@stacksjs/ts-cloud 0.11.0 → 0.11.2

package/dist/bin/{chunk-wzepfqf4.js → chunk-b0e39tpv.js}

@@ -1,4 +1,4 @@
-import{Wa as rb}from"./chunk-41yqpdv7.js";import{Ab as Xy,Ic as rp,Xa as Uo,Ya as xe,Za as Ly,ad as X,bb as Po,bc as tp,bd as Ka,cd as np,dd as ep,fb as By,gb as jy,hb as Fy,ib as Uy,jb as zy,kb as Vy,lb as qy,nb as xo,ob as Wl,pb as Do,qb as Jy,rb as Wy,sb as Gy,tb as Ei,ub as uo,vb as Ky,wb as Qy,xb as uy,yb as Yy,zb as ga}from"./chunk-67jsyn0g.js";import{fd as Sn}from"./chunk-jce28gnz.js";import{vd as Du}from"./chunk-gskbezam.js";import{wd as hh,zd as yh}from"./chunk-9rsn48qg.js";import{Ad as pf,Bd as Ii,Fd as ma}from"./chunk-xev7qr2h.js";import{Gd as ao}from"./chunk-9mydnqr6.js";import{Hd as so,Od as $h,Pd as Mh,Qd as Ru,Rd as xu,Wd as lt,Xd as Lh}from"./chunk-q182t9ba.js";import{Zd as zs}from"./chunk-nmkm1f68.js";import{Ge as aa,Je as eb,Ke as tb,Le as go,Me as Au,We as fa,_d as Ry,re as xr}from"./chunk-fpcghdr3.js";import{qf as Hy}from"./chunk-zejwh9cy.js";import{Df as fh,Ef as Qf,If as Yf,Kf as gu,Of as Iu,uf as gh,xf as mh}from"./chunk-ftse39wf.js";import{gg as Zy}from"./chunk-nyc2jxd8.js";import{ig as Nh}from"./chunk-21gggxvf.js";import{pg as hr}from"./chunk-4a85nk2q.js";import{qg as Py,tg as xy,ug as Dy,vg as Oy,wg as _y,xg as $y,yg as My}from"./chunk-e1bfd1yv.js";import{Ag as Df,Bg as Vt,Cg as po,Dg as $e,Eg as Of,Fg as Ny,zg as Bo}from"./chunk-ww770qpn.js";import{ch as ge}from"./chunk-0y89hs67.js";import{Ah as at,Dh as Pr,Fh as it,Kh as Xd,_h as Oh,mo as _h,xh as Em,zh as Mo}from"./chunk-4a97kbk1.js";import{np as ct}from"./chunk-ks4ewy1s.js";import{createHash as ST}from"node:crypto";import{existsSync as _r,mkdtempSync as Vu,readdirSync as yy,rmSync as Mn,statSync as nb}from"node:fs";import{readFile as ur,writeFile as Nn}from"node:fs/promises";import{tmpdir as ba}from"node:os";import{dirname as vT,extname as mo,join as Ie,normalize as wT,relative as IT,resolve as CT,sep as ET}from"node:path";import{fileURLToPath as TT}from"node:url";class ka extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class ll{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new ka(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as dS}from"node:crypto";import{lstatSync as bb,readdirSync as Sb,readFileSync as vb}from"node:fs";import{relative as wb,resolve as pl,sep as Ib}from"node:path";function Cb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function dn(e,t,r){return{path:e,reason:t,weight:r}}function gl(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function zn(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function Vn(e){let t=Cb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(zn("dockerfile","dockerfile",0.99,[dn("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=gl(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(zn("laravel","server",0.98,[dn("artisan","Laravel Artisan entrypoint is present.",0.45),dn("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(zn("php","server",0.82,[dn("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=gl(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",u=[dn("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)u.push(dn(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,p=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(zn(c,p.kind,Math.min(0.94,u.reduce((f,y)=>f+y.weight,0)),u,p,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(zn("static","static",0.78,[dn(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(zn("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Ra(e,t={}){let r=pl(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),u=(a)=>{for(let p of Sb(a).sort()){if(c.has(p))continue;let f=pl(a,p),y=wb(r,f).split(Ib).join("/");if(!y||y.startsWith("../"))throw Error("Detection path escaped the application root");let b=bb(f);if(b.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${y}`);if(b.isDirectory())u(f);else if(b.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let C={path:y,size:b.size};if(s.has(y)&&b.size<=i)C.content=vb(f,"utf8");o.push(C)}}};return u(r),o}function xa(e){if(Array.isArray(e))return`[${e.map(xa).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${xa(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function Pi(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function It(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Pa(e){return JSON.parse(JSON.stringify(e))}function Eb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Pa({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Pa({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Pa({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function Ut(e,t=[]){let r=[],n=(C)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(C),i=Object.fromEntries(Object.entries(e.environment??{}).map(([C,T])=>{if(typeof T==="string"&&n(C))return r.push(It(`environment.${C}`,"write_only_secret_required",`${C} must be supplied through the write-only secrets boundary.`)),[C,{secretRef:C}];return[C,T]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let C=Object.fromEntries(Object.entries(e.build.buildArgs).map(([T,R])=>{if(n(T))return r.push(It(`build.buildArgs.${T}`,"write_only_build_secret_required",`${T} must be declared in secretNames instead of buildArgs.`)),[T,"[REDACTED]"];return[T,R]}));o={...e.build,buildArgs:C}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(It("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!Pi((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(It("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((C)=>!Pi(C)))r.push(It("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!Pi(e.build.context)||!Pi(e.build.dockerfile)))r.push(It("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!Pi(e.build.publishDirectory))r.push(It("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(It("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(It("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(It("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(It("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(It("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(It("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(It("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((C)=>typeof C==="object"?[C.secretRef]:[]),u=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),p=u.filter((C)=>!a.has(C)),f={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},y=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),b=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&p.length===0,issues:r,missingSecrets:p,manifest:f,configPatch:Eb({...e,build:o,environment:i}),capabilityRequirements:y,costDrivers:b,serializedManifest:`${xa(f)}
+import{Xa as rb}from"./chunk-sj5csg49.js";import{Ab as ga,Bb as Xy,Jc as rp,Ya as Uo,Za as xe,_a as Ly,bd as X,cb as Po,cc as tp,cd as Ka,dd as np,ed as ep,gb as By,hb as jy,ib as Fy,jb as Uy,kb as zy,lb as Vy,mb as qy,ob as xo,pb as Wl,qb as Do,rb as Jy,sb as Wy,tb as Gy,ub as Ei,vb as uo,wb as Ky,xb as Qy,yb as uy,zb as Yy}from"./chunk-cbsys5v8.js";import{gd as Sn}from"./chunk-3aph4c1w.js";import{wd as Du}from"./chunk-82mj52xr.js";import{Ad as yh,xd as hh}from"./chunk-81hmza39.js";import{Bd as pf,Cd as Ii,Gd as ma}from"./chunk-e2bybahr.js";import{Hd as ao}from"./chunk-d7ke90zt.js";import{Id as so,Pd as $h,Qd as Mh,Rd as Ru,Sd as xu,Xd as lt,Yd as Lh}from"./chunk-kg61p5hw.js";import{_d as zs}from"./chunk-c0bdafbx.js";import{$d as Ry,He as aa,Ke as eb,Le as tb,Me as go,Ne as Au,Xe as fa,se as xr}from"./chunk-cq9mca3h.js";import{rf as Hy}from"./chunk-xk08030d.js";import{Ef as fh,Ff as Qf,Jf as Yf,Lf as gu,Pf as Iu,vf as gh,yf as mh}from"./chunk-56wvjysz.js";import{hg as Zy}from"./chunk-xhwqpgwq.js";import{jg as Nh}from"./chunk-a7w13qfm.js";import{qg as hr}from"./chunk-btsyjhk7.js";import{rg as Py,ug as xy,vg as Dy,wg as Oy,xg as _y,yg as $y,zg as My}from"./chunk-w32xv8n4.js";import{Ag as Bo,Bg as Df,Cg as Vt,Dg as po,Eg as $e,Fg as Of,Gg as Ny}from"./chunk-dz1ec589.js";import{dh as ge}from"./chunk-ja1vjdn1.js";import{$h as Oh,Ah as Mo,Bh as at,Eh as Pr,Gh as it,Lh as Xd,no as _h,yh as Em}from"./chunk-4q6tad44.js";import{op as ct}from"./chunk-ehc63fvs.js";import{createHash as ST}from"node:crypto";import{existsSync as _r,mkdtempSync as Vu,readdirSync as yy,rmSync as Mn,statSync as nb}from"node:fs";import{readFile as ur,writeFile as Nn}from"node:fs/promises";import{tmpdir as ba}from"node:os";import{dirname as vT,extname as mo,join as Ie,normalize as wT,relative as IT,resolve as CT,sep as ET}from"node:path";import{fileURLToPath as TT}from"node:url";class ka extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class ll{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new ka(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as dS}from"node:crypto";import{lstatSync as bb,readdirSync as Sb,readFileSync as vb}from"node:fs";import{relative as wb,resolve as pl,sep as Ib}from"node:path";function Cb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function dn(e,t,r){return{path:e,reason:t,weight:r}}function gl(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function zn(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function Vn(e){let t=Cb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(zn("dockerfile","dockerfile",0.99,[dn("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=gl(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(zn("laravel","server",0.98,[dn("artisan","Laravel Artisan entrypoint is present.",0.45),dn("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(zn("php","server",0.82,[dn("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=gl(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",u=[dn("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)u.push(dn(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,p=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(zn(c,p.kind,Math.min(0.94,u.reduce((f,y)=>f+y.weight,0)),u,p,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(zn("static","static",0.78,[dn(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(zn("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Ra(e,t={}){let r=pl(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),u=(a)=>{for(let p of Sb(a).sort()){if(c.has(p))continue;let f=pl(a,p),y=wb(r,f).split(Ib).join("/");if(!y||y.startsWith("../"))throw Error("Detection path escaped the application root");let b=bb(f);if(b.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${y}`);if(b.isDirectory())u(f);else if(b.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let C={path:y,size:b.size};if(s.has(y)&&b.size<=i)C.content=vb(f,"utf8");o.push(C)}}};return u(r),o}function xa(e){if(Array.isArray(e))return`[${e.map(xa).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${xa(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function Pi(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function It(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Pa(e){return JSON.parse(JSON.stringify(e))}function Eb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Pa({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Pa({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Pa({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function Ut(e,t=[]){let r=[],n=(C)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(C),i=Object.fromEntries(Object.entries(e.environment??{}).map(([C,T])=>{if(typeof T==="string"&&n(C))return r.push(It(`environment.${C}`,"write_only_secret_required",`${C} must be supplied through the write-only secrets boundary.`)),[C,{secretRef:C}];return[C,T]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let C=Object.fromEntries(Object.entries(e.build.buildArgs).map(([T,R])=>{if(n(T))return r.push(It(`build.buildArgs.${T}`,"write_only_build_secret_required",`${T} must be declared in secretNames instead of buildArgs.`)),[T,"[REDACTED]"];return[T,R]}));o={...e.build,buildArgs:C}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(It("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!Pi((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(It("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((C)=>!Pi(C)))r.push(It("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!Pi(e.build.context)||!Pi(e.build.dockerfile)))r.push(It("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!Pi(e.build.publishDirectory))r.push(It("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(It("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(It("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(It("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(It("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(It("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(It("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(It("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((C)=>typeof C==="object"?[C.secretRef]:[]),u=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),p=u.filter((C)=>!a.has(C)),f={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},y=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),b=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&p.length===0,issues:r,missingSecrets:p,manifest:f,configPatch:Eb({...e,build:o,environment:i}),capabilityRequirements:y,costDrivers:b,serializedManifest:`${xa(f)}
 `}}function ml(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function fl(e,t,r={}){let n=r.maxBytes??104857600,i=r.maxEntries??1e4,o=r.maxExpandedBytes??524288000;if(e.byteLength>n)throw Error("Archive exceeds the compressed size limit");let s=new DataView(e.buffer,e.byteOffset,e.byteLength),c=[],u=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let p=0;while(p+30<=e.length){let f=s.getUint32(p,!0);if(f===33639248||f===101010256)break;if(f!==67324752)throw Error("Malformed ZIP local header");let y=s.getUint16(p+6,!0),b=s.getUint32(p+18,!0),C=s.getUint32(p+22,!0),T=s.getUint16(p+26,!0),R=s.getUint16(p+28,!0);if(y&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let x=new TextDecoder().decode(e.subarray(p+30,p+30+T));if(!ml(x))throw Error(`Unsafe archive path: ${x}`);if(c.push(x),u+=C,c.length>i||u>o)throw Error("Archive expansion limit exceeded");p+=30+T+R+b}return{format:"zip",entries:c.length,expandedBytes:u,paths:c}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let a=0;while(a+512<=e.length){let p=e.subarray(a,a+512);if(p.every((T)=>T===0))break;let f=(T,R)=>new TextDecoder().decode(p.subarray(T,T+R)).replace(/\0.*$/,""),y=`${f(345,155)}${f(345,155)?"/":""}${f(0,100)}`,b=Number.parseInt(f(124,12).trim()||"0",8),C=String.fromCharCode(p[156]??0);if(!ml(y))throw Error(`Unsafe archive path: ${y}`);if(C==="1"||C==="2")throw Error(`Archive links are not accepted: ${y}`);if(!Number.isFinite(b)||b<0)throw Error("Malformed TAR entry size");if(c.push(y),u+=b,c.length>i||u>o)throw Error("Archive expansion limit exceeded");a+=512+Math.ceil(b/512)*512}return{format:"tar",entries:c.length,expandedBytes:u,paths:c}}var hl=new Set(["source","build","runtime","environment","domain","review"]);function yl(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function bl(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function Sl(e){for(let[r,n]of Object.entries(e.environment??{}))if(typeof n==="string"&&bl(r)&&n)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,n]of Object.entries(e.build.buildArgs??{}))if(bl(r)&&n)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function vl(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:yl(e.input,{}),suppliedSecretNames:yl(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Da{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(Sl(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),n=this.now(),i=e.step??"source";if(!hl.has(i))throw Error("Invalid draft step");let o=[...new Set(e.suppliedSecretNames??[])].sort(),s=Ut(e.draft,o).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),i,JSON.stringify(e.draft),JSON.stringify(o),s,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:i,status:s,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?vl(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(vl)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!hl.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==n.projectId)throw Error("Draft project cannot be changed");Sl(r.draft);let i=[...new Set(r.suppliedSecretNames??n.suppliedSecretNames)].sort(),o=Ut(r.draft,i).valid?"ready":"draft",s=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(i),o,s,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:o}}),this.get(e)}markApplied(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let i=Ut(n.input,n.suppliedSecretNames);if(!i.valid)throw Error(`Draft is not deployable: ${[...i.issues.map((s)=>s.message),...i.missingSecrets.map((s)=>`Missing secret ${s}`)].join("; ")}`);let o=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[o,e,t]),this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r,type:"application.draft.applied",payload:$e({draftId:e,manifest:i.manifest})}),this.get(e)}}import{createCipheriv as Tb,createDecipheriv as Ab,createHash as Cl,randomBytes as kb}from"node:crypto";function xi(e){return typeof e==="string"&&e?e:void 0}function Oa(e){return Cl("sha256").update(e).digest("hex").slice(0,16)}function wl(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function Rb(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:xi(e.credential_fingerprint),credentialExpiresAt:xi(e.credential_expires_at),status:String(e.status),healthMessage:xi(e.health_message),lastTestedAt:xi(e.last_tested_at),version:Number(e.version),createdByActorId:xi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class _a{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=Cl("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=kb(12),r=Tb("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Registry credential envelope is invalid");let o=Ab("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}current(e){let t=Rb(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),n=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),wl(e.host),t?this.encrypt(t):null,t?Oa(t):null,e.credentialExpiresAt??null,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:wl(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let n=this.get(e);if(!n||n.status==="disconnected")throw Error("Registry connection was not found");let i=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(i),Oa(i),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:Oa(i),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let n=this.credential(e),i=t.fetch??fetch,o=new AbortController,s=setTimeout(()=>o.abort(),t.timeoutMs??15000),c=n?.token?`Bearer ${n.token}`:n?.username||n?.password?`Basic ${Buffer.from(`${n.username??""}:${n.password??""}`).toString("base64")}`:void 0;try{let u=await i(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:o.signal,headers:c?{Authorization:c}:void 0}),a=u.headers.get("www-authenticate")??"";if(u.status===401&&a.startsWith("Bearer ")&&n){let y=Object.fromEntries([...a.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((x)=>[x[1],x[2]])),b=new URL(y.realm??"");if(b.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(y.service)b.searchParams.set("service",y.service);if(t.image)b.searchParams.set("scope",`repository:${El(t.image).repository}:pull`);let C=await i(b,{signal:o.signal,redirect:"error",headers:c?{Authorization:c}:void 0});if(!C.ok)throw Error(`Registry authentication failed (${C.status})`);let T=await C.json(),R=T.token??T.access_token;if(!R)throw Error("Registry did not return an access token");u=t.image?await Il(i,r.host,t.image,R,o.signal):await i(`${r.host}/v2/`,{signal:o.signal,redirect:"error",headers:{Authorization:`Bearer ${R}`}})}else if(u.ok&&t.image)u=await Il(i,r.host,t.image,n?.token,o.signal,c);let p=u.ok?"healthy":"degraded",f=u.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${u.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[p,f,this.now(),this.now(),e]),this.get(e)}catch(u){let a=o.signal.aborted?"Registry request timed out.":u instanceof Error?u.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[a.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(s)}}}function El(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let n=t.slice(r+1),i=n.lastIndexOf("@"),o=n.lastIndexOf(":"),s=i>=0?i:o>n.lastIndexOf("/")?o:-1,c=s>=0?n.slice(0,s):n,u=s>=0?n.slice(s+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(c)||!/^[A-Za-z0-9_.:+-]+$/.test(u))throw Error("Image reference is invalid");return{repository:c,reference:u}}async function Il(e,t,r,n,i,o){let s=El(r);return e(`${t}/v2/${s.repository}/manifests/${encodeURIComponent(s.reference)}`,{method:"HEAD",redirect:"error",signal:i,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...n?{Authorization:`Bearer ${n}`}:o?{Authorization:o}:{}}})}import{createHash as Pb}from"node:crypto";import{chmodSync as Tl,existsSync as Al,mkdirSync as xb,renameSync as Db,unlinkSync as kl,writeFileSync as Ob}from"node:fs";import{basename as _b,join as Nb}from"node:path";function Na(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class $a{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=at(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=_b(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let n=fl(e.bytes,r),i=Pb("sha256").update(e.bytes).digest("hex"),o=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,i);if(o)return Na(o);let s=this.idFn();xb(this.root,{recursive:!0,mode:448}),Tl(this.root,448);let c=Nb(this.root,`${s}.archive`),u=`${c}.partial`;try{Ob(u,e.bytes,{mode:384,flag:"wx"}),Db(u,c),Tl(c,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.organizationId,e.projectId,r,c,i,e.bytes.byteLength,n.format,n.entries,n.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(a){if(Al(u))kl(u);if(Al(c))kl(c);throw a}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:s,filename:r,sha256:i,size:e.bytes.byteLength,entries:n.entries}}),this.get(s)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?Na(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(Na)}}function Io(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),n=r?e.controlPlane.listEnvironments(r.id).find((a)=>a.id===t.input.environmentId):void 0;if(!r||!n||n.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==n.slug)throw Error(`Type ${n.slug} to confirm this deployment target`);let i=Ut(t.input,t.suppliedSecretNames);if(!i.valid)throw Error(`Application plan is invalid: ${[...i.issues.map((a)=>a.message),...i.missingSecrets.map((a)=>`Missing secret ${a}`)].join("; ")}`);let o=e.controlPlane.listResources(r.id,n.id).find((a)=>a.kind==="application"&&a.slug===t.input.slug),s=JSON.parse(JSON.stringify({manifest:i.manifest,configPatch:i.configPatch})),c=o?e.controlPlane.updateResource(o.id,o.version,{name:t.input.name,desiredState:s}):e.controlPlane.createResource({projectId:r.id,environmentId:n.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:s,metadata:{source:"application-onboarding",draftId:t.id}}),u=new xe(e.controlPlane).enqueue({projectId:r.id,environmentId:n.id,resourceId:c.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:s,lockKey:`resource:${c.id}`,providerKey:c.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:c.id,operationId:u.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:n.slug,strategy:t.input.build.kind,costDrivers:i.costDrivers}}),{plan:i,resource:c,operation:u}}function Di(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,n=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",i=(o,s)=>s&&(o==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:i("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:i("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:i("blue_green",n),explanation:n?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:i("canary",n),explanation:n?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Co(e,t){let r=Di(e).find((n)=>n.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as $b}from"node:crypto";var Mb=/^sha256:[a-f0-9]{64}$/,Lb=/^[a-f0-9]{40,64}$/i;function nr(e){return typeof e==="string"&&e?e:void 0}function un(e,t){try{return JSON.parse(String(e))}catch{return t}}function Rl(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:un(e.provenance,{}),attestation:un(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Pl(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:nr(e.source_sha),configHash:String(e.config_hash),manifest:un(e.manifest,{}),provenance:un(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:un(e.health_gate,void 0),hooks:un(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:nr(e.previous_release_id),promotedFromReleaseId:nr(e.promoted_from_release_id),actorId:nr(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:nr(e.pin_reason),activatedAt:nr(e.activated_at),failedAt:nr(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Bb(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:nr(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:un(e.health,{}),message:String(e.message),operationId:nr(e.operation_id),createdAt:String(e.created_at)}}function jb(e,t){let r=[],n=(i,o,s)=>{if(JSON.stringify(o)===JSON.stringify(s))return;if(o&&s&&typeof o==="object"&&typeof s==="object"&&!Array.isArray(o)&&!Array.isArray(s)){for(let c of[...new Set([...Object.keys(o),...Object.keys(s)])].sort())n(i?`${i}.${c}`:c,o[c],s[c]);return}r.push({path:i,...o!==void 0?{before:o}:{},...s!==void 0?{after:s}:{}})};return n("",e,t),r}class Ma{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Mb.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return Rl(t);let r=this.id(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify($e(e.provenance??{})),JSON.stringify($e(e.attestation??{})),n,n]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?Rl(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),n=this.controlPlane.listEnvironments(e.projectId).find((f)=>f.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!n)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Lb.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Co({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let i=$e(e.config),o=$b("sha256").update(JSON.stringify(i)).digest("hex"),s=this.active(e.resourceId),c=this.id(),u=this.now().toISOString(),a=e.approvalRequired?"awaiting_approval":"built",p=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,o,JSON.stringify($e(e.manifest)),JSON.stringify($e(e.provenance??{})),e.strategy,a,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(p),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,s?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",u,u]),this.recordTransition(c,void 0,a,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(c)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Pl(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Pl).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(Bb)}recordTransition(e,t,r,n){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,n.trafficPercent??null,JSON.stringify($e(n.health??{})),n.message.slice(0,1000),n.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let n=this.get(e);if(!n)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[n.status].includes(t))throw Error(`Invalid release transition ${n.status} → ${t}`);let o=this.now().toISOString();if(t==="active"){let s=this.active(n.resourceId);if(s&&s.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[o,s.id]),this.recordTransition(s.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,o,t,o,o,e]),this.recordTransition(e,n.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let n=this.id(),i=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,i]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:nr(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),n=this.get(t);if(!r||!n)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==n.artifactId,sourceChanged:r.sourceSha!==n.sourceSha,configChanged:r.configHash!==n.configHash,manifestChanges:jb(r.manifest,n.manifest),dataCaveat:n.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${n.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let n of this.list()){let i=r.get(n.resourceId)??[];i.push(n),r.set(n.resourceId,i)}return[...r.values()].flatMap((n)=>n.slice(t)).filter((n)=>new Date(n.createdAt)<e.before&&!n.pinned&&!["active","activating","awaiting_approval"].includes(n.status)&&!this.list().some((i)=>i.previousReleaseId===n.id&&["active","activating"].includes(i.status)))}}class ln{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Ma(e),this.queue=new xe(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let n=t.action??"activate",i=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${n}`,idempotencyKey:`release:${r.id}:${n}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${n} queued.`,operationId:i.id,trafficPercent:0}),i}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let n=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),i=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!i)return{release:n};let o=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:i.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:n,rollbackOperation:o}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let n=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!n||n.resourceId!==r.resourceId||!["superseded","active"].includes(n.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${n.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:n.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function Fb(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function xl(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Co({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:Fb(t.release)})}async function Dl(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var Ub=["release.activate","release.rollback"];function zb(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Ol(e){let t=new ln(e.store),r=async(n)=>{let i=zb(n.operation.input),o=typeof i.releaseId==="string"?i.releaseId:"",s=t.releases.get(o);if(!s)throw Error(`Queued release ${o||"(missing)"} was not found`);if(s.projectId!