access['trim_changed'];
    $trace[] = 'access_key_prefix=' . $access['prefix'];
    $trace[] = 'access_key_suffix=' . $access['suffix'];
    $trace[] = 'access_key_sha256_8=' . $access['sha256_8'];

    $trace[] = 'secret_key_length=' . $secret['length'];
    $trace[] = 'secret_key_trimmed_length=' . $secret['trimmed_length'];
    $trace[] = 'secret_key_trim_changed=' . $secret['trim_changed'];
    $trace[] = 'secret_key_sha256_8=' . $secret['sha256_8'];

    $trace[] = 'session_token_present=' . ($tokenValue !== '' ? 'yes' : 'no');
    if ($tokenValue !== '') {
        $trace[] = 'session_token_length=' . $token['length'];
        $trace[] = 'session_token_trimmed_length=' . $token['trimmed_length'];
        $trace[] = 'session_token_trim_changed=' . $token['trim_changed'];
        $trace[] = 'session_token_sha256_8=' . $token['sha256_8'];
    }

    $trace[] = 'server_time_utc=' . gmdate('Y-m-d\TH:i:s\Z');
    $trace[] = 'server_unix_time=' . time();
}


function load_local_credentials(): array {
    // Compatibility wrapper used by the AWS test resolver.
    // This file's real local-config loader is credentials_from_local_config_file_if_available().
    // Read only AWS keys from local config. Never use the tool username/password fields.

    if (function_exists('credentials_from_local_config_file_if_available')) {
        $loaded = credentials_from_local_config_file_if_available(LOCAL_CONFIG_DEFAULT_PATH);
        if (is_array($loaded) && !empty($loaded['configured'])) {
            return [
                (string)($loaded['access'] ?? ''),
                (string)($loaded['secret'] ?? ''),
                (string)($loaded['token'] ?? ''),
            ];
        }

        if (is_array($loaded) && isset($loaded['config']) && is_array($loaded['config'])) {
            $cfg = $loaded['config'];
            return [
                (string)($cfg['awsAccessKeyId'] ?? $cfg['accessKeyId'] ?? $cfg['AWS_ACCESS_KEY_ID'] ?? ''),
                (string)($cfg['awsSecretAccessKey'] ?? $cfg['secretAccessKey'] ?? $cfg['AWS_SECRET_ACCESS_KEY'] ?? ''),
                (string)($cfg['awsSessionToken'] ?? $cfg['sessionToken'] ?? $cfg['aws_session_token'] ?? $cfg['AWS_SESSION_TOKEN'] ?? ''),
            ];
        }
    }

    if (function_exists('load_local_config_file')) {
        try {
            $cfg = load_local_config_file(LOCAL_CONFIG_DEFAULT_PATH);
            if (is_array($cfg)) {
                return [
                    (string)($cfg['awsAccessKeyId'] ?? $cfg['accessKeyId'] ?? $cfg['AWS_ACCESS_KEY_ID'] ?? ''),
                    (string)($cfg['awsSecretAccessKey'] ?? $cfg['secretAccessKey'] ?? $cfg['AWS_SECRET_ACCESS_KEY'] ?? ''),
                    (string)($cfg['awsSessionToken'] ?? $cfg['sessionToken'] ?? $cfg['aws_session_token'] ?? $cfg['AWS_SESSION_TOKEN'] ?? ''),
                ];
            }
        } catch (Throwable $e) {
            return ['', '', ''];
        }
    }

    return ['', '', ''];
}


function is_fixed_tool_username_value(string $value): bool {
    return strcasecmp(trim($value), 'cloudfront-media-tool') === 0;
}

function looks_like_aws_access_key_id(string $value): bool {
    $v = trim($value);
    return (bool)preg_match('/^(AKIA|ASIA)[A-Z0-9]{16}$/', $v);
}


function local_config_has_aws_credentials(): bool {
    [$access, $secret, $token] = load_local_credentials();
    return trim((string)$access) !== '' && trim((string)$secret) !== '';
}

function resolve_aws_credentials_for_test(): array {
    [$configAccess, $configSecret, $configToken] = load_local_credentials();

    $manualAccessRaw = (string)current_post('awsAccessKeyId', '');
    $manualSecretRaw = (string)current_post('awsSecretAccessKey', '');
    $manualTokenRaw = (string)current_post('awsSessionToken', '');

    $manualAccess = trim($manualAccessRaw);
    $manualSecret = trim($manualSecretRaw);
    $manualToken = trim($manualTokenRaw);

    $sourceDetail = 'local config';
    if (trim((string)$configAccess) === '' || trim((string)$configSecret) === '') {
        $sourceDetail = 'local config missing AWS access key or secret key; checked real local config loader';
    }

    // Browser autocomplete can accidentally place the fixed tool username into the AWS access key field.
    // Never treat the tool username as an AWS access key.
    if ($manualAccess !== '' && (is_fixed_tool_username_value($manualAccess))) {
        $manualAccess = '';
        $sourceDetail = 'local config; ignored manual AWS access field because it contained the tool username';
    }

    // Obfuscated placeholders and non-AWS strings are visual only; they are not AWS credentials.
    if ($manualAccess !== '' && !looks_like_aws_access_key_id($manualAccess)) {
        $manualAccess = '';
        $sourceDetail = 'local config; ignored manual AWS access field because it was not AKIA/ASIA format';
    }

    $hasManualPair = ($manualAccess !== '' && $manualSecret !== '');

    if ($hasManualPair) {
        return [
            0 => $manualAccess,
            1 => $manualSecret,
            2 => ($manualToken !== '' ? $manualToken : null),
            'accessKeyId' => $manualAccess,
            'secretAccessKey' => $manualSecret,
            'sessionToken' => $manualToken,
            'source' => 'manual AWS credential fields',
        ];
    }

    return [
        0 => trim((string)$configAccess),
        1 => trim((string)$configSecret),
        2 => (trim((string)$configToken) !== '' ? trim((string)$configToken) : null),
        'accessKeyId' => trim((string)$configAccess),
        'secretAccessKey' => trim((string)$configSecret),
        'sessionToken' => trim((string)$configToken),
        'source' => $sourceDetail,
    ];
}


function append_runtime_credential_source_log(array &$log, array $creds): void {
    $trace = [];
    append_safe_credential_trace($trace, $creds);

    foreach ($trace as $line) {
        if (
            str_starts_with($line, 'credential_source=') ||
            str_starts_with($line, 'access_key_prefix=') ||
            str_starts_with($line, 'access_key_suffix=') ||
            str_starts_with($line, 'access_key_sha256_8=') ||
            str_starts_with($line, 'secret_key_sha256_8=') ||
            str_starts_with($line, 'session_token_present=')
        ) {
            $log[] = $line;
        }
    }
}

function cloudfront_diagnostic_credentials_test(array $creds): array {
    $trace = [];
    $started = microtime(true);

    $trace[] = 'diagnostic_start';
    append_safe_credential_trace($trace, $creds);
    $trace[] = 'php_version=' . PHP_VERSION;
    $trace[] = 'curl_loaded=' . (extension_loaded('curl') ? 'yes' : 'no');
    $trace[] = 'openssl_loaded=' . (extension_loaded('openssl') ? 'yes' : 'no');
    $trace[] = 'php_sapi=' . PHP_SAPI;
    $trace[] = 'server_software=' . (string)($_SERVER['SERVER_SOFTWARE'] ?? '');
    $trace[] = 'os=' . PHP_OS_FAMILY . ' ' . PHP_OS;
    if (function_exists('curl_version')) {
        $cv = curl_version();
        $trace[] = 'curl_version=' . (string)($cv['version'] ?? '');
        $trace[] = 'curl_ssl_version=' . (string)($cv['ssl_version'] ?? '');
        $trace[] = 'curl_libz_version=' . (string)($cv['libz_version'] ?? '');
    }
    $trace[] = 'openssl_cafile=' . (string)ini_get('openssl.cafile');
    $trace[] = 'curl_cainfo=' . (string)ini_get('curl.cainfo');

    if (!extension_loaded('curl')) {
        return [
            'ok' => false,
            'message' => 'PHP cURL extension is not loaded.',
            'trace' => $trace
        ];
    }

    [$access, $secret, $token] = $creds;
    $method = 'GET';
    $host = CF_HOST;
    $path = '/' . CF_VERSION . '/distribution';
    $query = ['MaxItems' => '1'];
    $body = '';

    try {
        $trace[] = 'signing_request';
        $headers = aws_sigv4_headers($method, $host, $path, $query, $body, $access, $secret, $token);
        $url = 'https://' . $host . $path . '?' . http_build_query($query, '', '&', PHP_QUERY_RFC3986);
        $trace[] = 'url=' . $url;

        $headerLines = [];
        foreach ($headers as $k => $v) {
            $headerLines[] = $k . ': ' . $v;
        }

        $ch = curl_init($url);
        if (!$ch) {
            return [
                'ok' => false,
                'message' => 'Could not initialize cURL.',
                'trace' => $trace
            ];
        }

        $curlOptions = [
            CURLOPT_CUSTOMREQUEST => $method,
            CURLOPT_HTTPHEADER => $headerLines,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HEADER => true,
            CURLOPT_TIMEOUT => 8,
            CURLOPT_CONNECTTIMEOUT => 4,
            CURLOPT_NOSIGNAL => true,
            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
        ];
        apply_cloudfront_tls_options($curlOptions, $trace);
        curl_setopt_array($ch, $curlOptions);

        $trace[] = 'curl_exec_start timeout=8 connecttimeout=4';
        $raw = curl_exec($ch);
        $errno = curl_errno($ch);
        $error = curl_error($ch);
        $info = curl_getinfo($ch);
        curl_close($ch);

        $elapsedMs = (int)round((microtime(true) - $started) * 1000);
        $trace[] = 'curl_exec_end elapsed_ms=' . $elapsedMs;
        $trace[] = 'curl_errno=' . $errno;
        if ($error !== '') {
            $trace[] = 'curl_error=' . $error;
        }
        $trace[] = 'http_code=' . (string)($info['http_code'] ?? '');
        $trace[] = 'namelookup_time=' . (string)($info['namelookup_time'] ?? '');
        $trace[] = 'connect_time=' . (string)($info['connect_time'] ?? '');
        $trace[] = 'appconnect_time=' . (string)($info['appconnect_time'] ?? '');
        $trace[] = 'total_time=' . (string)($info['total_time'] ?? '');

        if ($raw === false) {
            return [
                'ok' => false,
                'message' => explain_curl_ssl_error($errno, $error),
                'trace' => $trace
            ];
        }

        $headerSize = (int)($info['header_size'] ?? 0);
        $responseBody = substr($raw, $headerSize);
        $status = (int)($info['http_code'] ?? 0);

        if ($status >= 200 && $status < 300) {
            return [
                'ok' => true,
                'message' => 'AWS credentials OK. CloudFront answered in ' . $elapsedMs . ' ms.',
                'trace' => $trace
            ];
        }

        [$awsErrorCode, $awsErrorMessage, $awsRequestId] = aws_error_details_from_body($responseBody);
        $cleanBody = one_line_snippet($responseBody, 500);
        if ($cleanBody === '') {
            $cleanBody = 'HTTP ' . $status;
        }

        if ($awsErrorCode !== '') {
            $trace[] = 'aws_error_code=' . $awsErrorCode;
        }
        if ($awsErrorMessage !== '') {
            $trace[] = 'aws_error_message=' . one_line_snippet($awsErrorMessage, 500);
        }
        if ($awsRequestId !== '') {
            $trace[] = 'aws_request_id=' . $awsRequestId;
        }
        $trace[] = 'aws_response_body_snippet=' . $cleanBody;

        $shortMessage = 'CloudFront answered HTTP ' . $status;
        if ($awsErrorCode !== '') {
            $shortMessage .= ' ' . $awsErrorCode;
        }
        if ($awsErrorMessage !== '') {
            $shortMessage .= ': ' . substr(one_line_snippet($awsErrorMessage, 240), 0, 240);
        } else {
            $shortMessage .= ': ' . substr($cleanBody, 0, 240);
        }

        return [
            'ok' => false,
            'message' => $shortMessage,
            'trace' => $trace
        ];
    } catch (Throwable $e) {
        $trace[] = 'exception=' . $e->getMessage();
        return [
            'ok' => false,
            'message' => 'Credential diagnostic failed before CloudFront response: ' . $e->getMessage(),
            'trace' => $trace
        ];
    }
}

function test_cloudfront_credentials(array $creds): array {
    try {
        cloudfront_request('GET', '/' . CF_VERSION . '/distribution', ['MaxItems' => '1'], '', [], $creds);
        return [
            'ok' => true,
            'message' => 'Credentials tested successfully with CloudFront.'
        ];
    } catch (Throwable $e) {
        return [
            'ok' => false,
            'message' => 'Credentials failed CloudFront test: ' . $e->getMessage()
        ];
    }
}

function current_post(string $key, string $default = ''): string {
    return isset($_POST[$key]) ? (string)$_POST[$key] : $default;
}

$missingExtensions = require_extensions();
$log = [];
$error = '';
$ran = false;
$actionLabel = '';
$discoveredDistributions = [];
$selectedDistributionRows = [];

$defaultPassword = getenv('CF_TOOL_PASSWORD') ?: TOOL_PASSWORD_DEFAULT;

$currentActionToken = current_tool_action_token_for_render($defaultPassword);


function tool_action_cookie_name(): string
{
    return 'cf_media_action_token_' . substr(hash('sha256', __FILE__), 0, 12);
}

function new_tool_action_token(string $password): string
{
    $issued = (string)time();
    $nonce = bin2hex(random_bytes(16));
    $sig = hash_hmac('sha256', $issued . '|' . $nonce, hash('sha256', $password));
    return $issued . '|' . $nonce . '|' . $sig;
}

function set_tool_action_token_cookie(string $password): string
{
    $token = new_tool_action_token($password);
    setcookie(tool_action_cookie_name(), $token, [
        'expires' => time() + TOOL_AUTH_COOKIE_SECONDS,
        'path' => '/',
        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
        'httponly' => false,
        'samesite' => 'Strict',
    ]);
    $_COOKIE[tool_action_cookie_name()] = $token;
    return $token;
}

function current_tool_action_token_for_render(string $password): string
{
    $token = (string)($_COOKIE[tool_action_cookie_name()] ?? '');
    if ($token === '') {
        return set_tool_action_token_cookie($password);
    }
    return $token;
}

function valid_tool_action_token(string $password, string $postedToken): bool
{
    $cookieToken = (string)($_COOKIE[tool_action_cookie_name()] ?? '');
    if ($postedToken === '' || $cookieToken === '' || !hash_equals($cookieToken, $postedToken)) {
        return false;
    }

    $parts = explode('|', $postedToken);
    if (count($parts) !== 3) {
        return false;
    }

    [$issued, $nonce, $sig] = $parts;
    if (!ctype_digit($issued) || strlen($nonce) < 16) {
        return false;
    }

    $age = time() - (int)$issued;
    if ($age < 0 || $age > TOOL_AUTH_COOKIE_SECONDS) {
        return false;
    }

    $expected = hash_hmac('sha256', $issued . '|' . $nonce, hash('sha256', $password));
    return hash_equals($expected, $sig);
}

function rotate_tool_action_token_cookie(string $password): string
{
    return set_tool_action_token_cookie($password);
}

function stream_json_line(array $row): void
{
    echo json_encode($row, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE) . "
";

    // Push a harmless whitespace line so IIS/FastCGI/proxies/browsers are much
    // less likely to buffer tiny progress events until the whole run completes.
    // The browser parser trims and ignores this blank line.
    echo str_repeat(' ', 4096) . "
";

    @ob_flush();
    @flush();
}

function start_ndjson_stream(): void
{
    while (ob_get_level() > 0) {
        @ob_end_flush();
    }

    @ini_set('zlib.output_compression', '0');
    @ini_set('output_buffering', '0');
    @ini_set('implicit_flush', '1');
    @ini_set('max_execution_time', '0');
    @set_time_limit(0);
    @ignore_user_abort(true);

    if (function_exists('apache_setenv')) {
        @apache_setenv('no-gzip', '1');
    }

    header('Content-Type: application/x-ndjson; charset=utf-8');
    header('Cache-Control: no-cache, no-store, must-revalidate, no-transform');
    header('Pragma: no-cache');
    header('Expires: 0');
    header('X-Accel-Buffering: no');

    // Initial padding opens the stream immediately on buffering servers.
    echo str_repeat(' ', 4096) . "
";
    @flush();
}


function runlog_job_dir(): string
{
    $dir = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'cf-media-tool-runlogs';
    if (!is_dir($dir)) {
        @mkdir($dir, 0700, true);
    }
    return $dir;
}

function sanitize_runlog_job_id(string $jobId): string
{
    $jobId = preg_replace('/[^a-zA-Z0-9_-]/', '', $jobId) ?: '';
    return substr($jobId, 0, 80);
}

function runlog_job_path(string $jobId): string
{
    $jobId = sanitize_runlog_job_id($jobId);
    if ($jobId === '') {
        $jobId = 'missing-job-id';
    }
    return runlog_job_dir() . DIRECTORY_SEPARATOR . $jobId . '.json';
}

function write_runlog_job(string $jobId, array $payload): void
{
    $jobId = sanitize_runlog_job_id($jobId);
    if ($jobId === '') {
        return;
    }
    $payload['jobId'] = $jobId;
    $payload['updatedAt'] = gmdate('c');
    @file_put_contents(runlog_job_path($jobId), json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE), LOCK_EX);
}

function read_runlog_job(string $jobId): ?array
{
    $jobId = sanitize_runlog_job_id($jobId);
    if ($jobId === '') {
        return null;
    }
    $path = runlog_job_path($jobId);
    if (!is_file($path)) {
        return null;
    }
    $json = @file_get_contents($path);
    $data = is_string($json) ? json_decode($json, true) : null;
    return is_array($data) ? $data : null;
}


function tool_auth_cookie_name(): string
{
    return 'cf_media_tool_auth';
}

function tool_auth_cookie_signature(string $password, int $expires): string
{
    return hash_hmac('sha256', $expires . '|' . TOOL_LOGIN_USERNAME, hash('sha256', $password, true));
}

function set_tool_auth_cookie(string $password): void
{
    $expires = time() + TOOL_AUTH_COOKIE_SECONDS;
    $sig = tool_auth_cookie_signature($password, $expires);
    $value = $expires . ':' . $sig;

    setcookie(tool_auth_cookie_name(), $value, [
        'expires' => $expires,
        'path' => '/',
        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
        'httponly' => true,
        'samesite' => 'Strict',
    ]);
}

function has_valid_tool_auth_cookie(string $password): bool
{
    $raw = $_COOKIE[tool_auth_cookie_name()] ?? '';
    if (!is_string($raw) || strpos($raw, ':') === false) {
        return false;
    }

    [$expires, $sig] = explode(':', $raw, 2);
    if (!ctype_digit($expires) || (int)$expires < time()) {
        return false;
    }

    $expected = tool_auth_cookie_signature($password, (int)$expires);
    return hash_equals($expected, $sig);
}

function clear_tool_auth_cookie(): void
{
    unset($_COOKIE[tool_auth_cookie_name()]);
    setcookie(tool_auth_cookie_name(), '', [
        'expires' => time() - 3600,
        'path' => '/',
        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
        'httponly' => true,
        'samesite' => 'Strict',
    ]);
}


function is_tool_access_authorized(string $password): bool
{
    $username = current_post('toolUsername', TOOL_LOGIN_USERNAME);
    $postedPassword = current_post('toolPassword');

    if (hash_equals(TOOL_LOGIN_USERNAME, $username) && hash_equals($password, $postedPassword)) {
        return true;
    }

    return has_valid_tool_auth_cookie($password);
}


$loadedLocalConfig = [];
$configHasKeys = false;
$configFileFound = false;
$configHasSessionToken = false;
$localConfigNotice = '';
$localConfigStatus = null;
$localConfigCredentialTest = null;
$localConfigPathForUi = current_post('localConfigPath', LOCAL_CONFIG_DEFAULT_PATH);


try {
    $localConfigStatus = credentials_from_local_config_file_if_available($localConfigPathForUi);
    if (!empty($localConfigStatus['found'])) {
        $loadedLocalConfig = $localConfigStatus['config'];
        $localConfigCredentialTest = [
            'ok' => !empty($localConfigStatus['configured']) ? null : false,
            'message' => $localConfigStatus['message'] ?? ''
        ];
    }
} catch (Throwable $e) {
    $localConfigStatus = [
        'found' => true,
        'path' => $localConfigPathForUi,
        'config' => [],
        'message' => 'Local config file found, but it could not be read.'
    ];
    $localConfigCredentialTest = [
        'ok' => false,
        'message' => 'Local config file found, but it could not be read.'
    ];
}


// Credential display state used by the page layout.
$configHasKeys = !empty($localConfigStatus['configured']);
$configFileFound = !empty($localConfigStatus['found']);
$configHasSessionToken = $configHasKeys && local_config_session_token($loadedLocalConfig) !== '';
$configAccessMask = $configHasKeys ? mask_for_value(local_config_value($loadedLocalConfig, 'awsAccessKeyId')) : '';
$configSecretMask = $configHasKeys ? mask_for_value(local_config_value($loadedLocalConfig, 'awsSecretAccessKey')) : '';
$configTokenMask = $configHasSessionToken ? mask_for_value(local_config_session_token($loadedLocalConfig)) : '';


if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $isAjaxMode = in_array(current_post('mode'), ['ajax-test-tool-password', 'ajax-test-credentials', 'ajax-discover-distributions', 'ajax-prefetch-distributions', 'ajax-check-tool-auth', 'ajax-logout-tool-auth', 'ajax-run-action'], true);
    if ($isAjaxMode) {
        ob_start();
        ini_set('display_errors', '0');
        error_reporting(E_ALL & ~E_DEPRECATED & ~E_NOTICE & ~E_WARNING);
    }

    if (current_post('mode') === 'ajax-logout-tool-auth') {
        // JSON response handled by send_json_response().
        clear_tool_auth_cookie();

        send_json_response([
            'ok' => true,
            'target' => 'toolPassword',
            'message' => 'Logged out.'
        ]);
    }

    if (current_post('mode') === 'ajax-check-tool-auth') {
        // JSON response handled by send_json_response().

        if ($defaultPassword === 'change-this-password-now') {
            send_json_response([
                'ok' => false,
                'target' => 'toolPassword',
                'message' => 'Change TOOL_PASSWORD_DEFAULT first.'
            ]);
        }

        if (has_valid_tool_auth_cookie($defaultPassword)) {
            send_json_response([
                'ok' => true,
                'target' => 'toolPassword',
                'message' => 'Access already authorized.'
            ]);
        }

        send_json_response([
            'ok' => false,
            'target' => 'toolPassword',
            'message' => 'Access not yet authorized.'
        ]);
    }

    if (current_post('mode') === 'ajax-test-tool-password') {
        // JSON response handled by send_json_response().

        $password = current_post('toolPassword');
        $username = current_post('toolUsername', TOOL_LOGIN_USERNAME);

        if (!hash_equals(TOOL_LOGIN_USERNAME, $username)) {
            send_json_response([
                'ok' => false,
                'target' => 'toolPassword',
                'message' => 'Tool username is incorrect.'
            ]);
        }

        if ($defaultPassword === 'change-this-password-now') {
            send_json_response([
                'ok' => false,
                'target' => 'toolPassword',
                'message' => 'Change TOOL_PASSWORD_DEFAULT first.'
            ]);
        }

        if (!hash_equals($defaultPassword, $password)) {
            send_json_response([
                'ok' => false,
                'target' => 'toolPassword',
                'message' => 'Tool password is incorrect.'
            ]);
        }

        set_tool_auth_cookie($defaultPassword);

        send_json_response([
            'ok' => true,
            'target' => 'toolPassword',
            'message' => 'Password OK.'
        ]);
    }

    if (current_post('mode') === 'ajax-test-credentials') {
        // JSON response handled by send_json_response().

        try {
            if ($missingExtensions) {
                throw new RuntimeException('Missing PHP extensions: ' . implode(', ', $missingExtensions));
            }

            $password = current_post('toolPassword');
            $username = current_post('toolUsername', TOOL_LOGIN_USERNAME);
            if (!hash_equals(TOOL_LOGIN_USERNAME, $username)) {
                send_json_response([
                    'ok' => false,
                    'target' => 'toolPassword',
                    'message' => 'Tool username is incorrect.'
                ]);
            }
            if (!(hash_equals($defaultPassword, $password) || has_valid_tool_auth_cookie($defaultPassword))) {
                send_json_response([
                    'ok' => false,
                    'target' => 'toolPassword',
                    'message' => 'Tool password is incorrect.'
                ]);
            }

            if ($defaultPassword === 'change-this-password-now') {
                send_json_response([
                    'ok' => false,
                    'target' => 'toolPassword',
                    'message' => 'Change TOOL_PASSWORD_DEFAULT first.'
                ]);
            }

            $test = cloudfront_diagnostic_credentials_test(resolve_aws_credentials_for_test());

            if (!empty($test['ok'])) {
                send_json_response([
                    'ok' => true,
                    'target' => 'awsCredentials',
                    'message' => $test['message'] ?? 'Credentials OK.',
                    'serverTrace' => $test['trace'] ?? []
                ]);
            }

            send_json_response([
                'ok' => false,
                'target' => 'awsCredentials',
                'message' => $test['message'] ?? 'Credential test failed.',
                'serverTrace' => $test['trace'] ?? []
            ]);
        } catch (Throwable $e) {
            send_json_response([
                'ok' => false,
                'target' => 'awsCredentials',
                'message' => $e->getMessage()
            ]);
        }
    }

    if (current_post('mode') === 'ajax-discover-distributions') {
        // JSON response handled by send_json_response().

        try {
            if ($missingExtensions) {
                throw new RuntimeException('Missing PHP extensions: ' . implode(', ', $missingExtensions));
            }

            $password = current_post('toolPassword');
            $username = current_post('toolUsername', TOOL_LOGIN_USERNAME);

            if (!hash_equals(TOOL_LOGIN_USERNAME, $username)) {
                send_json_response([
                    'ok' => false,
                    'target' => 'toolPassword',
                    'message' => 'Tool username is incorrect.'
                ]);
            }

            if (!(hash_equals($defaultPassword, $password) || has_valid_tool_auth_cookie($defaultPassword))) {
                send_json_response([
                    'ok' => false,
                    'target' => 'toolPassword',
                    'message' => 'Tool password is incorrect.'
                ]);
            }

            if ($defaultPassword === 'change-this-password-now') {
                send_json_response([
                    'ok' => false,
                    'target' => 'toolPassword',
                    'message' => 'Change TOOL_PASSWORD_DEFAULT first.'
                ]);
            }

            $access = current_post('awsAccessKeyId');
            $secret = current_post('awsSecretAccessKey');
            $token = current_post('awsSessionToken');

            if ($access === '') {
                $access = local_config_value($loadedLocalConfig, 'awsAccessKeyId');
            }
            if ($secret === '') {
                $secret = local_config_value($loadedLocalConfig, 'awsSecretAccessKey');
            }
            if ($token === '') {
                $token = local_config_session_token($loadedLocalConfig);
            }

            if (!$access || !$secret || looks_like_placeholder_key($access) || looks_like_placeholder_key($secret)) {
                send_json_response([
                    'ok' => false,
                    'target' => 'awsCredentials',
                    'message' => 'AWS keys are missing or still placeholders.'
                ]);
            }

            $rows = discover_distributions([$access, $secret, $token ?: null]);

            send_json_response([
                'ok' => true,
                'target' => 'distributions',
                'message' => 'Loaded ' . count($rows) . ' CloudFront distributions.',
                'distributions' => $rows
            ]);
        } catch (Throwable $e) {
            send_json_response([
                'ok' => false,
                'target' => 'distributions',
                'message' => $e->getMessage()
            ]);
        }
    }

    if (current_post('mode') === 'ajax-prefetch-distributions') {
        // Background local-config prefetch. Results are displayed only after Access is verified.

        try {
            if ($missingExtensions) {
                throw new RuntimeException('Missing PHP extensions: ' . implode(', ', $missingExtensions));
            }

            $access = local_config_value($loadedLocalConfig, 'awsAccessKeyId');
            $secret = local_config_value($loadedLocalConfig, 'awsSecretAccessKey');
            $token = local_config_session_token($loadedLocalConfig);

            if (!$access || !$secret || looks_like_placeholder_key($access) || looks_like_placeholder_key($secret)) {
                send_json_response([
                    'ok' => false,
                    'target' => 'awsCredentials',
                    'message' => 'Local AWS keys are missing or still placeholders.'
                ]);
            }

            $credentialTest = cloudfront_diagnostic_credentials_test([$access, $secret, $token ?: null]);
            if (empty($credentialTest['ok'])) {
                send_json_response([
                    'ok' => false,
                    'target' => 'awsCredentials',
                    'message' => $credentialTest['message'] ?? 'Credential test failed.',
                    'serverTrace' => $credentialTest['trace'] ?? []
                ]);
            }

            $rows = discover_distributions([$access, $secret, $token ?: null]);

            send_json_response([
                'ok' => true,
                'target' => 'distributions',
                'message' => 'AWS credentials OK. Loaded ' . count($rows) . ' CloudFront distributions.',
                'serverTrace' => $credentialTest['trace'] ?? [],
                'distributions' => $rows
            ]);
        } catch (Throwable $e) {
            send_json_response([
                'ok' => false,
                'target' => 'distributions',
                'message' => $e->getMessage()
            ]);
        }
    }


    if (current_post('mode') === 'ajax-run-status') {
        $jobId = sanitize_runlog_job_id(current_post('jobId'));
        $payload = read_runlog_job($jobId);
        if (!$payload) {
            send_json_response([
                'ok' => true,
                'type' => 'progress',
                'kind' => 'wait',
                'message' => 'Waiting for run to start…',
                'log' => ['Waiting for run to start…'],
                'jobId' => $jobId,
            ]);
        }
        $payload['ok'] = $payload['ok'] ?? true;
        send_json_response($payload);
    }


    if (current_post('mode') === 'ajax-run-action') {
        start_ndjson_stream();