==n.operation.projectId||s.environmentId!==n.operation.environmentId||s.resourceId!==n.operation.resourceId)throw Error("Queued release does not match the operation scope");let c=t.releases.getArtifact(s.artifactId);if(!c||c.digest!==t.releases.getArtifact(s.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let u=typeof i.targetReleaseId==="string"&&i.targetReleaseId?i.targetReleaseId:s.previousReleaseId,a=u?t.releases.get(u):void 0;if(a&&(a.resourceId!==s.resourceId||a.artifactId===s.artifactId&&a.id===s.id))throw Error("Rollback target does not match the release resource");let p=await e.resolveDriver(s);n.checkpoint("verify",`Verifying ${c.digest} and ${s.configHash} for ${p.name}.`),n.log(`Artifact ${c.digest}; source ${s.sourceSha??"not recorded"}; config ${s.configHash}.`,{stream:"system"}),n.throwIfCancellationRequested();let f;try{f=n.operation.kind==="release.rollback"?await Dl(p,{release:s,artifact:c,previous:a}):await xl(p,{release:s,artifact:c,previous:a})}catch(y){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:y instanceof Error?y.message:String(y)});throw y}for(let y of f.transitions)t.releases.progress(s.id,{message:`${n.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${y.trafficPercent}%.`,trafficPercent:y.trafficPercent,health:y.observed,operationId:n.operation.id}),n.log(`Traffic ${y.trafficPercent}%: ${y.healthy?"healthy":"unhealthy"}.`,{stream:y.healthy?"step":"stderr",step:"health"});if(n.checkpoint("health","Evaluating the provider health result."),!f.activated||!f.healthy){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:{resourceVersions:f.resourceVersions},message:f.error??"Provider health gate failed."});throw Error(f.error??`${p.name} reported an unhealthy release`)}if(n.operation.kind==="release.activate"&&s.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:`Named health gate ${s.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${s.healthGate.name} is unavailable`);n.checkpoint("named-health-gate",`Waiting on ${s.healthGate.name}.`);let y=await e.resolveHealthGate(s.healthGate.name,s);if(n.log(`${s.healthGate.name}: ${y.healthy?"healthy":"unhealthy"}${y.message?` — ${y.message}`:""}.`,{stream:y.healthy?"step":"stderr",step:"health"}),!y.healthy)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:y.evidence,message:y.message??`Named health gate ${s.healthGate.name} failed.`}),Error(y.message??`Named health gate ${s.healthGate.name} failed`)}if(n.operation.kind==="release.rollback"){let y=t.releases.get(s.id);if(y.status!=="rolled_back")t.releases.transition(y.id,"rolled_back",{message:`Traffic restored through ${p.name}.`,operationId:n.operation.id,trafficPercent:0,health:{resourceVersions:f.resourceVersions}});if(a&&a.status!=="active"){let b=a.status==="activating"?a:t.releases.transition(a.id,"activating",{message:"Rollback target restoring traffic.",operationId:n.operation.id,trafficPercent:0});t.releases.transition(b.id,"active",{message:"Previous immutable release restored.",operationId:n.operation.id,trafficPercent:100,health:{resourceVersions:f.resourceVersions}})}}else t.completeHealthGate(s.id,{healthy:!0,operationId:n.operation.id,health:{providerVersion:f.providerVersion??null,resourceVersions:f.resourceVersions},message:"Provider activation and health gates completed."});return n.checkpoint("finalize","Persisted the terminal release state."),{releaseId:s.id,artifactDigest:c.digest,provider:p.name,providerVersion:f.providerVersion??null,resourceVersions:f.resourceVersions,status:t.releases.get(s.id).status}};return Object.fromEntries(Ub.map((n)=>[n,r]))}import{createCipheriv as Vb,createDecipheriv as qb,createHash as Ll,randomBytes as La}from"node:crypto";var Bl={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Te(e){return typeof e==="string"&&e?e:void 0}function gn(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function ir(e){return JSON.stringify($e(e))}function pn(e){return Ll("sha256").update(e).digest("hex")}function _l(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Nl(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function Ba(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function $l(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Eo(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function Jb(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function Hb(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Te(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Te(e.credential_fingerprint),grantedScopes:gn(e.granted_scopes,[]),capabilities:gn(e.capabilities,Bl[String(e.provider)]),status:String(e.status),healthMessage:Te(e.health_message),lastTestedAt:Te(e.last_tested_at),lastSyncedAt:Te(e.last_synced_at),credentialExpiresAt:Te(e.credential_expires_at),version:Number(e.version),createdByActorId:Te(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function ja(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:gn(e.metadata,{}),syncedAt:String(e.synced_at)}}function Ml(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Te(e.environment_id),resourceId:Te(e.resource_id),connectionId:String(e.connection_id),repositoryId:Te(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Te(e.branch_rule),tagRule:Te(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:gn(e.include_paths,[]),excludePaths:gn(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Te(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Te(e.disabled_reason),version:Number(e.version),createdByActorId:Te(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Fa(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Te(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Ua(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Te(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Te(e.provider_webhook_id),events:gn(e.events,[]),status:String(e.status),healthMessage:Te(e.health_message),lastDeliveryAt:Te(e.last_delivery_at),lastReconciledAt:Te(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function za(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Te(e.action),commitSha:Te(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:gn(e.payload_summary,{}),operationId:Te(e.operation_id),error:Te(e.error),receivedAt:String(e.received_at),processedAt:Te(e.processed_at)}}class Va{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?Ll("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=La(12),r=Vb("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted source credential is unavailable");let o=qb("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),n=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Nl(e.name),_l(e.host),e.owner?.trim()||null,e.authKind??(n?"access_token":"none"),n?this.encrypt(n):null,n?pn(n).slice(0,16):null,ir([...new Set(e.grantedScopes??[])].sort()),ir(Bl[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:_l(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=Hb(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let n=this.getConnection(e);if(!n||n.status==="disconnected")throw Error("Active source connection was not found");let i=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(i),pn(i).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:pn(i).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let n=this.now(),i=t.grantedScopes?[...new Set(t.grantedScopes.map((o)=>o.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,i?ir(i):null,t.tested?n:null,t.synced?n:null,n,e]),i&&JSON.stringify(i)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:i}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),n=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),i=n?String(n.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[i,e.connectionId,e.providerRepositoryId,Ba(e.fullName),Jb(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,ir(e.metadata),r]),ja(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(i))}listRepositories(e,t,r=100){let n=t?.trim().toLowerCase();return(n?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${n}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(ja)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?ja(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),n=this.now(),i=`sha256:${pn(e.publicKey.trim())}`,o=`sha256:${pn(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Nl(e.name),e.publicKey.trim(),i,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),o,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:i,hostFingerprint:o}}),Fa(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?Fa(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(Fa)}revokeDeployKey(e,t){let r=this.getDeployKey(e),n=r?this.getConnection(r.connectionId):void 0;if(!r||!n)throw Error("Deploy key was not found");let i=this.listBindings({connectionId:n.id}).filter((s)=>s.deployKeyId===e),o=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[o,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:n.id,deployKeyId:e,affectedBindingIds:i.map((s)=>s.id)}}),{affectedBindings:i}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),n=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
@@ -30,7 +30,7 @@ data: ${JSON.stringify(ce)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,n,i,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(o),JSON.stringify(s),e.defaultRole??c.defaultRole,e.enabled??c.enabled?1:0,e.enforceSso??c.enforceSso?1:0,u,c.id]),this.getOidcProvider(c.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let a=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.organizationId,t,r,n,i,this.encrypt(e.clientSecret),JSON.stringify(o),JSON.stringify(s),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,u,u]),this.getOidcProvider(a)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?No(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?No(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(No).filter((n)=>t.includeDisabled||n.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:No(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let i=this.idFn(),o=mr(32).toString("base64url"),s=mr(32).toString("base64url"),c=mr(64).toString("base64url"),u=this.now(),a=new Date(this.nowFn().getTime()+mp).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e,zt(o),this.encrypt(s),this.encrypt(c),t,r,a,u]),{transaction:this.getOidcTransaction(i),state:o,nonce:s,verifier:c}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?dp(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,zt(t));if(!r)throw Error("OIDC transaction is invalid");let n=dp(r,this.now());if(n.state!=="pending")throw Error(`OIDC transaction is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(n.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?wS(r):void 0}linkOidcSubject(e,t,r,n){let i=this.getOidcProvider(e),o=this.getIdentity(t);if(!i||!o)throw Error("OIDC provider or identity was not found");let s=Za(n);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let c=this.getOidcSubject(e,r);if(c&&c.identityId!==t)throw Error("OIDC subject is already linked to another identity");let u=this.now();if(c)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[s,u,c.id]),this.getOidcSubject(e,r);let a=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,t,r,s,u,u]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Li(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:n}=await import("./chunk-80nra92y.js");return await new n({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as IS}from"node:crypto";import{chmodSync as CS,existsSync as ES,mkdirSync as TS,readFileSync as AS,writeFileSync as kS}from"node:fs";import{dirname as RS}from"node:path";function Hr(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=at(e,"auth-encryption-key");try{if(ES(r)){let i=AS(r,"utf8").trim();if(i)return i}}catch{}let n=IS(32).toString("base64url");try{TS(RS(r),{recursive:!0,mode:448}),kS(r,`${n}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e,zt(o),this.encrypt(s),this.encrypt(c),t,r,a,u]),{transaction:this.getOidcTransaction(i),state:o,nonce:s,verifier:c}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?dp(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,zt(t));if(!r)throw Error("OIDC transaction is invalid");let n=dp(r,this.now());if(n.state!=="pending")throw Error(`OIDC transaction is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(n.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?wS(r):void 0}linkOidcSubject(e,t,r,n){let i=this.getOidcProvider(e),o=this.getIdentity(t);if(!i||!o)throw Error("OIDC provider or identity was not found");let s=Za(n);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let c=this.getOidcSubject(e,r);if(c&&c.identityId!==t)throw Error("OIDC subject is already linked to another identity");let u=this.now();if(c)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[s,u,c.id]),this.getOidcSubject(e,r);let a=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,t,r,s,u,u]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Li(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:n}=await import("./chunk-5nkqza92.js");return await new n({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as IS}from"node:crypto";import{chmodSync as CS,existsSync as ES,mkdirSync as TS,readFileSync as AS,writeFileSync as kS}from"node:fs";import{dirname as RS}from"node:path";function Hr(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=at(e,"auth-encryption-key");try{if(ES(r)){let i=AS(r,"utf8").trim();if(i)return i}}catch{}let n=IS(32).toString("base64url");try{TS(RS(r),{recursive:!0,mode:448}),kS(r,`${n}
 `,{mode:384}),CS(r,384)}catch{}return n}import{constants as hp,createHash as rc,createPublicKey as PS,createVerify as xS,timingSafeEqual as DS}from"node:crypto";var bp=new Set(["RS256","PS256","ES256"]),yp=60;function Lo(e,t){let r=new URL(e),n=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function nc(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function ic(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let i=await e.text();if(i.length>1048576)throw Error(`${t} response is too large`);try{return nc(JSON.parse(i),t)}catch(o){if(o instanceof Error&&o.message===`${t} is invalid`)throw o;throw Error(`${t} returned invalid JSON`)}}function OS(e,t){let r=rc("sha256").update(e).digest(),n=rc("sha256").update(t).digest();return DS(r,n)}function Sp(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function oc(e,t=fetch){let r=Lo(e.issuer,"OIDC issuer"),n=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),i=await ic(await t(n,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(i.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let s of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof i[s]!=="string")throw Error(`OIDC discovery is missing ${s}`);Lo(i[s],`OIDC ${s}`)}if(Array.isArray(i.response_types_supported)&&!i.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(i.code_challenge_methods_supported)&&!i.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let o=Array.isArray(i.id_token_signing_alg_values_supported)?i.id_token_signing_alg_values_supported.filter((s)=>typeof s==="string"):[];if(o.length>0&&!o.some((s)=>bp.has(s)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return i}async function sc(e,t,r,n,i=fetch){let o=e.getOidcProviderBySlug(t);if(!o?.enabled)throw Error("OIDC provider is unavailable");let s=Lo(r,"Application origin").origin,c=await oc(o,i),u=`${s}/auth/oidc/${encodeURIComponent(o.slug)}/callback`,a=e.beginOidcTransaction(o.id,u,Sp(n)),p=new URL(c.authorization_endpoint);return p.searchParams.set("response_type","code"),p.searchParams.set("client_id",o.clientId),p.searchParams.set("redirect_uri",u),p.searchParams.set("scope",o.scopes.join(" ")),p.searchParams.set("state",a.state),p.searchParams.set("nonce",a.nonce),p.searchParams.set("code_challenge",rc("sha256").update(a.verifier).digest("base64url")),p.searchParams.set("code_challenge_method","S256"),{authorizationUrl:p.href,expiresAt:a.transaction.expiresAt}}function _S(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:nc(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:nc(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function NS(e,t,r){let n=_S(e),i=typeof n.header.alg==="string"?n.header.alg:"",o=typeof n.header.kid==="string"?n.header.kid:"";if(!bp.has(i)||!o)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(i))throw Error("OIDC ID-token algorithm was not advertised by the provider");let s=await ic(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(s.keys))throw Error("OIDC signing-key response is invalid");let c=s.keys.find((f)=>{if(!f||typeof f!=="object"||Array.isArray(f))return!1;let y=f;return y.kid===o&&(!y.alg||y.alg===i)&&(!y.use||y.use==="sig")});if(!c)throw Error("OIDC ID-token signing key was not found");let u=PS({key:c,format:"jwk"}),a=xS("SHA256").update(n.signingInput).end();if(!(i==="PS256"?a.verify({key:u,padding:hp.RSA_PKCS1_PSS_PADDING,saltLength:32},n.signature):i==="ES256"?a.verify({key:u,dsaEncoding:"ieee-p1363"},n.signature):a.verify(u,n.signature)))throw Error("OIDC ID-token signature is invalid");return n.claims}function $S(e,t,r,n){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let i=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((u)=>typeof u==="string"):[];if(!i.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((i.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let o=Math.floor(n.getTime()/1000);if(typeof e.exp!=="number"||e.exp<o-yp)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>o+yp)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!OS(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let s=e.email.trim().toLowerCase();if(s.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s))throw Error("OIDC provider returned an invalid email address");let c=s.split("@")[1];if(!c||!t.allowedDomains.includes(c))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:s,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function ac(e,t,r=fetch){let n=e.getOidcProviderBySlug(t.providerSlug);if(!n?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let i=Lo(t.origin,"Application origin").origin,o=e.consumeOidcTransaction(n.id,t.state),s=`${i}/auth/oidc/${encodeURIComponent(n.slug)}/callback`;if(o.transaction.redirectUri!==s)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:c}=e.getOidcProviderCredentials(n.id),u=await oc(n,r),a=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:o.transaction.redirectUri,code_verifier:o.verifier}),p={accept:"application/json","content-type":"application/x-www-form-urlencoded"},f=u.token_endpoint_auth_methods_supported??["client_secret_basic"];if(f.includes("client_secret_basic")){let C=(R)=>new URLSearchParams({value:R}).toString().slice(6),T=`${C(n.clientId)}:${C(c)}`;p.authorization=`Basic ${Buffer.from(T).toString("base64")}`}else if(f.includes("client_secret_post"))a.set("client_id",n.clientId),a.set("client_secret",c);else throw Error("OIDC provider does not support a configured client authentication method");let y=await ic(await r(u.token_endpoint,{method:"POST",headers:p,body:a,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof y.id_token!=="string")throw Error("OIDC token response did not include an ID token");let b=await NS(y.id_token,u,r);return{identity:$S(b,n,o.nonce,t.now??new Date),returnPath:o.transaction.returnPath}}import{createHash as MS,randomBytes as LS}from"node:crypto";var wp=new Set(Bo),Ip=7776000000,Cp=31536000000,Ep=86400000;function fr(e){return typeof e==="string"?e:void 0}function vp(e){return MS("sha256").update(e).digest("hex")}function BS(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&wp.has(r)):[]}catch{return[]}}function jS(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function cc(e){let t=fr(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:fr(e.description),createdByActorId:fr(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function dc(e,t){let r=fr(e.revoked_at),n=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:BS(e.capabilities),scope:jS(e),expiresAt:n,lastUsedAt:fr(e.last_used_at),lastNetworkHint:fr(e.last_network_hint),revokedAt:r,rotatedFromTokenId:fr(e.rotated_from_token_id),createdByActorId:fr(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":n<=t?"expired":"active"}}function FS(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:fr(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class jo{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let n=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),i=this.idFn(),o=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e.organizationId,n.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,o,o]);let s=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:n.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),c=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:i,roleTemplate:e.roleTemplate,scope:{type:c.type,id:c.id??null}}}),{serviceAccount:this.getServiceAccount(i),membership:s}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?cc(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?cc(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(cc).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let n=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[n,n,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[n,n,e]);let i=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(i?.status==="active")this.controlPlane.revokeMembership(i.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let n=[...new Set(e.capabilities)];if(n.length===0||n.some((y)=>!wp.has(y)))throw Error("API token requires valid explicit capabilities");let i=e.scope??r.scope,o=this.controlPlane.resolveAuthorizationTarget(t.organizationId,i);if(!o)throw Error("API token scope was not found in this organization");for(let y of n)if(!Vt({membership:r,grants:this.controlPlane.listGrants(r.id),capability:y,target:o}).allowed)throw Error(`Service-account membership does not grant ${y} at the token scope`);let s=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+Ip);if(!Number.isFinite(s.getTime())||s.getTime()<=this.nowFn().getTime()+60000||s.getTime()>this.nowFn().getTime()+Cp)throw Error("API token expiry must be between one minute and one year from now");let c=this.idFn(),u=LS(32).toString("base64url"),a=`tsc_v1.${c}.${u}`,p=`tsc_v1.${c.slice(0,8)}`,f=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[c,t.id,e.name.trim().slice(0,100)||"API token",vp(a),p,JSON.stringify(n.sort()),i.type,i.type==="organization"?null:i.id??null,s.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,f,f]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:c,prefix:p,capabilities:n,scope:{type:i.type,id:i.id??null},expiresAt:s.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(c),secret:a}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?dc(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>dc(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let n=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],vp(e));if(!n)return;let i=dc(n,this.now()),o=this.getServiceAccount(i.serviceAccountId);if(!o||o.state!=="active"||i.state!=="active")return;let s=this.controlPlane.getActor(o.actorId),c=this.controlPlane.getMembershipForActor(o.organizationId,o.actorId);if(!s||s.disabledAt||!c||c.status!=="active")return;let u=this.now(),a=!i.lastUsedAt||this.nowFn().getTime()-new Date(i.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[u,t?.slice(0,128)??null,u,i.id]),a)this.controlPlane.appendEvent({organizationId:o.organizationId,actorId:s.id,type:"api.token.used",payload:{serviceAccountId:o.id,tokenId:i.id,prefix:i.prefix}});return{serviceAccount:o,token:this.getToken(i.id),actor:s,membership:c}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let n=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),i=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:i?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:n.token.id}}),n}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let n=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[n,n,e]);let i=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:i?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?FS(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),n=this.now(),i=new Date(this.nowFn().getTime()+Ep).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -475,7 +475,7 @@ data: ${JSON.stringify({cursor:o,at:new Date().toISOString()})}
 ${c}
 ${u}`);return null}return n}catch(i){if(n)Mn(n,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${i.message}`);return null}}function GT(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:go(Ai(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,n])=>[r,{domain:n.domain,path:n.path,type:n.type,deploy:n.deploy,root:n.root,port:n.port,ssl:n.ssl}]))}}function ob(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function KT(e,t){return ob(t).find((r)=>r.id===e)}function Iy(e){if(e.length<=by)return e;return`${e.slice(0,by)}
 
-[output truncated]`}async function Cy(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:u}=await n.read();if(c)break;let a=i.decode(u,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function zu(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([Cy(r.stdout,"stdout",t.onOutput),Cy(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:Iy(i),stderr:Iy(o)}}finally{t.signal?.removeEventListener("abort",n)}}function QT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var YT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function XT(e){let t=mo(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!YT.has(r)}var ZT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function Ey(e,t){if(t.role==="admin")return!0;let r=mo(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!XT(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=ZT[n];return!!i&&!!t.capabilities?.includes(i)}function eA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=wT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Ie(e,i);if(_r(o)&&!nb(o).isDirectory())return o;if(!mo(o)&&_r(`${o}.html`))return`${o}.html`;if(!mo(o)&&_r(Ie(o,"index.html")))return Ie(o,"index.html");return null}async function Ty(e,t){let r=eA(e,t);if(!r){let o=Ie(e,"404.html");if(_r(o))return new Response(await ur(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Sa("Not found",404)}if(nb(r).isDirectory())return Sa("Not found",404);let n=await ur(r),i=xT[mo(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var ya=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],Ay=new WeakMap;async function ky(e){let t=Ay.get(e);if(t)return t;let r=await import("./chunk-a2t1e5yb.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return Ay.set(e,i),i}async function fB(e={}){PT();let t=e.cwd??process.cwd(),r=e.host??AT,n=e.port??kT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await BT(t);let o=e.config??await Am(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=it(o);if(s&&c&&!c.password)c.password=s;let u=o.infrastructure?.compute?.managedServices?.vitess;if(s&&u&&typeof u==="object"&&!u.password)u.password=s;let a=_f(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let p=Object.keys(o.environments??{}),f=MT(o,e.environment),y=jT(t),b=await $n(o,f),C=new Map([[f,b]]),T=new Map([[f,Date.now()]]),R=new Map([[f,Date.now()]]),x=new Map,j=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),P=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),K=Pr(o)!=="serverless",ae=(m)=>{let q=C.get(m);if(q&&!Sy(T.get(m),Date.now(),j))return Promise.resolve(q);let G=x.get(m);if(G)return G;let z=!K||Sy(R.get(m),Date.now(),P),te=$n(o,m,{includeSiteHealth:z}).then((ye)=>{let v=C.get(m),st=z?ye:JT(v,ye);if(C.set(m,st),T.set(m,Date.now()),z)R.set(m,Date.now());if(v?._serverReachable!==st._serverReachable||v?._metricsStatus!==st._metricsStatus||(v?.sitesDetail?.length??0)!==(st.sitesDetail?.length??0))Ft();return st}).finally(()=>x.delete(m));return x.set(m,te),te},Z=Hy(t),Le=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Le!=="0"&&(Le==="1"||!o.cloud?.attachTo)){let m=!1,q=Date.now()+300000,G=async()=>{if(m)return;m=!0;try{let te=Date.now(),ye=te>=q;if(ye)q=te+300000;let v=a.environments.get(f);await Fu({controlPlane:a.store,projectId:a.project.id,environmentId:v?.id,config:o,environment:f,force:!0,lightweight:!0,includeSiteHealth:ye})}catch(te){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${te instanceof Error?te.message:String(te)}`)}finally{m=!1}};G(),setInterval(()=>void G(),60000).unref?.()}let H=new Map,ie=new Map,Ce=new Set,Yt=0;function Nr(m,q){if(m.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${m.username.toLowerCase()}`))return m;let G=a.store.getActorByExternalId("user",`dashboard:${m.username.toLowerCase()}`),z=G?a.store.getMembershipForActor(a.organization.id,G.id):void 0;if(!z||z.status!=="active")return{...m,role:"member",sites:{},capabilities:[]};let te=a.store.listGrants(z.id),ye=a.store.resolveAuthorizationTarget(a.organization.id,z.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),v=po({membership:z,grants:te,target:ye});if(z.roleTemplate==="owner"||z.roleTemplate==="admin")return{...m,role:"admin",sites:{},organizationRole:z.roleTemplate,organizationSource:z.source,capabilities:v};let st=a.environments.get(q),Fe={};for(let oe of a.store.listResources(a.project.id,st?.id).filter((de)=>de.kind==="application")){let de=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:oe.id});if(!de||!Vt({membership:z,grants:te,capability:"project:read",target:de}).allowed)continue;Fe[oe.slug]=Vt({membership:z,grants:te,capability:"config:write",target:de}).allowed?"owner":"collaborator"}return{...m,role:"member",sites:Fe,organizationRole:z.roleTemplate,organizationSource:z.source,capabilities:v}}function Ft(){Yt+=1,H.clear();for(let m of Ce)Mn(m,{recursive:!0,force:!0});Ce.clear()}let Xt=(m,q)=>`${q}:${m.role==="admin"?"admin":`member:${Object.entries(m.sites).sort(([G],[z])=>G.localeCompare(z)).map(([G,z])=>`${G}=${z}`).join(",")}`}:${[...m.capabilities??