        $streamLog = [];
        $streamError = '';
        $streamApply = current_post('runAction') === 'apply';
        $streamJobId = sanitize_runlog_job_id(current_post('jobId'));
        if ($streamJobId === '') {
            $streamJobId = bin2hex(random_bytes(12));
        }

        write_runlog_job($streamJobId, [
            'type' => 'progress',
            'kind' => 'wait',
            'message' => 'Run accepted by server…',
            'log' => ['Run accepted by server…'],
            'done' => false,
        ]);

        $progress = function (string $text, string $kind = 'wait', array $extra = []) use (&$streamLog, $streamJobId): void {
            $streamLog[] = $text;
            $row = array_merge([
                'type' => 'progress',
                'kind' => $kind,
                'message' => $text,
                'log' => $streamLog,
                'done' => false,
            ], $extra);
            write_runlog_job($streamJobId, $row);
            stream_json_line($row);
        };

        try {
            $progress(TOOL_PACKAGE_NAME . ' | ' . TOOL_VERSION . ' | built ' . TOOL_BUILD_TIMESTAMP_UTC, 'wait');
            $progress($streamApply ? 'APPLY MODE: CloudFront will be updated.' : 'DRY RUN MODE: no CloudFront changes will be made.', $streamApply ? 'warn' : 'wait');

            if (!valid_tool_action_token($defaultPassword, current_post('toolActionToken'))) {
                throw new RuntimeException('Apply/Dry run was blocked because this was not an AJAX action from the current page. Reload the page and try again.');
            }

            $currentActionToken = current_tool_action_token_for_render($defaultPassword);
            stream_json_line([
                'type' => 'token',
                'token' => $currentActionToken,
            ]);

            $progress('Fresh AJAX action token accepted.', 'good');

            if ($missingExtensions) {
                throw new RuntimeException('Missing PHP extensions: ' . implode(', ', $missingExtensions));
            }

            $password = current_post('toolPassword');
            $username = current_post('toolUsername', TOOL_LOGIN_USERNAME);
            if (!hash_equals(TOOL_LOGIN_USERNAME, $username)) {
                throw new RuntimeException('Tool username is incorrect.');
            }
            if (!(hash_equals($defaultPassword, $password) || has_valid_tool_auth_cookie($defaultPassword))) {
                throw new RuntimeException('Tool password is incorrect. Log in again before applying changes.');
            }
            if ($defaultPassword === 'change-this-password-now') {
                throw new RuntimeException('Change TOOL_PASSWORD_DEFAULT or set CF_TOOL_PASSWORD before using this tool.');
            }

            $progress('Access authorization OK.', 'good');

            $resolvedCreds = resolve_aws_credentials_for_test();
            $access = (string)($resolvedCreds['accessKeyId'] ?? $resolvedCreds[0] ?? '');
            $secret = (string)($resolvedCreds['secretAccessKey'] ?? $resolvedCreds[1] ?? '');
            $token = (string)($resolvedCreds['sessionToken'] ?? $resolvedCreds[2] ?? '');

            if (!$access || !$secret || looks_like_placeholder_key($access) || looks_like_placeholder_key($secret)) {
                throw new RuntimeException('AWS access key and secret key are required. Enter real keys manually, or create a local config file with active awsAccessKeyId and awsSecretAccessKey entries. Make sure the key lines are not commented out and not left as placeholders.');
            }

            $creds = [
                0 => $access,
                1 => $secret,
                2 => ($token !== '' ? $token : null),
                'accessKeyId' => $access,
                'secretAccessKey' => $secret,
                'sessionToken' => $token,
                'source' => (string)($resolvedCreds['source'] ?? 'credential resolver'),
            ];

            $credentialLog = [];
            append_runtime_credential_source_log($credentialLog, $creds);
            foreach ($credentialLog as $line) {
                $progress($line, 'wait');
            }

            $progress('AWS credential source resolved. Creating/reusing CloudFront policies.', 'wait');

            $mediaPatterns = lines_to_array(current_post('mediaPatterns', DEFAULT_MEDIA_PATTERNS_TEXT));
            if (!$mediaPatterns) {
                throw new RuntimeException('At least one media pattern is required.');
            }

            $selectedDistributionRows = decode_selected_distributions($_POST['selectedDistributions'] ?? []);
            if ($selectedDistributionRows) {
                $distributionRows = $selectedDistributionRows;
            } else {
                $distributionRows = parse_distribution_pairs('', current_post('distributionLabels'));
            }

            if (!$distributionRows) {
                throw new RuntimeException('Select at least one distribution before applying changes.');
            }

            $removedPublicDistributionIdFallbacks = array_column($distributionRows, 'id');

            $config = [
                'removedPublicDistributionIdFallbacks' => $removedPublicDistributionIdFallbacks,
                'mediaPatterns' => $mediaPatterns,
                'addDebugBehavior' => current_post('addDebugBehavior') === '1',
                'addJsonBehavior' => false,
                'addMediaBehaviors' => current_post('addMediaBehaviors') === '1'
            ];

            if (!$streamApply) {
                $progress('Dry run note: candidate XML stays in this browser response. No CloudFront updates will be sent.', 'wait');
            }

            $progress('Ensuring media cache policy.', 'wait');
            $mediaPolicy = ensure_cache_policy(
                MEDIA_CACHE_POLICY_NAME,
                cache_policy_xml(MEDIA_CACHE_POLICY_NAME, 'Long-lived cache for immutable public media assets.', 0, 31536000, 31536000),
                $creds,
                $streamApply,
                $streamLog
            );
            $progress('Media cache policy ready: ' . $mediaPolicy, 'good');

            $progress('Ensuring JSON cache policy object only. JSON behaviors remain untouched.', 'wait');
            $jsonPolicy = ensure_cache_policy(
                JSON_CACHE_POLICY_NAME,
                cache_policy_xml(JSON_CACHE_POLICY_NAME, 'Near-fresh cache for JSON files, including .directory-index.json.', 0, 1, 60),
                $creds,
                $streamApply,
                $streamLog
            );
            $progress('JSON cache policy ready: ' . $jsonPolicy . ' ; *.json behavior remains untouched.', 'good');

            $progress('Ensuring debug cache policy.', 'wait');
            $debugPolicy = ensure_cache_policy(
                DEBUG_CACHE_POLICY_NAME,
                cache_policy_xml(DEBUG_CACHE_POLICY_NAME, 'No-cache policy for URLs containing debug.', 0, 0, 0, false),
                $creds,
                $streamApply,
                $streamLog
            );
            $progress('Debug cache policy ready: ' . $debugPolicy, 'good');

            $progress('Ensuring public CORS response headers policy.', 'wait');
            $corsPolicy = ensure_response_headers_policy(
                MEDIA_CORS_POLICY_NAME,
                response_headers_policy_xml(),
                $creds,
                $streamApply,
                $streamLog
            );
            $progress('Public CORS response headers policy ready: ' . $corsPolicy, 'good');

            $policyIds = [
                'media' => $mediaPolicy,
                'json' => $jsonPolicy,
                'debug' => $debugPolicy,
                'cors' => $corsPolicy
            ];

            $total = count($distributionRows);
            $index = 0;
            foreach ($distributionRows as $row) {
                $index++;
                $label = (string)($row['label'] ?? '');
                $id = (string)($row['id'] ?? '');
                $display = trim($label) !== '' ? $label . ' (' . $id . ')' : $id;

                $progress('Distribution ' . $index . ' of ' . $total . ': starting ' . $display, 'wait', [
                    'current' => $index,
                    'total' => $total,
                    'distributionId' => $id,
                    'distributionLabel' => $label,
                ]);

                update_distribution($id, $label, $config, $policyIds, $creds, $streamApply, $streamLog, $progress);

                $progress('Distribution ' . $index . ' of ' . $total . ': finished ' . $display, 'good', [
                    'current' => $index,
                    'total' => $total,
                    'distributionId' => $id,
                    'distributionLabel' => $label,
                ]);
            }

            $progress('Done.', 'good');

            $doneRow = [
                'type' => 'done',
                'ok' => true,
                'kind' => 'good',
                'message' => 'Done.',
                'log' => $streamLog,
                'token' => $currentActionToken,
                'done' => true,
            ];
            write_runlog_job($streamJobId, $doneRow);
            stream_json_line($doneRow);
        } catch (Throwable $e) {
            $streamError = $e->getMessage();
            $streamLog[] = 'ERROR: ' . $streamError;
            $errorRow = [
                'type' => 'error',
                'ok' => false,
                'kind' => 'bad',
                'message' => $streamError,
                'log' => $streamLog,
                'done' => true,
            ];
            write_runlog_job($streamJobId ?? '', $errorRow);
            stream_json_line($errorRow);
        }

        exit;
    }

    $ran = true;
    $actionLabel = current_post('mode') ?: 'run';

    try {

        if (in_array(current_post('mode'), ['dry-run', 'apply'], true)) {
            throw new RuntimeException('Dry run and Apply are AJAX-only in this version. Reload the page and use the buttons normally.');
        }

        if ($missingExtensions) {
            throw new RuntimeException('Missing PHP extensions: ' . implode(', ', $missingExtensions));
        }

        $password = current_post('toolPassword');
        $username = current_post('toolUsername', TOOL_LOGIN_USERNAME);
        if (!hash_equals(TOOL_LOGIN_USERNAME, $username)) {
            throw new RuntimeException('Tool username is incorrect.');
        }
        if (!(hash_equals($defaultPassword, $password) || has_valid_tool_auth_cookie($defaultPassword))) {
            throw new RuntimeException('Tool password is incorrect. Set CF_TOOL_PASSWORD in IIS/PHP environment or edit TOOL_PASSWORD_DEFAULT.');
        }

        if ($defaultPassword === 'change-this-password-now') {
            throw new RuntimeException('Change TOOL_PASSWORD_DEFAULT or set CF_TOOL_PASSWORD before using this tool.');
        }

        $resolvedCreds = resolve_aws_credentials_for_test();
        $access = (string)($resolvedCreds['accessKeyId'] ?? $resolvedCreds[0] ?? '');
        $secret = (string)($resolvedCreds['secretAccessKey'] ?? $resolvedCreds[1] ?? '');
        $token = (string)($resolvedCreds['sessionToken'] ?? $resolvedCreds[2] ?? '');

        if (!$access || !$secret || looks_like_placeholder_key($access) || looks_like_placeholder_key($secret)) {
            throw new RuntimeException('AWS access key and secret key are required. Enter real keys manually, or create a local config file with active awsAccessKeyId and awsSecretAccessKey entries. Make sure the key lines are not commented out and not left as placeholders.');
        }

        $localConfigNotice = 'Using AWS credentials from ' . (string)($resolvedCreds['source'] ?? 'credential resolver') . '.';

        if (current_post('mode') === 'test-credentials') {
            $log[] = TOOL_PACKAGE_NAME . ' | ' . TOOL_VERSION . ' | built ' . TOOL_BUILD_TIMESTAMP_UTC;
            if ($localConfigNotice !== '') { $log[] = $localConfigNotice; }
            $test = cloudfront_diagnostic_credentials_test(resolve_aws_credentials_for_test());
            if (!empty($test['ok'])) {
                $log[] = 'Credentials ready. CloudFront test succeeded.';
            } else {
                throw new RuntimeException($test['message'] ?? 'Credential test failed.');
            }
            throw new RuntimeException('__TEST_COMPLETE__');
        }

        $creds = [$access, $secret, $token ?: null];

        if (current_post('mode') === 'discover') {
            
        if (!hash_equals(TOOL_LOGIN_USERNAME, current_post('toolUsername', TOOL_LOGIN_USERNAME)) || !is_tool_access_authorized($defaultPassword)) {
            $messages[] = ['type' => 'bad', 'text' => 'Tool password must be correct before distributions can be displayed.'];
        } else 
$discoveredDistributions = discover_distributions($creds);
            $log[] = TOOL_PACKAGE_NAME . ' | ' . TOOL_VERSION . ' | built ' . TOOL_BUILD_TIMESTAMP_UTC;
            $log[] = 'Loaded ' . count($discoveredDistributions) . ' CloudFront distributions.';
            throw new RuntimeException('__DISCOVERY_COMPLETE__');
        }

        $selectedDistributionRows = decode_selected_distributions($_POST['selectedDistributions'] ?? []);

        if ($selectedDistributionRows) {
            $distributionRows = $selectedDistributionRows;
        } else {
            $distributionRows = parse_distribution_pairs('', current_post('distributionLabels'));
        }

        if (!$distributionRows) {
            throw new RuntimeException('Select at least one distribution, or enter at least one distribution ID.');
        }

        $removedGridOnlyTarget = trim('');
        if ($removedGridOnlyTarget !== '') {
            $distributionRows = array_values(array_filter($distributionRows, function ($row) use ($removedGridOnlyTarget) {
                return strcasecmp($row['id'], $removedGridOnlyTarget) === 0
                    || strcasecmp($row['label'], $removedGridOnlyTarget) === 0
                    || stripos($row['label'], $removedGridOnlyTarget) !== false;
            }));

            if (!$distributionRows) {
                throw new RuntimeException('Run-only filter did not match any distribution ID or friendly name.');
            }
        }

        $removedPublicDistributionIdFallbacks = array_column($distributionRows, 'id');

        
$friendlyDistributionNames = [];
$rawDistributionLinesForNames = preg_split('/\R+/', (string)'');
foreach ($rawDistributionLinesForNames as $rawDistributionLineForName) {
    $lineForName = trim((string)$rawDistributionLineForName);
    if ($lineForName === '') {
        continue;
    }

    $idForName = $lineForName;
    $nameForId = '';

    if (strpos($lineForName, '|') !== false) {
        [$idForName, $nameForId] = array_map('trim', explode('|', $lineForName, 2));
    } elseif (preg_match('/^(E[A-Z0-9]+)\s+(.+)$/', $lineForName, $mName)) {
        $idForName = trim($mName[1]);
        $nameForId = trim($mName[2]);
    } elseif (!preg_match('/^E[A-Z0-9]+$/', $lineForName)) {
        // A manually typed friendly name/domain can label itself until discovery maps it to an ID.
        $nameForId = $lineForName;
    }

    if ($idForName !== '' && $nameForId !== '') {
        $friendlyDistributionNames[$idForName] = $nameForId;
    }
}
$mediaPatterns = lines_to_array(current_post('mediaPatterns', DEFAULT_MEDIA_PATTERNS_TEXT));
        if (!$mediaPatterns) {
            throw new RuntimeException('At least one media pattern is required.');
        }

        $apply = current_post('mode') === 'apply';

        $config = [
            'removedPublicDistributionIdFallbacks' => $removedPublicDistributionIdFallbacks,
            'mediaPatterns' => $mediaPatterns,
            'addDebugBehavior' => current_post('addDebugBehavior') === '1',
            'addJsonBehavior' => false,
            'addMediaBehaviors' => current_post('addMediaBehaviors') === '1'
        ];

        $creds = [
            0 => $access,
            1 => $secret,
            2 => ($token !== '' ? $token : null),
            'accessKeyId' => $access,
            'secretAccessKey' => $secret,
            'sessionToken' => $token,
            'source' => (string)($resolvedCreds['source'] ?? 'credential resolver'),
        ];

        $log[] = TOOL_PACKAGE_NAME . ' | ' . TOOL_VERSION . ' | built ' . TOOL_BUILD_TIMESTAMP_UTC;
        if ($localConfigNotice !== '') { $log[] = $localConfigNotice; }
        $log[] = $apply ? 'APPLY MODE: CloudFront will be updated.' : 'DRY RUN MODE: no CloudFront changes will be made.';
        append_runtime_credential_source_log($log, $creds);
        if (!$apply) {
            $log[] = 'Dry run note: no files are written to this server. Candidate XML stays in this page for Copy results or Download results.';
        }

        $mediaPolicy = ensure_cache_policy(
            MEDIA_CACHE_POLICY_NAME,
            cache_policy_xml(MEDIA_CACHE_POLICY_NAME, 'Long-lived cache for immutable public media assets.', 0, 31536000, 31536000),
            $creds,
            $apply,
            $log
        );

        $jsonPolicy = ensure_cache_policy(
            JSON_CACHE_POLICY_NAME,
            cache_policy_xml(JSON_CACHE_POLICY_NAME, 'Near-fresh cache for JSON files, including .directory-index.json.', 0, 1, 60),
            $creds,
            $apply,
            $log
        );

        $debugPolicy = ensure_cache_policy(
            DEBUG_CACHE_POLICY_NAME,
            cache_policy_xml(DEBUG_CACHE_POLICY_NAME, 'No-cache policy for URLs containing debug.', 0, 0, 0, false),
            $creds,
            $apply,
            $log
        );

        $corsPolicy = ensure_response_headers_policy(
            MEDIA_CORS_POLICY_NAME,
            response_headers_policy_xml(),
            $creds,
            $apply,
            $log
        );

        $policyIds = [
            'media' => $mediaPolicy,
            'json' => $jsonPolicy,
            'debug' => $debugPolicy,
            'cors' => $corsPolicy
        ];

        foreach ($distributionRows as $row) {
            update_distribution($row['id'], $row['label'], $config, $policyIds, $creds, $apply, $log);
        }

        $log[] = 'Done.';
    } catch (Throwable $e) {
        if ($e->getMessage() === '__DISCOVERY_COMPLETE__' || $e->getMessage() === '__TEST_COMPLETE__') {
            $error = '';
        } else {
            $error = $e->getMessage();
        }
    }
}

$defaultDist = "E2V3BNV4FSTYQ1\nE23DJVV7J0ZZX9\nE1Z4EN8UZHXGSO";
$defaultLabels = "www.8k.art\nwww.8k.press\ndefine.com";
?><!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>CloudFront Media Behavior Automation v158</title>
<meta name="viewport" content="width=device-width, initial-scale=1">


<script>
async function copyTextFromElement(id, statusId) {
    const el = document.getElementById(id);
    const status = document.getElementById(statusId);
    if (!el) return;

    const text = el.innerText || el.textContent || "";

    try {
        await navigator.clipboard.writeText(text);
        if (status) status.textContent = "Copied.";
    } catch (err) {
        const range = document.createRange();
        range.selectNodeContents(el);
        const selection = window.getSelection();
        selection.removeAllRanges();
        selection.addRange(range);
        if (status) status.textContent = "Selected. Press Ctrl+C.";
    }
}
</script>


<script>
function openPitchModal() {
    const modal = document.getElementById('pitchModal');
    if (!modal) {
        alert('The educational popup was not found in this build.');
        return;
    }
    modal.classList.add('open');
    document.body.style.overflow = 'hidden';
}
function closePitchModal() {
    const modal = document.getElementById('pitchModal');
    if (!modal) return;
    modal.classList.remove('open');
    document.body.style.overflow = '';
}
document.addEventListener('keydown', function (event) {
    if (event.key === 'Escape') closePitchModal();
});
</script>


<script>
document.addEventListener('DOMContentLoaded', function () {
    const form = document.querySelector('form');
    if (!form) return;
    form.addEventListener('submit', function () {
        const visible = document.querySelector('input[name=localConfigPathVisible]');
        const hidden = document.querySelector('input[name=localConfigPath]');
        if (visible && hidden) hidden.value = visible.value;
    });
});
</script>


<script>
document.addEventListener('DOMContentLoaded', function () {
    const result = document.getElementById('runResultPanel');
    if (result && window.location.hash === '') {
        result.scrollIntoView({behavior: 'smooth', block: 'start'});
    }

    const form = document.querySelector('form');
    if (form) {
        form.addEventListener('submit', function () {
            if (!location.hash || location.hash !== '') {
                history.replaceState(null, '', location.pathname + location.search + '');
            }
        });
    }
});
</script>


<script>
(function () {

    function flashButton(button) {
        if (!button) return;
        button.classList.add('button-flash');
        window.setTimeout(function () {
            button.classList.remove('button-flash');
        }, 160);
    }

    function setButtonWorking(button, isWorking) {
        if (!button) return;
        button.classList.toggle('button-working', !!isWorking);
        button.setAttribute('aria-busy', isWorking ? 'true' : 'false');
    }


    function setInlineStatus(el, message, cls) {
        if (!el) return;
        el.textContent = message || '';
        el.className = 'inline-status ' + (cls || '');
    }

    function setAjaxStatus(message, cls) {
        const bar = document.getElementById('ajaxStatusBar');
        if (!bar) return;
        bar.textContent = message || '';
        bar.className = 'ajax-status-bar ' + (message ? 'show ' : '') + (cls || '');
    }
    }

    function setHiddenActionToken(token) {
        if (!token) return;
        const input = document.querySelector('input[name="toolActionToken"]');
        if (input) input.value = token;
    }

    async function streamRunAction(form, submitter, requestedMode) {
        const data = new FormData(form);
        data.set('mode', 'ajax-run-action');
        data.set('runAction', requestedMode);

        const label = requestedMode === 'apply' ? 'Apply Changes on CloudFront' : 'Dry run';
        setAjaxStatus(label + '…', 'wait');
        updateRunResultPanel('wait', [label + ' started.'], label + ' started.');

        if (submitter) { flashButton(submitter); setButtonWorking(submitter, true); }

        try {
            const response = await fetch(window.location.href, {
                method: 'POST',
                body: data,
                credentials: 'same-origin',
                headers: { 'X-Requested-With': 'XMLHttpRequest' }
            });

            if (!response.ok) {
                throw new Error('HTTP ' + response.status);
            }

            if (!response.body || !response.body.getReader) {
                throw new Error('This browser does not support streaming fetch responses.');
            }

            const reader = response.body.getReader();
            const decoder = new TextDecoder();
            let buffer = '';
            let finalOk = false;
            let latestLog = [];

            while (true) {
                const chunk = await reader.read();
                if (chunk.done) break;

                buffer += decoder.decode(chunk.value, { stream: true });
                const lines = buffer.split('\\n');
                buffer = lines.pop() || '';

                for (const line of lines) {
                    const trimmed = line.trim();
                    if (!trimmed) continue;

                    let eventRow;
                    try {
                        eventRow = JSON.parse(trimmed);
                    } catch (parseError) {
                        latestLog.push(trimmed);
                        updateRunResultPanel('wait', latestLog, trimmed);
                        continue;
                    }

                    if (eventRow.token) {
                        setHiddenActionToken(eventRow.token);
                    }

                    if (eventRow.log && Array.isArray(eventRow.log)) {
                        latestLog = eventRow.log;
                    } else if (eventRow.message) {
                        latestLog.push(eventRow.message);
                    }

                    if (window.cfToolTraceEvent) {
                        window.cfToolTraceEvent('ajax_run_progress', {
                            type: eventRow.type || '',
                            kind: eventRow.kind || '',
                            message: eventRow.message || '',
                            current: eventRow.current || null,
                            total: eventRow.total || null
                        });
                    }

                    if (eventRow.type === 'error') {
                        finalOk = false;
                        updateRunResultPanel('bad', latestLog, eventRow.message || 'Run failed.');
                        setAjaxStatus(eventRow.message || 'Run failed.', 'bad');
                    } else if (eventRow.type === 'done') {
                        finalOk = !!eventRow.ok;
                        updateRunResultPanel(finalOk ? 'good' : 'bad', latestLog, eventRow.message || 'Done.');
                        setAjaxStatus(finalOk ? 'Done.' : 'Run failed.', finalOk ? 'good' : 'bad');
                    } else {
                        updateRunResultPanel(eventRow.kind === 'bad' ? 'bad' : 'wait', latestLog, eventRow.message || 'Working…');
                        if (eventRow.message) setAjaxStatus(eventRow.message, eventRow.kind || 'wait');
                    }
                }
            }

            if (buffer.trim()) {
                try {
                    const eventRow = JSON.parse(buffer.trim());
                    if (eventRow.token) setHiddenActionToken(eventRow.token);
                    if (eventRow.log && Array.isArray(eventRow.log)) latestLog = eventRow.log;
                    updateRunResultPanel(eventRow.ok ? 'good' : 'bad', latestLog, eventRow.message || 'Done.');
                } catch (e) {}
            }

            window.setTimeout(function () {
                setAjaxStatus(finalOk ? 'Done.' : '', finalOk ? 'good' : '');
            }, 2500);
        } catch (error) {
            const message = 'Request failed: ' + error.message;
            setAjaxStatus(message, 'bad');
            updateRunResultPanel('bad', [message], message);
        } finally {
            if (submitter) setButtonWorking(submitter, false);
        }
    }


    function wireAjaxRunButtons() {
        const form = document.getElementById('cloudfrontToolForm') || document.querySelector('form');
        if (!form) return;

        ['dryRunButton', 'applyChangesButton'].forEach(function (id) {
            const button = document.getElementById(id);
            if (!button || button.dataset.ajaxRunWired === '1') return;

            button.dataset.ajaxRunWired = '1';
            button.addEventListener('click', function (event) {
                event.preventDefault();
                event.stopPropagation();

                if (button.disabled) {
                    return;
                }

                const action = button.dataset.runAction;
                if (action !== 'dry-run' && action !== 'apply') {
                    setAjaxStatus('Unsupported action.', 'bad');
                    return;
                }

                streamRunAction(form, button, action);
            }, true);
        });
    }

    async function postForm(form, submitter) {
        const data = submitter ? new FormData(form, submitter) : new FormData(form);
        const requestedMode = data.get('mode');

        if (requestedMode === 'dry-run' || requestedMode === 'apply') {
            await streamRunAction(form, submitter, requestedMode);
            return;
        }

        setAjaxStatus('Unsupported action.', 'bad');
    }

async function tryStoreToolPassword(form) {
        try {
            if (!('credentials' in navigator) || typeof PasswordCredential === 'undefined') return;
            const passwordInput = document.getElementById('toolPasswordInput');
            const password = passwordInput ? passwordInput.value : '';
            if (!password) return;

            const credential = new PasswordCredential({
                id: 'cloudfront-media-tool',
                name: 'cloudfront-media-tool',
                password: password
            });

            await .store(credential);
        } catch (e) {
            // Browser password save support is optional. Ignore failures.
        }
    }

    
    async function testToolPassword(button) {
        const form = document.getElementById('cloudfrontToolForm') || button.closest('form') || document.querySelector('form');
        const toolStatus = document.getElementById('toolPasswordStatus');

        setInlineStatus(toolStatus, 'Testing…', 'wait');
        flashButton(button);
        setButtonWorking(button, true);

        try {
            if (!(form instanceof HTMLFormElement)) { throw new Error('App form was not found.'); }
            const data = new FormData(form);
            data.set('mode', 'ajax-test-tool-password');

            const response = await (window.cfToolFetchWithTimeout || fetch)(window.location.href, {
                method: 'POST',
                body: data,
                credentials: 'same-origin',
                headers: { 'X-Requested-With': 'XMLHttpRequest' }
            }, 12000, data.get('mode') || 'ajax');

            const result = await response.json();
            setInlineStatus(toolStatus, result.message || (result.ok ? 'Password OK.' : 'Password failed.'), result.ok ? 'good' : 'bad');

            if (result.ok) {
                await tryStoreToolPassword(form);
            }
        } catch (error) {
            setInlineStatus(toolStatus, (error.name === 'AbortError' ? 'Timed out. Copy trace log.' : 'Test failed: ' + error.message), 'bad');
        } finally {
            setButtonWorking(button, false);
        }
    }

async function testCredentials(button) {
        const form = document.getElementById('cloudfrontToolForm') || button.closest('form') || document.querySelector('form');
        const awsStatus = document.getElementById('awsCredentialStatus');
        const toolStatus = document.getElementById('toolPasswordStatus');

        setInlineStatus(toolStatus, '', '');
        setInlineStatus(awsStatus, 'Testing…', 'wait');
        flashButton(button);
        setButtonWorking(button, true);

        try {
            if (!(form instanceof HTMLFormElement)) { throw new Error('App form was not found.'); }
            const data = new FormData(form);
            data.set('mode', 'ajax-test-credentials');

            const response = await (window.cfToolFetchWithTimeout || fetch)(window.location.href, {
                method: 'POST',
                body: data,
                credentials: 'same-origin',
                headers: { 'X-Requested-With': 'XMLHttpRequest' }
            }, 12000, data.get('mode') || 'ajax');

            const result = await response.json();
            if (window.cfToolTraceEvent && result.serverTrace) {
                window.cfToolTraceEvent('server_trace', { label: 'ajax-test-credentials', trace: result.serverTrace });
            }

            if (result.target === 'toolPassword') {
                setInlineStatus(toolStatus, result.message || 'Tool password problem.', result.ok ? 'good' : 'bad');
                setInlineStatus(awsStatus, '', '');
            } else {
                setInlineStatus(awsStatus, result.message || (result.ok ? 'Credentials OK.' : 'Credential test failed.'), result.ok ? 'good' : 'bad');
                    if (result.ok) { tryStoreToolPassword(form); }
            }
        } catch (error) {
            setInlineStatus(awsStatus, (error.name === 'AbortError' ? 'Timed out. Copy trace log.' : 'Test failed: ' + error.message), 'bad');
        } finally {
            setButtonWorking(button, false);
        }
    }

    document.addEventListener('click', function (event) {
        if (passwordButton) {
            event.preventDefault();
            testToolPassword(passwordButton);
            return;
        }

        const testButton = event.target.closest('#testCredentialsButton');
        if (testButton) {
            event.preventDefault();
            testCredentials(testButton);
        }
    });

    document.addEventListener('submit', function (event) {
        const form = event.target;
        if (!form || form.tagName !== 'FORM') return;

        event.preventDefault();
        postForm(form, event.submitter || null);
    });
})();
</script>