[]].sort().join(",")}`;async function Zt(m,q){let G=Nr(m,q),z=Xt(G,q),te=H.get(z);if(te)return te;let ye=ie.get(z);if(ye)return ye;let v=Yt,st=(async()=>{let Fe=C.get(q)??await $n(o,q);C.set(q,Fe);let oe={...Eu(Fe,{user:G,slug:o.project.slug}),viewer:{role:G.role,organizationRole:G.organizationRole,organizationSource:G.organizationSource,capabilities:G.capabilities??[]}},de=await WT(t,oe);if(de&&v!==Yt)return Mn(de,{recursive:!0,force:!0}),Z?.uiRoot;if(de)Ce.add(de);let Xe=de??Z?.uiRoot;if(Xe)H.set(z,Xe);return Xe})();ie.set(z,st);try{return await st}finally{ie.delete(z)}}let er=await Zt({username:"",passwordHash:"",role:"admin",sites:{}},f);if(!er)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let E=new WeakMap,N=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",V=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(V&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let W=!V,ke=Zf(t),Be=W?nh(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,U=new $o(a.store,{encryptionKey:Hr(t)}),pe=new jo(a.store),ce=new Xi(a.store),ee=new Va(a.store,{encryptionKey:Hr(t)}),ot=new Da(a.store),Ln=new $a(a.store,{cwd:t}),tr=new _a(a.store,{encryptionKey:Hr(t)}),Ee=new xe(a.store,{workerId:`dashboard:${process.pid}`}),Re=new Ic(a.store),lr=new Oc(a.store,Hr(t)),$r=new Py(a.store),fo=new Ko(Re,Ee,lr),Mr=o.project?.region??"us-east-1",qu=Hr(t),wt=new $y($r,{encryptionKey:qu,backends:[new xy(a.store,qu),new Dy(new so(Mr),Mr),new Oy(new Ry(Mr),Mr),new _y]});await My(wt,a,o);let va=new Sn(Mr),sb={aws_rds:new Cc(new Pc(va)),aws_aurora:new Ec(new xc(va)),aws_elasticache:new Tc(new Dc(new ji(Mr))),server:new Ac(new Xn),container:new kc(new Xn)},Ju=(m)=>sb[m.provider],Ue=new bc(a.store),on=new Ho(Ue,Ee),Hu=new vc(lr),ab={managed_database:new wc(Re,va),logical_database:new Mc(Re,lr),volume:new Bc,files:new $c(t),control_plane:new Fc(a.store,t),infrastructure:new zc(new Bi(Mr))},cb=(m)=>ab[m.resourceKind],db=(m)=>m.provider==="aws_backup"?void 0:Hu,wa=new Fy(a.store),Ia=[new Vy,new qy(at(t,"volumes"))],pr=new Uy(wa,Ia,Ee),ki=new Od(a.store),rr=new _d(ki,[new Gi("aws"),new Gi("hetzner"),new Gi("ssh")],Ee),Lr=new Fd(a.store),Wu=new Ud(Lr,ki),sn=new Jd(a.store),Gu=new Hd(sn,Ee),gr=new Md(a.store),Ca=new Ld(gr,Ee),Ku=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((m)=>new jd(m,a.store,a.project.id,a.organization.id)),Qe=new mc(a.store),Qu=new pc(Qe,{queue:Ee}),je=new Do(a.store),Br=new xo(a.store),xt=new ln(a.store),ne=new Wy(a.store,{encryptionKey:Hr(t)}),ub=()=>ky(a.store);for(let m of a.environments.values())lc(Qe,o,{organization:a.organization,project:a.project,environment:m,resources:a.store.listResources(a.project.id,m.id)});let Dt=new Gy(ne,{emailImpl:async(m)=>{let{email:q}=await import("./chunk-80nra92y.js");return q.send(m)}}),Yu=async(m)=>{let q=Xy(ne,a.project.id,m),G=[];for(let z of q.filter((te)=>te.notify&&te.alert))G.push(...await Dt.deliverAll(Dt.enqueue(a.organization.id,z.alert,z.transition)));return G.push(...await Dt.deliverAll(Dt.enqueueRemindersAndEscalations(a.organization.id,ne.listAlerts(a.project.id,{environmentId:m,states:["firing"]})))),G.push(...await Dt.retryDue()),{evaluations:q,deliveries:G}},Ea=!1,lb=async()=>{if(Ea)return;Ea=!0;try{for(let m of a.environments.values())for(let q of ne.listHealthChecks(a.project.id,m.id).filter((G)=>G.enabled)){let G=ne.listHealthResults(q.id,1)[0];if(G&&Date.now()-new Date(G.checkedAt).getTime()<q.intervalSeconds*1000)continue;let z=await new Ei(ne).runAndEvaluate(q);for(let te of z.evaluations.filter((ye)=>ye.notify&&ye.alert))await Dt.deliverAll(Dt.enqueue(a.organization.id,te.alert,te.transition))}}finally{Ea=!1}},Xu=setInterval(()=>{for(let m of a.environments.values())Yu(m.id).catch((q)=>console.error("ts-cloud alert evaluation failed:",q))},60000);Xu.unref?.();let Zu=setInterval(()=>{lb().catch((m)=>console.error("ts-cloud health check evaluation failed:",m))},30000);Zu.unref?.();let el=setInterval(()=>{try{Qu.tick()}catch(m){console.error("ts-cloud scheduled job evaluation failed:",m)}},30000);el.unref?.();let tl=setInterval(()=>{try{on.enqueueDue(),on.enqueueRetention()}catch(m){console.error("ts-cloud backup policy evaluation failed:",m)}},30000);tl.unref?.(),je.cleanup();let rl=setInterval(()=>{try{je.cleanup()}catch(m){console.error("ts-cloud preview cleanup failed:",m)}},3600000);rl.unref?.();let pb=e.queueWorker??!0,gb=QT(),mb=async(m,q)=>{let z=(m.environmentId?a.store.listEnvironments(m.projectId).find((te)=>te.id===m.environmentId):void 0)?.slug??String(f);if(q.kind==="dashboard_operation"&&q.operationId){let te=C.get(z)??b,ye=Cu(q.operationId,o,te);if(!ye||ye.danger||!["scheduler","backup","worker"].includes(ye.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let v=await da(o,z,ye);return{ok:v.ok,stdout:v.stdout,stderr:v.stderr??v.error,retryable:/temporar|unavailable|timeout|network/i.test(v.stderr??v.error??""),output:{command:v.command??null,operation:v.operation}}}if(q.kind==="serverless_scheduler"){let te=await Mu(o,z,"run");return{ok:te.ok,stdout:te.stdout,stderr:te.error,retryable:/temporar|unavailable|timeout|network/i.test(te.error??""),output:{command:te.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${q.kind}.`}},ho=pb?new Ly(Ee,{...Jy({store:a.store,execute:async(m,q)=>{let G=q.operation.input&&typeof q.operation.input==="object"&&!Array.isArray(q.operation.input)?q.operation.input:{},z=G.source&&typeof G.source==="object"?G.source:void 0,te=t,ye,v,st;try{if(z?.bindingId&&z?.connectionId&&z?.commitSha){let oe=ee.getBinding(String(z.bindingId)),de=ee.getConnection(String(z.connectionId));if(!oe||!de||oe.connectionId!==de.id)throw Error("Queued source binding is no longer available");let Ge=(oe.repositoryId?ee.getRepository(oe.repositoryId):ee.listRepositories(de.id).find((Fn)=>Fn.fullName.toLowerCase()===oe.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Ge&&de.provider==="generic_ssh")Ge=`git@${new URL(de.host).hostname}:${oe.repositoryFullName}.git`;if(!Ge)Ge=new URL(`/${oe.repositoryFullName}.git`,de.host.endsWith("/")?de.host:`${de.host}/`).href;let L=oe.deployKeyId?ee.getDeployKey(oe.deployKeyId):void 0,Pe=L&&oe.deployKeyId?{...L,privateKey:ee.getDeployPrivateKey(oe.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(de.provider)&&m.target.previewId){let Fn=Vr(de,ee.getCredential(de.id)),O=je.previews.getInstance(m.target.previewId);st=async(Ot,wo)=>{try{await Fn.setCommitStatus(oe.repositoryFullName,String(z.commitSha),{state:Ot,url:O?.url,description:wo})}catch(Un){q.log(`Could not publish source status: ${Un instanceof Error?Un.message:String(Un)}`,{stream:"stderr"})}},await st("pending",`Preview deployment started for ${String(z.commitSha).slice(0,12)}`)}ye=Vu(Ie(ba(),"ts-cloud-queued-source-")),q.log(`Checking out immutable source commit ${z.commitSha}.`,{stream:"system"}),te=(await Ha({remote:Ge,binding:oe,destination:Ie(ye,"checkout"),ref:String(z.branch??oe.defaultBranch),commitSha:String(z.commitSha)},{credential:ee.getCredential(de.id),deployKey:Pe})).directory}if(q.operation.kind!=="preview.destroy"){let oe=m.target.previewId?je.previews.getInstance(m.target.previewId):void 0,de=oe?je.previews.getDefinition(oe.definitionId):void 0,Xe=q.operation.resourceId?a.store.getResource(q.operation.resourceId):void 0;if(v=await wt.resolve({projectId:a.project.id,environmentId:q.operation.environmentId,resourceId:q.operation.resourceId,functionId:Xe?.kind==="function"?Xe.id:void 0,previewId:oe?.id,trustedPreview:!!oe&&!oe.fork,allowedPreviewSecrets:de?.inheritedSecrets}),v.warnings.some((Ge)=>Ge.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${v.warnings.filter((Ge)=>Ge.code==="missing_required").map((Ge)=>Ge.key).join(", ")}`);if(q.operation.resourceId)for(let Ge of Object.values(v.entries))$r.setDependency({entryId:Ge.id,resourceId:q.operation.resourceId,injectionTarget:"environment",required:Ge.required,requiresRedeploy:!0});q.log(`Resolved configuration ${v.configurationHash.slice(0,18)} for ${Object.keys(v.values).length} keys.`,{stream:"system"})}let Fe=await zu(m,{cwd:te,cliEntry:i,signal:q.signal,env:v?.values,onOutput:(oe,de)=>q.log(de,{stream:oe,step:"execute",secrets:[...gb,...Object.entries(v?.entries??{}).filter(([,Xe])=>Xe.kind==="secret").map(([Xe])=>v.values[Xe]).filter(Boolean)]})});if(Fe.ok&&q.operation.resourceId&&v)for(let oe of Object.values(v.entries))$r.setDependency({entryId:oe.id,resourceId:q.operation.resourceId,injectionTarget:"environment",required:oe.required,requiresRedeploy:!1,lastDeployedVersion:oe.version});return await st?.(Fe.ok?"success":"failure",Fe.ok?`Preview is ready at ${String(z?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(z?.commitSha).slice(0,12)}`),Fe}catch(Fe){throw await st?.("error",`Preview deployment could not complete at ${String(z?.commitSha).slice(0,12)}`),Fe}finally{if(ye)Mn(ye,{recursive:!0,force:!0})}}}),...Pp({store:Qe,executor:mb}),...Up({store:Re,secrets:lr,resolveAdapter:Ju}),...Pm(ki,rr.drivers),...Qm(sn,[new Wd("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...zm({store:gr,cleanup:Ku}),...zy(wa,Ia),...Lp({store:Ue,queue:Ee,resolveSource:cb,resolveDestination:db,validateHealth:async(m,q)=>{if(!m.healthCheckId)return{healthy:!0,mode:"adapter"};let G=ne.getHealthCheck(m.healthCheckId);if(!G||G.projectId!==m.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let z=await new Ei(ne).runAndEvaluate(G);return{healthy:z.result.status==="healthy",healthCheckId:G.id,healthResultId:z.result.id,target:q}}}),...Ol({store:a.store,resolveDriver:e.releaseDriver??((m)=>({name:`${a.store.getResource(m.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:m.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(m,q)=>{let G=ne.listHealthChecks(q.projectId,q.environmentId).find((te)=>te.enabled&&te.name===m&&(!te.resourceId||te.resourceId===q.resourceId));if(!G)return{healthy:!1,message:`Named health gate ${m} was not found for this release.`};let z=await new Ei(ne).runAndEvaluate(G);return{healthy:z.result.status==="healthy",evidence:{healthCheckId:G.id,healthResultId:z.result.id,status:z.result.status,timings:z.result.timings},message:z.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(m)=>console.error("ts-cloud deployment queue worker failed:",m)}):void 0;if(Af(a),Ws(ce,Kt(a,String(f)),b),Be)Ks(a,Be.users),sh(U,a,Be.users);let Oe=ih({cwd:t,enabled:W,secret:ke,authentication:U,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(f)}}),ze=new Zd,nl=setInterval(()=>ze.sweep(),60000);nl.unref?.();let yo=new io,Ta=new io(3,900000,900000),bo=new io(8,900000,900000),il=setInterval(()=>yo.prune(),300000),ol=setInterval(()=>Ta.prune(),300000),sl=setInterval(()=>bo.prune(),300000);if(il.unref?.(),ol.unref?.(),sl.unref?.(),W){if(Be?.generated)console.warn(`
+[output truncated]`}async function Cy(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:u}=await n.read();if(c)break;let a=i.decode(u,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function zu(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([Cy(r.stdout,"stdout",t.onOutput),Cy(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:Iy(i),stderr:Iy(o)}}finally{t.signal?.removeEventListener("abort",n)}}function QT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var YT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function XT(e){let t=mo(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!YT.has(r)}var ZT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function Ey(e,t){if(t.role==="admin")return!0;let r=mo(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!XT(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=ZT[n];return!!i&&!!t.capabilities?.includes(i)}function eA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=wT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Ie(e,i);if(_r(o)&&!nb(o).isDirectory())return o;if(!mo(o)&&_r(`${o}.html`))return`${o}.html`;if(!mo(o)&&_r(Ie(o,"index.html")))return Ie(o,"index.html");return null}async function Ty(e,t){let r=eA(e,t);if(!r){let o=Ie(e,"404.html");if(_r(o))return new Response(await ur(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Sa("Not found",404)}if(nb(r).isDirectory())return Sa("Not found",404);let n=await ur(r),i=xT[mo(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var ya=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],Ay=new WeakMap;async function ky(e){let t=Ay.get(e);if(t)return t;let r=await import("./chunk-zsf6pccz.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return Ay.set(e,i),i}async function fB(e={}){PT();let t=e.cwd??process.cwd(),r=e.host??AT,n=e.port??kT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await BT(t);let o=e.config??await Am(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=it(o);if(s&&c&&!c.password)c.password=s;let u=o.infrastructure?.compute?.managedServices?.vitess;if(s&&u&&typeof u==="object"&&!u.password)u.password=s;let a=_f(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let p=Object.keys(o.environments??{}),f=MT(o,e.environment),y=jT(t),b=await $n(o,f),C=new Map([[f,b]]),T=new Map([[f,Date.now()]]),R=new Map([[f,Date.now()]]),x=new Map,j=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),P=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),K=Pr(o)!=="serverless",ae=(m)=>{let q=C.get(m);if(q&&!Sy(T.get(m),Date.now(),j))return Promise.resolve(q);let G=x.get(m);if(G)return G;let z=!K||Sy(R.get(m),Date.now(),P),te=$n(o,m,{includeSiteHealth:z}).then((ye)=>{let v=C.get(m),st=z?ye:JT(v,ye);if(C.set(m,st),T.set(m,Date.now()),z)R.set(m,Date.now());if(v?._serverReachable!==st._serverReachable||v?._metricsStatus!==st._metricsStatus||(v?.sitesDetail?.length??0)!==(st.sitesDetail?.length??0))Ft();return st}).finally(()=>x.delete(m));return x.set(m,te),te},Z=Hy(t),Le=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Le!=="0"&&(Le==="1"||!o.cloud?.attachTo)){let m=!1,q=Date.now()+300000,G=async()=>{if(m)return;m=!0;try{let te=Date.now(),ye=te>=q;if(ye)q=te+300000;let v=a.environments.get(f);await Fu({controlPlane:a.store,projectId:a.project.id,environmentId:v?.id,config:o,environment:f,force:!0,lightweight:!0,includeSiteHealth:ye})}catch(te){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${te instanceof Error?te.message:String(te)}`)}finally{m=!1}};G(),setInterval(()=>void G(),60000).unref?.()}let H=new Map,ie=new Map,Ce=new Set,Yt=0;function Nr(m,q){if(m.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${m.username.toLowerCase()}`))return m;let G=a.store.getActorByExternalId("user",`dashboard:${m.username.toLowerCase()}`),z=G?a.store.getMembershipForActor(a.organization.id,G.id):void 0;if(!z||z.status!=="active")return{...m,role:"member",sites:{},capabilities:[]};let te=a.store.listGrants(z.id),ye=a.store.resolveAuthorizationTarget(a.organization.id,z.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),v=po({membership:z,grants:te,target:ye});if(z.roleTemplate==="owner"||z.roleTemplate==="admin")return{...m,role:"admin",sites:{},organizationRole:z.roleTemplate,organizationSource:z.source,capabilities:v};let st=a.environments.get(q),Fe={};for(let oe of a.store.listResources(a.project.id,st?.id).filter((de)=>de.kind==="application")){let de=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:oe.id});if(!de||!Vt({membership:z,grants:te,capability:"project:read",target:de}).allowed)continue;Fe[oe.slug]=Vt({membership:z,grants:te,capability:"config:write",target:de}).allowed?"owner":"collaborator"}return{...m,role:"member",sites:Fe,organizationRole:z.roleTemplate,organizationSource:z.source,capabilities:v}}function Ft(){Yt+=1,H.clear();for(let m of Ce)Mn(m,{recursive:!0,force:!0});Ce.clear()}let Xt=(m,q)=>`${q}:${m.role==="admin"?"admin":`member:${Object.entries(m.sites).sort(([G],[z])=>G.localeCompare(z)).map(([G,z])=>`${G}=${z}`).join(",")}`}:${[...m.capabilities??[]].sort().join(",")}`;async function Zt(m,q){let G=Nr(m,q),z=Xt(G,q),te=H.get(z);if(te)return te;let ye=ie.get(z);if(ye)return ye;let v=Yt,st=(async()=>{let Fe=C.get(q)??await $n(o,q);C.set(q,Fe);let oe={...Eu(Fe,{user:G,slug:o.project.slug}),viewer:{role:G.role,organizationRole:G.organizationRole,organizationSource:G.organizationSource,capabilities:G.capabilities??[]}},de=await WT(t,oe);if(de&&v!==Yt)return Mn(de,{recursive:!0,force:!0}),Z?.uiRoot;if(de)Ce.add(de);let Xe=de??Z?.uiRoot;if(Xe)H.set(z,Xe);return Xe})();ie.set(z,st);try{return await st}finally{ie.delete(z)}}let er=await Zt({username:"",passwordHash:"",role:"admin",sites:{}},f);if(!er)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let E=new WeakMap,N=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",V=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(V&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let W=!V,ke=Zf(t),Be=W?nh(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,U=new $o(a.store,{encryptionKey:Hr(t)}),pe=new jo(a.store),ce=new Xi(a.store),ee=new Va(a.store,{encryptionKey:Hr(t)}),ot=new Da(a.store),Ln=new $a(a.store,{cwd:t}),tr=new _a(a.store,{encryptionKey:Hr(t)}),Ee=new xe(a.store,{workerId:`dashboard:${process.pid}`}),Re=new Ic(a.store),lr=new Oc(a.store,Hr(t)),$r=new Py(a.store),fo=new Ko(Re,Ee,lr),Mr=o.project?.region??"us-east-1",qu=Hr(t),wt=new $y($r,{encryptionKey:qu,backends:[new xy(a.store,qu),new Dy(new so(Mr),Mr),new Oy(new Ry(Mr),Mr),new _y]});await My(wt,a,o);let va=new Sn(Mr),sb={aws_rds:new Cc(new Pc(va)),aws_aurora:new Ec(new xc(va)),aws_elasticache:new Tc(new Dc(new ji(Mr))),server:new Ac(new Xn),container:new kc(new Xn)},Ju=(m)=>sb[m.provider],Ue=new bc(a.store),on=new Ho(Ue,Ee),Hu=new vc(lr),ab={managed_database:new wc(Re,va),logical_database:new Mc(Re,lr),volume:new Bc,files:new $c(t),control_plane:new Fc(a.store,t),infrastructure:new zc(new Bi(Mr))},cb=(m)=>ab[m.resourceKind],db=(m)=>m.provider==="aws_backup"?void 0:Hu,wa=new Fy(a.store),Ia=[new Vy,new qy(at(t,"volumes"))],pr=new Uy(wa,Ia,Ee),ki=new Od(a.store),rr=new _d(ki,[new Gi("aws"),new Gi("hetzner"),new Gi("ssh")],Ee),Lr=new Fd(a.store),Wu=new Ud(Lr,ki),sn=new Jd(a.store),Gu=new Hd(sn,Ee),gr=new Md(a.store),Ca=new Ld(gr,Ee),Ku=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((m)=>new jd(m,a.store,a.project.id,a.organization.id)),Qe=new mc(a.store),Qu=new pc(Qe,{queue:Ee}),je=new Do(a.store),Br=new xo(a.store),xt=new ln(a.store),ne=new Wy(a.store,{encryptionKey:Hr(t)}),ub=()=>ky(a.store);for(let m of a.environments.values())lc(Qe,o,{organization:a.organization,project:a.project,environment:m,resources:a.store.listResources(a.project.id,m.id)});let Dt=new Gy(ne,{emailImpl:async(m)=>{let{email:q}=await import("./chunk-5nkqza92.js");return q.send(m)}}),Yu=async(m)=>{let q=Xy(ne,a.project.id,m),G=[];for(let z of q.filter((te)=>te.notify&&te.alert))G.push(...await Dt.deliverAll(Dt.enqueue(a.organization.id,z.alert,z.transition)));return G.push(...await Dt.deliverAll(Dt.enqueueRemindersAndEscalations(a.organization.id,ne.listAlerts(a.project.id,{environmentId:m,states:["firing"]})))),G.push(...await Dt.retryDue()),{evaluations:q,deliveries:G}},Ea=!1,lb=async()=>{if(Ea)return;Ea=!0;try{for(let m of a.environments.values())for(let q of ne.listHealthChecks(a.project.id,m.id).filter((G)=>G.enabled)){let G=ne.listHealthResults(q.id,1)[0];if(G&&Date.now()-new Date(G.checkedAt).getTime()<q.intervalSeconds*1000)continue;let z=await new Ei(ne).runAndEvaluate(q);for(let te of z.evaluations.filter((ye)=>ye.notify&&ye.alert))await Dt.deliverAll(Dt.enqueue(a.organization.id,te.alert,te.transition))}}finally{Ea=!1}},Xu=setInterval(()=>{for(let m of a.environments.values())Yu(m.id).catch((q)=>console.error("ts-cloud alert evaluation failed:",q))},60000);Xu.unref?.();let Zu=setInterval(()=>{lb().catch((m)=>console.error("ts-cloud health check evaluation failed:",m))},30000);Zu.unref?.();let el=setInterval(()=>{try{Qu.tick()}catch(m){console.error("ts-cloud scheduled job evaluation failed:",m)}},30000);el.unref?.();let tl=setInterval(()=>{try{on.enqueueDue(),on.enqueueRetention()}catch(m){console.error("ts-cloud backup policy evaluation failed:",m)}},30000);tl.unref?.(),je.cleanup();let rl=setInterval(()=>{try{je.cleanup()}catch(m){console.error("ts-cloud preview cleanup failed:",m)}},3600000);rl.unref?.();let pb=e.queueWorker??!0,gb=QT(),mb=async(m,q)=>{let z=(m.environmentId?a.store.listEnvironments(m.projectId).find((te)=>te.id===m.environmentId):void 0)?.slug??String(f);if(q.kind==="dashboard_operation"&&q.operationId){let te=C.get(z)??b,ye=Cu(q.operationId,o,te);if(!ye||ye.danger||!["scheduler","backup","worker"].includes(ye.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let v=await da(o,z,ye);return{ok:v.ok,stdout:v.stdout,stderr:v.stderr??v.error,retryable:/temporar|unavailable|timeout|network/i.test(v.stderr??v.error??""),output:{command:v.command??null,operation:v.operation}}}if(q.kind==="serverless_scheduler"){let te=await Mu(o,z,"run");return{ok:te.ok,stdout:te.stdout,stderr:te.error,retryable:/temporar|unavailable|timeout|network/i.test(te.error??""),output:{command:te.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${q.kind}.`}},ho=pb?new Ly(Ee,{...Jy({store:a.store,execute:async(m,q)=>{let G=q.operation.input&&typeof q.operation.input==="object"&&!Array.isArray(q.operation.input)?q.operation.input:{},z=G.source&&typeof G.source==="object"?G.source:void 0,te=t,ye,v,st;try{if(z?.bindingId&&z?.connectionId&&z?.commitSha){let oe=ee.getBinding(String(z.bindingId)),de=ee.getConnection(String(z.connectionId));if(!oe||!de||oe.connectionId!==de.id)throw Error("Queued source binding is no longer available");let Ge=(oe.repositoryId?ee.getRepository(oe.repositoryId):ee.listRepositories(de.id).find((Fn)=>Fn.fullName.toLowerCase()===oe.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Ge&&de.provider==="generic_ssh")Ge=`git@${new URL(de.host).hostname}:${oe.repositoryFullName}.git`;if(!Ge)Ge=new URL(`/${oe.repositoryFullName}.git`,de.host.endsWith("/")?de.host:`${de.host}/`).href;let L=oe.deployKeyId?ee.getDeployKey(oe.deployKeyId):void 0,Pe=L&&oe.deployKeyId?{...L,privateKey:ee.getDeployPrivateKey(oe.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(de.provider)&&m.target.previewId){let Fn=Vr(de,ee.getCredential(de.id)),O=je.previews.getInstance(m.target.previewId);st=async(Ot,wo)=>{try{await Fn.setCommitStatus(oe.repositoryFullName,String(z.commitSha),{state:Ot,url:O?.url,description:wo})}catch(Un){q.log(`Could not publish source status: ${Un instanceof Error?Un.message:String(Un)}`,{stream:"stderr"})}},await st("pending",`Preview deployment started for ${String(z.commitSha).slice(0,12)}`)}ye=Vu(Ie(ba(),"ts-cloud-queued-source-")),q.log(`Checking out immutable source commit ${z.commitSha}.`,{stream:"system"}),te=(await Ha({remote:Ge,binding:oe,destination:Ie(ye,"checkout"),ref:String(z.branch??oe.defaultBranch),commitSha:String(z.commitSha)},{credential:ee.getCredential(de.id),deployKey:Pe})).directory}if(q.operation.kind!=="preview.destroy"){let oe=m.target.previewId?je.previews.getInstance(m.target.previewId):void 0,de=oe?je.previews.getDefinition(oe.definitionId):void 0,Xe=q.operation.resourceId?a.store.getResource(q.operation.resourceId):void 0;if(v=await wt.resolve({projectId:a.project.id,environmentId:q.operation.environmentId,resourceId:q.operation.resourceId,functionId:Xe?.kind==="function"?Xe.id:void 0,previewId:oe?.id,trustedPreview:!!oe&&!oe.fork,allowedPreviewSecrets:de?.inheritedSecrets}),v.warnings.some((Ge)=>Ge.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${v.warnings.filter((Ge)=>Ge.code==="missing_required").map((Ge)=>Ge.key).join(", ")}`);if(q.operation.resourceId)for(let Ge of Object.values(v.entries))$r.setDependency({entryId:Ge.id,resourceId:q.operation.resourceId,injectionTarget:"environment",required:Ge.required,requiresRedeploy:!0});q.log(`Resolved configuration ${v.configurationHash.slice(0,18)} for ${Object.keys(v.values).length} keys.`,{stream:"system"})}let Fe=await zu(m,{cwd:te,cliEntry:i,signal:q.signal,env:v?.values,onOutput:(oe,de)=>q.log(de,{stream:oe,step:"execute",secrets:[...gb,...Object.entries(v?.entries??{}).filter(([,Xe])=>Xe.kind==="secret").map(([Xe])=>v.values[Xe]).filter(Boolean)]})});if(Fe.ok&&q.operation.resourceId&&v)for(let oe of Object.values(v.entries))$r.setDependency({entryId:oe.id,resourceId:q.operation.resourceId,injectionTarget:"environment",required:oe.required,requiresRedeploy:!1,lastDeployedVersion:oe.version});return await st?.(Fe.ok?"success":"failure",Fe.ok?`Preview is ready at ${String(z?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(z?.commitSha).slice(0,12)}`),Fe}catch(Fe){throw await st?.("error",`Preview deployment could not complete at ${String(z?.commitSha).slice(0,12)}`),Fe}finally{if(ye)Mn(ye,{recursive:!0,force:!0})}}}),...Pp({store:Qe,executor:mb}),...Up({store:Re,secrets:lr,resolveAdapter:Ju}),...Pm(ki,rr.drivers),...Qm(sn,[new Wd("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...zm({store:gr,cleanup:Ku}),...zy(wa,Ia),...Lp({store:Ue,queue:Ee,resolveSource:cb,resolveDestination:db,validateHealth:async(m,q)=>{if(!m.healthCheckId)return{healthy:!0,mode:"adapter"};let G=ne.getHealthCheck(m.healthCheckId);if(!G||G.projectId!==m.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let z=await new Ei(ne).runAndEvaluate(G);return{healthy:z.result.status==="healthy",healthCheckId:G.id,healthResultId:z.result.id,target:q}}}),...Ol({store:a.store,resolveDriver:e.releaseDriver??((m)=>({name:`${a.store.getResource(m.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:m.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(m,q)=>{let G=ne.listHealthChecks(q.projectId,q.environmentId).find((te)=>te.enabled&&te.name===m&&(!te.resourceId||te.resourceId===q.resourceId));if(!G)return{healthy:!1,message:`Named health gate ${m} was not found for this release.`};let z=await new Ei(ne).runAndEvaluate(G);return{healthy:z.result.status==="healthy",evidence:{healthCheckId:G.id,healthResultId:z.result.id,status:z.result.status,timings:z.result.timings},message:z.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(m)=>console.error("ts-cloud deployment queue worker failed:",m)}):void 0;if(Af(a),Ws(ce,Kt(a,String(f)),b),Be)Ks(a,Be.users),sh(U,a,Be.users);let Oe=ih({cwd:t,enabled:W,secret:ke,authentication:U,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(f)}}),ze=new Zd,nl=setInterval(()=>ze.sweep(),60000);nl.unref?.();let yo=new io,Ta=new io(3,900000,900000),bo=new io(8,900000,900000),il=setInterval(()=>yo.prune(),300000),ol=setInterval(()=>Ta.prune(),300000),sl=setInterval(()=>bo.prune(),300000);if(il.unref?.(),ol.unref?.(),sl.unref?.(),W){if(Be?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${Be.generated.username}
     password: ${Be.generated.password}
@@ -497,7 +497,7 @@ This link expires ${w.invitation.expiresAt} and can be used once.`});return g({i
 