<script>
(function () {
    const TRACE_TIMEOUT_MS = 12000;
    window.cfToolTrace = window.cfToolTrace || [];

    function trace(event, data) {
        const row = {
            time: new Date().toISOString(),
            event: event,
            data: data || {}
        };
        window.cfToolTrace.push(row);
        const viewer = document.getElementById('traceViewer');
        if (viewer) viewer.textContent = traceText();
        try { console.debug('[CloudFrontTool]', row); } catch (e) {}
    }

    function traceText() {
        const lines = [];
        lines.push('CloudFront Media Behavior Automation Trace');
        lines.push('Page: ' + window.location.href);
        lines.push('User agent: ' + navigator.userAgent);
        lines.push('Generated: ' + new Date().toISOString());
        lines.push('');
        for (const row of window.cfToolTrace) {
            lines.push(row.time + ' | ' + row.event + ' | ' + JSON.stringify(row.data));
        }
        return lines.join('\n');
    }


    function openTraceInApp() {
        trace('trace_open_requested');
        const details = document.getElementById('traceDetails');
        const viewer = document.getElementById('traceViewer');
        const status = document.getElementById('traceStatus');

        if (details) details.open = true;
        if (viewer) viewer.textContent = traceText();

        if (status) {
            status.textContent = 'Trace opened.';
            status.className = 'inline-status good';
        }
    }


    function downloadTrace() {
        trace('trace_download_requested');
        const blob = new Blob([traceText()], { type: 'text/plain;charset=utf-8' });
        const url = URL.createObjectURL(blob);
        const a = document.createElement('a');
        const stamp = new Date().toISOString().replace(/[:.]/g, '-');
        a.href = url;
        a.download = 'cloudfront-media-tool-trace-' + stamp + '.txt';
        document.body.appendChild(a);
        a.click();
        a.remove();
        URL.revokeObjectURL(url);
        const status = document.getElementById('traceStatus');
        if (status) {
            status.textContent = 'Trace downloaded.';
            status.className = 'inline-status good';
        }
    }

    async function fetchWithTimeout(url, options, timeoutMs, label) {
        const controller = new AbortController();
        const timeout = setTimeout(function () {
            trace('ajax_timeout_abort', { label: label, timeoutMs: timeoutMs });
            controller.abort();
        }, timeoutMs);

        try {
            const start = performance.now();
            trace('ajax_start', { label: label, timeoutMs: timeoutMs });
            const response = await fetch(url, Object.assign({}, options || {}, { signal: controller.signal }));
            const elapsedMs = Math.round(performance.now() - start);
            trace('ajax_response', { label: label, status: response.status, ok: response.ok, elapsedMs: elapsedMs });
            return response;
        } catch (error) {
            trace('ajax_error', { label: label, name: error.name, message: error.message });
            throw error;
        } finally {
            clearTimeout(timeout);
        }
    }

    window.cfToolFetchWithTimeout = fetchWithTimeout;
    window.cfToolTraceEvent = trace;


    async function copyTraceToClipboard() {
        trace('trace_copy_requested');
        const text = traceText();
        const status = document.getElementById('traceStatus');

        try {
            if (navigator.clipboard && window.isSecureContext) {
                await navigator.clipboard.writeText(text);
            } else {
                const textarea = document.createElement('textarea');
                textarea.value = text;
                textarea.setAttribute('readonly', '');
                textarea.style.position = 'fixed';
                textarea.style.left = '-9999px';
                textarea.style.top = '0';
                document.body.appendChild(textarea);
                textarea.select();
                const ok = document.execCommand('copy');
                textarea.remove();

                if (!ok) {
                    throw new Error('copy command failed');
                }
            }

            trace('trace_copy_succeeded');
            if (status) {
                status.textContent = 'Trace copied.';
                status.className = 'inline-status good';
            }
        } catch (error) {
            trace('trace_copy_failed', { name: error.name, message: error.message });
            if (status) {
                status.textContent = 'Copy failed. Use Download trace log.';
                status.className = 'inline-status bad';
            }
        }
    }


    document.addEventListener('DOMContentLoaded', function () {
        trace('page_loaded', { version: 'v158' });
        const initialViewer = document.getElementById('traceViewer');
        if (initialViewer) {
            initialViewer.textContent = traceText();
            trace('trace_viewer_initialized');
        }
        const downloadButton = document.getElementById('downloadTraceButton');
        if (downloadButton) {
            downloadButton.addEventListener('click', function (event) {
                event.preventDefault();
                flashButton(downloadButton);
                downloadTrace();
            });
        }

        const copyButton = document.getElementById('copyTraceButton');
        if (copyButton) {
            copyButton.addEventListener('click', function (event) {
                event.preventDefault();
                flashButton(copyButton);
                copyTraceToClipboard();
            });
        }
    });
})();
</script>


<style>
:root {
    --bg: #0b0d13;
    --card: #181c28;
    --field: #080b11;
    --line: #343b50;
    --line2: #657086;
    --text: #eef3ff;
    --muted: #b7c0d8;
    --good: #9ff5c2;
    --bad: #ffbac5;
    --warn: #ffe8a3;
    --blue: #5d7df2;
    --gap: 10px;
    --control: 38px;
    --radius: 14px;
    --status-min-width: 180px;
    --tool-password-width: 210px;
    --aws-access-width: 180px;
    --aws-secret-width: 260px;
    --aws-token-width: 220px;
}

[hidden] {
    display: none;
}

* {
    box-sizing: border-box;
}

html,
body {
    margin: 0;
    padding: 0;
    background: var(--bg);
    color: var(--text);
    font-family: system-ui, -apple-system, Segoe UI, Arial, sans-serif;
}

main {
    width: min(1360px, calc(100vw - 32px));
    margin: 0 auto;
    padding: var(--gap) 0;
}

.app-header,
.card {
    margin: 0 0 var(--gap);
}

.app-header > * {
    margin: 0 0 var(--gap);
}

.app-header > *:last-child {
    margin-bottom: 0;
}

.app-header h1 {
    margin: 0 0 var(--gap);
    font-size: 24px;
    line-height: 1.1;
    font-weight: 900;
}

.title-version {
    font-size: 13px;
    font-weight: 800;
    color: var(--muted);
}

.app-header p {
    margin: 0 0 var(--gap);
    color: var(--muted);
    font-size: 13px;
    line-height: 1.35;
}

.card {
    padding: var(--gap);
    background: var(--card);
    border: 1px solid var(--line);
    border-radius: var(--radius);
}

.card > * {
    margin: 0 0 var(--gap);
}

.card > *:last-child {
    margin-bottom: 0;
}

.section-title {
    margin: 0 0 var(--gap);
    padding: 0;
    color: var(--text);
    font-size: 20px;
    line-height: 1.15;
    font-weight: 900;
}

.card h2 {
    display: none;
}

p,
.small,
.help-text {
    margin: 0;
    color: var(--muted);
    font-size: 13px;
    line-height: 1.4;
}

label {
    display: block;
    margin: 0 0 4px;
    color: var(--text);
    font-size: 13px;
    line-height: 1.15;
    font-weight: 800;
}

.credential-field-cell label {
    margin: 0;
}

input,
textarea,
select,
.fixed-username-box,
.standard-field {
    min-height: var(--control);
    padding: 7px 10px;
    background: var(--field);
    border: 1px solid var(--line2);
    border-radius: 10px;
    color: var(--text);
    font-size: 14px;
    outline: none;
    box-shadow: none;
}

input:focus,
textarea:focus,
select:focus,
.standard-field:focus {
    border-color: #9eb4ff;
    background: var(--field);
    color: var(--text);
}

input::placeholder,
textarea::placeholder {
    color: #7f8899;
}

input:-webkit-autofill,
input:-webkit-autofill:hover,
input:-webkit-autofill:focus,
input:-webkit-autofill:active,
textarea:-webkit-autofill,
textarea:-webkit-autofill:hover,
textarea:-webkit-autofill:focus,
select:-webkit-autofill,
select:-webkit-autofill:hover,
select:-webkit-autofill:focus {
    -webkit-box-shadow: 0 0 0 1000px var(--field) inset !important;
    box-shadow: 0 0 0 1000px var(--field) inset !important;
    -webkit-text-fill-color: var(--text) !important;
    caret-color: var(--text);
    background: var(--field) !important;
    background-color: var(--field) !important;
}

.btn,
button,
input[type="button"],
input[type="submit"] {
    appearance: none;
    display: inline-flex;
    align-items: center;
    justify-content: center;
    min-height: var(--control);
    height: var(--control);
    margin: 0;
    padding: 0 14px;
    border: 1px solid var(--line2);
    border-radius: 999px;
    background: #2a3044;
    color: var(--text);
    font-size: 14px;
    font-weight: 900;
    line-height: 1;
    cursor: pointer;
    user-select: none;
    position: static;
    transform: none;
    box-shadow: none;
    transition: box-shadow 90ms linear, border-color 90ms linear, background-color 90ms linear, opacity 90ms linear;
}

.btn:hover,
button:hover,
input[type="button"]:hover,
input[type="submit"]:hover {
    border-color: #9eb4ff;
    box-shadow: 0 0 0 2px rgba(158, 180, 255, .18);
}

.button-glow,
.btn:active,
button:active {
    background: #3b4770;
    border-color: #b8c6ff;
    box-shadow: 0 0 0 3px rgba(158, 180, 255, .42), 0 0 14px rgba(158, 180, 255, .30);
}

.access-login-row,
.credential-row {
    display: grid;
    align-items: end;
    gap: var(--gap);
    margin: 0;
}

.trace-actions,
.ui-row,
.standard-action-row {
    display: flex;
    align-items: center;
    flex-wrap: wrap;
    gap: var(--gap);
}

.access-login-row {
    grid-template-columns: max-content var(--tool-password-width) max-content minmax(var(--status-min-width), 1fr);
}

.aws-credential-row {
    grid-template-columns: var(--aws-access-width) var(--aws-secret-width) var(--aws-token-width) max-content minmax(var(--status-min-width), 1fr) max-content;
}

.trace-actions,
.ui-row,
.standard-action-row {
    display: flex;
    align-items: center;
    flex-wrap: wrap;
    gap: var(--gap);}

.fixed-username-box {
    height: var(--control);
    display: inline-flex;
    align-items: center;
    white-space: nowrap;
    user-select: none;
    font-weight: 900;
}

.tool-password-input {
    width: var(--tool-password-width);
    height: var(--control);
}

.credential-input {
    width: 100%;
    height: var(--control);
}

.credential-field-cell {
    display: flex;
    flex-direction: column;
    justify-content: flex-end;
    gap: 4px;
    min-width: 0;
    margin: 0;
    padding: 0;
    align-self: end;
}

.help-cell {
    display: flex;
    align-items: end;
    justify-content: flex-end;
    min-width: 0;
    margin: 0;
    padding: 0;
    align-self: end;
}

.button-cell,


.aws-card .credential-row {
    margin-bottom: 0;
}

.help-panel {
    width: 100%;
    margin: 0;
    padding: var(--gap);
    white-space: pre-wrap;
    word-break: break-word;
    font-family: inherit;
    font-size: 13px;
    line-height: 1.4;
}


details {
    margin: 0;
    padding: 0;
}

summary {
    display: block;
    margin: 0 0 var(--gap);
    padding: 0;
    color: var(--text);
    font-size: 15px;
    line-height: 1.25;
    font-weight: 900;
    cursor: pointer;
}

details > * {
    margin: var(--gap) 0 0;
}

details > summary {
    margin-top: 0;
}

.checkbox-label {
    display: inline-flex;
    align-items: center;
    gap: 8px;
    min-height: var(--control);
    margin: 0 var(--gap) 0 0;
    padding: 0;
    color: var(--text);
    font-size: 14px;
    font-weight: 900;
    line-height: 1;
    white-space: nowrap;
}

.checkbox-label input[type="checkbox"],
input[type="checkbox"] {
    width: 20px;
    height: 20px;
    min-width: 20px;
    min-height: 20px;
    margin: 0;
    padding: 0;
    accent-color: var(--blue);
}

.distribution-manual-box {
    width: min(680px, 100%);
    height: 108px;
    min-height: 108px;
    resize: vertical;
    font-family: Consolas, Monaco, monospace;
}

.media-patterns-box {
    width: 100%;
    min-height: 300px;
    height: 300px;
    margin: 0;
    resize: vertical;
    font-family: Consolas, Monaco, monospace;
    font-size: 14px;
    line-height: 1.25;
}

.policy-list {
    display: grid;
    gap: var(--gap);
    margin: 0;
}

.policy-list details {
    padding: var(--gap);
    border: 1px solid var(--line);
    border-radius: 10px;
    background: rgba(8, 11, 17, .45);
}

.compact-pre,
.card pre {
    margin: 0;
    padding: var(--gap);
    overflow: auto;
    white-space: pre-wrap;
    word-break: break-word;
    background: var(--field);
    border: 1px solid var(--line2);
    border-radius: 10px;
    color: var(--text);
    font-family: Consolas, Monaco, monospace;
    font-size: 12px;
    line-height: 1.35;
}

.mini-title {
    margin: 0 0 var(--gap);
    font-size: 15px;
    line-height: 1.25;
    font-weight: 900;
}

.picker-grid {
    display: grid;
    grid-template-columns: minmax(360px, 1fr) minmax(280px, .65fr);
    gap: var(--gap);
    margin: 0;
}

.dist-list {
    display: grid;
    gap: var(--gap);
}

.dist-item {
    display: flex;
    align-items: flex-start;
    gap: var(--gap);
    margin: 0;
    padding: var(--gap);
    border: 1px solid var(--line);
    border-radius: 10px;
    background: rgba(8, 11, 17, .45);
}

.dist-title {
    font-weight: 900;
}

.dist-meta {
    color: var(--muted);
    font-size: 12px;
    line-height: 1.35;
}

.modal-shell {
    display: none;
    position: fixed;
    inset: 0;
    z-index: 9999;
    padding: 48px 24px;
    background: rgba(0, 0, 0, .62);
}

.modal-shell.open {
    display: block;
}

.modal-panel {
    width: min(900px, calc(100vw - 48px));
    max-height: calc(100vh - 96px);
    margin: 0 auto;
    overflow: auto;
    padding: var(--gap);
    background: var(--card);
    border: 1px solid var(--line2);
    border-radius: var(--radius);
}

.modal-head {
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: var(--gap);
    margin-bottom: var(--gap);
}

.modal-head .section-title {
    margin: 0;
}

.modal-body p {
    margin: 0 0 var(--gap);
}


.button-cell,
.access-result-cell,
.aws-result-cell,
.credential-status-cell {
    width: 100%;
    min-width: 0;
    max-width: none;
    height: var(--control);
    min-height: var(--control);
    max-height: var(--control);
    display: flex;
    align-items: center;
    overflow: hidden;
}

.inline-status,
.status-line {
    display: block;
    width: 100%;
    min-width: 0;
    max-width: none;
    height: var(--control);
    max-height: var(--control);
    line-height: var(--control);
    margin: 0;
    padding: 0;
    overflow: hidden;
    white-space: nowrap;
    text-overflow: ellipsis;
    color: var(--muted);
    font-size: 13px;
    font-weight: 900;
}

.inline-status.good,
.inline-status.ok,
.status-line.good,
.status-line.ok {
    color: var(--good);
}

.inline-status.bad,
.status-line.bad {
    color: var(--bad);
}

.inline-status.wait,
.status-line.wait {
    color: var(--warn);
}


.trace-card .status-line,
.trace-card

.trace-card .section-body {
    display: flex;
    flex-direction: column;
    gap: var(--gap);
    margin: 0;
    padding: 0;
    min-height: 0;
    justify-content: flex-start;
}

.trace-actions {
    display: flex;
    align-items: center;
    gap: var(--gap);
    flex-wrap: wrap;
    margin: 0 0 var(--gap) 0;
    padding: 0;
    min-height: 0;
}

.trace-actions .trace-status {
    display: inline-flex;
    align-items: center;
    width: auto;
    min-width: 0;
    max-width: none;
    height: var(--control);
    min-height: var(--control);
    max-height: var(--control);
    line-height: var(--control);
    margin: 0;
    padding: 0;
    white-space: nowrap;
}

.trace-actions .trace-status:empty {
    display: none;
}

.trace-viewer {
    height: 260px;
    min-height: 260px;
    max-height: 260px;
    margin: 0;
    overflow: auto;
}

@media (max-width: 1050px) {
    main {
        width: calc(100vw - 20px);
    }

    .access-login-row,
    .aws-credential-row,
    .picker-grid {
        grid-template-columns: 1fr;
    }

    .trace-actions,
.ui-row,
.standard-action-row {
    display: flex;
    align-items: center;
    flex-wrap: wrap;
    gap: var(--gap);}

    .tool-password-input,
    .credential-input,
    .access-result-cell,
    .aws-result-cell,
    .credential-status-cell,
    .btn,
    button {
        width: 100%;
        min-width: 0;
        max-width: none;
    }
}


.trace-card .status-line,
.trace-card 


</style>


<!-- v161-polled-runlog-default-locked 2026-05-21T12:05:00Z -->
</head>
<body>
<main>
<header class="app-header">
<h1>CloudFront Media Setup <span class="title-version">v158</span></h1>
<p>Fast CloudFront setup for media caching, public CORS, near-fresh JSON, and no-cache debug paths.</p>
<button type="button" class="btn subtle-btn" id="salesPitchButton">Why this saves time</button>

</header>
<div id="ajaxStatusBar" class="ajax-status-bar"></div>
<form id="cloudfrontToolForm" method="post">
<input type="hidden" name="toolActionToken" value="<?= h($currentActionToken) ?>">

<section class="card access-card compact-section">
<div class="section-title">Access</div>

<div class="access-login-row">
<div class="username-cell">
<label>Tool username</label>
<div class="fixed-username-box" aria-label="Fixed tool username"><?= h(TOOL_LOGIN_USERNAME) ?></div>
<input type="hidden" name="toolUsername" autocomplete="username" value="<?= h(TOOL_LOGIN_USERNAME) ?>">
</div>

<div class="password-cell">
<label>Tool password</label>
<input id="toolPasswordInput" class="tool-password-input" type="password" name="toolPassword" autocomplete="current-password" value="<?= h(current_post('toolPassword')) ?>">
</div>

<div class="button-cell">
<button type="button" class="btn" id="accessLoginLogoutButton">Login</button>
</div>

<div class="access-result-cell credential-status-cell">
<span id="toolPasswordStatus" class="inline-status"></span>
</div>
</div>

</section>

<section class="card aws-card compact-section">
<div class="section-title">AWS credentials</div>

<div class="credential-row aws-credential-row">
<div class="credential-field-cell aws-access-cell">
<label>AWS Access Key ID</label>
<input class="credential-input" type="password" name="awsAccessKeyId" autocomplete="new-password" autocapitalize="off" spellcheck="false" placeholder="<?= h($configAccessMask) ?>" value="">
</div>

<div class="credential-field-cell aws-secret-cell">
<label>AWS Secret Access Key</label>
<input class="credential-input" type="password" name="awsSecretAccessKey" autocomplete="new-password" autocapitalize="off" spellcheck="false" placeholder="<?= h($configSecretMask) ?>" value="">
</div>

<div class="credential-field-cell aws-token-cell">
<label>AWS Session Token optional</label>
<input class="credential-input" type="password" name="awsSessionToken" autocomplete="new-password" autocapitalize="off" spellcheck="false" placeholder="<?= h($configTokenMask) ?>" value="">
</div>

<div class="button-cell"><button type="button" class="btn" id="testCredentialsButton">Test AWS credentials</button></div>
<div class="aws-result-cell credential-status-cell">
<span id="awsCredentialStatus" class="inline-status <?= $configHasKeys ? 'good' : 'bad' ?>"><?= $configHasKeys ? 'local config loaded' : 'not loaded' ?></span></div>
<div class="help-cell"><button type="button" class="btn help-button" id="awsCredentialHelpButton" data-help-topic="aws-credentials">Help</button></div>


</div>
</section>

<section class="card trace-card compact-section">
<div class="section-title">TraceLog</div>
<div class="trace-actions">
<button type="button" class="btn" id="copyTraceButton">Copy trace log</button>
<button type="button" class="btn" id="downloadTraceButton">Download trace log</button>
<span id="traceStatus" class="inline-status trace-status"></span>
</div>
<pre id="traceViewer" class="trace-viewer standard-field">Trace log is empty until you use the tool.</pre>
</section>


<section class="card">
<div class="section-title">Distributions</div>
<p>Recommended: the app tests local AWS config automatically, authorizes with the tool password, then displays distributions automatically when both checks are OK. Choose friendly site names from the picker.</p>
<div id="distributionPickerSlot"></div>
<div id="manualFallbackPanel" hidden>
<label>Distributions one per line</label>
<p class="small">Use a distribution ID, or use <code>DISTRIBUTION_ID|friendly name</code>. Friendly names/domains work automatically after loading distributions.</p>
</div>
<?php if ($discoveredDistributions): ?>
<div class="picker-grid">
<div>
<div class="mini-title">Available CloudFront distributions</div>
<div class="dist-list">
<?php foreach ($discoveredDistributions as $dist): ?>
<label class="dist-item">
<input type="checkbox" name="selectedDistributions[]" value="<?= h(encode_selected_distribution($dist)) ?>">
<span>
<span class="dist-title"><?= h($dist['friendly']) ?></span><br>
<span class="dist-meta">
ID: <?= h($dist['id']) ?><br>
Aliases: <?= h($dist['aliases'] ? implode(', ', $dist['aliases']) : '(none)') ?><br>
CloudFront: <?= h($dist['domain']) ?><br>
Status: <?= h($dist['status']) ?> | Enabled: <?= h($dist['enabled']) ?>
</span>
</span>
</label>
<?php endforeach; ?>
</div>
</div>
<div>
<div class="mini-title">How selection works</div>
<p class="small">Check one or more distributions, then run Dry run or Apply. Logs show friendly names beside distribution IDs.</p>
<p class="small">For IIS/FastCGI timeout safety, process one distribution at a time.</p>
</div>
</div>
<?php endif; ?>

</section>

<section class="card">
<div class="section-title">Behaviors</div>
<div class="checks">
<label class="checkbox-label"><input type="checkbox" name="addDebugBehavior" value="1" <?= current_post('addDebugBehavior', '1') === '1' ? 'checked' : '' ?>> *debug* no-cache</label>
<label class="checkbox-label"><input type="checkbox" name="addMediaBehaviors" value="1" <?= current_post('addMediaBehaviors', '1') === '1' ? 'checked' : '' ?>> media long-cache + CORS</label>
</div>

<label>Media path patterns one per line</label>
<textarea class="media-patterns-box distribution-manual-box" name="mediaPatterns"><?= h(current_post('mediaPatterns', DEFAULT_MEDIA_PATTERNS_TEXT)) ?></textarea>
</section>

<section class="card">
<div class="section-title">Run</div>
<p>Dry run keeps candidate distribution XML in memory and does not update CloudFront. Apply sends the distribution updates to AWS.</p>
<button type="button" class="primary" id="dryRunButton" data-run-action="dry-run" disabled>Dry run</button>
<button type="button" class="danger" id="applyChangesButton" data-run-action="apply" disabled>Apply Changes on CloudFront</button>
</section>

<section class="card trace-card compact-section" id="runLogCard" hidden>
<div class="section-title">RunLog</div>
<div class="trace-actions">
<button type="button" class="btn" id="copyRunLogButton">Copy to Clipboard</button>
<button type="button" class="btn" id="downloadRunLogButton">Download</button>
<span id="runInlineLogStatus" class="inline-status trace-status"></span>
</div>
<pre id="runInlineLogText" class="trace-viewer standard-field">Run log will appear here.</pre>
</section>

</form>

<?php if ($ran): ?>
<section id="runResultPanel" class="card <?= $error ? 'error' : 'ok' ?>">
<h2><?= $error ? 'Error' : 'Result' ?><?= $actionLabel ? ' — ' . h($actionLabel) : '' ?></h2>
<?php if ($error): ?>
<div class="trace-actions">
<button type="button" class="btn" onclick="copyTextFromElement('errorText', 'copyStatus')">Copy error</button>
<span id="copyStatus" class="copy-status"></span>
</div>
<pre id="errorText"><?= h($error) ?></pre>
<?php else: ?>
<div class="trace-actions">
<button type="button" class="btn" onclick="copyTextFromElement('resultText', 'copyResultStatus')">Copy results</button>
<span id="copyResultStatus" class="copy-status"></span>
</div>
<pre id="resultText"><?= h(implode("\n", $log)) ?></pre>
<?php endif; ?>
</section>
<?php endif; ?>

<section class="card policy-card">
<div class="section-title">Created/reused policies</div>
<p>These are the reusable CloudFront policies the tool creates or reuses. Open any item to see what it means in plain English.</p>
<div class="policy-list">
<details>
<summary>MediaCacheLong1Year</summary>
<p class="small">Used for image, audio, and video file patterns. This tells CloudFront to cache public media for a long time so repeat visitors are served from CloudFront instead of your origin.</p>
<pre class="compact-pre">Purpose: long-cache public media
Typical paths: *.jpg, *.png, *.webp, *.mp4, *.mp3, *.wav, ...
Result: faster media delivery and lower origin load</pre>
</details>
<details>
<summary>PublicMediaCORSFromEverywhere</summary>
<p class="small">Used when media or JSON must be readable by browsers, apps, canvases, players, creative tools, and JavaScript apps that people run from local files on their home PCs.</p>
<pre class="compact-pre">Purpose: public CORS response headers
Allowed origin: *
Common methods: GET, HEAD, OPTIONS
Result: public media can be fetched by browser JavaScript apps, including apps opened from the local file system on people's home PCs, without hand-editing every behavior</pre>
</details>
<details>
<summary>JsonNearFresh</summary>
<p class="small">Used for JSON files that should update quickly while still getting some CloudFront benefit.</p>
<pre class="compact-pre">Purpose: short-cache JSON
Typical paths: *.json
Result: app data and indexes stay near-fresh without making all static media short-cache</pre>
</details>
<details>
<summary>DebugNoCache</summary>
<p class="small">Used for debug paths so troubleshooting does not poison public cache results.</p>
<pre class="compact-pre">Purpose: no-cache debug behavior
Typical paths: *debug*
Result: testing and diagnostics stay uncached</pre>
</details>
</div>
</section>
</form>
</main>

<div id="pitchModal" class="modal-backdrop" onclick="if (event.target === this) closePitchModal();">
  <div class="modal-window" role="dialog" aria-modal="true" aria-labelledby="pitchTitle">
    <div class="modal-header">
      <h2 id="pitchTitle">
<script id="v66-ui-fix">
(function () {
    function traceRows() { return window.cfToolTrace || []; }

    function traceText() {
        const lines = [
            'CloudFront Media Behavior Automation Trace',
            'Page: ' + window.location.href,
            'User agent: ' + navigator.userAgent,
            'Generated: ' + new Date().toISOString(),
            ''
        ];
        for (const row of traceRows()) {
            lines.push((row.time || '') + ' | ' + (row.event || '') + ' | ' + JSON.stringify(row.data || {}));
        }
        return lines.join('\n');
    }

    function refreshTraceViewer() {
        const viewer = document.getElementById('traceViewer');
        if (viewer) viewer.textContent = traceText();
    }

    function setStatus(id, text, good) {
        const el = document.getElementById(id);
        if (!el) return;
        el.textContent = text || '';
        el.className = 'inline-status ' + (good ? 'good' : 'bad');
    }

    function glow(button) {
        if (!button) return;
        button.classList.add('button-glow');
        window.setTimeout(function () { button.classList.remove('button-glow'); }, 220);
    }

    async function copyText(text) {
        if (navigator.clipboard && window.isSecureContext) {
            await navigator.clipboard.writeText(text);
            return;
        }
        const ta = document.createElement('textarea');
        ta.value = text;
        ta.setAttribute('readonly', '');
        ta.style.position = 'fixed';
        ta.style.left = '-10000px';
        ta.style.top = '0';
        document.body.appendChild(ta);
        ta.focus();
        ta.select();
        const ok = document.execCommand('copy');
        ta.remove();
        if (!ok) throw new Error('copy failed');
    }

    function openPitch() {
        const modal = document.getElementById('salesPitchModal');
        if (!modal) return;
        modal.classList.add('open');
        modal.setAttribute('aria-hidden', 'false');
    }

    function closePitch() {
        const modal = document.getElementById('salesPitchModal');
        if (!modal) return;
        modal.classList.remove('open');
        modal.setAttribute('aria-hidden', 'true');
    }

    document.addEventListener('click', async function (event) {
        const btn = event.target.closest('button, input[type="button"], input[type="submit"]');
        if (btn) glow(btn);

        if (event.target.closest('#salesPitchButton')) {
            event.preventDefault();
            openPitch();
            return;
        }

        if (event.target.closest('#salesPitchCloseButton') || event.target.id === 'salesPitchModal') {
            event.preventDefault();
            closePitch();
            return;
        }

        const copy = event.target.closest('#copyTraceButton');
        if (copy) {
            event.preventDefault();
            event.stopPropagation();
            refreshTraceViewer();
            try {
                if (window.cfToolTraceEvent) window.cfToolTraceEvent('trace_copy_requested', {});
                await copyText(traceText());
                if (window.cfToolTraceEvent) window.cfToolTraceEvent('trace_copy_succeeded', {});
                setStatus('traceStatus', 'Trace copied.', true);
            } catch (error) {
                if (window.cfToolTraceEvent) window.cfToolTraceEvent('trace_copy_failed', { message: error.message });
                setStatus('traceStatus', 'Copy failed.', false);
            }
            refreshTraceViewer();
            return;
        }

        const download = event.target.closest('#downloadTraceButton');
        if (download) {
            event.preventDefault();
            event.stopPropagation();
            refreshTraceViewer();
            try {
                if (window.cfToolTraceEvent) window.cfToolTraceEvent('trace_download_requested', {});
                const blob = new Blob([traceText()], { type: 'text/plain;charset=utf-8' });
                const url = URL.createObjectURL(blob);
                const a = document.createElement('a');
                a.href = url;
                a.download = 'cloudfront-media-tool-trace-' + new Date().toISOString().replace(/[:.]/g, '-') + '.txt';
                document.body.appendChild(a);
                a.click();
                a.remove();
                URL.revokeObjectURL(url);
                setStatus('traceStatus', 'Trace downloaded.', true);
            } catch (error) {
                setStatus('traceStatus', 'Download failed.', false);
            }
            refreshTraceViewer();
        }
    }, true);

    document.addEventListener('keydown', function (event) {
        if (event.key === 'Escape') closePitch();
    });

    document.addEventListener('DOMContentLoaded', refreshTraceViewer);
})();
</script>