 This replacement link expires ${h.invitation.expiresAt} and can be used once.`});return g({invitation:h.invitation,token:h.token,acceptUrl:S,delivered:w})}catch(h){return g({ok:!1,error:h instanceof Error?h.message:"Invitation could not be resent."},409)}}if(v.pathname==="/api/organization/memberships"&&m.method==="PATCH"){let d=await D(m),l=a.store.getMembership(String(d.id??"")),h=ha(d.roleTemplate),S=lo(d);if(!l||l.organizationId!==a.organization.id)return g({ok:!1,error:"Membership was not found."},404);if(!h||!S)return g({ok:!1,error:"Choose a valid role template and resource scope."},422);let w=Q(O);if((l.roleTemplate==="owner"||h==="owner")&&(!Qt(String(d.password??""),O.passwordHash)||w.membership?.roleTemplate!=="owner"))return g({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let I=a.store.resolveAuthorizationTarget(a.organization.id,S)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),k=a.store.listGrants(l.id),M=po({membership:l,grants:k,target:I}),_={...l,roleTemplate:h,scope:S},re=po({membership:_,grants:k,target:I}),B={gained:re.filter((Y)=>!M.includes(Y)),lost:M.filter((Y)=>!re.includes(Y))};if(d.preview===!0)return g({membership:l,proposed:{roleTemplate:h,scope:S},accessDiff:B});if(String(d.confirm??"")!==l.id)return g({ok:!1,error:`Confirm this change with membership ID ${l.id}.`,accessDiff:B},409);try{return g({membership:a.store.updateMembership({id:l.id,roleTemplate:h,scope:S,actorId:w.actor?.id}),accessDiff:B})}catch(Y){return g({ok:!1,error:Y instanceof Error?Y.message:"Membership could not be updated."},409)}}if(v.pathname==="/api/organization/memberships"&&m.method==="DELETE"){let d=await D(m),l=a.store.getMembership(String(d.id??""));if(!l||l.organizationId!==a.organization.id)return g({ok:!1,error:"Membership was not found."},404);if(String(d.confirm??"")!==l.id)return g({ok:!1,error:`Confirm removal with membership ID ${l.id}.`},409);let h=Q(O);if(l.roleTemplate==="owner"&&(h.membership?.roleTemplate!=="owner"||!Qt(String(d.password??""),O.passwordHash)))return g({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return g({membership:a.store.revokeMembership(l.id,h.actor?.id)})}catch(S){return g({ok:!1,error:S instanceof Error?S.message:"Membership could not be removed."},409)}}if(v.pathname==="/api/organization/grants"&&m.method==="POST"){let d=await D(m),l=String(d.capability??""),h=d.effect==="deny"?"deny":d.effect==="allow"?"allow":void 0,S=lo(d),w=Q(O);if(!h||!S||!Bo.includes(l))return g({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return g({grant:a.store.upsertGrant({organizationId:a.organization.id,membershipId:String(d.membershipId??""),effect:h,capability:l,scope:S,actorId:w.actor?.id})},201)}catch(A){return g({ok:!1,error:A instanceof Error?A.message:"Grant could not be created."},422)}}if(v.pathname==="/api/organization/grants"&&m.method==="DELETE"){let d=await D(m),l=Q(O),h=a.store.getGrant(String(d.id??""));if(!h||h.organizationId!==a.organization.id)return g({ok:!1,error:"Grant was not found."},404);return g({ok:a.store.removeGrant(h.id,l.actor?.id)})}if(v.pathname==="/api/tags"&&m.method==="GET")return g({tags:a.store.listTags(a.project.id),assignments:a.store.listResourceTags(a.project.id)});if(v.pathname==="/api/tags"&&m.method==="POST"){let d=await D(m),l=a.store.upsertTag(a.project.id,String(d.name??""),String(d.color??"#5a8be0"));if(d.resourceId)a.store.assignTag(String(d.resourceId),l.id);return g({tag:l},201)}if(v.pathname==="/api/tags"&&m.method==="DELETE"){let d=await D(m);return a.store.removeTag(String(d.resourceId??""),String(d.tagId??"")),g({ok:!0})}if(v.pathname==="/"&&!Ey(v.pathname,Ot))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(L)}`}});if(v.pathname==="/"&&Pe?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(L)}`}});let wo=Sh(v.pathname);if(wo)return new Response(null,{status:308,headers:{location:`${wo}?env=${encodeURIComponent(L)}`}});if(v.pathname==="/api/env"&&m.method==="POST"){let d=await D(m),l=String(d.env??"");if(!p.includes(l))return g({ok:!1,error:`Unknown environment '${l}'.`,environments:p},404);return g({ok:!0,environment:l,environments:p,href:`?env=${encodeURIComponent(l)}`})}if(v.pathname==="/api/config"){let d={...GT(o),environment:L,environments:p};return g(wh(d,Ot))}if(v.pathname==="/api/ssh-keys"&&m.method==="GET")return g({configPath:y,keys:go(Ai(o))});if(v.pathname==="/api/ssh-keys"&&m.method==="POST"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=await ur(y,"utf8"),h=Ai(o),S=eb({configText:l,name:String(d.name??""),publicKey:String(d.publicKey??""),existingKeys:h});return await Nn(y,S),vy(o,[...h,{name:String(d.name??"").trim(),publicKey:String(d.publicKey??"").trim().replace(/\s+/g," ")}]),g({ok:!0,configPath:y,keys:go(Ai(o))})}if(v.pathname==="/api/ssh-keys"&&m.method==="DELETE"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=String(d.name??v.searchParams.get("name")??""),h=await ur(y,"utf8"),S=Ai(o),w=tb({configText:h,name:l,existingKeys:S});return await Nn(y,w),vy(o,S.filter((A)=>A.name!==l.trim())),g({ok:!0,configPath:y,keys:go(Ai(o))})}if(v.pathname==="/api/firewall"&&m.method==="GET")return g({configPath:y,alwaysOpen:[22,80,443],ports:Uu(o)});if(v.pathname==="/api/firewall"&&m.method==="POST"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=Number(d.port);if(!oo(l))return g({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let h=Uu(o),S=await ur(y,"utf8");try{await Nn(y,Rh(S,l,h))}catch(I){return g({ok:!1,error:I?.message??String(I)},422)}let w=_n([...h,l]);wy(o,w);let A=d.apply===!1?null:await no(o,L,`ufw allow ${l}/tcp`).catch((I)=>({ok:!1,error:String(I?.message??I)}));return g({ok:!0,configPath:y,ports:w,apply:A})}if(v.pathname==="/api/firewall"&&m.method==="DELETE"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=Number(d.port??v.searchParams.get("port"));if(!oo(l))return g({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let h=Uu(o),S=await ur(y,"utf8");await Nn(y,Ph(S,l,h));let w=_n(h.filter((I)=>I!==l));wy(o,w);let A=d.apply===!1?null:await no(o,L,`ufw delete allow ${l}/tcp`).catch((I)=>({ok:!1,error:String(I?.message??I)}));return g({ok:!0,configPath:y,ports:w,apply:A})}if(v.pathname==="/api/sites"&&m.method==="POST"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=String(d.name??"").trim(),h=String(d.root??"").trim();if(!l||!h)return g({ok:!1,error:"Site name and root are required."},422);let S={deploy:d.deploy==="bucket"?"bucket":"server",root:h,path:String(d.path??"").trim()||void 0,domain:String(d.domain??"").trim()||void 0,build:String(d.build??"").trim()||void 0,start:String(d.start??"").trim()||void 0,port:d.port?Number(d.port):void 0,type:String(d.type??"").trim()||void 0};if(S.port!==void 0&&(!Number.isInteger(S.port)||S.port<1||S.port>65535))return g({ok:!1,error:"Port must be a number between 1 and 65535."},422);let w=await ur(y,"utf8"),A=Yh({configText:w,name:l,root:S.root,domain:S.domain,path:S.path,deploy:S.deploy,build:S.build,start:S.start,port:S.port,type:S.type});return await Nn(y,A),FT(o,l,Object.fromEntries(Object.entries(S).filter(([,I])=>I!==void 0))),Pe=await $n(o,L),C.set(L,Pe),g({ok:!0,configPath:y,site:l,data:Pe})}if(v.pathname==="/api/sites"&&m.method==="DELETE"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=String(d.name??v.searchParams.get("name")??"").trim();if(!l||!o.sites?.[l])return g({ok:!1,error:`Site '${l}' was not found.`},404);let h=await ur(y,"utf8");return await Nn(y,Xh({configText:h,name:l})),delete o.sites[l],Pe=await $n(o,L),C.set(L,Pe),g({ok:!0,configPath:y,site:l,data:Pe})}if(v.pathname==="/api/sites"&&m.method==="PATCH"){if(!y)return g({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await D(m),l=String(d.name??"").trim(),h=o.sites?.[l];if(!l||!h)return g({ok:!1,error:`Site '${l}' was not found.`},404);if(Ot.role==="member"){let A=Eh(d);if(!A.ok)return g({ok:!1,error:A.error},403);let I=Th({siteName:l,body:d,sites:o.sites??{},ownSites:Object.keys(Ot.sites)});if(!I.ok)return g({ok:!1,error:I.error},409)}if(d.port!==void 0&&d.port!==null&&d.port!==""&&(!Number.isInteger(Number(d.port))||Number(d.port)<1||Number(d.port)>65535))return g({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof d.domain==="string"&&d.domain.trim()&&!Lu(d.domain.trim()))return g({ok:!1,error:`Domain '${d.domain.trim()}' is not a valid hostname.`},422);let S=await ur(y,"utf8"),w=(A,I)=>{S=Zh({configText:S,siteName:l,key:A,valueText:I})};if(d.ssl!==void 0)w("ssl",ey(d.ssl)),h.ssl=d.ssl;if(d.env!==void 0&&d.env&&typeof d.env==="object")w("env",ry(d.env)),h.env=d.env;if(d.aliases!==void 0&&Array.isArray(d.aliases)){let A=d.aliases.map((I)=>String(I));w("aliases",ny(A)),h.aliases=A.map((I)=>I.trim().toLowerCase()).filter(Boolean)}if(d.redirects!==void 0&&d.redirects&&typeof d.redirects==="object")w("redirects",iy(d.redirects)),h.redirects=d.redirects;for(let A of["domain","path","build","start","type","root","php"])if(typeof d[A]==="string"&&d[A].trim())w(A,ty(String(d[A]).trim())),h[A]=String(d[A]).trim();if(d.port!==void 0&&d.port!==null&&d.port!=="")w("port",String(Number(d.port))),h.port=Number(d.port);return await Nn(y,S),Pe=await $n(o,L),C.set(L,Pe),g({ok:!0,configPath:y,site:l,data:Pe})}if(v.pathname==="/api/sites/deploy"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim();if(!l||!o.sites?.[l])return g({ok:!1,error:`Site '${l}' was not found.`},404);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to deploy this site.`},409);let h=Kt(a,String(L));await new Pn(ce).run(new Zi,{...h,artifactRoot:t}),Ws(ce,h,Pe??{});let S=Gs(ce,{scope:h,desiredConfigHash:a.project.desiredConfigHash});if(S.decision.outcome==="block")return g({ok:!1,error:`Deployment blocked by security policy: ${S.decision.explanation}`,securityReview:S},409);let w={id:`deploy:${l}`,label:`Deploy ${l}`,description:`Deploy the ${l} site for ${L}.`,command:["deploy","--env",L,"--site",l,"--yes"],mutates:!0},A=await Dr({controlPlane:a,environment:L,actor:O,kind:"dashboard.site.deploy",resourceSlug:l,input:{site:l},execute:()=>zu(w,{cwd:t,cliEntry:i})});return g({...A.result,controlPlaneOperation:A.operation,securityReview:S})}if(v.pathname==="/api/actions")return g(ob(L));if(v.pathname==="/api/server/operations")return g(ca(o,Pe));if(v.pathname==="/api/runtime/workloads"&&m.method==="GET"){let d=await Wt(o,L);return g(d)}if(v.pathname==="/api/runtime/logs"&&m.method==="GET"){let d=String(v.searchParams.get("workload")??"");if(!d)return g({ok:!1,error:"A workload query parameter is required."},422);let l=Math.min(1000,Math.max(1,Number(v.searchParams.get("limit"))||200));try{return g(await new cr(o,L).logs(d,{limit:l}))}catch(h){return g({ok:!1,error:String(h?.message??h)},404)}}if(v.pathname==="/api/runtime/log-sessions"&&m.method==="POST"){let d=await D(m),l=String(d.workloadId??"");if(!l)return g({ok:!1,error:"A workloadId is required."},422);let h=await Wt(o,L),S=h.workloads.find((I)=>I.id===l);if(!S)return g({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!S.capabilities.logs.supported)return g({ok:!1,error:S.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let w=new cr(o,L,{inventory:async()=>h}),A=ze.create("logs",l);return(async()=>{let I=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(d.sinceMs)||60000)));try{for(let k=0;k<200&&!ze.signal(A.id)?.aborted;k++){let M=await w.logs(l,{limit:Math.min(500,Math.max(1,Number(d.limit)||200)),since:I});for(let _ of M.lines)if(ze.append(A.id,`${_.timestamp?`${_.timestamp} `:""}${_.message}
 `),_.timestamp)I=new Date(Math.max(I.getTime(),new Date(_.timestamp).getTime()+1));await Bun.sleep(3000)}if(!ze.signal(A.id)?.aborted)ze.close(A.id,"complete")}catch(k){ze.append(A.id,k instanceof Error?k.message:String(k),"stderr"),ze.close(A.id,"failed",k instanceof Error?k.message:String(k))}})(),g({ok:!0,session:A,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(A.id)}&workload=${encodeURIComponent(l)}`},201)}if((v.pathname==="/api/runtime/log-stream"||v.pathname==="/api/runtime/exec-stream")&&m.method==="GET"){let d=String(v.searchParams.get("id")??""),l=String(v.searchParams.get("workload")??""),h=Number(m.headers.get("last-event-id")??v.searchParams.get("after")??0)||0,S=ze.read(d,l,h),w=v.pathname.includes("exec")?"exec":"logs";if(!S||S.kind!==w)return g({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return DT(ze,S,h,m.signal)}if((v.pathname==="/api/runtime/log-sessions"||v.pathname==="/api/runtime/exec-sessions")&&m.method==="DELETE"){let d=await D(m),l=ze.cancel(String(d.id??""),String(d.workloadId??""));if(!l)return g({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return g({ok:!0,session:l})}if(v.pathname==="/api/runtime/exec-sessions"&&m.method==="POST"){let d=await D(m),l=String(d.workloadId??""),h=await Wt(o,L),S=h.workloads.find((k)=>k.id===l);if(!S)return g({ok:!1,error:"Workload was not found in the current project and environment."},404);let w=Oe.resolveSession(m),A=new cr(o,L,{inventory:async()=>h}),I=ze.create("exec",l);return Dr({controlPlane:a,environment:L,actor:O,kind:"runtime.exec",resourceSlug:S.links.service,input:{workloadId:l,provider:S.provider,preset:d.preset?String(d.preset):null,freeForm:!!String(d.command??"").trim()},execute:()=>A.exec({workloadId:l,preset:["process","sockets","filesystem"].includes(String(d.preset))?String(d.preset):void 0,command:typeof d.command==="string"?d.command:void 0,confirm:String(d.confirm??""),recentAuth:!W||!!w&&U.isRecentlyAuthenticated(w)})}).then(({result:k,operation:M})=>{if(ze.append(I.id,`operation ${M.id}
-`,"system"),k.stdout)ze.append(I.id,k.stdout,"stdout");if(k.stderr)ze.append(I.id,k.stderr,"stderr");ze.close(I.id,k.ok?"complete":"failed",k.error)}).catch((k)=>{let M=k instanceof Error?k.message:String(k);ze.append(I.id,M,"stderr"),ze.close(I.id,"failed",M)}),g({ok:!0,session:I,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(I.id)}&workload=${encodeURIComponent(l)}`},202)}if(v.pathname==="/api/runtime/files/read"&&m.method==="POST"){let d=await D(m),l=await Wt(o,L),h=Oe.resolveSession(m),S=await new cr(o,L,{inventory:async()=>l}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!W||!!h&&U.isRecentlyAuthenticated(h)});return g(S,S.ok?200:409)}if(v.pathname==="/api/runtime/files/write"&&m.method==="POST"){let d=await D(m),l=await Wt(o,L),h=String(d.workloadId??""),S=l.workloads.find((k)=>k.id===h);if(!S)return g({ok:!1,error:"Workload was not found in the current project and environment."},404);let w=Oe.resolveSession(m),A=new cr(o,L,{inventory:async()=>l}),I=await Dr({controlPlane:a,environment:L,actor:O,kind:"runtime.file.write",resourceSlug:S.links.service,input:{workloadId:h,provider:S.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>A.writeFile({workloadId:h,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!W||!!w&&U.isRecentlyAuthenticated(w)})});return g({...I.result,controlPlaneOperation:I.operation},I.result.ok?200:409)}if(v.pathname==="/api/runtime/operations"&&m.method==="POST"){let d=await D(m),l=String(d.workloadId??""),h=String(d.action??"");if(!l||!["start","stop","restart","redeploy","scale","inspect"].includes(h))return g({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let S=await Wt(o,L),w=S.workloads.find((M)=>M.id===l);if(!w)return g({ok:!1,error:"Workload was not found in the current project and environment."},404);let A=Oe.resolveSession(m),I=new cr(o,L,{inventory:async()=>S}),k=await Dr({controlPlane:a,environment:L,actor:O,kind:`runtime.${h}`,resourceSlug:w.links.service,input:{workloadId:l,provider:w.provider,action:h,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>I.run({workloadId:l,action:h,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!W||!!A&&U.isRecentlyAuthenticated(A)})});return g({...k.result,controlPlaneOperation:k.operation},k.result.ok?200:409)}if(v.pathname.startsWith("/api/protection")){let d=O.role==="admin"||vo(O,"security:read"),l=O.role==="admin"||vo(O,"security:manage");if(!d)return g({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:h,describePosture:S}=await import("./chunk-35xstvnq.js"),w=new h(a.store),A=()=>{if(!l)throw Error("Changing protection controls requires security:manage.")};if(v.pathname==="/api/protection"&&m.method==="GET"){let I=w.current();return g({ok:!0,posture:S(I),controls:I,raw:w.raw()})}if(v.pathname==="/api/protection/attack-mode"&&m.method==="POST"){A();let I=await D(m);if(I.enabled===!1)return g({ok:!0,disabled:w.disableAttackMode()});return g({ok:!0,control:w.enableAttackMode({hours:I.hours==null?void 0:Number(I.hours),reason:String(I.reason??"Enabled from the dashboard."),actorId:Q(O).actor?.id})})}if(v.pathname==="/api/protection/pause"&&m.method==="POST"){A();let I=await D(m);if(I.enabled===!1)return g({ok:!0,resumed:w.resumeMitigations()});return g({ok:!0,control:w.pauseMitigations({hours:I.hours==null?void 0:Number(I.hours),reason:String(I.reason??""),actorId:Q(O).actor?.id})})}if(v.pathname==="/api/protection/ip-rules"&&m.method==="GET")return g({ok:!0,ipRules:w.current().ipRules});if(v.pathname==="/api/protection/ip-rules"&&(m.method==="POST"||m.method==="DELETE")){A();let I=await D(m),k=I.list==="allow"?"allow":"block",M=m.method==="POST"?w.addIpRule(k,String(I.cidr??"")):w.removeIpRule(k,String(I.cidr??""));return g({ok:!0,ipRules:M})}return g({ok:!1,error:"Protection endpoint was not found."},404)}if(v.pathname.startsWith("/api/spend/")||v.pathname==="/api/usage"){let d=await ub(),l=d.store,h=d.service,S=d.gate,w=O.role==="admin"||vo(O,"billing:read"),A=O.role==="admin"||vo(O,"billing:manage");if(!w)return g({ok:!1,error:"Spend data requires the billing:read capability."},403);let I=a.environments.get(L),k={organizationId:a.organization.id,projectId:a.project.id,environmentId:I?.id},M=()=>{if(!A)throw Error("Changing a budget requires the billing:manage capability.")};if(v.pathname==="/api/usage"&&m.method==="GET")return g({ok:!0,...h.usageReport({organizationId:k.organizationId,projectId:k.projectId,period:v.searchParams.get("period")??"monthly",timezone:v.searchParams.get("timezone")??void 0})});if(v.pathname==="/api/spend/budgets"&&m.method==="GET")return g({ok:!0,budgets:l.listBudgets({organizationId:k.organizationId,projectId:k.projectId}).map((_)=>({..._,status:h.status(_)}))});if(v.pathname==="/api/spend/budgets"&&m.method==="POST"){M();let _=await D(m),re=String(_.scope??"project"),B=l.createBudget({organizationId:k.organizationId,projectId:re==="organization"?void 0:k.projectId,environmentId:re==="environment"?k.environmentId:void 0,name:String(_.name??"").trim(),period:_.period??"monthly",timezone:_.timezone?String(_.timezone):void 0,softLimitCents:_.softLimitCents==null?void 0:Math.round(Number(_.softLimitCents)),hardLimitCents:_.hardLimitCents==null?void 0:Math.round(Number(_.hardLimitCents)),graceSeconds:_.graceSeconds==null?void 0:Number(_.graceSeconds),dryRun:_.dryRun!==!1});return g({ok:!0,budget:B})}if(v.pathname==="/api/spend/budgets"&&m.method==="PATCH"){M();let _=await D(m),re=String(_.id??""),B=l.getBudget(re);if(!B||B.organizationId!==k.organizationId)return g({ok:!1,error:"Budget was not found."},404);return g({ok:!0,budget:l.updateBudget(re,{softLimitCents:_.softLimitCents==null?B.softLimitCents:Math.round(Number(_.softLimitCents)),hardLimitCents:_.hardLimitCents==null?B.hardLimitCents:Math.round(Number(_.hardLimitCents)),enabled:_.enabled==null?B.enabled:_.enabled===!0,dryRun:_.dryRun==null?B.dryRun:_.dryRun===!0},_.expectedVersion==null?void 0:Number(_.expectedVersion))})}if(v.pathname==="/api/spend/budgets"&&m.method==="DELETE"){M();let _=await D(m),re=String(_.id??""),B=l.getBudget(re);if(!B||B.organizationId!==k.organizationId)return g({ok:!1,error:"Budget was not found."},404);let Y=S.closeBudget(re);return l.deleteBudget(re),g({ok:!0,deleted:!0,lifted:Y})}if(v.pathname==="/api/spend/check"&&m.method==="POST"){M();let _=await D(m),{SpendRunner:re}=await import("./chunk-a2t1e5yb.js"),B=new re({controlPlane:a.store,store:l,alerts:ne});if(_.apply!==!0){let F=l.budgetsForScope(k.organizationId,k.projectId,k.environmentId);return g({ok:!0,applied:!1,preview:F.map((J)=>h.status(J))})}let Y=await B.run({...k,environmentKind:I?.kind});return g({ok:!0,applied:!0,result:Y})}if(v.pathname==="/api/spend/enforcement"&&m.method==="GET")return g({ok:!0,enforcement:S.listUnder({organizationId:k.organizationId})});if(v.pathname==="/api/spend/release"&&m.method==="POST"){M();let _=await D(m),re=S.close(String(_.budgetId??""),_.action);return g({ok:re,released:re,note:re?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(v.pathname==="/api/spend/anomalies"&&m.method==="GET")return g({ok:!0,anomalies:l.listAnomalies({organizationId:k.organizationId,projectId:k.projectId,unacknowledgedOnly:v.searchParams.get("unacknowledged")==="true"})});if(v.pathname==="/api/spend/anomalies/acknowledge"&&m.method==="POST"){M();let _=await D(m);return g({ok:!0,acknowledged:l.acknowledgeAnomaly(String(_.id??""))})}return g({ok:!1,error:"Spend endpoint was not found."},404)}if(v.pathname.startsWith("/api/health/")||v.pathname.startsWith("/api/alerts")||v.pathname.startsWith("/api/notifications/")){let d=a.environments.get(L),l=a.store.listResources(a.project.id,d?.id),h=O.role==="admin"||!!d&&Ri(O,d.id,"runtime:read")?l:l.filter((I)=>Ye(O,I.id,"runtime:read")),S=(I)=>!I||h.some((k)=>k.id===I),w=(I)=>{if(!I)return;let k=l.find((M)=>M.id===I||M.slug===I);if(!k)throw Error("Alert resource was not found.");if(!S(k.id))throw Error("Alert resource is outside your authorized scope.");return k.id},A=Q(O).actor;if(v.pathname==="/api/health/checks"&&m.method==="GET")return g({ok:!0,checks:ne.listHealthChecks(a.project.id,d?.id).filter((I)=>S(I.resourceId)).map((I)=>({...I,results:ne.listHealthResults(I.id,20)}))});if(v.pathname==="/api/health/checks"&&m.method==="POST"){let I=await D(m),k=String(I.kind??"http");if(k==="command"&&O.role!=="admin")return g({ok:!1,error:"Command health checks require an administrator."},403);let M={method:String(I.config?.method??"GET").toUpperCase().slice(0,10),path:I.config?.path?String(I.config.path).slice(0,500):void 0,port:I.config?.port==null?void 0:Number(I.config.port),command:Array.isArray(I.config?.command)?I.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(I.config?.expectedStatuses)?I.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:I.config?.expectedBody?String(I.config.expectedBody).slice(0,500):void 0};return g({ok:!0,check:ne.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource),name:String(I.name??""),kind:k,target:String(I.target??""),config:M,intervalSeconds:Number(I.intervalSeconds)||60,timeoutSeconds:Number(I.timeoutSeconds)||10,failureThreshold:Number(I.failureThreshold)||3,recoveryThreshold:Number(I.recoveryThreshold)||2,regions:Array.isArray(I.regions)?I.regions.map(String):["local"],enabled:I.enabled!==!1})},201)}if(v.pathname==="/api/health/checks"&&m.method==="PATCH"){let I=await D(m),k=ne.getHealthCheck(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Health check was not found."},404);return g({ok:!0,check:ne.setHealthCheckEnabled(k.id,I.enabled!==!1)})}if(v.pathname==="/api/health/checks/test"&&m.method==="POST"){let I=await D(m),k=ne.getHealthCheck(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Health check was not found."},404);return g({ok:!0,productionIncidentCreated:!1,result:await new Ei(ne).probe(k)})}if(v.pathname==="/api/health/checks/run"&&m.method==="POST"){let I=await D(m),k=ne.getHealthCheck(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Health check was not found."},404);let M=await new Ei(ne).runAndEvaluate(k),_=[];for(let re of M.evaluations.filter((B)=>B.notify&&B.alert)){let B=Dt.enqueue(a.organization.id,re.alert,re.transition);_.push(...await Dt.deliverAll(B))}return g({ok:!0,...M,deliveries:_})}if(v.pathname==="/api/alerts/rules"&&m.method==="GET")return g({ok:!0,rules:ne.listRules(a.project.id,d?.id).filter((I)=>S(I.resourceId))});if(v.pathname==="/api/alerts/rules"&&m.method==="POST"){let I=await D(m),k=I.healthCheckId?ne.getHealthCheck(String(I.healthCheckId)):void 0;if(I.healthCheckId&&(!k||!S(k.resourceId)))return g({ok:!1,error:"Health check was not found."},404);return g({ok:!0,rule:ne.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource)??k?.resourceId,healthCheckId:k?.id,name:String(I.name??""),signal:String(I.signal??(k?"health":"")),operator:String(I.operator??(k?"unhealthy":"gt")),threshold:I.threshold==null?void 0:Number(I.threshold),recoveryThreshold:I.recoveryThreshold==null?void 0:Number(I.recoveryThreshold),windowMs:Number(I.windowMs)||300000,consecutive:Number(I.consecutive)||k?.failureThreshold||3,recoveryConsecutive:Number(I.recoveryConsecutive)||k?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(I.noDataPolicy))?I.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(I.severity))?I.severity:"warning",groupBy:Array.isArray(I.groupBy)?I.groupBy.map(String):[],labels:I.labels&&typeof I.labels==="object"?I.labels:{},enabled:I.enabled!==!1})},201)}if(v.pathname==="/api/alerts/rules"&&m.method==="PATCH"){let I=await D(m),k=ne.getRule(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Alert rule was not found."},404);return g({ok:!0,rule:ne.setRuleEnabled(k.id,I.enabled!==!1)})}if(v.pathname==="/api/alerts/evaluate"&&m.method==="POST")return g({ok:!0,...await Yu(d?.id)});if(v.pathname==="/api/alerts"&&m.method==="GET")return g({ok:!0,alerts:ne.listAlerts(a.project.id,{environmentId:d?.id,states:v.searchParams.getAll("state").length?v.searchParams.getAll("state"):void 0,limit:Number(v.searchParams.get("limit"))||200}).filter((I)=>S(I.resourceId)).map((I)=>({...I,deliveries:ne.listDeliveries({alertId:I.id,limit:50})}))});if(v.pathname==="/api/alerts/action"&&m.method==="POST"){let I=await D(m),k=ne.getAlert(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Alert was not found."},404);let M=String(I.action??"");if(M==="acknowledge")return g({ok:!0,alert:ne.acknowledge(k.id,A?.id??"")});if(M==="assign")return g({ok:!0,alert:ne.assign(k.id,I.ownerActorId==="me"?A?.id:I.ownerActorId?String(I.ownerActorId):void 0,A?.id)});if(M==="silence"){if(O.role!=="admin")return g({ok:!1,error:"Silencing production alerts requires an administrator."},403);let _=Oe.resolveSession(m);if(W&&(!_||!U.isRecentlyAuthenticated(_)))return g({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return g({ok:!0,alert:ne.silenceAlert(k.id,String(I.until??""),A?.id)})}return g({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(v.pathname==="/api/alerts/silences"&&m.method==="POST"){let I=await D(m);return g({ok:!0,id:ne.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource),matcher:I.matcher,reason:String(I.reason??""),startsAt:String(I.startsAt??new Date().toISOString()),endsAt:String(I.endsAt??""),timezone:String(I.timezone??"UTC"),actorId:A?.id})},201)}if(v.pathname==="/api/notifications/channels"&&m.method==="GET")return g({ok:!0,channels:ne.listChannels(a.organization.id)});if(v.pathname==="/api/notifications/channels"&&m.method==="POST"){let I=await D(m),k=String(I.kind??""),M=k==="email"?{to:I.config?.to,from:I.config?.from}:k==="telegram"?{chatId:String(I.config?.chatId??"")}:{};return g({ok:!0,channel:ne.createChannel({organizationId:a.organization.id,name:String(I.name??""),kind:k,config:M,credential:I.credential?String(I.credential):void 0,actorId:A?.id})},201)}if(v.pathname==="/api/notifications/channels"&&m.method==="PATCH"){let I=await D(m),k=String(I.id??"");if(I.credential)return g({ok:!0,channel:ne.rotateChannel(k,String(I.credential))});let M=String(I.status??"paused");if(!["active","paused","disabled"].includes(M))return g({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return g({ok:!0,channel:ne.setChannelStatus(k,M)})}if(v.pathname==="/api/notifications/channels/test"&&m.method==="POST"){let I=await D(m);return g({ok:!0,productionIncidentCreated:!1,result:await Dt.testChannel(String(I.id??""))})}if(v.pathname==="/api/notifications/routes"&&m.method==="GET")return g({ok:!0,routes:ne.listRoutes(a.organization.id)});if(v.pathname==="/api/notifications/routes"&&m.method==="POST"){let I=await D(m),k=Array.isArray(I.channelIds)?I.channelIds.map(String):[];if(k.some((M)=>ne.getChannel(M)?.organizationId!==a.organization.id))return g({ok:!1,error:"Route contains an unavailable channel."},422);return g({ok:!0,route:ne.createRoute({organizationId:a.organization.id,name:String(I.name??""),priority:Number(I.priority)||0,matcher:I.matcher&&typeof I.matcher==="object"?I.matcher:{},channelIds:k,quietHours:I.quietHours,groupWaitSeconds:Number(I.groupWaitSeconds)||30,reminderSeconds:I.reminderSeconds==null?void 0:Number(I.reminderSeconds),escalation:Array.isArray(I.escalation)?I.escalation:[],template:I.template?String(I.template):void 0,rateLimitPerMinute:Number(I.rateLimitPerMinute)||60,enabled:I.enabled!==!1})},201)}if(v.pathname==="/api/notifications/routes"&&m.method==="PATCH"){let I=await D(m),k=ne.getRoute(String(I.id??""));if(!k||k.organizationId!==a.organization.id)return g({ok:!1,error:"Notification route was not found."},404);return g({ok:!0,route:ne.setRouteEnabled(k.id,I.enabled!==!1)})}if(v.pathname==="/api/notifications/routes/preview"&&m.method==="POST"){let I=await D(m),M=(I.alertId?ne.getAlert(String(I.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource),dedupKey:"preview",groupKey:String(I.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(I.severity))?I.severity:"warning",title:String(I.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return g({ok:!0,productionIncidentCreated:!1,matches:Dt.preview(a.organization.id,M,String(I.eventType??"firing")).map((_)=>({route:_.route,channels:_.channels,quiet:_.quiet}))})}if(v.pathname==="/api/notifications/deliveries"&&m.method==="GET")return g({ok:!0,deliveries:ne.listDeliveries({alertId:v.searchParams.get("alertId")??void 0,states:v.searchParams.getAll("state"),limit:Number(v.searchParams.get("limit"))||200})});if(v.pathname==="/api/notifications/deliveries/retry"&&m.method==="POST"){let I=await D(m),k=ne.getDelivery(String(I.id??""));if(!k)return g({ok:!1,error:"Delivery was not found."},404);return ne.updateDelivery(k.id,{state:"retrying",attempt:Math.max(0,k.attempt-1),nextAttemptAt:new Date().toISOString()}),g({ok:!0,delivery:await Dt.deliver(k.id)})}}if(v.pathname.startsWith("/api/jobs")||v.pathname.startsWith("/api/workers")){let d=a.environments.get(L),l=a.store.listResources(a.project.id,d?.id),S=O.role==="admin"||!!d&&Ri(O,d.id,"automation:read")?l:l.filter((F)=>Ye(O,F.id,"automation:read")),w=(F)=>!F||S.some((J)=>J.id===F),A=Q(O).actor,I=C.get(L)??b,k=ca(o,I),M=k.filter((F)=>!F.danger&&["scheduler","backup","worker"].includes(F.group)),_=Pr(o),re=()=>{let F=Oe.resolveSession(m);return!W||!!F&&U.isRecentlyAuthenticated(F)},B=(F)=>{if(!F||typeof F!=="object"||Array.isArray(F))return{};let J=Object.entries(F).slice(0,50);if(J.some(([,se])=>typeof se!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(se)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(J)},Y=(F,J,se)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:se,actorId:A?.id,type:`job.${F}`,payload:J});if(v.pathname==="/api/jobs/preview"&&m.method==="POST"){let F=await D(m);try{return g({ok:!0,productionExecutionCreated:!1,preview:yn(String(F.expression??""),String(F.timezone??"UTC"),new Date(F.from?String(F.from):Date.now()),Number(F.count)||5)})}catch(J){return g({ok:!1,error:J instanceof Error?J.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(v.pathname==="/api/jobs"&&m.method==="GET")return g({ok:!0,jobs:Qe.list(a.project.id,{environmentId:d?.id}).filter((F)=>w(F.resourceId)).map((F)=>({...F,preview:yn(F.normalizedExpression,F.timezone,new Date,5),capability:uc(F),lastExecution:Qe.listExecutions(F.id,1)[0]}))});if(v.pathname==="/api/jobs"&&m.method==="POST"){let F=await D(m),J=String(F.provider??(_==="serverless"?"eventbridge":"server")),se=_==="serverless"?"eventbridge":"server";if(J!==se)return g({ok:!1,error:`${_} environments accept ${se} schedules through this adapter.`},422);let le=F.operationId?String(F.operationId):void 0;if(J==="server"&&(!le||!M.some((Ve)=>Ve.id===le)))return g({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let ve=uc({provider:J,expression:String(F.expression??""),flexibleMinutes:Number(F.flexibleMinutes)||0,missedRunPolicy:F.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(F.overlapPolicy))?F.overlapPolicy:"forbid"});if(!ve.supported)return g({ok:!1,error:ve.notes.join(" ")},422);let Tt=F.resourceId?l.find((Ve)=>Ve.id===F.resourceId||Ve.slug===F.resourceId):void 0;if(F.resourceId&&(!Tt||!w(Tt.id)))return g({ok:!1,error:"Job resource was not found."},404);try{let Ve=J==="server"?{kind:"dashboard_operation",operationId:le}:{kind:"serverless_scheduler",action:"run"},Fr=Qe.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:Tt?.id,name:String(F.name??""),provider:J,expression:String(F.expression??""),timezone:String(F.timezone??"UTC"),startsAt:F.startsAt?String(F.startsAt):void 0,endsAt:F.endsAt?String(F.endsAt):void 0,flexibleMinutes:Number(F.flexibleMinutes)||0,target:Ve,payloadRefs:B(F.payloadRefs),missedRunPolicy:F.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(F.overlapPolicy))?F.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(F.maxAttempts)||3,backoffSeconds:Number(F.backoffSeconds)||30,deadLetterRef:F.deadLetterRef?String(F.deadLetterRef):void 0},timeoutSeconds:Number(F.timeoutSeconds)||900,enabled:F.enabled!