<script id="v158-aws-credential-status-fix">
(function () {
    function byId(id) { return document.getElementById(id); }

    function setAwsStatus(text, kind) {
        const el = byId('awsCredentialStatus');
        if (!el) return;
        el.textContent = text || '';
        el.className = 'inline-status ' + (kind || '');
    }

    function glow(button) {
        if (!button) return;
        button.classList.add('button-glow');
        window.setTimeout(function () { button.classList.remove('button-glow'); }, 220);
    }

    function traceEvent(event, data) {
        if (window.cfToolTraceEvent) {
            window.cfToolTraceEvent(event, data || {});
        }
    }

    function refreshTraceViewer() {
        if (window.v61RefreshTraceViewer) {
            try { window.v61RefreshTraceViewer(); } catch (e) {}
        }

        const viewer = byId('traceViewer');
        if (!viewer || !window.cfToolTrace) return;

        const lines = [
            'CloudFront Media Behavior Automation Trace',
            'Page: ' + window.location.href,
            'User agent: ' + navigator.userAgent,
            'Generated: ' + new Date().toISOString(),
            ''
        ];

        for (const row of window.cfToolTrace) {
            lines.push((row.time || '') + ' | ' + (row.event || '') + ' | ' + JSON.stringify(row.data || {}));
        }

        viewer.textContent = lines.join('
');
    }

    function shortAwsMessage(payload) {
        if (!payload) {
            return { text: 'AWS test failed; see TraceLog.', kind: 'bad' };
        }

        if (payload.ok === true) {
            const text = payload.message || 'AWS credentials OK.';
            return { text: text, kind: 'good' };
        }

        const raw = [
            payload.message || '',
            payload.error || '',
            payload.code || '',
            payload.awsCode || '',
            payload.awsMessage || '',
            payload.raw || ''
        ].join(' ').toLowerCase();

        const trace = Array.isArray(payload.trace) ? payload.trace.join(' ').toLowerCase() : '';
        const msg = raw + ' ' + trace;

        if (
            msg.indexOf('ssl') !== -1 ||
            msg.indexOf('tls') !== -1 ||
            msg.indexOf('certificate') !== -1 ||
            msg.indexOf('issuer certificate') !== -1 ||
            msg.indexOf('curl_errno=60') !== -1
        ) {
            return { text: 'Server TLS/certificate problem; open Help or TraceLog.', kind: 'bad' };
        }

        if (
            msg.indexOf('signaturedoesnotmatch') !== -1 ||
            msg.indexOf('invalidaccesskeyid') !== -1 ||
            msg.indexOf('expiredtoken') !== -1 ||
            msg.indexOf('request signature we calculated does not match') !== -1
        ) {
            return { text: 'AWS rejected key/signature; see TraceLog.', kind: 'bad' };
        }

        if (
            msg.indexOf('invalidclienttokenid') !== -1 ||
            msg.indexOf('the security token included in the request is invalid') !== -1
        ) {
            return { text: 'AWS rejected token/key; compare TraceLog fingerprint.', kind: 'bad' };
        }

        if (
            msg.indexOf('accessdenied') !== -1 ||
            msg.indexOf('access denied') !== -1 ||
            msg.indexOf('not authorized') !== -1 ||
            msg.indexOf('unauthorizedoperation') !== -1
        ) {
            return { text: 'AWS denied this CloudFront action; see TraceLog.', kind: 'bad' };
        }

        if (payload.message && payload.message.indexOf('CloudFront answered HTTP') === 0) {
            return { text: payload.message, kind: 'bad' };
        }

        if (
            msg.indexOf('http_code=403') !== -1 ||
            msg.indexOf('http code=403') !== -1 ||
            msg.indexOf('http_code":403') !== -1
        ) {
            return { text: 'AWS returned HTTP 403; see TraceLog.', kind: 'bad' };
        }

        return { text: payload.message || 'AWS test failed; see TraceLog.', kind: 'bad' };
    }

    async function postAwsCredentialTest(button) {
        const form = button.closest('form') || document.querySelector('form');
        if (!form) {
            setAwsStatus('Form not found', 'bad');
            return;
        }

        glow(button);
        setAwsStatus('Testing…', 'wait');
        traceEvent('ajax_start', { label: 'ajax-test-credentials-v158', timeoutMs: 12000 });

        const controller = new AbortController();
        const timer = window.setTimeout(function () { controller.abort(); }, 12000);

        try {
            const data = new FormData(form);
            data.set('mode', 'ajax-test-credentials');

            const started = Date.now();
            const response = await fetch(window.location.href, {
                method: 'POST',
                body: data,
                credentials: 'same-origin',
                signal: controller.signal
            });

            const text = await response.text();
            let payload;
            try {
                payload = JSON.parse(text);
            } catch (parseError) {
                payload = { ok: false, message: 'Invalid server response', raw: text.slice(0, 500) };
            }

            traceEvent('ajax_response', {
                label: 'ajax-test-credentials-v158',
                status: response.status,
                ok: response.ok,
                elapsedMs: Date.now() - started
            });

            if (payload && payload.trace) {
                traceEvent('server_trace', { label: 'ajax-test-credentials-v158', trace: payloadfinally {
            window.clearTimeout(timer);
        }
    }

    document.addEventListener('click', function (event) {
        const button = event.target.closest('#testCredentialsButton');
        if (!button) return;

        event.preventDefault();
        event.stopImmediatePropagation();
        event.stopPropagation();

        postAwsCredentialTest(button);
    }, true);
})();
</script>


<script id="v158-standard-help-panel">
(function () {
    const helpText = {
        'aws-credentials': [
            'AWS credential test help',
            '',
            'This status is the short result. TraceLog contains the exact server response, AWS response, and a safe credential fingerprint.',
            '',
            'What a successful test proves',
            'The web server can run PHP, PHP can use cURL, TLS worked, the AWS request was signed, and CloudFront answered.',
            '',
            'For IIS on a home PC',
            'The common failure is not the AWS key. It is the local PHP/IIS environment: missing curl extension, missing openssl extension, blocked outbound HTTPS, or PHP/cURL not trusting certificate authorities.',
            '',
            'What the IT consultant should check',
            '1. PHP is running under IIS/FastCGI.',
            '2. PHP extensions curl and openssl are loaded.',
            '3. The server can make outbound HTTPS requests to cloudfront.amazonaws.com.',
            '4. Windows/PHP/cURL certificate trust works. If TraceLog shows cURL errno 60 or issuer certificate errors, fix PHP/cURL certificate trust.',
            '5. The local config file contains the access key and secret key. Leave awsSessionToken blank for ordinary permanent IAM access keys.',
            '',
            'What to copy when asking for help',
            'Use Copy trace log. It includes PHP version, server software, OS, cURL/OpenSSL status, cURL timings, and the AWS HTTP response.'
        ].join('\n')
    };

    function ensureHelpPanel(card) {
        let panel = card.querySelector('.help-panel');
        if (!panel) {
            panel = document.createElement('pre');
            panel.className = 'help-panel standard-field';
            panel.hidden = true;
            card.appendChild(panel);
        }
        return panel;
    }

    function initHelpButtons() {
        document.querySelectorAll('[data-help-topic]').forEach(function (button) {
            button.addEventListener('click', function () {
                const card = button.closest('.card');
                if (!card) return;
                const panel = ensureHelpPanel(card);
                const topic = button.getAttribute('data-help-topic');
                panel.textContent = helpText[topic] || 'No help is available for this item yet.';
                panel.hidden = !panel.hidden;
                button.classList.add('button-glow');
                window.setTimeout(function () { button.classList.remove('button-glow'); }, 220);
                if (window.cfToolTraceEvent) {
                    window.cfToolTraceEvent('help_toggle', { topic: topic, open: !panel.hidden });
                }
            });
        });
    }

    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', initHelpButtons);
    } else {
        initHelpButtons();
    }
})();
</script>


<script id="v158-local-config-boot-state">
window.CLOUDFRONT_MEDIA_LOCAL_CONFIG_HAS_AWS_CREDENTIALS = <?= local_config_has_aws_credentials() ? 'true' : 'false' ?>;
</script>

<script id="v158-trace-status-inline-helper">
(function () {
    'use strict';

    function rowContainingButtons() {
        var buttons = Array.prototype.slice.call(document.querySelectorAll('button'));
        var copy = buttons.find(function (b) { return /copy trace log/i.test((b.textContent || '').trim()); });
        var download = buttons.find(function (b) { return /download trace log/i.test((b.textContent || '').trim()); });
        if (!copy || !download) return null;
        return copy.closest('.trace-actions, .action-row, .standard-action-row, div') || copy.parentElement;
    }

    function ensureInlineTraceStatus() {
        var row = rowContainingButtons();
        if (!row) return null;
        row.classList.add('trace-actions');
        var status = document.getElementById('traceStatus') || row.querySelector('.trace-status');
        if (!status) {
            status = document.createElement('span');
            status.id = 'traceStatus';
            status.className = 'status-line trace-status';
            status.setAttribute('aria-live', 'polite');
            row.appendChild(status);
        } else if (status.parentElement !== row) {
            row.appendChild(status);
        }
        status.classList.add('status-line', 'trace-status');
        return status;
    }

    window.setInlineTraceStatus = function (text, kind) {
        var status = ensureInlineTraceStatus();
        if (!status) return;
        status.textContent = text || '';
        status.classList.remove('ok', 'bad');
        if (kind) status.classList.add(kind);
    };

    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', ensureInlineTraceStatus);
    } else {
        ensureInlineTraceStatus();
    }
})();
</script>

<script id="v158-auto-authorize-then-aws-then-load-distributions">
(function () {
    'use strict';

    var prefetchPromise = null;
    var prefetchedPayload = null;
    var accessAuthorized = false;
    var passwordTestInFlight = false;

    function traceAuto(eventName, data) {
        if (typeof window.trace === 'function') {
            window.trace(eventName, data || {});
        }
    }

    function fieldByName(name) {
        return document.querySelector('[name="' + name + '"]');
    }

    function accessPasswordField() {
        return fieldByName('toolPassword') || fieldByName('tool_password') || fieldByName('password');
    }

    function mainForm() {
        var password = accessPasswordField();
        if (password && password.form) return password.form;
        return document.querySelector('form');
    }

    function setStandardStatus(id, text, kind) {
        var el = document.getElementById(id);
        if (!el) return;
        el.textContent = text || '';
        el.className = 'inline-status ' + (kind === 'ok' ? 'good' : (kind || ''));
    }

    function setAccessStatus(text, kind) {
        setStandardStatus('toolPasswordStatus', text, kind);
    }

    function setAwsStatus(text, kind) {
        if (/tool password|password is incorrect|Password OK|Passed OK|Please enter the tool password|Enter tool password/i.test(text || '')) {
            traceAuto('blocked_wrong_status_target', { target: 'aws', text: text || '' });
            return;
        }
        setStandardStatus('awsCredentialStatus', text, kind);
    }

    function requestMode(mode, fields) {
        var body = new URLSearchParams();
        body.set('mode', mode);
        Object.keys(fields || {}).forEach(function (key) {
            body.set(key, fields[key] == null ? '' : String(fields[key]));
        });

        return fetch(window.location.href, {
            method: 'POST',
            headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' },
            body: body.toString(),
            credentials: 'same-origin'
        }).then(function (r) {
            return r.json();
        });
    }

    function requestModeWithCurrentFormData(mode) {
        var form = mainForm();
        var data = form ? new FormData(form) : new FormData();
        data.set('mode', mode);

        traceAuto('login_formdata_password_submit', {
            mode: mode,
            hasForm: !!form,
            hasToolPasswordEntry: data.has('toolPassword'),
            toolPasswordLengthFromFormData: String(data.get('toolPassword') || '').length
        });

        return fetch(window.location.href, {
            method: 'POST',
            body: data,
            credentials: 'same-origin'
        }).then(function (r) {
            return r.json();
        });
    }

    function appendServerTrace(label, payload) {
        var trace = payload && (payload.serverTrace || payload.trace);
        if (!trace) return;
        if (typeof window.trace === 'function') {
            window.trace('server_trace', { label: label, trace: trace });
        }
    }

    function escapeHtml(value) {
        return String(value == null ? '' : value).replace(/[&<>"']/g, function (ch) {
            return ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#039;' })[ch];
        });
    }

    function encodeSelectedDistribution(dist) {
        return btoa(JSON.stringify({
            id: dist.id || '',
            label: dist.friendly || dist.label || dist.id || ''
        }));
    }

    function renderDistributions(rows) {
        var slot = document.getElementById('distributionPickerSlot');
        if (!slot || !rows || !rows.length) return false;

        var html = ''
            + '<div class="picker-grid">'
            + '<div>'
            + '<div class="mini-title">Available CloudFront distributions</div>'
            + '<div class="dist-list">';

        rows.forEach(function (dist) {
            var aliases = dist.aliases && dist.aliases.length ? dist.aliases.join(', ') : '(none)';
            html += ''
                + '<label class="dist-item">'
                + '<input type="checkbox" name="selectedDistributions[]" value="' + escapeHtml(encodeSelectedDistribution(dist)) + '">'
                + '<span>'
                + '<span class="dist-title">' + escapeHtml(dist.friendly || dist.id || '') + '</span><br>'
                + '<span class="dist-meta">'
                + 'ID: ' + escapeHtml(dist.id || '') + '<br>'
                + 'Aliases: ' + escapeHtml(aliases) + '<br>'
                + 'CloudFront: ' + escapeHtml(dist.domain || '') + '<br>'
                + 'Status: ' + escapeHtml(dist.status || '') + ' | Enabled: ' + escapeHtml(dist.enabled || '')
                + '</span>'
                + '</span>'
                + '</label>';
        });

        html += '</div></div></div>';
        slot.innerHTML = html;
        return true;
    }

    function setAuthorizedUiState(isAuthorized) {
        var loginLogoutButton = document.getElementById('accessLoginLogoutButton');
        var dryRunButton = document.getElementById('dryRunButton');
        var applyButton = document.getElementById('applyChangesButton');

        if (loginLogoutButton) {
            loginLogoutButton.textContent = isAuthorized ? 'Logout' : 'Login';
            loginLogoutButton.dataset.accessAuthorized = isAuthorized ? '1' : '0';
        }
        if (dryRunButton) dryRunButton.disabled = !isAuthorized;
        if (applyButton) applyButton.disabled = !isAuthorized;
    }

    function revealPrefetchedDistributions(reason) {
        if (!accessAuthorized || !prefetchedPayload || !prefetchedPayload.ok) return false;

        var rendered = renderDistributions(prefetchedPayload.distributions || []);
        if (rendered) {
            traceAuto('auto_prefetch_revealed_after_access_ok', {
                reason: reason || '',
                count: prefetchedPayload.distributions ? prefetchedPayload.distributions.length : 0
            });
        }
        return rendered;
    }

    function clearAuthorizedUiState(reason, statusText, statusKind) {
        accessAuthorized = false;
        setAuthorizedUiState(false);
        setAccessStatus(statusText || 'Logged out.', statusKind || '');