==!1,origin:"managed",ownerActorId:A?.id,observedState:{},reconciliationStatus:"pending"});return Y("created",{jobId:Fr.id,provider:Fr.provider,expression:Fr.normalizedExpression},Fr.resourceId),g({ok:!0,job:Fr,capability:ve},201)}catch(Ve){return g({ok:!1,error:Ve instanceof Error?Ve.message:"Scheduled job could not be created."},422)}}if(v.pathname==="/api/jobs"&&m.method==="PATCH"){let F=await D(m),J=Qe.get(String(F.id??""));if(!J||!w(J.resourceId))return g({ok:!1,error:"Scheduled job was not found."},404);if(J.origin==="config")return g({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let se=F.missedRunPolicy==null?void 0:String(F.missedRunPolicy),le=F.overlapPolicy==null?void 0:String(F.overlapPolicy);if(se&&!["skip","catch_up"].includes(se))return g({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(le&&!["allow","forbid","replace"].includes(le))return g({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let ve=Qe.updateSchedule(J.id,{expression:F.expression?String(F.expression):void 0,timezone:F.timezone?String(F.timezone):void 0,missedRunPolicy:se,overlapPolicy:le,timeoutSeconds:F.timeoutSeconds==null?void 0:Number(F.timeoutSeconds)});return Y("updated",{jobId:ve.id,expression:ve.normalizedExpression,version:ve.version},ve.resourceId),g({ok:!0,job:ve})}catch(ve){return g({ok:!1,error:ve instanceof Error?ve.message:"Scheduled job could not be updated."},422)}}if(v.pathname==="/api/jobs/action"&&m.method==="POST"){let F=await D(m),J=Qe.get(String(F.id??""));if(!J||!w(J.resourceId))return g({ok:!1,error:"Scheduled job was not found."},404);let se=String(F.action??"");if(se==="run"){let le=Qu.enqueue(J,{trigger:"manual",actorId:A?.id});return Y("run_queued",{jobId:J.id,executionId:le.id},J.resourceId),g({ok:!0,execution:le},202)}if(["disable","delete"].includes(se)&&d?.kind==="production"){if(String(F.confirm??"")!==se)return g({ok:!1,error:`Type "${se}" to confirm this production change.`},409);if(!re())return g({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(se==="enable"||se==="disable"){let le=Qe.setEnabled(J.id,se==="enable");return Y(se==="enable"?"enabled":"disabled",{jobId:J.id},J.resourceId),g({ok:!0,job:le})}if(se==="delete")try{return Qe.remove(J.id),Y("deleted",{jobId:J.id,name:J.name},J.resourceId),g({ok:!0,deleted:J.id})}catch(le){return g({ok:!1,error:le instanceof Error?le.message:"Scheduled job could not be deleted."},409)}return g({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(v.pathname==="/api/jobs/history"&&m.method==="GET"){let F=Qe.get(String(v.searchParams.get("jobId")??""));if(!F||!w(F.resourceId))return g({ok:!1,error:"Scheduled job was not found."},404);return g({ok:!0,executions:Qe.listExecutions(F.id,Number(v.searchParams.get("limit"))||100).map((J)=>({...J,logs:J.operationId?Ee.logs(J.operationId,{limit:500}):[]}))})}if(v.pathname==="/api/jobs/reconcile"&&m.method==="POST"){if(!d)return g({ok:!1,error:"Environment was not found."},404);let F=lc(Qe,o,{organization:a.organization,project:a.project,environment:d,resources:l});return Y("reconciled",F),g({ok:!0,reconciliation:F})}if(v.pathname==="/api/workers"&&m.method==="GET"){let F=Array.isArray(I.workersDetail??I.workers)?I.workersDetail??I.workers:[];return g({ok:!0,workers:Qe.listWorkers(a.project.id,d?.id).filter((J)=>w(J.resourceId)).map((J)=>{let se=F.find((le)=>le.name===J.name||le.site===J.target.site);return se?{...J,observedState:{...J.observedState,status:se.status??"configured",currentJob:se.currentJob??null,failures:Number(se.failed??se.failures)||0,processed:Number(se.processed)||0}}:J})})}if(v.pathname==="/api/workers/action"&&m.method==="POST"){let F=await D(m),J=Qe.getWorker(String(F.id??""));if(!J||!w(J.resourceId))return g({ok:!1,error:"Worker was not found."},404);let se=String(F.action??"");if(se==="restart"){if(String(F.confirm??"")!==J.name)return g({ok:!1,error:`Type "${J.name}" to restart this worker.`},409);let le=k.find((Ve)=>Ve.id===J.target.operationId);if(!le)return g({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let ve=await da(o,L,le),Tt=Qe.reconcileWorker(J.id,ve.ok?"in_sync":"unavailable",{...J.observedState,lastRestartAt:new Date().toISOString(),command:ve.command??null,error:ve.error??ve.stderr??null});return Y("worker_restarted",{workerId:J.id,ok:ve.ok},J.resourceId),g({...ve,worker:Tt},ve.ok?200:409)}if(se==="scale")return g({ok:!1,error:J.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return g({ok:!1,error:"Action must be restart or scale."},422)}}if(v.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(L),l=new ga(a.store),h=a.store.listResources(a.project.id,d?.id),S=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(v.pathname)?"runtime:logs":"runtime:read",w=O.role==="admin"||!!d&&Ri(O,d.id,S),A=w?h:h.filter((B)=>Ye(O,B.id,S)),I=(B)=>ay(A,w,B),k=(B)=>{let Y=new Date,F={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},J=String(B.to??Y.toISOString()),se=String(B.from??new Date(new Date(J).getTime()-(F[String(B.range??"1h")]??F["1h"])).toISOString()),le=(Tt)=>{let Ve=(Array.isArray(Tt)?Tt:String(Tt??"").split(",")).map(String).filter(Boolean);return Ve.length?Ve:void 0},ve=le(B.kinds)?.filter((Tt)=>["metric","log","trace","request","event"].includes(Tt));return{projectId:a.project.id,environmentId:d?.id,resourceIds:I(B.resources),kinds:ve,names:le(B.names),sources:le(B.sources),levels:le(B.levels),from:se,to:J,text:String(B.text??"")||void 0,traceId:String(B.traceId??"")||void 0,requestId:String(B.requestId??"")||void 0,deploymentId:String(B.deploymentId??"")||void 0,releaseId:String(B.releaseId??"")||void 0,workloadId:String(B.workloadId??"")||void 0,cursor:String(B.cursor??"")||void 0,limit:Number(B.limit)||void 0}},M=Object.fromEntries(v.searchParams.entries()),_=(B=!1)=>Fu({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:L,force:B,lightweight:!B}),re=()=>{let B=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(B.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(B.statuses)?B.statuses:[],errors:Array.isArray(B.errors)?B.errors:[],policy:B.policy??uo(a.store,a.project.id)}};if(v.pathname==="/api/telemetry/status"&&m.method==="GET"){_(!1);let B=re(),Y=w?B.statuses:l.status(a.project.id,d?.id,B.policy.rawDays,B.policy.samplingRate,A.map((J)=>J.id)),F=Y.reduce((J,se)=>J+se.estimatedDailyBytes*30,0);return g({ok:!0,generatedAt:B.generatedAt,cached:B.cached,sources:Y,errors:w?B.errors:[],policy:B.policy,retention:{rawDays:B.policy.rawDays,downsampleAfterDays:B.policy.downsampleAfterDays,downsampleBucketMs:B.policy.downsampleBucketMs,maxRecords:B.policy.maxRecords},estimatedMonthlyBytes:F,estimatedMonthlyCostUsd:Qy(F,B.policy),costEstimateConfigured:B.policy.estimatedStorageUsdPerGbMonth>0})}if(v.pathname==="/api/telemetry/settings"&&m.method==="GET")return g({ok:!0,policy:uo(a.store,a.project.id)});if(v.pathname==="/api/telemetry/settings"&&m.method==="PATCH"){let B=Ky(a.store,a.project.id,await D(m));return fy(a.project.id),g({ok:!0,policy:B})}if(v.pathname==="/api/telemetry/query"&&m.method==="GET"){_(!1);let B=re();return g({ok:!0,collection:{generatedAt:B.generatedAt,cached:B.cached},...l.query(k(M))})}if(v.pathname==="/api/telemetry/tail"&&m.method==="GET"){_(!1);let B=new TextEncoder,Y=new Date,F=k({...M,kinds:M.kinds||"log,request,event,trace",from:M.from||new Date(Y.getTime()-120000).toISOString(),to:Y.toISOString(),limit:Math.min(1000,Number(M.limit)||200),cursor:void 0}),J=m.headers.get("last-event-id")||String(M.cursor??"")||void 0,se,le=!1,ve=!1,Tt=new ReadableStream({start(Ve){let Fr=()=>{if(le)return;if(le=!0,se)clearInterval(se);m.signal.removeEventListener("abort",Fr);try{Ve.close()}catch{}},dl=async()=>{if(le||ve)return;ve=!0;try{let cn=l.tail({...F,to:new Date(Date.now()+1000).toISOString()},J);for(let ul of cn.records)J=Yy(ul)??J,Ve.enqueue(B.encode(`id: ${J??""}
+`,"system"),k.stdout)ze.append(I.id,k.stdout,"stdout");if(k.stderr)ze.append(I.id,k.stderr,"stderr");ze.close(I.id,k.ok?"complete":"failed",k.error)}).catch((k)=>{let M=k instanceof Error?k.message:String(k);ze.append(I.id,M,"stderr"),ze.close(I.id,"failed",M)}),g({ok:!0,session:I,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(I.id)}&workload=${encodeURIComponent(l)}`},202)}if(v.pathname==="/api/runtime/files/read"&&m.method==="POST"){let d=await D(m),l=await Wt(o,L),h=Oe.resolveSession(m),S=await new cr(o,L,{inventory:async()=>l}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!W||!!h&&U.isRecentlyAuthenticated(h)});return g(S,S.ok?200:409)}if(v.pathname==="/api/runtime/files/write"&&m.method==="POST"){let d=await D(m),l=await Wt(o,L),h=String(d.workloadId??""),S=l.workloads.find((k)=>k.id===h);if(!S)return g({ok:!1,error:"Workload was not found in the current project and environment."},404);let w=Oe.resolveSession(m),A=new cr(o,L,{inventory:async()=>l}),I=await Dr({controlPlane:a,environment:L,actor:O,kind:"runtime.file.write",resourceSlug:S.links.service,input:{workloadId:h,provider:S.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>A.writeFile({workloadId:h,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!W||!!w&&U.isRecentlyAuthenticated(w)})});return g({...I.result,controlPlaneOperation:I.operation},I.result.ok?200:409)}if(v.pathname==="/api/runtime/operations"&&m.method==="POST"){let d=await D(m),l=String(d.workloadId??""),h=String(d.action??"");if(!l||!["start","stop","restart","redeploy","scale","inspect"].includes(h))return g({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let S=await Wt(o,L),w=S.workloads.find((M)=>M.id===l);if(!w)return g({ok:!1,error:"Workload was not found in the current project and environment."},404);let A=Oe.resolveSession(m),I=new cr(o,L,{inventory:async()=>S}),k=await Dr({controlPlane:a,environment:L,actor:O,kind:`runtime.${h}`,resourceSlug:w.links.service,input:{workloadId:l,provider:w.provider,action:h,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>I.run({workloadId:l,action:h,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!W||!!A&&U.isRecentlyAuthenticated(A)})});return g({...k.result,controlPlaneOperation:k.operation},k.result.ok?200:409)}if(v.pathname.startsWith("/api/protection")){let d=O.role==="admin"||vo(O,"security:read"),l=O.role==="admin"||vo(O,"security:manage");if(!d)return g({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:h,describePosture:S}=await import("./chunk-znnawt0k.js"),w=new h(a.store),A=()=>{if(!l)throw Error("Changing protection controls requires security:manage.")};if(v.pathname==="/api/protection"&&m.method==="GET"){let I=w.current();return g({ok:!0,posture:S(I),controls:I,raw:w.raw()})}if(v.pathname==="/api/protection/attack-mode"&&m.method==="POST"){A();let I=await D(m);if(I.enabled===!1)return g({ok:!0,disabled:w.disableAttackMode()});return g({ok:!0,control:w.enableAttackMode({hours:I.hours==null?void 0:Number(I.hours),reason:String(I.reason??"Enabled from the dashboard."),actorId:Q(O).actor?.id})})}if(v.pathname==="/api/protection/pause"&&m.method==="POST"){A();let I=await D(m);if(I.enabled===!1)return g({ok:!0,resumed:w.resumeMitigations()});return g({ok:!0,control:w.pauseMitigations({hours:I.hours==null?void 0:Number(I.hours),reason:String(I.reason??""),actorId:Q(O).actor?.id})})}if(v.pathname==="/api/protection/ip-rules"&&m.method==="GET")return g({ok:!0,ipRules:w.current().ipRules});if(v.pathname==="/api/protection/ip-rules"&&(m.method==="POST"||m.method==="DELETE")){A();let I=await D(m),k=I.list==="allow"?"allow":"block",M=m.method==="POST"?w.addIpRule(k,String(I.cidr??"")):w.removeIpRule(k,String(I.cidr??""));return g({ok:!0,ipRules:M})}return g({ok:!1,error:"Protection endpoint was not found."},404)}if(v.pathname.startsWith("/api/spend/")||v.pathname==="/api/usage"){let d=await ub(),l=d.store,h=d.service,S=d.gate,w=O.role==="admin"||vo(O,"billing:read"),A=O.role==="admin"||vo(O,"billing:manage");if(!w)return g({ok:!1,error:"Spend data requires the billing:read capability."},403);let I=a.environments.get(L),k={organizationId:a.organization.id,projectId:a.project.id,environmentId:I?.id},M=()=>{if(!A)throw Error("Changing a budget requires the billing:manage capability.")};if(v.pathname==="/api/usage"&&m.method==="GET")return g({ok:!0,...h.usageReport({organizationId:k.organizationId,projectId:k.projectId,period:v.searchParams.get("period")??"monthly",timezone:v.searchParams.get("timezone")??void 0})});if(v.pathname==="/api/spend/budgets"&&m.method==="GET")return g({ok:!0,budgets:l.listBudgets({organizationId:k.organizationId,projectId:k.projectId}).map((_)=>({..._,status:h.status(_)}))});if(v.pathname==="/api/spend/budgets"&&m.method==="POST"){M();let _=await D(m),re=String(_.scope??"project"),B=l.createBudget({organizationId:k.organizationId,projectId:re==="organization"?void 0:k.projectId,environmentId:re==="environment"?k.environmentId:void 0,name:String(_.name??"").trim(),period:_.period??"monthly",timezone:_.timezone?String(_.timezone):void 0,softLimitCents:_.softLimitCents==null?void 0:Math.round(Number(_.softLimitCents)),hardLimitCents:_.hardLimitCents==null?void 0:Math.round(Number(_.hardLimitCents)),graceSeconds:_.graceSeconds==null?void 0:Number(_.graceSeconds),dryRun:_.dryRun!==!1});return g({ok:!0,budget:B})}if(v.pathname==="/api/spend/budgets"&&m.method==="PATCH"){M();let _=await D(m),re=String(_.id??""),B=l.getBudget(re);if(!B||B.organizationId!==k.organizationId)return g({ok:!1,error:"Budget was not found."},404);return g({ok:!0,budget:l.updateBudget(re,{softLimitCents:_.softLimitCents==null?B.softLimitCents:Math.round(Number(_.softLimitCents)),hardLimitCents:_.hardLimitCents==null?B.hardLimitCents:Math.round(Number(_.hardLimitCents)),enabled:_.enabled==null?B.enabled:_.enabled===!0,dryRun:_.dryRun==null?B.dryRun:_.dryRun===!0},_.expectedVersion==null?void 0:Number(_.expectedVersion))})}if(v.pathname==="/api/spend/budgets"&&m.method==="DELETE"){M();let _=await D(m),re=String(_.id??""),B=l.getBudget(re);if(!B||B.organizationId!==k.organizationId)return g({ok:!1,error:"Budget was not found."},404);let Y=S.closeBudget(re);return l.deleteBudget(re),g({ok:!0,deleted:!0,lifted:Y})}if(v.pathname==="/api/spend/check"&&m.method==="POST"){M();let _=await D(m),{SpendRunner:re}=await import("./chunk-zsf6pccz.js"),B=new re({controlPlane:a.store,store:l,alerts:ne});if(_.apply!==!0){let F=l.budgetsForScope(k.organizationId,k.projectId,k.environmentId);return g({ok:!0,applied:!1,preview:F.map((J)=>h.status(J))})}let Y=await B.run({...k,environmentKind:I?.kind});return g({ok:!0,applied:!0,result:Y})}if(v.pathname==="/api/spend/enforcement"&&m.method==="GET")return g({ok:!0,enforcement:S.listUnder({organizationId:k.organizationId})});if(v.pathname==="/api/spend/release"&&m.method==="POST"){M();let _=await D(m),re=S.close(String(_.budgetId??""),_.action);return g({ok:re,released:re,note:re?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(v.pathname==="/api/spend/anomalies"&&m.method==="GET")return g({ok:!0,anomalies:l.listAnomalies({organizationId:k.organizationId,projectId:k.projectId,unacknowledgedOnly:v.searchParams.get("unacknowledged")==="true"})});if(v.pathname==="/api/spend/anomalies/acknowledge"&&m.method==="POST"){M();let _=await D(m);return g({ok:!0,acknowledged:l.acknowledgeAnomaly(String(_.id??""))})}return g({ok:!1,error:"Spend endpoint was not found."},404)}if(v.pathname.startsWith("/api/health/")||v.pathname.startsWith("/api/alerts")||v.pathname.startsWith("/api/notifications/")){let d=a.environments.get(L),l=a.store.listResources(a.project.id,d?.id),h=O.role==="admin"||!!d&&Ri(O,d.id,"runtime:read")?l:l.filter((I)=>Ye(O,I.id,"runtime:read")),S=(I)=>!I||h.some((k)=>k.id===I),w=(I)=>{if(!I)return;let k=l.find((M)=>M.id===I||M.slug===I);if(!k)throw Error("Alert resource was not found.");if(!S(k.id))throw Error("Alert resource is outside your authorized scope.");return k.id},A=Q(O).actor;if(v.pathname==="/api/health/checks"&&m.method==="GET")return g({ok:!0,checks:ne.listHealthChecks(a.project.id,d?.id).filter((I)=>S(I.resourceId)).map((I)=>({...I,results:ne.listHealthResults(I.id,20)}))});if(v.pathname==="/api/health/checks"&&m.method==="POST"){let I=await D(m),k=String(I.kind??"http");if(k==="command"&&O.role!=="admin")return g({ok:!1,error:"Command health checks require an administrator."},403);let M={method:String(I.config?.method??"GET").toUpperCase().slice(0,10),path:I.config?.path?String(I.config.path).slice(0,500):void 0,port:I.config?.port==null?void 0:Number(I.config.port),command:Array.isArray(I.config?.command)?I.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(I.config?.expectedStatuses)?I.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:I.config?.expectedBody?String(I.config.expectedBody).slice(0,500):void 0};return g({ok:!0,check:ne.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource),name:String(I.name??""),kind:k,target:String(I.target??""),config:M,intervalSeconds:Number(I.intervalSeconds)||60,timeoutSeconds:Number(I.timeoutSeconds)||10,failureThreshold:Number(I.failureThreshold)||3,recoveryThreshold:Number(I.recoveryThreshold)||2,regions:Array.isArray(I.regions)?I.regions.map(String):["local"],enabled:I.enabled!==!1})},201)}if(v.pathname==="/api/health/checks"&&m.method==="PATCH"){let I=await D(m),k=ne.getHealthCheck(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Health check was not found."},404);return g({ok:!0,check:ne.setHealthCheckEnabled(k.id,I.enabled!==!1)})}if(v.pathname==="/api/health/checks/test"&&m.method==="POST"){let I=await D(m),k=ne.getHealthCheck(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Health check was not found."},404);return g({ok:!0,productionIncidentCreated:!1,result:await new Ei(ne).probe(k)})}if(v.pathname==="/api/health/checks/run"&&m.method==="POST"){let I=await D(m),k=ne.getHealthCheck(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Health check was not found."},404);let M=await new Ei(ne).runAndEvaluate(k),_=[];for(let re of M.evaluations.filter((B)=>B.notify&&B.alert)){let B=Dt.enqueue(a.organization.id,re.alert,re.transition);_.push(...await Dt.deliverAll(B))}return g({ok:!0,...M,deliveries:_})}if(v.pathname==="/api/alerts/rules"&&m.method==="GET")return g({ok:!0,rules:ne.listRules(a.project.id,d?.id).filter((I)=>S(I.resourceId))});if(v.pathname==="/api/alerts/rules"&&m.method==="POST"){let I=await D(m),k=I.healthCheckId?ne.getHealthCheck(String(I.healthCheckId)):void 0;if(I.healthCheckId&&(!k||!S(k.resourceId)))return g({ok:!1,error:"Health check was not found."},404);return g({ok:!0,rule:ne.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource)??k?.resourceId,healthCheckId:k?.id,name:String(I.name??""),signal:String(I.signal??(k?"health":"")),operator:String(I.operator??(k?"unhealthy":"gt")),threshold:I.threshold==null?void 0:Number(I.threshold),recoveryThreshold:I.recoveryThreshold==null?void 0:Number(I.recoveryThreshold),windowMs:Number(I.windowMs)||300000,consecutive:Number(I.consecutive)||k?.failureThreshold||3,recoveryConsecutive:Number(I.recoveryConsecutive)||k?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(I.noDataPolicy))?I.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(I.severity))?I.severity:"warning",groupBy:Array.isArray(I.groupBy)?I.groupBy.map(String):[],labels:I.labels&&typeof I.labels==="object"?I.labels:{},enabled:I.enabled!==!1})},201)}if(v.pathname==="/api/alerts/rules"&&m.method==="PATCH"){let I=await D(m),k=ne.getRule(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Alert rule was not found."},404);return g({ok:!0,rule:ne.setRuleEnabled(k.id,I.enabled!==!1)})}if(v.pathname==="/api/alerts/evaluate"&&m.method==="POST")return g({ok:!0,...await Yu(d?.id)});if(v.pathname==="/api/alerts"&&m.method==="GET")return g({ok:!0,alerts:ne.listAlerts(a.project.id,{environmentId:d?.id,states:v.searchParams.getAll("state").length?v.searchParams.getAll("state"):void 0,limit:Number(v.searchParams.get("limit"))||200}).filter((I)=>S(I.resourceId)).map((I)=>({...I,deliveries:ne.listDeliveries({alertId:I.id,limit:50})}))});if(v.pathname==="/api/alerts/action"&&m.method==="POST"){let I=await D(m),k=ne.getAlert(String(I.id??""));if(!k||!S(k.resourceId))return g({ok:!1,error:"Alert was not found."},404);let M=String(I.action??"");if(M==="acknowledge")return g({ok:!0,alert:ne.acknowledge(k.id,A?.id??"")});if(M==="assign")return g({ok:!0,alert:ne.assign(k.id,I.ownerActorId==="me"?A?.id:I.ownerActorId?String(I.ownerActorId):void 0,A?.id)});if(M==="silence"){if(O.role!=="admin")return g({ok:!1,error:"Silencing production alerts requires an administrator."},403);let _=Oe.resolveSession(m);if(W&&(!_||!U.isRecentlyAuthenticated(_)))return g({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return g({ok:!0,alert:ne.silenceAlert(k.id,String(I.until??""),A?.id)})}return g({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(v.pathname==="/api/alerts/silences"&&m.method==="POST"){let I=await D(m);return g({ok:!0,id:ne.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource),matcher:I.matcher,reason:String(I.reason??""),startsAt:String(I.startsAt??new Date().toISOString()),endsAt:String(I.endsAt??""),timezone:String(I.timezone??"UTC"),actorId:A?.id})},201)}if(v.pathname==="/api/notifications/channels"&&m.method==="GET")return g({ok:!0,channels:ne.listChannels(a.organization.id)});if(v.pathname==="/api/notifications/channels"&&m.method==="POST"){let I=await D(m),k=String(I.kind??""),M=k==="email"?{to:I.config?.to,from:I.config?.from}:k==="telegram"?{chatId:String(I.config?.chatId??"")}:{};return g({ok:!0,channel:ne.createChannel({organizationId:a.organization.id,name:String(I.name??""),kind:k,config:M,credential:I.credential?String(I.credential):void 0,actorId:A?.id})},201)}if(v.pathname==="/api/notifications/channels"&&m.method==="PATCH"){let I=await D(m),k=String(I.id??"");if(I.credential)return g({ok:!0,channel:ne.rotateChannel(k,String(I.credential))});let M=String(I.status??"paused");if(!["active","paused","disabled"].includes(M))return g({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return g({ok:!0,channel:ne.setChannelStatus(k,M)})}if(v.pathname==="/api/notifications/channels/test"&&m.method==="POST"){let I=await D(m);return g({ok:!0,productionIncidentCreated:!1,result:await Dt.testChannel(String(I.id??""))})}if(v.pathname==="/api/notifications/routes"&&m.method==="GET")return g({ok:!0,routes:ne.listRoutes(a.organization.id)});if(v.pathname==="/api/notifications/routes"&&m.method==="POST"){let I=await D(m),k=Array.isArray(I.channelIds)?I.channelIds.map(String):[];if(k.some((M)=>ne.getChannel(M)?.organizationId!==a.organization.id))return g({ok:!1,error:"Route contains an unavailable channel."},422);return g({ok:!0,route:ne.createRoute({organizationId:a.organization.id,name:String(I.name??""),priority:Number(I.priority)||0,matcher:I.matcher&&typeof I.matcher==="object"?I.matcher:{},channelIds:k,quietHours:I.quietHours,groupWaitSeconds:Number(I.groupWaitSeconds)||30,reminderSeconds:I.reminderSeconds==null?void 0:Number(I.reminderSeconds),escalation:Array.isArray(I.escalation)?I.escalation:[],template:I.template?String(I.template):void 0,rateLimitPerMinute:Number(I.rateLimitPerMinute)||60,enabled:I.enabled!==!1})},201)}if(v.pathname==="/api/notifications/routes"&&m.method==="PATCH"){let I=await D(m),k=ne.getRoute(String(I.id??""));if(!k||k.organizationId!==a.organization.id)return g({ok:!1,error:"Notification route was not found."},404);return g({ok:!0,route:ne.setRouteEnabled(k.id,I.enabled!==!1)})}if(v.pathname==="/api/notifications/routes/preview"&&m.method==="POST"){let I=await D(m),M=(I.alertId?ne.getAlert(String(I.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:w(I.resourceId??I.resource),dedupKey:"preview",groupKey:String(I.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(I.severity))?I.severity:"warning",title:String(I.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return g({ok:!0,productionIncidentCreated:!1,matches:Dt.preview(a.organization.id,M,String(I.eventType??"firing")).map((_)=>({route:_.route,channels:_.channels,quiet:_.quiet}))})}if(v.pathname==="/api/notifications/deliveries"&&m.method==="GET")return g({ok:!0,deliveries:ne.listDeliveries({alertId:v.searchParams.get("alertId")??void 0,states:v.searchParams.getAll("state"),limit:Number(v.searchParams.get("limit"))||200})});if(v.pathname==="/api/notifications/deliveries/retry"&&m.method==="POST"){let I=await D(m),k=ne.getDelivery(String(I.id??""));if(!k)return g({ok:!1,error:"Delivery was not found."},404);return ne.updateDelivery(k.id,{state:"retrying",attempt:Math.max(0,k.attempt-1),nextAttemptAt:new Date().toISOString()}),g({ok:!0,delivery:await Dt.deliver(k.id)})}}if(v.pathname.startsWith("/api/jobs")||v.pathname.startsWith("/api/workers")){let d=a.environments.get(L),l=a.store.listResources(a.project.id,d?.id),S=O.role==="admin"||!!d&&Ri(O,d.id,"automation:read")?l:l.filter((F)=>Ye(O,F.id,"automation:read")),w=(F)=>!F||S.some((J)=>J.id===F),A=Q(O).actor,I=C.get(L)??b,k=ca(o,I),M=k.filter((F)=>!F.danger&&["scheduler","backup","worker"].includes(F.group)),_=Pr(o),re=()=>{let F=Oe.resolveSession(m);return!W||!!F&&U.isRecentlyAuthenticated(F)},B=(F)=>{if(!F||typeof F!=="object"||Array.isArray(F))return{};let J=Object.entries(F).slice(0,50);if(J.some(([,se])=>typeof se!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(se)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(J)},Y=(F,J,se)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:se,actorId:A?.id,type:`job.${F}`,payload:J});if(v.pathname==="/api/jobs/preview"&&m.method==="POST"){let F=await D(m);try{return g({ok:!0,productionExecutionCreated:!1,preview:yn(String(F.expression??""),String(F.timezone??"UTC"),new Date(F.from?String(F.from):Date.now()),Number(F.count)||5)})}catch(J){return g({ok:!1,error:J instanceof Error?J.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(v.pathname==="/api/jobs"&&m.method==="GET")return g({ok:!0,jobs:Qe.list(a.project.id,{environmentId:d?.id}).filter((F)=>w(F.resourceId)).map((F)=>({...F,preview:yn(F.normalizedExpression,F.timezone,new Date,5),capability:uc(F),lastExecution:Qe.listExecutions(F.id,1)[0]}))});if(v.pathname==="/api/jobs"&&m.method==="POST"){let F=await D(m),J=String(F.provider??(_==="serverless"?"eventbridge":"server")),se=_==="serverless"?"eventbridge":"server";if(J!==se)return g({ok:!1,error:`${_} environments accept ${se} schedules through this adapter.`},422);let le=F.operationId?String(F.operationId):void 0;if(J==="server"&&(!le||!M.some((Ve)=>Ve.id===le)))return g({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let ve=uc({provider:J,expression:String(F.expression??""),flexibleMinutes:Number(F.flexibleMinutes)||0,missedRunPolicy:F.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(F.overlapPolicy))?F.overlapPolicy:"forbid"});if(!ve.supported)return g({ok:!1,error:ve.notes.join(" ")},422);let Tt=F.resourceId?l.find((Ve)=>Ve.id===F.resourceId||Ve.slug===F.resourceId):void 0;if(F.resourceId&&(!Tt||!w(Tt.id)))return g({ok:!1,error:"Job resource was not found."},404);try{let Ve=J==="server"?{kind:"dashboard_operation",operationId:le}:{kind:"serverless_scheduler",action:"run"},Fr=Qe.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:Tt?.id,name:String(F.name??""),provider:J,expression:String(F.expression??""),timezone:String(F.timezone??"UTC"),startsAt:F.startsAt?String(F.startsAt):void 0,endsAt:F.endsAt?String(F.endsAt):void 0,flexibleMinutes:Number(F.flexibleMinutes)||0,target:Ve,payloadRefs:B(F.payloadRefs),missedRunPolicy:F.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(F.overlapPolicy))?F.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(F.maxAttempts)||3,backoffSeconds:Number(F.backoffSeconds)||30,deadLetterRef:F.deadLetterRef?String(F.deadLetterRef):void 0},timeoutSeconds:Number(F.timeoutSeconds)||900,enabled:F.enabled!==!1,origin:"managed",ownerActorId:A?.id,observedState:{},reconciliationStatus:"pending"});return Y("created",{jobId:Fr.id,provider:Fr.provider,expression:Fr.normalizedExpression},Fr.resourceId),g({ok:!0,job:Fr,capability:ve},201)}catch(Ve){return g({ok:!1,error:Ve instanceof Error?Ve.message:"Scheduled job could not be created."},422)}}if(v.pathname==="/api/jobs"&&m.method==="PATCH"){let F=await D(m),J=Qe.get(String(F.id??""));if(!J||!w(J.resourceId))return g({ok:!1,error:"Scheduled job was not found."},404);if(J.origin==="config")return g({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let se=F.missedRunPolicy==null?void 0:String(F.missedRunPolicy),le=F.overlapPolicy==null?void 0:String(F.overlapPolicy);if(se&&!["skip","catch_up"].includes(se))return g({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(le&&!["allow","forbid","replace"].includes(le))return g({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let ve=Qe.updateSchedule(J.id,{expression:F.expression?String(F.expression):void 0,timezone:F.timezone?String(F.timezone):void 0,missedRunPolicy:se,overlapPolicy:le,timeoutSeconds:F.timeoutSeconds==null?void 0:Number(F.timeoutSeconds)});return Y("updated",{jobId:ve.id,expression:ve.normalizedExpression,version:ve.version},ve.resourceId),g({ok:!0,job:ve})}catch(ve){return g({ok:!1,error:ve instanceof Error?ve.message:"Scheduled job could not be updated."},422)}}if(v.pathname==="/api/jobs/action"&&m.method==="POST"){let F=await D(m),J=Qe.get(String(F.id??""));if(!J||!w(J.resourceId))return g({ok:!1,error:"Scheduled job was not found."},404);let se=String(F.action??"");if(se==="run"){let le=Qu.enqueue(J,{trigger:"manual",actorId:A?.id});return Y("run_queued",{jobId:J.id,executionId:le.id},J.resourceId),g({ok:!0,execution:le},202)}if(["disable","delete"].includes(se)&&d?.kind==="production"){if(String(F.confirm??"")!==se)return g({ok:!1,error:`Type "${se}" to confirm this production change.`},409);if(!re())return g({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(se==="enable"||se==="disable"){let le=Qe.setEnabled(J.id,se==="enable");return Y(se==="enable"?"enabled":"disabled",{jobId:J.id},J.resourceId),g({ok:!0,job:le})}if(se==="delete")try{return Qe.remove(J.id),Y("deleted",{jobId:J.id,name:J.name},J.resourceId),g({ok:!0,deleted:J.id})}catch(le){return g({ok:!1,error:le instanceof Error?le.message:"Scheduled job could not be deleted."},409)}return g({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(v.pathname==="/api/jobs/history"&&m.method==="GET"){let F=Qe.get(String(v.searchParams.get("jobId")??""));if(!F||!w(F.resourceId))return g({ok:!1,error:"Scheduled job was not found."},404);return g({ok:!0,executions:Qe.listExecutions(F.id,Number(v.searchParams.get("limit"))||100).map((J)=>({...J,logs:J.operationId?Ee.logs(J.operationId,{limit:500}):[]}))})}if(v.pathname==="/api/jobs/reconcile"&&m.method==="POST"){if(!d)return g({ok:!1,error:"Environment was not found."},404);let F=lc(Qe,o,{organization:a.organization,project:a.project,environment:d,resources:l});return Y("reconciled",F),g({ok:!0,reconciliation:F})}if(v.pathname==="/api/workers"&&m.method==="GET"){let F=Array.isArray(I.workersDetail??I.workers)?I.workersDetail??I.workers:[];return g({ok:!0,workers:Qe.listWorkers(a.project.id,d?.id).filter((J)=>w(J.resourceId)).map((J)=>{let se=F.find((le)=>le.name===J.name||le.site===J.target.site);return se?{...J,observedState:{...J.observedState,status:se.status??"configured",currentJob:se.currentJob??null,failures:Number(se.failed??se.failures)||0,processed:Number(se.processed)||0}}:J})})}if(v.pathname==="/api/workers/action"&&m.method==="POST"){let F=await D(m),J=Qe.getWorker(String(F.id??""));if(!J||!w(J.resourceId))return g({ok:!1,error:"Worker was not found."},404);let se=String(F.action??"");if(se==="restart"){if(String(F.confirm??"")!==J.name)return g({ok:!1,error:`Type "${J.name}" to restart this worker.`},409);let le=k.find((Ve)=>Ve.id===J.target.operationId);if(!le)return g({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let ve=await da(o,L,le),Tt=Qe.reconcileWorker(J.id,ve.ok?"in_sync":"unavailable",{...J.observedState,lastRestartAt:new Date().toISOString(),command:ve.command??null,error:ve.error??ve.stderr??null});return Y("worker_restarted",{workerId:J.id,ok:ve.ok},J.resourceId),g({...ve,worker:Tt},ve.ok?200:409)}if(se==="scale")return g({ok:!1,error:J.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return g({ok:!1,error:"Action must be restart or scale."},422)}}if(v.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(L),l=new ga(a.store),h=a.store.listResources(a.project.id,d?.id),S=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(v.pathname)?"runtime:logs":"runtime:read",w=O.role==="admin"||!!d&&Ri(O,d.id,S),A=w?h:h.filter((B)=>Ye(O,B.id,S)),I=(B)=>ay(A,w,B),k=(B)=>{let Y=new Date,F={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},J=String(B.to??Y.toISOString()),se=String(B.from??new Date(new Date(J).getTime()-(F[String(B.range??"1h")]??F["1h"])).toISOString()),le=(Tt)=>{let Ve=(Array.isArray(Tt)?Tt:String(Tt??"").split(",")).map(String).filter(Boolean);return Ve.length?Ve:void 0},ve=le(B.kinds)?.filter((Tt)=>["metric","log","trace","request","event"].includes(Tt));return{projectId:a.project.id,environmentId:d?.id,resourceIds:I(B.resources),kinds:ve,names:le(B.names),sources:le(B.sources),levels:le(B.levels),from:se,to:J,text:String(B.text??"")||void 0,traceId:String(B.traceId??"")||void 0,requestId:String(B.requestId??"")||void 0,deploymentId:String(B.deploymentId??"")||void 0,releaseId:String(B.releaseId??"")||void 0,workloadId:String(B.workloadId??"")||void 0,cursor:String(B.cursor??"")||void 0,limit:Number(B.limit)||void 0}},M=Object.fromEntries(v.searchParams.entries()),_=(B=!1)=>Fu({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:L,force:B,lightweight:!B}),re=()=>{let B=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(B.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(B.statuses)?B.statuses:[],errors:Array.isArray(B.errors)?B.errors:[],policy:B.policy??uo(a.store,a.project.id)}};if(v.pathname==="/api/telemetry/status"&&m.method==="GET"){_(!1);let B=re(),Y=w?B.statuses:l.status(a.project.id,d?.id,B.policy.rawDays,B.policy.samplingRate,A.map((J)=>J.id)),F=Y.reduce((J,se)=>J+se.estimatedDailyBytes*30,0);return g({ok:!0,generatedAt:B.generatedAt,cached:B.cached,sources:Y,errors:w?B.errors:[],policy:B.policy,retention:{rawDays:B.policy.rawDays,downsampleAfterDays:B.policy.downsampleAfterDays,downsampleBucketMs:B.policy.downsampleBucketMs,maxRecords:B.policy.maxRecords},estimatedMonthlyBytes:F,estimatedMonthlyCostUsd:Qy(F,B.policy),costEstimateConfigured:B.policy.estimatedStorageUsdPerGbMonth>0})}if(v.pathname==="/api/telemetry/settings"&&m.method==="GET")return g({ok:!0,policy:uo(a.store,a.project.id)});if(v.pathname==="/api/telemetry/settings"&&m.method==="PATCH"){let B=Ky(a.store,a.project.id,await D(m));return fy(a.project.id),g({ok:!0,policy:B})}if(v.pathname==="/api/telemetry/query"&&m.method==="GET"){_(!1);let B=re();return g({ok:!0,collection:{generatedAt:B.generatedAt,cached:B.cached},...l.query(k(M))})}if(v.pathname==="/api/telemetry/tail"&&m.method==="GET"){_(!1);let B=new TextEncoder,Y=new Date,F=k({...M,kinds:M.kinds||"log,request,event,trace",from:M.from||new Date(Y.getTime()-120000).toISOString(),to:Y.toISOString(),limit:Math.min(1000,Number(M.limit)||200),cursor:void 0}),J=m.headers.get("last-event-id")||String(M.cursor??"")||void 0,se,le=!1,ve=!1,Tt=new ReadableStream({start(Ve){let Fr=()=>{if(le)return;if(le=!0,se)clearInterval(se);m.signal.removeEventListener("abort",Fr);try{Ve.close()}catch{}},dl=async()=>{if(le||ve)return;ve=!0;try{let cn=l.tail({...F,to:new Date(Date.now()+1000).toISOString()},J);for(let ul of cn.records)J=Yy(ul)??J,Ve.enqueue(B.encode(`id: ${J??""}
 event: record
 data: ${JSON.stringify(ul)}
 
@@ -508,5 +508,5 @@ data: ${JSON.stringify({message:cn instanceof Error?cn.message:String(cn)})}
 data: ${JSON.stringify({cursor:J,at:new Date().toISOString()})}
 
 `))},5000),se.unref?.(),m.signal.addEventListener("abort",Fr,{once:!0})},cancel(){if(le=!0,se)clearInterval(se)}});return new Response(Tt,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(v.pathname==="/api/telemetry/series"&&m.method==="GET"){_(!1);let B=re(),Y=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(M.aggregation))?M.aggregation:"avg",F=k({...M,kinds:"metric",limit:5000}),J=l.series({...F,bucketMs:Number(M.bucketMs)||60000,aggregation:Y,timezone:String(M.timezone??"UTC"),compareFrom:M.compareFrom,compareTo:M.compareTo});return g({ok:!0,collection:{generatedAt:B.generatedAt,cached:B.cached},query:{aggregation:Y,bucketMs:Number(M.bucketMs)||60000,timezone:String(M.timezone??"UTC")},series:J})}if(v.pathname==="/api/telemetry/refresh"&&m.method==="POST")return g({ok:!0,...await _(!0)});if(v.pathname==="/api/telemetry/export"&&m.method==="POST"){let B=await D(m);await _(!1);let Y=l.query({...k(B),limit:Math.min(5000,Number(B.limit)||5000),cursor:void 0});if((B.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:k(B),...Y},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let J=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],se=[J.join(","),...Y.records.map((le)=>J.map((ve)=>`"${String(le[ve]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(se,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(v.pathname==="/api/telemetry/saved-queries"&&m.method==="GET"){let B=Q(O);return g({ok:!0,queries:l.listSavedQueries(a.project.id,B.actor?.id)})}if(v.pathname==="/api/telemetry/saved-queries"&&m.method==="POST"){let B=await D(m),Y=Q(O);return g({ok:!0,query:l.saveQuery(a.project.id,Y.actor?.id,String(B.name??""),k(B.query??B))},201)}if(v.pathname==="/api/telemetry/saved-queries"&&m.method==="DELETE"){let B=await D(m),Y=Q(O),F=l.deleteSavedQuery(a.project.id,Y.actor?.id,String(B.id??""));return g({ok:F},F?200:404)}}if(v.pathname.startsWith("/api/configuration")){let d=a.environments.get(L),l=O.role==="admin"||!!Ot.capabilities?.includes("secrets:read"),h=O.role==="admin"||!!Ot.capabilities?.includes("secrets:write"),S={projectId:a.project.id,environmentId:d?.id},w={"cache-control":"no-store"};if(v.pathname==="/api/configuration"&&m.method==="GET"){let A=Object.fromEntries(v.searchParams),I=A.scopeType||A.scopeId?Ci(A,S):void 0,k=["variable","secret"].includes(String(A.kind))?A.kind:void 0,M=I?.type==="preview"?je.previews.getInstance(I.id):void 0,_=M?je.previews.getDefinition(M.definitionId):void 0,re=I?await wt.resolve({projectId:a.project.id,environmentId:I.environmentId,resourceId:I.resourceId,functionId:I.type==="function"?I.id:void 0,previewId:I.previewId,trustedPreview:!!M&&!M.fork,allowedPreviewSecrets:_?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:l}):void 0,B=a.store.listResources(a.project.id);return g({ok:!0,entries:wt.list({projectId:a.project.id,scope:I,kind:k,search:A.search,canReadSecretMetadata:l}),effectiveEntries:re?Object.values(re.entries).filter((Y)=>!k||Y.kind===k).filter((Y)=>!A.search||Y.key.toLowerCase().includes(String(A.search).toLowerCase())):[],configurationHash:re?.configurationHash,warnings:re?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:B.filter((Y)=>Y.kind!=="function"),functions:B.filter((Y)=>Y.kind==="function"),previews:je.previews.listInstances({projectId:a.project.id}).filter((Y)=>Y.status!=="destroyed").map((Y)=>({id:Y.id,name:Y.name,environmentId:Y.baseEnvironmentId,resourceId:Y.resourceId,fork:Y.fork,status:Y.status}))}},200,w)}if(v.pathname==="/api/configuration/export"&&m.method==="GET"){let A=Ci(Object.fromEntries(v.searchParams),S);return new Response(wt.exportVariables({projectId:a.project.id,scope:A}),{headers:{...w,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(v.pathname==="/api/configuration/plan"&&m.method==="POST"){let A=await D(m),I=Ci(A,S),k=A.values&&typeof A.values==="object"&&!Array.isArray(A.values)?Object.fromEntries(Object.entries(A.values).map(([M,_])=>[M,String(_)])):{};return g({ok:!0,plan:wt.plan({projectId:a.project.id,scope:I,values:k,removeMissing:A.removeMissing===!0})},200,w)}if(v.pathname==="/api/configuration"&&m.method==="POST"){let A=await D(m),I=Ci(A,S),k=A.kind==="secret"?"secret":"variable",M=String(A.key??"");if(k==="secret"&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);try{let _=await wt.set({organizationId:a.organization.id,projectId:a.project.id,scope:I,key:M,kind:k,value:A.value==null?void 0:String(A.value),reference:A.reference==null?void 0:String(A.reference),backend:A.backend,required:A.required===!0,expectedVersion:A.expectedVersion==null?void 0:Number(A.expectedVersion),confirmed:String(A.confirm??"")===M,idempotencyKey:m.headers.get("idempotency-key")??A.idempotencyKey,actorId:Q(O).actor?.id});return g({ok:!0,entry:wt.list({projectId:a.project.id,scope:I,canReadSecretMetadata:l}).find((re)=>re.id===_.entry.id),mutation:_.mutation,warnings:_.warnings},_.mutation.added.length?201:200,w)}catch(_){return g({ok:!1,error:_ instanceof Error?_.message:String(_)},409,w)}}if(v.pathname==="/api/configuration/import"&&m.method==="POST"){let A=await D(m),I=Ci(A,S),k=Array.isArray(A.secretKeys)?A.secretKeys.map(String):[];if(k.length&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);try{let M=await wt.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:I,source:String(A.source??""),secretKeys:k,backend:A.backend,confirmed:A.confirm==="import",idempotencyKey:m.headers.get("idempotency-key")??A.idempotencyKey,actorId:Q(O).actor?.id});return g({ok:M.document.valid,diagnostics:M.document.diagnostics,mutation:M.mutation,warnings:M.warnings},M.document.valid?200:422,w)}catch(M){return g({ok:!1,error:M instanceof Error?M.message:String(M)},409,w)}}if(v.pathname==="/api/configuration/dependencies"&&m.method==="POST"){let A=await D(m),I=$r.get(String(A.entryId??"")),k=a.store.getResource(String(A.resourceId??""));if(!I||I.projectId!==a.project.id||!k||k.projectId!==a.project.id)return g({ok:!1,error:"Configuration entry or dependent resource was not found."},404,w);return g({ok:!0,dependency:$r.setDependency({entryId:I.id,resourceId:k.id,injectionTarget:["native_reference","file"].includes(String(A.injectionTarget))?A.injectionTarget:"environment",required:A.required!==!1,requiresRedeploy:A.requiresRedeploy!==!1,lastDeployedVersion:A.lastDeployedVersion==null?void 0:Number(A.lastDeployedVersion)})},200,w)}if(v.pathname==="/api/configuration/transfer"&&m.method==="POST"){let A=await D(m),I=$r.get(String(A.id??"")),k=Ci({...A,scopeType:A.targetScopeType,scopeId:A.targetScopeId},S);if(!I||I.projectId!==a.project.id)return g({ok:!1,error:"Configuration entry was not found."},404,w);if(I.kind==="secret"&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);try{let M=await wt.transfer({entryId:I.id,targetScope:k,mode:A.mode==="move"?"move":"copy",confirmed:A.confirm===I.key,actorId:Q(O).actor?.id,idempotencyKey:m.headers.get("idempotency-key")??A.idempotencyKey});return g({ok:!0,entry:wt.list({projectId:a.project.id,scope:k,canReadSecretMetadata:l}).find((_)=>_.id===M.entry.id),mutation:M.mutation},200,w)}catch(M){return g({ok:!1,error:M instanceof Error?M.message:String(M)},409,w)}}if(v.pathname==="/api/configuration/bulk"&&m.method==="POST"){let A=await D(m),I=Array.isArray(A.ids)?A.ids.map(String).slice(0,500):[],k=I.map((_)=>$r.get(_)).filter((_)=>!!_&&_.projectId===a.project.id);if(k.length!==I.length)return g({ok:!1,error:"One or more configuration entries were not found."},404,w);if(k.some((_)=>_.kind==="secret")&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);if(A.action!=="delete"||A.confirm!=="bulk")return g({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,w);let M=[];try{for(let _ of k)M.push(await wt.remove({entryId:_.id,expectedVersion:_.version,confirmed:!0,actorId:Q(O).actor?.id}));return g({ok:!0,removed:M.flatMap((_)=>_.removed),affectedResourceIds:[...new Set(M.flatMap((_)=>_.affectedResourceIds))].sort()},200,w)}catch(_){return g({ok:!1,error:_ instanceof Error?_.message:String(_),partial:M.flatMap((re)=>re.removed)},409,w)}}if(v.pathname==="/api/configuration/reveal"&&m.method==="POST"){let A=await D(m),I=Oe.resolveSession(m);try{return g({ok:!0,value:await wt.reveal({entryId:String(A.id??""),canRevealSecrets:l,recentlyAuthenticated:!W||!!I&&U.isRecentlyAuthenticated(I),actorId:Q(O).actor?.id})},200,w)}catch(k){return g({ok:!1,error:k instanceof Error?k.message:String(k)},403,w)}}if(v.pathname==="/api/configuration"&&m.method==="DELETE"){let A=await D(m),I=$r.get(String(A.id??""));if(I?.kind==="secret"&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);if(!I||I.projectId!==a.project.id)return g({ok:!1,error:"Configuration entry was not found."},404,w);try{return g({ok:!0,mutation:await wt.remove({entryId:I.id,expectedVersion:Number(A.expectedVersion),confirmed:String(A.confirm??"")===I.key,actorId:Q(O).actor?.id})},200,w)}catch(k){return g({ok:!1,error:k instanceof Error?k.message:String(k)},409,w)}}}if(v.pathname.startsWith("/api/fleet")){let d=Q(O).actor?.id,l=(h,S=409)=>g({ok:!1,error:h instanceof Error?h.message:String(h)},S,{"cache-control":"no-store"});if(v.pathname==="/api/fleet"&&m.method==="GET")return g({ok:!0,servers:ki.list(a.project.id),resources:a.store.listResources(a.project.id),operations:Ee.list({projectId:a.project.id,limit:200}).filter((h)=>h.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(v.pathname==="/api/fleet"&&m.method==="POST"){let h=await D(m);try{return g({ok:!0,server:rr.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(h.name??""),provider:["aws","hetzner"].includes(String(h.provider))?h.provider:"ssh",providerId:h.providerId?String(h.providerId):void 0,region:h.region?String(h.region):void 0,zone:h.zone?String(h.zone):void 0,endpoint:String(h.endpoint??""),sshUser:String(h.sshUser??"deploy"),sshPort:h.sshPort?Number(h.sshPort):22,credentialRef:String(h.credentialRef??""),roles:Array.isArray(h.roles)?h.roles:[],labels:h.labels&&typeof h.labels==="object"?h.labels:{}})},201)}catch(S){return l(S,422)}}if(v.pathname==="/api/fleet/action"&&m.method==="POST"){let h=await D(m),S=String(h.id??""),w=String(h.action??"");try{if(w==="test")return g({ok:!0,server:await rr.test(S)});if(w==="validate")return g({ok:!0,server:await rr.validate(S)});if(w==="review_host_key")return g({ok:!0,server:rr.reviewHostKey(S,String(h.fingerprint??""))});if(w==="bootstrap")return g({ok:!0,...rr.bootstrap(S,h.confirmed===!0)},h.confirmed===!0?202:200);if(w==="heartbeat")return g({ok:!0,server:rr.heartbeat(S,{usage:h.usage&&typeof h.usage==="object"?h.usage:{}})});if(w==="drain")return g({ok:!0,server:rr.drain(S,h.completed===!0)});if(w==="uncordon")return g({ok:!0,server:rr.uncordon(S)});if(w==="archive")return g({ok:!0,server:rr.archive(S,String(h.confirmation??""))});return l("Unsupported fleet action.",422)}catch(A){return l(A)}}}if(v.pathname.startsWith("/api/capacity")){let d=(l,h=409)=>g({ok:!1,error:l instanceof Error?l.message:String(l)},h,{"cache-control":"no-store"});if(v.pathname==="/api/capacity"&&m.method==="GET")return g({ok:!0,pools:Lr.listPools(a.project.id),placements:Lr.listPlacements(a.project.id),servers:ki.list(a.project.id)},200,{"cache-control":"no-store"});if(v.pathname==="/api/capacity"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,pool:Lr.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(l.name??""),purpose:String(l.purpose??"application"),backend:String(l.backend??"server"),region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{},requiredServerLabels:l.requiredServerLabels&&typeof l.requiredServerLabels==="object"?l.requiredServerLabels:{},toleratedTaints:Array.isArray(l.toleratedTaints)?l.toleratedTaints.map(String):[],capacity:l.capacity&&typeof l.capacity==="object"?l.capacity:{},maxWorkloads:Number(l.maxWorkloads??10),costWeight:Number(l.costWeight??1),spreadKey:l.spreadKey?String(l.spreadKey):void 0,concurrency:Number(l.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/capacity/member"&&m.method==="POST"){let l=await D(m);try{return Lr.addMember(String(l.poolId??""),String(l.serverId??"")),g({ok:!0,pool:Lr.getPool(String(l.poolId??""))})}catch(h){return d(h,422)}}if(v.pathname==="/api/capacity/explain"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,decisions:Wu.explain(a.project.id,{purpose:String(l.purpose??"application"),resources:l.resources&&typeof l.resources==="object"?l.resources:{},region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{}})})}catch(h){return d(h,422)}}if(v.pathname==="/api/capacity/action"&&m.method==="POST"){let l=await D(m);try{if(l.action==="drain")return g({ok:!0,...Wu.drainPool(String(l.poolId??""))});if(l.action==="enable")return g({ok:!0,pool:Lr.updatePool(String(l.poolId??""),{status:"active"})});if(l.action==="disable")return g({ok:!0,pool:Lr.updatePool(String(l.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(h){return d(h,422)}}}if(v.pathname.startsWith("/api/regions")){let d=(l,h=409)=>g({ok:!1,error:l instanceof Error?l.message:String(l)},h,{"cache-control":"no-store"});if(v.pathname==="/api/regions"&&m.method==="GET")return g({ok:!0,topologies:sn.list(a.project.id).map((l)=>({topology:l,targets:sn.targets(l.id),channels:sn.channels(l.id),route:sn.route(l.id),executions:sn.executions(l.id)}))},200,{"cache-control":"no-store"});if(v.pathname==="/api/regions"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,topology:Gu.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(L)?.id,name:String(l.name??""),hostname:String(l.hostname??""),regions:Array.isArray(l.regions)?l.regions:[],trafficPolicy:l.trafficPolicy==="weighted"||l.trafficPolicy==="latency"?l.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(l.replicate)?l.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(l.maxLagSeconds??30),retainOnDestroy:l.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:l.cdnEnabled===!0,wafEnabled:l.wafEnabled===!0})},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/regions/action"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,...Gu.enqueue({topologyId:String(l.topologyId??""),kind:String(l.action??""),targetRegion:l.targetRegion?String(l.targetRegion):void 0,revision:l.revision?String(l.revision):void 0,manifest:l.manifest&&typeof l.manifest==="object"?l.manifest:{},confirmation:l.confirmation?String(l.confirmation):void 0,deleteData:l.deleteData===!0})},202)}catch(h){return d(h,422)}}}if(v.pathname.startsWith("/api/maintenance")){let d=(l,h=409)=>g({ok:!1,error:l instanceof Error?l.message:String(l)},h,{"cache-control":"no-store"});if(v.pathname==="/api/maintenance"&&m.method==="GET")return g({ok:!0,manifests:gr.manifests(a.organization.id),windows:gr.windows(a.project.id),campaigns:gr.campaigns(a.project.id).map((l)=>({campaign:l,targets:gr.targets(l.id)})),cleanups:gr.cleanups(a.project.id),drills:gr.drills(a.project.id)},200,{"cache-control":"no-store"});if(v.pathname==="/api/maintenance/cleanup-preview"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,plan:await Ca.previewCleanup({projectId:a.project.id,kind:String(l.kind??"operations"),criteria:{olderThanDays:Number(l.olderThanDays??30)}},Ku)},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/maintenance/cleanup-apply"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,...Ca.enqueueCleanup(String(l.planId??""),String(l.confirmation??""))},202)}catch(h){return d(h,422)}}if(v.pathname==="/api/maintenance/drill"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,drill:gr.createDrill({projectId:a.project.id,scenario:String(l.scenario??"control_plane"),isolatedTarget:String(l.isolatedTarget??""),expectedRpoMinutes:Number(l.expectedRpoMinutes??60),expectedRtoMinutes:Number(l.expectedRtoMinutes??30),recoveryPointId:l.recoveryPointId?String(l.recoveryPointId):void 0,topologyId:l.topologyId?String(l.topologyId):void 0})},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/maintenance/drill-run"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,...Ca.enqueueDrill(String(l.drillId??""))},202)}catch(h){return d(h,422)}}}if(v.pathname.startsWith("/api/volumes")){let d=a.environments.get(L),l=Q(O).actor?.id,h=(S,w=409)=>g({ok:!1,error:S instanceof Error?S.message:String(S)},w,{"cache-control":"no-store"});if(v.pathname==="/api/volumes"&&m.method==="GET"){let S=wa.inventory(a.project.id,d?.id),w=a.store.listResources(a.project.id,d?.id).map((A)=>({id:A.id,name:A.name,slug:A.slug,kind:A.kind,provider:A.provider,providerId:A.providerId}));return g({ok:!0,volumes:S,resources:w,operations:Ee.list({projectId:a.project.id,limit:100}).filter((A)=>A.operation.kind.startsWith("volume.")),recoveryPoints:Ue.listRecoveryPoints(a.project.id).filter((A)=>A.kind==="volume"),providers:Ia.map((A)=>({provider:A.provider,type:A.type,capabilities:A.capabilities()}))},200,{"cache-control":"no-store"})}if(v.pathname==="/api/volumes"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:S.resourceId?String(S.resourceId):void 0,name:String(S.name??""),provider:String(S.provider??"docker"),type:S.type==="docker"?"docker":S.type,capacityBytes:S.capacityBytes==null?void 0:Number(S.capacityBytes),filesystem:S.filesystem?String(S.filesystem):void 0,encrypted:S.encrypted===!0,desiredState:S.desiredState&&typeof S.desiredState==="object"?S.desiredState:{},actorId:l})},202,{"cache-control":"no-store"})}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/attach"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.attach(String(S.volumeId??""),{resourceId:String(S.resourceId??""),targetPath:String(S.targetPath??""),readOnly:S.readOnly===!0,uid:S.uid==null?void 0:Number(S.uid),gid:S.gid==null?void 0:Number(S.gid),mode:S.mode?String(S.mode):void 0,propagation:S.propagation,driverOptions:S.driverOptions&&typeof S.driverOptions==="object"?S.driverOptions:{},actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/detach"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.detach(String(S.volumeId??""),String(S.attachmentId??""),{force:S.force===!0,drained:S.drained===!0,unmounted:S.unmounted===!0,confirmation:S.confirmation?String(S.confirmation):void 0,actorId:l})},202)}catch(w){return h(w)}}if(v.pathname==="/api/volumes/resize"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.resize(String(S.volumeId??""),Number(S.capacityBytes),{drained:S.drained===!0,actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/snapshot"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.snapshot(String(S.volumeId??""),{name:S.name?String(S.name):void 0,actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/restore"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.restore(String(S.snapshotId??""),{name:String(S.name??""),actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/discover"&&m.method==="POST")try{return g({ok:!0,volumes:await pr.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:l})})}catch(S){return h(S,502)}if(v.pathname==="/api/volumes/adopt"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,volume:pr.adopt(String(S.volumeId??""),{name:String(S.name??""),actorId:l})})}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes"&&m.method==="DELETE"){let S=await D(m),w=Oe.resolveSession(m);try{return g({ok:!0,...pr.delete(String(S.volumeId??""),{recentAuthAt:!W||w&&U.isRecentlyAuthenticated(w)?new Date().toISOString():void 0,confirmation:S.confirmation?String(S.confirmation):void 0,backupOverride:S.backupOverride===!0,backupOverrideConfirmation:S.backupOverrideConfirmation?String(S.backupOverrideConfirmation):void 0,actorId:l})},202)}catch(A){return h(A)}}}if(v.pathname==="/api/backups"&&m.method==="GET"){let d=a.environments.get(L),l=Ue.listPolicies(a.project.id,d?.id),h=new Set(l.map((k)=>k.id)),S=Ue.listRecoveryPoints(a.project.id).filter((k)=>!k.policyId||h.has(k.policyId)),w=Ue.listJobs(a.project.id).filter((k)=>!k.policyId||h.has(k.policyId)),A=(k)=>({...k,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!k.credentialRef,clientEncryptionConfigured:!!k.encryptionKeyRef}),I=await Promise.all(Ue.listDestinations(a.project.id).map(async(k)=>({...A(k),credentialStatus:await Mp(k,lr)})));return g({ok:!0,destinations:I,policies:l,recoveryPoints:S,jobs:w,coverage:Ue.coverage(a.project.id).filter((k)=>h.has(k.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((k)=>({id:k.id,name:k.name,slug:k.slug,kind:k.kind})):[]})}if(v.pathname==="/api/backups/destinations"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim(),h=String(d.provider??""),S=String(d.encryption??"provider"),w=`secret://data-services/backups/${a.project.id}/${l}`,A=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(h))return g({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(S))return g({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let I,k;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))I=`${w}/credentials`,await lr.put(I,JSON.stringify(d.credentials)),A.push(I);if(S!=="provider"){let _=String(d.encryptionKey??"");if(_.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");k=`${w}/encryption-key`,await lr.put(k,_),A.push(k)}let M=Ue.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:l,provider:h,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):Mr,forcePathStyle:d.forcePathStyle===!0,credentialRef:I,encryption:S,encryptionKeyRef:k,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return g({ok:!0,destination:{...M,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!I,clientEncryptionConfigured:!!k}},201)}catch(I){for(let k of A)await lr.remove(k).catch(()=>{});return g({ok:!1,error:I instanceof Error?I.message:String(I)},422)}}if(v.pathname==="/api/backups/destinations/test"&&m.method==="POST"){let d=await D(m),l=Ue.getDestination(String(d.id??""));if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Backup destination was not found."},404);if(l.provider==="aws_backup")return g({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Hu.test(l),g({ok:!0,destination:Ue.recordDestinationTest(l.id,{ok:!0})})}catch(h){let S=h instanceof Error?h.message:String(h);return Ue.recordDestinationTest(l.id,{ok:!1,error:S}),g({ok:!1,error:S},502)}}if(v.pathname==="/api/backups/policies"&&m.method==="POST"){let d=await D(m),l=a.environments.get(L),h=Ue.getDestination(String(d.destinationId??"")),S=String(d.resourceKind??""),w=d.dataServiceId?String(d.dataServiceId):void 0,A=w?Re.get(w):void 0,I=d.resourceId?String(d.resourceId):void 0,k=I?a.store.getResource(I):void 0;if(!l)return g({ok:!1,error:"Environment was not found."},404);if(!h||h.projectId!==a.project.id)return g({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(S))return g({ok:!1,error:"A supported backup resource kind is required."},422);if(w&&(!A||A.projectId!==a.project.id||A.environmentId!==l.id))return g({ok:!1,error:"Data service was not found in this environment."},404);if(I&&(!k||k.projectId!==a.project.id||k.environmentId!==l.id))return g({ok:!1,error:"Resource was not found in this environment."},404);if(S==="managed_database"&&!A)return g({ok:!1,error:"Managed database policies require a data service."},422);if(S==="logical_database"&&(!A||!["container","server"].includes(A.provider)))return g({ok:!1,error:"Logical database policies require an on-box data service."},422);if(S==="volume"&&(!k||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return g({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let M=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(S==="files"&&(!k||!M.length))return g({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(S==="control_plane"&&h.encryption==="provider")return g({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(S==="infrastructure"&&(h.provider!=="aws_backup"||!M.some((_)=>_.startsWith("resource:arn:"))||!M.some((_)=>_.startsWith("role:arn:"))))return g({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let _=Ue.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:l.id,resourceId:I,dataServiceId:w,destinationId:h.id,name:String(d.name??"").trim(),resourceKind:S,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:S==="volume"?[String(d.volumeName),...M]:M,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return g({ok:!0,policy:_},201)}catch(_){return g({ok:!1,error:_ instanceof Error?_.message:String(_)},422)}}if(v.pathname==="/api/backups/run"&&m.method==="POST"){let d=await D(m),l=Ue.getPolicy(String(d.policyId??"")),h=a.environments.get(L);if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Backup policy was not found in this environment."