        var slot = document.getElementById('distributionPickerSlot');
        if (slot) slot.innerHTML = '';

        traceAuto('auto_access_logged_out', { reason: reason || '', status: statusText || 'Logged out.' });
    }

    function markAccessAuthorized(reason) {
        accessAuthorized = true;
        setAccessStatus('Passed OK.', 'good');
        setAuthorizedUiState(true);
        traceAuto('auto_access_authorized', { reason: reason || '' });
        revealPrefetchedDistributions(reason || 'access_authorized');
    }

    function accessOkFromPayload(payload) {
        if (!payload) return false;
        if (payload.ok === true || payload.success === true) return true;
        var message = String(payload.message || payload.status || payload.error || '');
        return /Password OK|Passed OK|OK|authorized/i.test(message) && !/incorrect|wrong|failed|error|not yet/i.test(message);
    }

    function startInvisibleDistributionPrefetch() {
        if (prefetchPromise) return prefetchPromise;

        if (!window.CLOUDFRONT_MEDIA_LOCAL_CONFIG_HAS_AWS_CREDENTIALS) {
            traceAuto('auto_prefetch_skipped_no_local_aws_credentials', {});
            prefetchPromise = Promise.resolve({ ok: false, noLocalAwsCredentials: true });
            return prefetchPromise;
        }

        traceAuto('auto_prefetch_start', { method: 'background-local-config-before-access-auth' });

        prefetchPromise = requestMode('ajax-prefetch-distributions', {}).then(function (payload) {
            prefetchedPayload = payload || { ok: false };
            appendServerTrace('ajax-prefetch-distributions', prefetchedPayload);

            if (prefetchedPayload.ok) {
                setAwsStatus(prefetchedPayload.message || 'AWS credentials OK. Distributions loaded in background.', 'good');
            } else if (!prefetchedPayload.noLocalAwsCredentials) {
                setAwsStatus(prefetchedPayload.message || 'AWS credential test failed. See TraceLog.', 'bad');
            }

            traceAuto('auto_prefetch_result', {
                ok: !!prefetchedPayload.ok,
                count: prefetchedPayload.distributions ? prefetchedPayload.distributions.length : 0,
                status: prefetchedPayload.message || ''
            });

            revealPrefetchedDistributions('prefetch_finished_after_access_ok');
            return prefetchedPayload;
        }).catch(function (err) {
            var message = String(err && err.message ? err.message : err);
            prefetchedPayload = { ok: false, message: message };
            setAwsStatus('AWS credential test failed. See TraceLog.', 'bad');
            traceAuto('auto_prefetch_error', { message: message });
            return prefetchedPayload;
        });

        return prefetchPromise;
    }

    function checkServerAuthCookie() {
        traceAuto('auto_access_cookie_check_start', {});

        return requestMode('ajax-check-tool-auth', {}).then(function (payload) {
            var ok = accessOkFromPayload(payload);
            traceAuto('auto_access_cookie_check_result', {
                ok: ok,
                status: payload && payload.message ? payload.message : ''
            });

            if (ok) {
                markAccessAuthorized('signed-server-auth-cookie');
            }

            return { ok: ok, payload: payload };
        }).catch(function (err) {
            traceAuto('auto_access_cookie_check_error', { message: String(err && err.message ? err.message : err) });
            return { ok: false };
        });
    }

    function loginWithCurrentFormData() {
        if (accessAuthorized) {
            revealPrefetchedDistributions('already-authorized');
            return Promise.resolve({ ok: true });
        }

        if (passwordTestInFlight) {
            return Promise.resolve({ ok: false, inFlight: true });
        }

        passwordTestInFlight = true;
        traceAuto('manual_access_login_start', { method: 'login-button-formdata-submit' });

        return requestModeWithCurrentFormData('ajax-test-tool-password').then(function (payload) {
            var ok = accessOkFromPayload(payload);
            var message = (payload && payload.message) || (ok ? 'Passed OK.' : 'Tool password is incorrect.');

            if (ok) {
                markAccessAuthorized('manual-login-button-click');
            } else {
                setAccessStatus(message, 'bad');
            }

            traceAuto('manual_access_login_result', {
                ok: ok,
                status: ok ? 'Passed OK.' : message
            });

            return { ok: ok, payload: payload };
        }).catch(function (err) {
            var message = String(err && err.message ? err.message : err);
            setAccessStatus('Tool login failed.', 'bad');
            traceAuto('manual_access_login_error', { message: message });
            return { ok: false };
        }).finally(function () {
            passwordTestInFlight = false;
        });
    }

    function logoutToolAuth() {
        traceAuto('auto_access_logout_start', {});

        return requestMode('ajax-logout-tool-auth', {}).then(function (payload) {
            clearAuthorizedUiState('logout-button', 'Logged out.', '');
            traceAuto('auto_access_logout_result', {
                ok: !!(payload && payload.ok),
                status: payload && payload.message ? payload.message : ''
            });
            return payload || { ok: true };
        }).catch(function (err) {
            traceAuto('auto_access_logout_error', { message: String(err && err.message ? err.message : err) });
            clearAuthorizedUiState('logout-button-error', 'Logged out.', '');
            return { ok: false };
        });
    }

    function wireAccessLoginLogout() {
        var loginLogoutButton = document.getElementById('accessLoginLogoutButton');
        if (loginLogoutButton) {
            loginLogoutButton.addEventListener('click', function (event) {
                event.preventDefault();

                if (accessAuthorized || loginLogoutButton.dataset.accessAuthorized === '1') {
                    logoutToolAuth();
                    return;
                }

                loginWithCurrentFormData();
            }, true);
        }
    }

    function runAutoFlow() {
        if (window.__cloudfrontMediaAutoFlowStarted) return;
        window.__cloudfrontMediaAutoFlowStarted = true;

        traceAuto('auto_flow_start', {
            strategy: 'signed-cookie-only-on-startup-password-read-only-on-login-click'
        });

        setAuthorizedUiState(false);
        wireAccessLoginLogout();
        startInvisibleDistributionPrefetch();
        checkServerAuthCookie();
    }

    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', runAutoFlow);
    } else {
        runAutoFlow();
    }
})();
</script>

<script id="v158-wire-ajax-run-buttons">
(function () {
    'use strict';

    var runInFlight = false;
    var runLogLines = [];

    function traceRun(eventName, data) {
        if (typeof window.trace === 'function') {
            window.trace(eventName, data || {});
        } else if (typeof window.cfToolTraceEvent === 'function') {
            window.cfToolTraceEvent(eventName, data || {});
        }
    }

    function formElement() {
        return document.getElementById('cloudfrontToolForm') || document.querySelector('form');
    }

    function statusElement() {
        return document.getElementById('ajaxStatus') || document.getElementById('awsCredentialStatus') || document.getElementById('traceStatus');
    }

    function setStatus(message, kind) {
        var el = statusElement();
        if (!el) return;
        el.textContent = message || '';
        el.className = 'inline-status ' + (kind === 'ok' || kind === 'good' ? 'good' : (kind === 'bad' ? 'bad' : (kind || '')));
    }

    function setButtonWorking(button, isWorking) {
        if (!button) return;
        button.dataset.working = isWorking ? '1' : '0';
        button.disabled = !!isWorking;
    }

    function setHiddenActionToken(token) {
        if (!token) return;
        var input = document.querySelector('input[name="toolActionToken"]');
        if (input) input.value = token;
    }

    function showInlinePanel() {
        var panel = document.getElementById('runLogCard');
        if (panel) panel.hidden = false;
        return panel;
    }

    function writeInlineLog(lines) {
        showInlinePanel();
        var pre = document.getElementById('runInlineLogText');
        if (!pre) return;
        pre.textContent = lines && lines.length ? lines.join('\n') : 'Working…';
        pre.scrollTop = pre.scrollHeight;
        window.requestAnimationFrame(function () { pre.scrollTop = pre.scrollHeight; });
    }

    function appendInlineLog(message) {
        if (!message) return;
        runLogLines.push(message);
        writeInlineLog(runLogLines);
    }

    function applyEventRow(row) {
        if (!row) return;

        if (row.token) {
            setHiddenActionToken(row.token);
        }

        if (row.log && Array.isArray(row.log)) {
            runLogLines = row.log.slice();
            writeInlineLog(runLogLines);
        } else if (row.message) {
            appendInlineLog(row.message);
        }

        traceRun('ajax_run_progress', {
            type: row.type || '',
            kind: row.kind || '',
            message: row.message || '',
            current: row.current || null,
            total: row.total || null
        });

        if (row.type === 'error') {
            setStatus(row.message || 'Run failed.', 'bad');
        } else if (row.type === 'done') {
            setStatus(row.ok ? 'Done.' : 'Run failed.', row.ok ? 'good' : 'bad');
        } else if (row.message) {
            setStatus(row.message, row.kind || 'wait');
        }
    }

    async function runAjaxAction(action, button) {
        if (runInFlight) {
            setStatus('A run is already in progress.', 'wait');
            return;
        }

        var form = formElement();
        if (!form) {
            setStatus('Form not found.', 'bad');
            return;
        }

        if (action !== 'dry-run' && action !== 'apply') {
            setStatus('Unsupported action.', 'bad');
            return;
        }

        runInFlight = true;
        runLogLines = [];

        var label = action === 'apply' ? 'Apply Changes on CloudFront' : 'Dry run';
        appendInlineLog(label + ' started.');
        setStatus(label + ' started.', 'wait');
        setButtonWorking(button, true);

        var jobId = 'job_' + Date.now().toString(36) + '_' + Math.random().toString(36).slice(2);
        var pollTimer = null;
        var pollDone = false;

        async function pollRunLogOnce() {
            if (pollDone) return;
            try {
                var pollData = new FormData();
                pollData.set('mode', 'ajax-run-status');
                pollData.set('jobId', jobId);
                var pollResponse = await fetch(window.location.href, {
                    method: 'POST',
                    body: pollData,
                    credentials: 'same-origin',
                    headers: { 'X-Requested-With': 'XMLHttpRequest', 'Cache-Control': 'no-cache' }
                });
                if (!pollResponse.ok) return;
                var row = await pollResponse.json();
                applyEventRow(row);
                if (row && row.done) {
                    pollDone = true;
                }
            } catch (e) {
                // Keep polling; the main request will surface fatal errors.
            }
        }

        pollTimer = window.setInterval(pollRunLogOnce, 750);
        pollRunLogOnce();

        try {
            var data = new FormData(form);
            data.set('mode', 'ajax-run-action');
            data.set('runAction', action);
            data.set('jobId', jobId);

            traceRun('ajax_run_start', { action: action, jobId: jobId });

            var response = await fetch(window.location.href, {
                method: 'POST',
                body: data,
                credentials: 'same-origin',
                headers: { 'X-Requested-With': 'XMLHttpRequest' }
            });

            if (!response.ok) {
                throw new Error('HTTP ' + response.status);
            }

            if (!response.body || !response.body.getReader) {
                throw new Error('Streaming fetch is not available in this browser.');
            }

            var reader = response.body.getReader();
            var decoder = new TextDecoder();
            var buffer = '';

            while (true) {
                var chunk = await reader.read();
                if (chunk.done) break;

                buffer += decoder.decode(chunk.value, { stream: true });
                var lines = buffer.split('\n');
                buffer = lines.pop() || '';

                for (var i = 0; i < lines.length; i++) {
                    var line = lines[i].trim();
                    if (!line) continue;

                    try {
                        applyEventRow(JSON.parse(line));
                    } catch (parseError) {
                        appendInlineLog(line);
                    }
                }
            }

            if (buffer.trim()) {
                try {
                    applyEventRow(JSON.parse(buffer.trim()));
                } catch (parseError2) {
                    appendInlineLog(buffer.trim());
                }
            }

            traceRun('ajax_run_end', { action: action, lines: runLogLines.length });
        } catch (error) {
            var message = 'Request failed: ' + (error && error.message ? error.message : String(error));
            appendInlineLog('ERROR: ' + message);
            setStatus(message, 'bad');
            traceRun('ajax_run_error', { action: action, message: message });
        } finally {
            pollDone = true;
            if (pollTimer) window.clearInterval(pollTimer);
            await pollRunLogOnce();
            runInFlight = false;
            setButtonWorking(button, false);
        }
    }

    function wireButtons() {
        ['dryRunButton', 'applyChangesButton'].forEach(function (id) {
            var button = document.getElementById(id);
            if (!button || button.dataset.v158Wired === '1') return;

            button.dataset.v158Wired = '1';
            button.addEventListener('click', function (event) {
                event.preventDefault();
                event.stopPropagation();

                if (button.disabled && button.dataset.working !== '1') {
                    setStatus('Log in and select a distribution before running.', 'bad');
                    return;
                }

                runAjaxAction(button.dataset.runAction, button);
            }, true);
        });

        var form = formElement();
        if (form && form.dataset.v158SubmitBlocked !== '1') {
            form.dataset.v158SubmitBlocked = '1';
            form.addEventListener('submit', function (event) {
                event.preventDefault();
                event.stopPropagation();
                traceRun('blocked_normal_form_submit_v158', {});
                setStatus('Dry run and Apply use AJAX buttons only.', 'bad');
            }, true);
        }
    }

    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', wireButtons);
    } else {
        wireButtons();
    }
})();
</script>


<script id="v158-runlog-copy-download">
(function () {
    function runLogText() {
        var el = document.getElementById('runInlineLogText');
        return el ? (el.innerText || el.textContent || '') : '';
    }

    function setRunLogStatus(text) {
        var status = document.getElementById('runInlineLogStatus');
        if (status) status.textContent = text || '';
    }

    async function copyRunLog() {
        var text = runLogText();
        try {
            await navigator.clipboard.writeText(text);
            setRunLogStatus('Copied.');
        } catch (err) {
            var el = document.getElementById('runInlineLogText');
            if (!el) return;
            var range = document.createRange();
            range.selectNodeContents(el);
            var selection = window.getSelection();
            selection.removeAllRanges();
            selection.addRange(range);
            setRunLogStatus('Selected. Press Ctrl+C.');
        }
    }

    function downloadRunLog() {
        var blob = new Blob([runLogText()], { type: 'text/plain;charset=utf-8' });
        var url = URL.createObjectURL(blob);
        var a = document.createElement('a');
        a.href = url;
        a.download = 'cloudfront-media-run-log.txt';
        document.body.appendChild(a);
        a.click();
        a.remove();
        URL.revokeObjectURL(url);
        setRunLogStatus('Downloaded.');
    }

    function wire() {
        var copy = document.getElementById('copyRunLogButton');
        if (copy && copy.dataset.v158Wired !== '1') {
            copy.dataset.v158Wired = '1';
            copy.addEventListener('click', function (event) {
                event.preventDefault();
                copyRunLog();
            });
        }

        var download = document.getElementById('downloadRunLogButton');
        if (download && download.dataset.v158Wired !== '1') {
            download.dataset.v158Wired = '1';
            download.addEventListener('click', function (event) {
                event.preventDefault();
                downloadRunLog();
            });
        }
    }

    if (document.readyState === 'loading') {
        document.addEventListener('DOMContentLoaded', wire);
    } else {
        wire();
    }
})();
</script>

</body>
</html>