},404);try{let S=on.enqueueBackup(l,new Date().toISOString(),Q(O).actor?.id);return g({ok:!0,job:S},202)}catch(S){return g({ok:!1,error:S instanceof Error?S.message:String(S)},409)}}if(v.pathname==="/api/backups/verify"&&m.method==="POST"){let d=await D(m),l=Ue.getRecoveryPoint(String(d.recoveryPointId??""));if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Recovery point was not found."},404);return g({ok:!0,job:on.enqueueVerification(l)},202)}if(v.pathname==="/api/backups/restore"&&m.method==="POST"){let d=await D(m),l=Ue.getRecoveryPoint(String(d.recoveryPointId??"")),h=d.mode==="in_place"?"in_place":"isolated",S=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:h==="in_place"}:{inPlace:h==="in_place"},w=Oe.resolveSession(m),A={mode:h,target:S,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!W||!!w&&U.isRecentlyAuthenticated(w),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&h!=="isolated")return g({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let I=on.planRestore(l,A);if(d.execute!==!0)return g({ok:!0,plan:I,executionCreated:!1});let k=on.enqueueRestore(l,{...A,drill:d.drill===!0,actorId:Q(O).actor?.id});return g({ok:!0,plan:I,job:k},202)}catch(I){return g({ok:!1,error:I instanceof Error?I.message:String(I)},409)}}if(v.pathname==="/api/backups/recovery-points"&&m.method==="POST"){let d=await D(m),l=Ue.getRecoveryPoint(String(d.id??""));if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return g({ok:!1,error:"held or pinned must be provided."},422);return g({ok:!0,recoveryPoint:Ue.updateRecoveryPoint(l.id,{held:d.held==null?l.held:d.held===!0,pinned:d.pinned==null?l.pinned:d.pinned===!0})})}if(v.pathname==="/api/backups/retention"&&m.method==="POST")return g({ok:!0,jobs:on.enqueueRetention()},202);if(v.pathname==="/api/data-services/capabilities"&&m.method==="GET"){let d=String(v.searchParams.get("engine")??""),l=String(v.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(l))return g({ok:!1,error:"A supported engine and provider are required."},422);return g({ok:!0,engine:d,provider:l,capabilities:Fi(d,l)})}if(v.pathname==="/api/data-services"&&m.method==="GET"){let d=a.environments.get(L),l=Re.list(a.project.id,d?.id).map((h)=>{let S=Re.credential(h.id);return{...h,credentialRef:void 0,credential:S?{configured:!0,username:S.username,version:S.version,rotatedAt:S.rotatedAt}:void 0,dependencies:Re.dependencies(h.id).map((w)=>({resourceId:w.resourceId,requiresRedeploy:w.requiresRedeploy}))}});return g({ok:!0,services:l})}if(v.pathname==="/api/data-services/preview"&&m.method==="POST"){let d=await D(m);if(d.id){let S=Re.get(String(d.id)),w=a.environments.get(L),A=String(d.action??"");if(!S||S.projectId!==a.project.id||S.environmentId!==w?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!ya.includes(A))return g({ok:!1,error:`Action must be one of: ${ya.join(", ")}.`},422);try{return g({ok:!0,plan:fo.plan(S,A,d.changes??{})})}catch(I){return g({ok:!1,error:I instanceof Error?I.message:String(I)},422)}}let l=String(d.engine??""),h=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(h))return g({ok:!1,error:"A supported engine and provider are required."},422);return g({ok:!0,capabilities:Fi(l,h),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(v.pathname==="/api/data-services"&&m.method==="POST"){let d=await D(m),l=String(d.engine??""),h=String(d.provider??""),S=a.environments.get(L),w=Q(O);if(!S)return g({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(h))return g({ok:!1,error:"A supported engine and provider are required."},422);let A={organizationId:a.organization.id,projectId:a.project.id,environmentId:S.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:l,provider:h,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(h==="aws_elasticache"?"cache.t4g.micro":h==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:w.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let k=Re.create({...A,status:"adopted",credentialRef:void 0});return g({ok:!0,service:k,readOnly:!0},201)}if(!Ju({provider:h,engine:l}))return g({ok:!1,error:`No ${h}/${l} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let I=await fo.create(A);return g({ok:!0,service:I.service,operationId:I.operationId,oneTimeCredential:I.credential},201)}catch(I){return g({ok:!1,error:I instanceof Error?I.message:String(I)},422)}}if(v.pathname==="/api/data-services/connections"&&m.method==="GET"){let d=Re.get(String(v.searchParams.get("id")??"")),l=a.environments.get(L);if(!d||d.projectId!==a.project.id||d.environmentId!==l?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);let h=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,S=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,w=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),A=typeof d.observedState.database==="string"?d.observedState.database:void 0,I=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),k=[...h?[{type:d.publicExposure?"external":"internal",host:h,port:w,database:A,tls:I}]:[],...S?[{type:"internal",host:S,port:w,database:A,tls:I}]:[],{type:"tunnel",host:h??d.placement,port:w,database:A,tls:I}];return g({ok:!0,serviceId:d.id,guidance:Fp(d,k)})}if(v.pathname==="/api/data-services/action"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L),S=String(d.action??"");if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!ya.includes(S))return g({ok:!1,error:`Action must be one of: ${ya.join(", ")}.`},422);let w=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let A=fo.plan(l,S,w);if(d.execute!==!0)return g({ok:!0,plan:A,productionExecutionCreated:!1});let I=fo.enqueue(l,S,w,Q(O).actor?.id);return g({ok:!0,plan:A,operationId:I},202)}catch(A){return g({ok:!1,error:A instanceof Error?A.message:String(A)},409)}}if(v.pathname==="/api/data-services/dependencies"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L),S=a.store.getResource(String(d.resourceId??""));if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!S||S.projectId!==a.project.id||S.environmentId!==h?.id)return g({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return g({ok:Re.removeDependency(l.id,S.id)});return Re.addDependency({serviceId:l.id,resourceId:S.id,secretRef:l.credentialRef??`secret://data-services/${l.projectId}/${l.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),g({ok:!0,dependencies:Re.dependencies(l.id).map((w)=>({resourceId:w.resourceId,requiresRedeploy:w.requiresRedeploy}))})}if(v.pathname==="/api/data-services/management"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L);if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(l.origin!=="adopted"||d.reviewed!==!0||d.confirm!==l.name)return g({ok:!1,error:`Enabling management requires reviewed=true and typing ${l.name}.`},409);return g({ok:!0,service:Re.update(l.id,l.version,{managementEnabled:!0})})}if(v.pathname==="/api/data-services/reveal"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L),S=l?Re.credential(l.id):void 0;if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!S)return g({ok:!1,error:"No managed credential is configured."},404);return g({ok:!0,credential:{username:S.username,password:await lr.resolve(S.secretRef),version:S.version}},200,{"cache-control":"no-store"})}if(v.pathname==="/api/databases"&&m.method==="GET")return g(await Nf(o,L));if(v.pathname==="/api/databases"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim();if(!Or(l))return g({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return g({...await $f(o,L,l),name:l})}if(v.pathname==="/api/databases/vitess"&&m.method==="GET"){let d=await jf(o,L);return g({...d,unhealthy:Ff(d.tablets),missingPrimary:Uf(d)})}if(v.pathname==="/api/databases/vitess/provision"&&m.method==="POST"){let d=await D(m);try{return g(await Xf(o,L,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(l){return g({ok:!1,error:l instanceof Error?l.message:String(l)},422)}}if(v.pathname==="/api/databases/vitess/migrations"&&m.method==="GET"){let d=v.searchParams.get("keyspace")??void 0;return g(await Gf(o,L,d))}if(v.pathname==="/api/databases/vitess/migrations/action"&&m.method==="POST"){let d=await D(m),l=String(d.uuid??"").trim(),h=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(h))return g({ok:!1,error:"Unknown migration action."},422);return g(await Kf(o,L,l,h))}if(v.pathname==="/api/databases/vitess/keyspaces"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim(),h=d.sharded===!0;return g(await Jf(o,L,l,{sharded:h}))}if(v.pathname==="/api/databases/vitess/vschema"&&m.method==="POST"){let d=await D(m),l=String(d.keyspace??"").trim(),h=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return g(await Hf(o,L,l,h))}if(v.pathname==="/api/databases/vitess/schema"&&m.method==="POST"){let d=await D(m),l=String(d.sql??"");return g(await Wf(o,L,l))}if(v.pathname==="/api/databases/vitess/install-client"&&m.method==="POST")return g(await qf(o,L));if(v.pathname==="/api/databases/backups"&&m.method==="GET")return g(await Bf(o,L));if(v.pathname==="/api/databases/backup"&&m.method==="POST"){let d=await D(m),l=String(d.database??"").trim();if(!Or(l))return g({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to back up this database.`},409);return g(await Lf(o,L,l))}if(v.pathname==="/api/databases/users"&&m.method==="POST"){let d=await D(m),l=String(d.username??"").trim(),h=String(d.password??""),S=String(d.database??"").trim()||void 0,w=d.access==="readonly"?"readonly":"all";if(!Or(l))return g({ok:!1,error:"Username must be a valid identifier."},422);if(!h)return g({ok:!1,error:"Password is required."},422);if(S&&!Or(S))return g({ok:!1,error:"Database must be a valid identifier."},422);return g({...await Mf(o,L,{username:l,password:h,database:S,access:w}),username:l})}if(v.pathname==="/api/dashboard-data")return Pe=C.get(L)??await ae(L),ae(L),g(Eu(Pe,{user:Ot,slug:o.project.slug}));if(v.pathname==="/api/users"&&m.method==="GET")return g({ok:!0,users:vt(t).map(vi)});if(v.pathname==="/api/users"&&m.method==="POST"){let d=await D(m),l=String(d.username??"").trim();if(!ia(l))return g({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let h=d.sites&&typeof d.sites==="object"?d.sites:{},S=new Set(Object.keys(o.sites??{})),w={};for(let[k,M]of Object.entries(h)){if(!S.has(k))return g({ok:!1,error:`Site '${k}' was not found.`},404);if(M!=="owner"&&M!=="collaborator")return g({ok:!1,error:`Unknown site role '${M}'. Use 'owner' or 'collaborator'.`},422);w[k]=M}let A=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(A&&A.length<12)return g({ok:!1,error:"Password must be at least 12 characters."},422);let I=ro(t,{username:l,password:A,name:typeof d.name==="string"?d.name:void 0,sites:w});return Ks(a,vt(t)),Ft(),g({ok:!0,user:vi(I.user),password:I.password})}if(v.pathname==="/api/users"&&m.method==="DELETE"){let d=await D(m),l=String(d.username??"").trim();if(l.toLowerCase()===O.username.toLowerCase())return g({ok:!1,error:"You cannot remove your own account."},409);let h=jt(vt(t),l),S=h?a.store.getActorByExternalId("user",`dashboard:${h.username.toLowerCase()}`):void 0,w=S?a.store.getMembershipForActor(a.organization.id,S.id):void 0;if(w&&w.source!=="legacy")return g({ok:!1,error:"Organization members must be removed from Organization access."},409);let A=vu(t,l);if(!A.ok)return g(A,409);return Ks(a,vt(t)),H.clear(),g({ok:!0,username:l})}if(v.pathname==="/api/actions/run"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=d.action?KT(d.action,L):void 0;if(!l)return g({ok:!1,error:"Unknown dashboard action."},404);if(l.mutates&&d.confirm!==l.confirm)return g({ok:!1,error:`Type "${l.confirm}" to run this action.`},409);let h=await Dr({controlPlane:a,environment:L,actor:O,kind:`dashboard.action.${l.id}`,input:{action:l.id},execute:()=>zu(l,{cwd:t,cliEntry:i})});return g({...h.result,controlPlaneOperation:h.operation})}if(v.pathname==="/api/server/operations/run"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=d.operation?Cu(d.operation,o,Pe):void 0;if(!l)return g({ok:!1,error:"Unknown or unavailable server operation."},404);if(l.mutates&&d.confirm!==l.confirm)return g({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let h=Kt(a,String(L));await new Pn(ce).run(new Zi,{...h,artifactRoot:t});let S=Gs(ce,{scope:h,desiredConfigHash:a.project.desiredConfigHash});if(S.decision.outcome==="block")return g({ok:!1,error:`Operation blocked by security policy: ${S.decision.explanation}`,securityReview:S},409);let w=await Dr({controlPlane:a,environment:L,actor:O,kind:`dashboard.server.${l.id}`,resourceSlug:l.target,input:{operation:l.id,target:l.target,to:d.to??null},execute:()=>da(o,L,l,{to:d.to})});return g({...w.result,controlPlaneOperation:w.operation,securityReview:S})}if(v.pathname==="/api/server/command"&&m.method==="POST"){let d=await m.json().catch(()=>({}));if(d.confirm!=="run")return g({ok:!1,error:'Type "run" to execute this command on the server.'},409);let l=await Dr({controlPlane:a,environment:L,actor:O,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>no(o,L,String(d.command??""))});return g({...l.result,controlPlaneOperation:l.operation})}if(v.pathname==="/api/serverless/operations")return g(_u(o,L,Pe));if(v.pathname==="/api/serverless/operations/run"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=d.operation?Bh(d.operation,o,L,Pe):void 0;if(!l)return g({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(l.mutates&&d.confirm!==l.confirm)return g({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let h=await Dr({controlPlane:a,environment:L,actor:O,kind:`dashboard.serverless.${l.id}`,input:{operation:l.id,min:d.min??null,max:d.max??null},execute:()=>jh(o,L,l,{min:d.min,max:d.max})});return Pe=await $n(o,L),C.set(L,Pe),g({...h.result,controlPlaneOperation:h.operation})}if(v.pathname==="/api/serverless/command"&&m.method==="POST"){let d=await m.json().catch(()=>({}));if(d.confirm!=="run")return g({ok:!1,error:'Type "run" to execute this command.'},409);return g(await Fh(o,L,String(d.command??"")))}if(v.pathname==="/api/serverless/dlq"&&m.method==="GET"){let d=Number(v.searchParams.get("max"))||10;return g(await Uh(o,L,d))}if(v.pathname==="/api/serverless/dlq/redrive"&&m.method==="POST"){let d=await m.json().catch(()=>({}));if(d.confirm!=="redrive")return g({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return g(await zh(o,L,{max:d.max,targetQueue:d.targetQueue}))}if(v.pathname==="/api/serverless/dlq/purge"&&m.method==="POST"){if((await m.json().catch(()=>({}))).confirm!=="purge")return g({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return g(await Vh(o,L))}if(v.pathname==="/api/serverless/secrets"&&m.method==="GET")return g({secrets:qh(o,L)});if(v.pathname==="/api/serverless/secrets"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return g({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return g({ok:!1,error:"A non-empty value is required."},422);return g(await Jh(o,L,l,d.value))}if(v.pathname==="/api/serverless/secrets"&&m.method==="DELETE"){let d=await m.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return g({ok:!1,error:"A secret id is required."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to delete this secret.`},409);return g(await Hh(o,L,l))}if(v.pathname==="/api/serverless/functions/config"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.mode??"").trim();if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to update this function.`},409);return g(await Wh(o,L,l,{memory:d.memory,timeout:d.timeout}))}if(v.pathname==="/api/serverless/alarms"&&m.method==="GET")return g(await Gh(o,L));if(v.pathname==="/api/serverless/alarms"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.preset??"").trim(),h=Number(d.threshold);if(!l)return g({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(h))return g({ok:!1,error:"A numeric threshold is required."},422);return g(await Kh(o,L,l,h))}if(v.pathname==="/api/serverless/alarms"&&m.method==="DELETE"){let d=await m.json().catch(()=>({})),l=String(d.name??"").trim();if(!l)return g({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to delete this alarm.`},409);return g(await Qh(o,L,l))}if(v.pathname==="/api/serverless/traces"&&m.method==="GET"){let d=Number(v.searchParams.get("minutes"))||30;return g(await la(o,L,d))}if(v.pathname==="/api/serverless/scheduler"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.action??"").trim();if(l!=="enable"&&l!=="disable"&&l!=="run")return g({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to ${l} the scheduler.`},409);return g(await Mu(o,L,l))}if(!Ey(v.pathname,Ot))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(L)}`}});let Un=await Zt(O,L);if(!Un)return Sa("ts-cloud dashboard UI is unavailable.",503);return Ty(Un,v.pathname)}catch(an){if(e.verbose)console.error(an);return g({ok:!1,error:an?.message??String(an)},500)}})();if(!Fe)return Fe;if(ye&&(v.pathname.startsWith("/api/")||v.pathname.startsWith("/auth/"))){let oe;if((z.headers.get("content-type")||"").includes("application/json"))oe=await z.json().catch(()=>{return});let Xe=Oe.resolveUser(m),Ge=Xe?Q(Xe).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:Ge?.id,correlationId:te,type:Fe.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Fe.status<400?"info":"warning",payload:_T(m.method,v.pathname,oe,Fe.status,Date.now()-G)})}return Fe.headers.set("x-request-id",te),Fe}});ho?.start();let hb=e.spendLoop??!0,cl;if(hb)(async()=>{let{SpendRunner:m,SpendLoopLease:q,startSpendLoop:G}=await import("./chunk-a2t1e5yb.js"),{store:z}=await ky(a.store),te=new m({controlPlane:a.store,store:z,alerts:ne});cl=G(te,{lease:new q(a.store,{owner:`dashboard:${process.pid}`}),onError:(ye)=>console.error(`[ts-cloud] spend cycle failed: ${ye instanceof Error?ye.message:String(ye)}`)})})();let yb=jn.stop.bind(jn);return jn.stop=(m)=>{clearInterval(il),clearInterval(ol),clearInterval(sl),clearInterval(nl),clearInterval(rl),clearInterval(Xu),clearInterval(Zu),clearInterval(el),clearInterval(tl),Ft(),ze.clear(),ho?.stop(),cl?.();let q=yb(m);if(ho)ho.settled().finally(()=>a.store.close());else a.store.close();return q},{server:jn,url:`http://${r}:${jn.port}/`}}
-export{$o as w,Hr as x,oc as y,_f as z,Am as A,Yh as B,nE as C,Rm as D,Gi as E,Od as F,_d as G,Fd as H,Ud as I,Jd as J,Hd as K,Md as L,Ld as M,jd as N,ji as O,Fi as P,Ic as Q,Fp as R,Ko as S,Cc as T,Ec as U,Tc as V,Ac as W,kc as X,Pc as Y,xc as Z,Dc as _,Xn as $,Oc as aa,Va as ba,Hn as ca,Ao as da,ko as ea,$i as fa,Zl as ga,Vn as ha,Ra as ia,Ut as ja,Da as ka,_a as la,$a as ma,Io as na,ca as oa,Cu as pa,da as qa,no as ra,Di as sa,ln as ta,Qi as ua,Xi as va,Hs as wa,Kt as xa,Af as ya,u$ as za,l$ as Aa,Gs as Ba,f$ as Ca,Rn as Da,ll as Ea,jo as Fa,hn as Ga,yn as Ha,uc as Ia,mc as Ja,lc as Ka,pc as La,bc as Ma,vc as Na,Ho as Oa,JO as Pa,Gd as Qa,Kd as Ra,nf as Sa,cr as Ta,Fu as Ua,fB as Va};
+`);return new Response(se,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(v.pathname==="/api/telemetry/saved-queries"&&m.method==="GET"){let B=Q(O);return g({ok:!0,queries:l.listSavedQueries(a.project.id,B.actor?.id)})}if(v.pathname==="/api/telemetry/saved-queries"&&m.method==="POST"){let B=await D(m),Y=Q(O);return g({ok:!0,query:l.saveQuery(a.project.id,Y.actor?.id,String(B.name??""),k(B.query??B))},201)}if(v.pathname==="/api/telemetry/saved-queries"&&m.method==="DELETE"){let B=await D(m),Y=Q(O),F=l.deleteSavedQuery(a.project.id,Y.actor?.id,String(B.id??""));return g({ok:F},F?200:404)}}if(v.pathname.startsWith("/api/configuration")){let d=a.environments.get(L),l=O.role==="admin"||!!Ot.capabilities?.includes("secrets:read"),h=O.role==="admin"||!!Ot.capabilities?.includes("secrets:write"),S={projectId:a.project.id,environmentId:d?.id},w={"cache-control":"no-store"};if(v.pathname==="/api/configuration"&&m.method==="GET"){let A=Object.fromEntries(v.searchParams),I=A.scopeType||A.scopeId?Ci(A,S):void 0,k=["variable","secret"].includes(String(A.kind))?A.kind:void 0,M=I?.type==="preview"?je.previews.getInstance(I.id):void 0,_=M?je.previews.getDefinition(M.definitionId):void 0,re=I?await wt.resolve({projectId:a.project.id,environmentId:I.environmentId,resourceId:I.resourceId,functionId:I.type==="function"?I.id:void 0,previewId:I.previewId,trustedPreview:!!M&&!M.fork,allowedPreviewSecrets:_?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:l}):void 0,B=a.store.listResources(a.project.id);return g({ok:!0,entries:wt.list({projectId:a.project.id,scope:I,kind:k,search:A.search,canReadSecretMetadata:l}),effectiveEntries:re?Object.values(re.entries).filter((Y)=>!k||Y.kind===k).filter((Y)=>!A.search||Y.key.toLowerCase().includes(String(A.search).toLowerCase())):[],configurationHash:re?.configurationHash,warnings:re?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:B.filter((Y)=>Y.kind!=="function"),functions:B.filter((Y)=>Y.kind==="function"),previews:je.previews.listInstances({projectId:a.project.id}).filter((Y)=>Y.status!=="destroyed").map((Y)=>({id:Y.id,name:Y.name,environmentId:Y.baseEnvironmentId,resourceId:Y.resourceId,fork:Y.fork,status:Y.status}))}},200,w)}if(v.pathname==="/api/configuration/export"&&m.method==="GET"){let A=Ci(Object.fromEntries(v.searchParams),S);return new Response(wt.exportVariables({projectId:a.project.id,scope:A}),{headers:{...w,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(v.pathname==="/api/configuration/plan"&&m.method==="POST"){let A=await D(m),I=Ci(A,S),k=A.values&&typeof A.values==="object"&&!Array.isArray(A.values)?Object.fromEntries(Object.entries(A.values).map(([M,_])=>[M,String(_)])):{};return g({ok:!0,plan:wt.plan({projectId:a.project.id,scope:I,values:k,removeMissing:A.removeMissing===!0})},200,w)}if(v.pathname==="/api/configuration"&&m.method==="POST"){let A=await D(m),I=Ci(A,S),k=A.kind==="secret"?"secret":"variable",M=String(A.key??"");if(k==="secret"&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);try{let _=await wt.set({organizationId:a.organization.id,projectId:a.project.id,scope:I,key:M,kind:k,value:A.value==null?void 0:String(A.value),reference:A.reference==null?void 0:String(A.reference),backend:A.backend,required:A.required===!0,expectedVersion:A.expectedVersion==null?void 0:Number(A.expectedVersion),confirmed:String(A.confirm??"")===M,idempotencyKey:m.headers.get("idempotency-key")??A.idempotencyKey,actorId:Q(O).actor?.id});return g({ok:!0,entry:wt.list({projectId:a.project.id,scope:I,canReadSecretMetadata:l}).find((re)=>re.id===_.entry.id),mutation:_.mutation,warnings:_.warnings},_.mutation.added.length?201:200,w)}catch(_){return g({ok:!1,error:_ instanceof Error?_.message:String(_)},409,w)}}if(v.pathname==="/api/configuration/import"&&m.method==="POST"){let A=await D(m),I=Ci(A,S),k=Array.isArray(A.secretKeys)?A.secretKeys.map(String):[];if(k.length&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);try{let M=await wt.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:I,source:String(A.source??""),secretKeys:k,backend:A.backend,confirmed:A.confirm==="import",idempotencyKey:m.headers.get("idempotency-key")??A.idempotencyKey,actorId:Q(O).actor?.id});return g({ok:M.document.valid,diagnostics:M.document.diagnostics,mutation:M.mutation,warnings:M.warnings},M.document.valid?200:422,w)}catch(M){return g({ok:!1,error:M instanceof Error?M.message:String(M)},409,w)}}if(v.pathname==="/api/configuration/dependencies"&&m.method==="POST"){let A=await D(m),I=$r.get(String(A.entryId??"")),k=a.store.getResource(String(A.resourceId??""));if(!I||I.projectId!==a.project.id||!k||k.projectId!==a.project.id)return g({ok:!1,error:"Configuration entry or dependent resource was not found."},404,w);return g({ok:!0,dependency:$r.setDependency({entryId:I.id,resourceId:k.id,injectionTarget:["native_reference","file"].includes(String(A.injectionTarget))?A.injectionTarget:"environment",required:A.required!==!1,requiresRedeploy:A.requiresRedeploy!==!1,lastDeployedVersion:A.lastDeployedVersion==null?void 0:Number(A.lastDeployedVersion)})},200,w)}if(v.pathname==="/api/configuration/transfer"&&m.method==="POST"){let A=await D(m),I=$r.get(String(A.id??"")),k=Ci({...A,scopeType:A.targetScopeType,scopeId:A.targetScopeId},S);if(!I||I.projectId!==a.project.id)return g({ok:!1,error:"Configuration entry was not found."},404,w);if(I.kind==="secret"&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);try{let M=await wt.transfer({entryId:I.id,targetScope:k,mode:A.mode==="move"?"move":"copy",confirmed:A.confirm===I.key,actorId:Q(O).actor?.id,idempotencyKey:m.headers.get("idempotency-key")??A.idempotencyKey});return g({ok:!0,entry:wt.list({projectId:a.project.id,scope:k,canReadSecretMetadata:l}).find((_)=>_.id===M.entry.id),mutation:M.mutation},200,w)}catch(M){return g({ok:!1,error:M instanceof Error?M.message:String(M)},409,w)}}if(v.pathname==="/api/configuration/bulk"&&m.method==="POST"){let A=await D(m),I=Array.isArray(A.ids)?A.ids.map(String).slice(0,500):[],k=I.map((_)=>$r.get(_)).filter((_)=>!!_&&_.projectId===a.project.id);if(k.length!==I.length)return g({ok:!1,error:"One or more configuration entries were not found."},404,w);if(k.some((_)=>_.kind==="secret")&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);if(A.action!=="delete"||A.confirm!=="bulk")return g({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,w);let M=[];try{for(let _ of k)M.push(await wt.remove({entryId:_.id,expectedVersion:_.version,confirmed:!0,actorId:Q(O).actor?.id}));return g({ok:!0,removed:M.flatMap((_)=>_.removed),affectedResourceIds:[...new Set(M.flatMap((_)=>_.affectedResourceIds))].sort()},200,w)}catch(_){return g({ok:!1,error:_ instanceof Error?_.message:String(_),partial:M.flatMap((re)=>re.removed)},409,w)}}if(v.pathname==="/api/configuration/reveal"&&m.method==="POST"){let A=await D(m),I=Oe.resolveSession(m);try{return g({ok:!0,value:await wt.reveal({entryId:String(A.id??""),canRevealSecrets:l,recentlyAuthenticated:!W||!!I&&U.isRecentlyAuthenticated(I),actorId:Q(O).actor?.id})},200,w)}catch(k){return g({ok:!1,error:k instanceof Error?k.message:String(k)},403,w)}}if(v.pathname==="/api/configuration"&&m.method==="DELETE"){let A=await D(m),I=$r.get(String(A.id??""));if(I?.kind==="secret"&&!h)return g({ok:!1,error:"Secret write permission is required."},403,w);if(!I||I.projectId!==a.project.id)return g({ok:!1,error:"Configuration entry was not found."},404,w);try{return g({ok:!0,mutation:await wt.remove({entryId:I.id,expectedVersion:Number(A.expectedVersion),confirmed:String(A.confirm??"")===I.key,actorId:Q(O).actor?.id})},200,w)}catch(k){return g({ok:!1,error:k instanceof Error?k.message:String(k)},409,w)}}}if(v.pathname.startsWith("/api/fleet")){let d=Q(O).actor?.id,l=(h,S=409)=>g({ok:!1,error:h instanceof Error?h.message:String(h)},S,{"cache-control":"no-store"});if(v.pathname==="/api/fleet"&&m.method==="GET")return g({ok:!0,servers:ki.list(a.project.id),resources:a.store.listResources(a.project.id),operations:Ee.list({projectId:a.project.id,limit:200}).filter((h)=>h.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(v.pathname==="/api/fleet"&&m.method==="POST"){let h=await D(m);try{return g({ok:!0,server:rr.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(h.name??""),provider:["aws","hetzner"].includes(String(h.provider))?h.provider:"ssh",providerId:h.providerId?String(h.providerId):void 0,region:h.region?String(h.region):void 0,zone:h.zone?String(h.zone):void 0,endpoint:String(h.endpoint??""),sshUser:String(h.sshUser??"deploy"),sshPort:h.sshPort?Number(h.sshPort):22,credentialRef:String(h.credentialRef??""),roles:Array.isArray(h.roles)?h.roles:[],labels:h.labels&&typeof h.labels==="object"?h.labels:{}})},201)}catch(S){return l(S,422)}}if(v.pathname==="/api/fleet/action"&&m.method==="POST"){let h=await D(m),S=String(h.id??""),w=String(h.action??"");try{if(w==="test")return g({ok:!0,server:await rr.test(S)});if(w==="validate")return g({ok:!0,server:await rr.validate(S)});if(w==="review_host_key")return g({ok:!0,server:rr.reviewHostKey(S,String(h.fingerprint??""))});if(w==="bootstrap")return g({ok:!0,...rr.bootstrap(S,h.confirmed===!0)},h.confirmed===!0?202:200);if(w==="heartbeat")return g({ok:!0,server:rr.heartbeat(S,{usage:h.usage&&typeof h.usage==="object"?h.usage:{}})});if(w==="drain")return g({ok:!0,server:rr.drain(S,h.completed===!0)});if(w==="uncordon")return g({ok:!0,server:rr.uncordon(S)});if(w==="archive")return g({ok:!0,server:rr.archive(S,String(h.confirmation??""))});return l("Unsupported fleet action.",422)}catch(A){return l(A)}}}if(v.pathname.startsWith("/api/capacity")){let d=(l,h=409)=>g({ok:!1,error:l instanceof Error?l.message:String(l)},h,{"cache-control":"no-store"});if(v.pathname==="/api/capacity"&&m.method==="GET")return g({ok:!0,pools:Lr.listPools(a.project.id),placements:Lr.listPlacements(a.project.id),servers:ki.list(a.project.id)},200,{"cache-control":"no-store"});if(v.pathname==="/api/capacity"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,pool:Lr.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(l.name??""),purpose:String(l.purpose??"application"),backend:String(l.backend??"server"),region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{},requiredServerLabels:l.requiredServerLabels&&typeof l.requiredServerLabels==="object"?l.requiredServerLabels:{},toleratedTaints:Array.isArray(l.toleratedTaints)?l.toleratedTaints.map(String):[],capacity:l.capacity&&typeof l.capacity==="object"?l.capacity:{},maxWorkloads:Number(l.maxWorkloads??10),costWeight:Number(l.costWeight??1),spreadKey:l.spreadKey?String(l.spreadKey):void 0,concurrency:Number(l.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/capacity/member"&&m.method==="POST"){let l=await D(m);try{return Lr.addMember(String(l.poolId??""),String(l.serverId??"")),g({ok:!0,pool:Lr.getPool(String(l.poolId??""))})}catch(h){return d(h,422)}}if(v.pathname==="/api/capacity/explain"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,decisions:Wu.explain(a.project.id,{purpose:String(l.purpose??"application"),resources:l.resources&&typeof l.resources==="object"?l.resources:{},region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{}})})}catch(h){return d(h,422)}}if(v.pathname==="/api/capacity/action"&&m.method==="POST"){let l=await D(m);try{if(l.action==="drain")return g({ok:!0,...Wu.drainPool(String(l.poolId??""))});if(l.action==="enable")return g({ok:!0,pool:Lr.updatePool(String(l.poolId??""),{status:"active"})});if(l.action==="disable")return g({ok:!0,pool:Lr.updatePool(String(l.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(h){return d(h,422)}}}if(v.pathname.startsWith("/api/regions")){let d=(l,h=409)=>g({ok:!1,error:l instanceof Error?l.message:String(l)},h,{"cache-control":"no-store"});if(v.pathname==="/api/regions"&&m.method==="GET")return g({ok:!0,topologies:sn.list(a.project.id).map((l)=>({topology:l,targets:sn.targets(l.id),channels:sn.channels(l.id),route:sn.route(l.id),executions:sn.executions(l.id)}))},200,{"cache-control":"no-store"});if(v.pathname==="/api/regions"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,topology:Gu.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(L)?.id,name:String(l.name??""),hostname:String(l.hostname??""),regions:Array.isArray(l.regions)?l.regions:[],trafficPolicy:l.trafficPolicy==="weighted"||l.trafficPolicy==="latency"?l.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(l.replicate)?l.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(l.maxLagSeconds??30),retainOnDestroy:l.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:l.cdnEnabled===!0,wafEnabled:l.wafEnabled===!0})},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/regions/action"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,...Gu.enqueue({topologyId:String(l.topologyId??""),kind:String(l.action??""),targetRegion:l.targetRegion?String(l.targetRegion):void 0,revision:l.revision?String(l.revision):void 0,manifest:l.manifest&&typeof l.manifest==="object"?l.manifest:{},confirmation:l.confirmation?String(l.confirmation):void 0,deleteData:l.deleteData===!0})},202)}catch(h){return d(h,422)}}}if(v.pathname.startsWith("/api/maintenance")){let d=(l,h=409)=>g({ok:!1,error:l instanceof Error?l.message:String(l)},h,{"cache-control":"no-store"});if(v.pathname==="/api/maintenance"&&m.method==="GET")return g({ok:!0,manifests:gr.manifests(a.organization.id),windows:gr.windows(a.project.id),campaigns:gr.campaigns(a.project.id).map((l)=>({campaign:l,targets:gr.targets(l.id)})),cleanups:gr.cleanups(a.project.id),drills:gr.drills(a.project.id)},200,{"cache-control":"no-store"});if(v.pathname==="/api/maintenance/cleanup-preview"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,plan:await Ca.previewCleanup({projectId:a.project.id,kind:String(l.kind??"operations"),criteria:{olderThanDays:Number(l.olderThanDays??30)}},Ku)},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/maintenance/cleanup-apply"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,...Ca.enqueueCleanup(String(l.planId??""),String(l.confirmation??""))},202)}catch(h){return d(h,422)}}if(v.pathname==="/api/maintenance/drill"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,drill:gr.createDrill({projectId:a.project.id,scenario:String(l.scenario??"control_plane"),isolatedTarget:String(l.isolatedTarget??""),expectedRpoMinutes:Number(l.expectedRpoMinutes??60),expectedRtoMinutes:Number(l.expectedRtoMinutes??30),recoveryPointId:l.recoveryPointId?String(l.recoveryPointId):void 0,topologyId:l.topologyId?String(l.topologyId):void 0})},201)}catch(h){return d(h,422)}}if(v.pathname==="/api/maintenance/drill-run"&&m.method==="POST"){let l=await D(m);try{return g({ok:!0,...Ca.enqueueDrill(String(l.drillId??""))},202)}catch(h){return d(h,422)}}}if(v.pathname.startsWith("/api/volumes")){let d=a.environments.get(L),l=Q(O).actor?.id,h=(S,w=409)=>g({ok:!1,error:S instanceof Error?S.message:String(S)},w,{"cache-control":"no-store"});if(v.pathname==="/api/volumes"&&m.method==="GET"){let S=wa.inventory(a.project.id,d?.id),w=a.store.listResources(a.project.id,d?.id).map((A)=>({id:A.id,name:A.name,slug:A.slug,kind:A.kind,provider:A.provider,providerId:A.providerId}));return g({ok:!0,volumes:S,resources:w,operations:Ee.list({projectId:a.project.id,limit:100}).filter((A)=>A.operation.kind.startsWith("volume.")),recoveryPoints:Ue.listRecoveryPoints(a.project.id).filter((A)=>A.kind==="volume"),providers:Ia.map((A)=>({provider:A.provider,type:A.type,capabilities:A.capabilities()}))},200,{"cache-control":"no-store"})}if(v.pathname==="/api/volumes"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:S.resourceId?String(S.resourceId):void 0,name:String(S.name??""),provider:String(S.provider??"docker"),type:S.type==="docker"?"docker":S.type,capacityBytes:S.capacityBytes==null?void 0:Number(S.capacityBytes),filesystem:S.filesystem?String(S.filesystem):void 0,encrypted:S.encrypted===!0,desiredState:S.desiredState&&typeof S.desiredState==="object"?S.desiredState:{},actorId:l})},202,{"cache-control":"no-store"})}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/attach"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.attach(String(S.volumeId??""),{resourceId:String(S.resourceId??""),targetPath:String(S.targetPath??""),readOnly:S.readOnly===!0,uid:S.uid==null?void 0:Number(S.uid),gid:S.gid==null?void 0:Number(S.gid),mode:S.mode?String(S.mode):void 0,propagation:S.propagation,driverOptions:S.driverOptions&&typeof S.driverOptions==="object"?S.driverOptions:{},actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/detach"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.detach(String(S.volumeId??""),String(S.attachmentId??""),{force:S.force===!0,drained:S.drained===!0,unmounted:S.unmounted===!0,confirmation:S.confirmation?String(S.confirmation):void 0,actorId:l})},202)}catch(w){return h(w)}}if(v.pathname==="/api/volumes/resize"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.resize(String(S.volumeId??""),Number(S.capacityBytes),{drained:S.drained===!0,actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/snapshot"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.snapshot(String(S.volumeId??""),{name:S.name?String(S.name):void 0,actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/restore"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,...pr.restore(String(S.snapshotId??""),{name:String(S.name??""),actorId:l})},202)}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes/discover"&&m.method==="POST")try{return g({ok:!0,volumes:await pr.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:l})})}catch(S){return h(S,502)}if(v.pathname==="/api/volumes/adopt"&&m.method==="POST"){let S=await D(m);try{return g({ok:!0,volume:pr.adopt(String(S.volumeId??""),{name:String(S.name??""),actorId:l})})}catch(w){return h(w,422)}}if(v.pathname==="/api/volumes"&&m.method==="DELETE"){let S=await D(m),w=Oe.resolveSession(m);try{return g({ok:!0,...pr.delete(String(S.volumeId??""),{recentAuthAt:!W||w&&U.isRecentlyAuthenticated(w)?new Date().toISOString():void 0,confirmation:S.confirmation?String(S.confirmation):void 0,backupOverride:S.backupOverride===!0,backupOverrideConfirmation:S.backupOverrideConfirmation?String(S.backupOverrideConfirmation):void 0,actorId:l})},202)}catch(A){return h(A)}}}if(v.pathname==="/api/backups"&&m.method==="GET"){let d=a.environments.get(L),l=Ue.listPolicies(a.project.id,d?.id),h=new Set(l.map((k)=>k.id)),S=Ue.listRecoveryPoints(a.project.id).filter((k)=>!k.policyId||h.has(k.policyId)),w=Ue.listJobs(a.project.id).filter((k)=>!k.policyId||h.has(k.policyId)),A=(k)=>({...k,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!k.credentialRef,clientEncryptionConfigured:!!k.encryptionKeyRef}),I=await Promise.all(Ue.listDestinations(a.project.id).map(async(k)=>({...A(k),credentialStatus:await Mp(k,lr)})));return g({ok:!0,destinations:I,policies:l,recoveryPoints:S,jobs:w,coverage:Ue.coverage(a.project.id).filter((k)=>h.has(k.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((k)=>({id:k.id,name:k.name,slug:k.slug,kind:k.kind})):[]})}if(v.pathname==="/api/backups/destinations"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim(),h=String(d.provider??""),S=String(d.encryption??"provider"),w=`secret://data-services/backups/${a.project.id}/${l}`,A=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(h))return g({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(S))return g({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let I,k;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))I=`${w}/credentials`,await lr.put(I,JSON.stringify(d.credentials)),A.push(I);if(S!=="provider"){let _=String(d.encryptionKey??"");if(_.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");k=`${w}/encryption-key`,await lr.put(k,_),A.push(k)}let M=Ue.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:l,provider:h,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):Mr,forcePathStyle:d.forcePathStyle===!0,credentialRef:I,encryption:S,encryptionKeyRef:k,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return g({ok:!0,destination:{...M,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!I,clientEncryptionConfigured:!!k}},201)}catch(I){for(let k of A)await lr.remove(k).catch(()=>{});return g({ok:!1,error:I instanceof Error?I.message:String(I)},422)}}if(v.pathname==="/api/backups/destinations/test"&&m.method==="POST"){let d=await D(m),l=Ue.getDestination(String(d.id??""));if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Backup destination was not found."},404);if(l.provider==="aws_backup")return g({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Hu.test(l),g({ok:!0,destination:Ue.recordDestinationTest(l.id,{ok:!0})})}catch(h){let S=h instanceof Error?h.message:String(h);return Ue.recordDestinationTest(l.id,{ok:!1,error:S}),g({ok:!1,error:S},502)}}if(v.pathname==="/api/backups/policies"&&m.method==="POST"){let d=await D(m),l=a.environments.get(L),h=Ue.getDestination(String(d.destinationId??"")),S=String(d.resourceKind??""),w=d.dataServiceId?String(d.dataServiceId):void 0,A=w?Re.get(w):void 0,I=d.resourceId?String(d.resourceId):void 0,k=I?a.store.getResource(I):void 0;if(!l)return g({ok:!1,error:"Environment was not found."},404);if(!h||h.projectId!==a.project.id)return g({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(S))return g({ok:!1,error:"A supported backup resource kind is required."},422);if(w&&(!A||A.projectId!==a.project.id||A.environmentId!==l.id))return g({ok:!1,error:"Data service was not found in this environment."},404);if(I&&(!k||k.projectId!==a.project.id||k.environmentId!==l.id))return g({ok:!1,error:"Resource was not found in this environment."},404);if(S==="managed_database"&&!A)return g({ok:!1,error:"Managed database policies require a data service."},422);if(S==="logical_database"&&(!A||!["container","server"].includes(A.provider)))return g({ok:!1,error:"Logical database policies require an on-box data service."},422);if(S==="volume"&&(!k||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return g({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let M=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(S==="files"&&(!k||!M.length))return g({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(S==="control_plane"&&h.encryption==="provider")return g({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(S==="infrastructure"&&(h.provider!=="aws_backup"||!M.some((_)=>_.startsWith("resource:arn:"))||!M.some((_)=>_.startsWith("role:arn:"))))return g({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let _=Ue.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:l.id,resourceId:I,dataServiceId:w,destinationId:h.id,name:String(d.name??"").trim(),resourceKind:S,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:S==="volume"?[String(d.volumeName),...M]:M,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return g({ok:!0,policy:_},201)}catch(_){return g({ok:!1,error:_ instanceof Error?_.message:String(_)},422)}}if(v.pathname==="/api/backups/run"&&m.method==="POST"){let d=await D(m),l=Ue.getPolicy(String(d.policyId??"")),h=a.environments.get(L);if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Backup policy was not found in this environment."},404);try{let S=on.enqueueBackup(l,new Date().toISOString(),Q(O).actor?.id);return g({ok:!0,job:S},202)}catch(S){return g({ok:!1,error:S instanceof Error?S.message:String(S)},409)}}if(v.pathname==="/api/backups/verify"&&m.method==="POST"){let d=await D(m),l=Ue.getRecoveryPoint(String(d.recoveryPointId??""));if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Recovery point was not found."},404);return g({ok:!0,job:on.enqueueVerification(l)},202)}if(v.pathname==="/api/backups/restore"&&m.method==="POST"){let d=await D(m),l=Ue.getRecoveryPoint(String(d.recoveryPointId??"")),h=d.mode==="in_place"?"in_place":"isolated",S=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:h==="in_place"}:{inPlace:h==="in_place"},w=Oe.resolveSession(m),A={mode:h,target:S,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!W||!!w&&U.isRecentlyAuthenticated(w),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&h!=="isolated")return g({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let I=on.planRestore(l,A);if(d.execute!==!0)return g({ok:!0,plan:I,executionCreated:!1});let k=on.enqueueRestore(l,{...A,drill:d.drill===!0,actorId:Q(O).actor?.id});return g({ok:!0,plan:I,job:k},202)}catch(I){return g({ok:!1,error:I instanceof Error?I.message:String(I)},409)}}if(v.pathname==="/api/backups/recovery-points"&&m.method==="POST"){let d=await D(m),l=Ue.getRecoveryPoint(String(d.id??""));if(!l||l.projectId!==a.project.id)return g({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return g({ok:!1,error:"held or pinned must be provided."},422);return g({ok:!0,recoveryPoint:Ue.updateRecoveryPoint(l.id,{held:d.held==null?l.held:d.held===!0,pinned:d.pinned==null?l.pinned:d.pinned===!0})})}if(v.pathname==="/api/backups/retention"&&m.method==="POST")return g({ok:!0,jobs:on.enqueueRetention()},202);if(v.pathname==="/api/data-services/capabilities"&&m.method==="GET"){let d=String(v.searchParams.get("engine")??""),l=String(v.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(l))return g({ok:!1,error:"A supported engine and provider are required."},422);return g({ok:!0,engine:d,provider:l,capabilities:Fi(d,l)})}if(v.pathname==="/api/data-services"&&m.method==="GET"){let d=a.environments.get(L),l=Re.list(a.project.id,d?.id).map((h)=>{let S=Re.credential(h.id);return{...h,credentialRef:void 0,credential:S?{configured:!0,username:S.username,version:S.version,rotatedAt:S.rotatedAt}:void 0,dependencies:Re.dependencies(h.id).map((w)=>({resourceId:w.resourceId,requiresRedeploy:w.requiresRedeploy}))}});return g({ok:!0,services:l})}if(v.pathname==="/api/data-services/preview"&&m.method==="POST"){let d=await D(m);if(d.id){let S=Re.get(String(d.id)),w=a.environments.get(L),A=String(d.action??"");if(!S||S.projectId!==a.project.id||S.environmentId!==w?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!ya.includes(A))return g({ok:!1,error:`Action must be one of: ${ya.join(", ")}.`},422);try{return g({ok:!0,plan:fo.plan(S,A,d.changes??{})})}catch(I){return g({ok:!1,error:I instanceof Error?I.message:String(I)},422)}}let l=String(d.engine??""),h=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(h))return g({ok:!1,error:"A supported engine and provider are required."},422);return g({ok:!0,capabilities:Fi(l,h),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(v.pathname==="/api/data-services"&&m.method==="POST"){let d=await D(m),l=String(d.engine??""),h=String(d.provider??""),S=a.environments.get(L),w=Q(O);if(!S)return g({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(h))return g({ok:!1,error:"A supported engine and provider are required."},422);let A={organizationId:a.organization.id,projectId:a.project.id,environmentId:S.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:l,provider:h,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(h==="aws_elasticache"?"cache.t4g.micro":h==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:w.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let k=Re.create({...A,status:"adopted",credentialRef:void 0});return g({ok:!0,service:k,readOnly:!0},201)}if(!Ju({provider:h,engine:l}))return g({ok:!1,error:`No ${h}/${l} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let I=await fo.create(A);return g({ok:!0,service:I.service,operationId:I.operationId,oneTimeCredential:I.credential},201)}catch(I){return g({ok:!1,error:I instanceof Error?I.message:String(I)},422)}}if(v.pathname==="/api/data-services/connections"&&m.method==="GET"){let d=Re.get(String(v.searchParams.get("id")??"")),l=a.environments.get(L);if(!d||d.projectId!==a.project.id||d.environmentId!==l?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);let h=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,S=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,w=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),A=typeof d.observedState.database==="string"?d.observedState.database:void 0,I=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),k=[...h?[{type:d.publicExposure?"external":"internal",host:h,port:w,database:A,tls:I}]:[],...S?[{type:"internal",host:S,port:w,database:A,tls:I}]:[],{type:"tunnel",host:h??d.placement,port:w,database:A,tls:I}];return g({ok:!0,serviceId:d.id,guidance:Fp(d,k)})}if(v.pathname==="/api/data-services/action"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L),S=String(d.action??"");if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!ya.includes(S))return g({ok:!1,error:`Action must be one of: ${ya.join(", ")}.`},422);let w=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let A=fo.plan(l,S,w);if(d.execute!==!0)return g({ok:!0,plan:A,productionExecutionCreated:!1});let I=fo.enqueue(l,S,w,Q(O).actor?.id);return g({ok:!0,plan:A,operationId:I},202)}catch(A){return g({ok:!1,error:A instanceof Error?A.message:String(A)},409)}}if(v.pathname==="/api/data-services/dependencies"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L),S=a.store.getResource(String(d.resourceId??""));if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!S||S.projectId!==a.project.id||S.environmentId!==h?.id)return g({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return g({ok:Re.removeDependency(l.id,S.id)});return Re.addDependency({serviceId:l.id,resourceId:S.id,secretRef:l.credentialRef??`secret://data-services/${l.projectId}/${l.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),g({ok:!0,dependencies:Re.dependencies(l.id).map((w)=>({resourceId:w.resourceId,requiresRedeploy:w.requiresRedeploy}))})}if(v.pathname==="/api/data-services/management"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L);if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(l.origin!=="adopted"||d.reviewed!==!0||d.confirm!==l.name)return g({ok:!1,error:`Enabling management requires reviewed=true and typing ${l.name}.`},409);return g({ok:!0,service:Re.update(l.id,l.version,{managementEnabled:!0})})}if(v.pathname==="/api/data-services/reveal"&&m.method==="POST"){let d=await D(m),l=Re.get(String(d.id??"")),h=a.environments.get(L),S=l?Re.credential(l.id):void 0;if(!l||l.projectId!==a.project.id||l.environmentId!==h?.id)return g({ok:!1,error:"Data service was not found in this environment."},404);if(!S)return g({ok:!1,error:"No managed credential is configured."},404);return g({ok:!0,credential:{username:S.username,password:await lr.resolve(S.secretRef),version:S.version}},200,{"cache-control":"no-store"})}if(v.pathname==="/api/databases"&&m.method==="GET")return g(await Nf(o,L));if(v.pathname==="/api/databases"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim();if(!Or(l))return g({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return g({...await $f(o,L,l),name:l})}if(v.pathname==="/api/databases/vitess"&&m.method==="GET"){let d=await jf(o,L);return g({...d,unhealthy:Ff(d.tablets),missingPrimary:Uf(d)})}if(v.pathname==="/api/databases/vitess/provision"&&m.method==="POST"){let d=await D(m);try{return g(await Xf(o,L,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(l){return g({ok:!1,error:l instanceof Error?l.message:String(l)},422)}}if(v.pathname==="/api/databases/vitess/migrations"&&m.method==="GET"){let d=v.searchParams.get("keyspace")??void 0;return g(await Gf(o,L,d))}if(v.pathname==="/api/databases/vitess/migrations/action"&&m.method==="POST"){let d=await D(m),l=String(d.uuid??"").trim(),h=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(h))return g({ok:!1,error:"Unknown migration action."},422);return g(await Kf(o,L,l,h))}if(v.pathname==="/api/databases/vitess/keyspaces"&&m.method==="POST"){let d=await D(m),l=String(d.name??"").trim(),h=d.sharded===!0;return g(await Jf(o,L,l,{sharded:h}))}if(v.pathname==="/api/databases/vitess/vschema"&&m.method==="POST"){let d=await D(m),l=String(d.keyspace??"").trim(),h=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return g(await Hf(o,L,l,h))}if(v.pathname==="/api/databases/vitess/schema"&&m.method==="POST"){let d=await D(m),l=String(d.sql??"");return g(await Wf(o,L,l))}if(v.pathname==="/api/databases/vitess/install-client"&&m.method==="POST")return g(await qf(o,L));if(v.pathname==="/api/databases/backups"&&m.method==="GET")return g(await Bf(o,L));if(v.pathname==="/api/databases/backup"&&m.method==="POST"){let d=await D(m),l=String(d.database??"").trim();if(!Or(l))return g({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to back up this database.`},409);return g(await Lf(o,L,l))}if(v.pathname==="/api/databases/users"&&m.method==="POST"){let d=await D(m),l=String(d.username??"").trim(),h=String(d.password??""),S=String(d.database??"").trim()||void 0,w=d.access==="readonly"?"readonly":"all";if(!Or(l))return g({ok:!1,error:"Username must be a valid identifier."},422);if(!h)return g({ok:!1,error:"Password is required."},422);if(S&&!Or(S))return g({ok:!1,error:"Database must be a valid identifier."},422);return g({...await Mf(o,L,{username:l,password:h,database:S,access:w}),username:l})}if(v.pathname==="/api/dashboard-data")return Pe=C.get(L)??await ae(L),ae(L),g(Eu(Pe,{user:Ot,slug:o.project.slug}));if(v.pathname==="/api/users"&&m.method==="GET")return g({ok:!0,users:vt(t).map(vi)});if(v.pathname==="/api/users"&&m.method==="POST"){let d=await D(m),l=String(d.username??"").trim();if(!ia(l))return g({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let h=d.sites&&typeof d.sites==="object"?d.sites:{},S=new Set(Object.keys(o.sites??{})),w={};for(let[k,M]of Object.entries(h)){if(!S.has(k))return g({ok:!1,error:`Site '${k}' was not found.`},404);if(M!=="owner"&&M!=="collaborator")return g({ok:!1,error:`Unknown site role '${M}'. Use 'owner' or 'collaborator'.`},422);w[k]=M}let A=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(A&&A.length<12)return g({ok:!1,error:"Password must be at least 12 characters."},422);let I=ro(t,{username:l,password:A,name:typeof d.name==="string"?d.name:void 0,sites:w});return Ks(a,vt(t)),Ft(),g({ok:!0,user:vi(I.user),password:I.password})}if(v.pathname==="/api/users"&&m.method==="DELETE"){let d=await D(m),l=String(d.username??"").trim();if(l.toLowerCase()===O.username.toLowerCase())return g({ok:!1,error:"You cannot remove your own account."},409);let h=jt(vt(t),l),S=h?a.store.getActorByExternalId("user",`dashboard:${h.username.toLowerCase()}`):void 0,w=S?a.store.getMembershipForActor(a.organization.id,S.id):void 0;if(w&&w.source!=="legacy")return g({ok:!1,error:"Organization members must be removed from Organization access."},409);let A=vu(t,l);if(!A.ok)return g(A,409);return Ks(a,vt(t)),H.clear(),g({ok:!0,username:l})}if(v.pathname==="/api/actions/run"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=d.action?KT(d.action,L):void 0;if(!l)return g({ok:!1,error:"Unknown dashboard action."},404);if(l.mutates&&d.confirm!==l.confirm)return g({ok:!1,error:`Type "${l.confirm}" to run this action.`},409);let h=await Dr({controlPlane:a,environment:L,actor:O,kind:`dashboard.action.${l.id}`,input:{action:l.id},execute:()=>zu(l,{cwd:t,cliEntry:i})});return g({...h.result,controlPlaneOperation:h.operation})}if(v.pathname==="/api/server/operations/run"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=d.operation?Cu(d.operation,o,Pe):void 0;if(!l)return g({ok:!1,error:"Unknown or unavailable server operation."},404);if(l.mutates&&d.confirm!==l.confirm)return g({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let h=Kt(a,String(L));await new Pn(ce).run(new Zi,{...h,artifactRoot:t});let S=Gs(ce,{scope:h,desiredConfigHash:a.project.desiredConfigHash});if(S.decision.outcome==="block")return g({ok:!1,error:`Operation blocked by security policy: ${S.decision.explanation}`,securityReview:S},409);let w=await Dr({controlPlane:a,environment:L,actor:O,kind:`dashboard.server.${l.id}`,resourceSlug:l.target,input:{operation:l.id,target:l.target,to:d.to??null},execute:()=>da(o,L,l,{to:d.to})});return g({...w.result,controlPlaneOperation:w.operation,securityReview:S})}if(v.pathname==="/api/server/command"&&m.method==="POST"){let d=await m.json().catch(()=>({}));if(d.confirm!=="run")return g({ok:!1,error:'Type "run" to execute this command on the server.'},409);let l=await Dr({controlPlane:a,environment:L,actor:O,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>no(o,L,String(d.command??""))});return g({...l.result,controlPlaneOperation:l.operation})}if(v.pathname==="/api/serverless/operations")return g(_u(o,L,Pe));if(v.pathname==="/api/serverless/operations/run"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=d.operation?Bh(d.operation,o,L,Pe):void 0;if(!l)return g({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(l.mutates&&d.confirm!==l.confirm)return g({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let h=await Dr({controlPlane:a,environment:L,actor:O,kind:`dashboard.serverless.${l.id}`,input:{operation:l.id,min:d.min??null,max:d.max??null},execute:()=>jh(o,L,l,{min:d.min,max:d.max})});return Pe=await $n(o,L),C.set(L,Pe),g({...h.result,controlPlaneOperation:h.operation})}if(v.pathname==="/api/serverless/command"&&m.method==="POST"){let d=await m.json().catch(()=>({}));if(d.confirm!=="run")return g({ok:!1,error:'Type "run" to execute this command.'},409);return g(await Fh(o,L,String(d.command??"")))}if(v.pathname==="/api/serverless/dlq"&&m.method==="GET"){let d=Number(v.searchParams.get("max"))||10;return g(await Uh(o,L,d))}if(v.pathname==="/api/serverless/dlq/redrive"&&m.method==="POST"){let d=await m.json().catch(()=>({}));if(d.confirm!=="redrive")return g({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return g(await zh(o,L,{max:d.max,targetQueue:d.targetQueue}))}if(v.pathname==="/api/serverless/dlq/purge"&&m.method==="POST"){if((await m.json().catch(()=>({}))).confirm!=="purge")return g({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return g(await Vh(o,L))}if(v.pathname==="/api/serverless/secrets"&&m.method==="GET")return g({secrets:qh(o,L)});if(v.pathname==="/api/serverless/secrets"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return g({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return g({ok:!1,error:"A non-empty value is required."},422);return g(await Jh(o,L,l,d.value))}if(v.pathname==="/api/serverless/secrets"&&m.method==="DELETE"){let d=await m.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return g({ok:!1,error:"A secret id is required."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to delete this secret.`},409);return g(await Hh(o,L,l))}if(v.pathname==="/api/serverless/functions/config"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.mode??"").trim();if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to update this function.`},409);return g(await Wh(o,L,l,{memory:d.memory,timeout:d.timeout}))}if(v.pathname==="/api/serverless/alarms"&&m.method==="GET")return g(await Gh(o,L));if(v.pathname==="/api/serverless/alarms"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.preset??"").trim(),h=Number(d.threshold);if(!l)return g({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(h))return g({ok:!1,error:"A numeric threshold is required."},422);return g(await Kh(o,L,l,h))}if(v.pathname==="/api/serverless/alarms"&&m.method==="DELETE"){let d=await m.json().catch(()=>({})),l=String(d.name??"").trim();if(!l)return g({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to delete this alarm.`},409);return g(await Qh(o,L,l))}if(v.pathname==="/api/serverless/traces"&&m.method==="GET"){let d=Number(v.searchParams.get("minutes"))||30;return g(await la(o,L,d))}if(v.pathname==="/api/serverless/scheduler"&&m.method==="POST"){let d=await m.json().catch(()=>({})),l=String(d.action??"").trim();if(l!=="enable"&&l!=="disable"&&l!=="run")return g({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==l)return g({ok:!1,error:`Type "${l}" to ${l} the scheduler.`},409);return g(await Mu(o,L,l))}if(!Ey(v.pathname,Ot))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(L)}`}});let Un=await Zt(O,L);if(!Un)return Sa("ts-cloud dashboard UI is unavailable.",503);return Ty(Un,v.pathname)}catch(an){if(e.verbose)console.error(an);return g({ok:!1,error:an?.message??String(an)},500)}})();if(!Fe)return Fe;if(ye&&(v.pathname.startsWith("/api/")||v.pathname.startsWith("/auth/"))){let oe;if((z.headers.get("content-type")||"").includes("application/json"))oe=await z.json().catch(()=>{return});let Xe=Oe.resolveUser(m),Ge=Xe?Q(Xe).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:Ge?.id,correlationId:te,type:Fe.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Fe.status<400?"info":"warning",payload:_T(m.method,v.pathname,oe,Fe.status,Date.now()-G)})}return Fe.headers.set("x-request-id",te),Fe}});ho?.start();let hb=e.spendLoop??!0,cl;if(hb)(async()=>{let{SpendRunner:m,SpendLoopLease:q,startSpendLoop:G}=await import("./chunk-zsf6pccz.js"),{store:z}=await ky(a.store),te=new m({controlPlane:a.store,store:z,alerts:ne});cl=G(te,{lease:new q(a.store,{owner:`dashboard:${process.pid}`}),onError:(ye)=>console.error(`[ts-cloud] spend cycle failed: ${ye instanceof Error?ye.message:String(ye)}`)})})();let yb=jn.stop.bind(jn);return jn.stop=(m)=>{clearInterval(il),clearInterval(ol),clearInterval(sl),clearInterval(nl),clearInterval(rl),clearInterval(Xu),clearInterval(Zu),clearInterval(el),clearInterval(tl),Ft(),ze.clear(),ho?.stop(),cl?.();let q=yb(m);if(ho)ho.settled().finally(()=>a.store.close());else a.store.close();return q},{server:jn,url:`http://${r}:${jn.port}/`}}
+export{$o as w,Hr as x,oc as y,_f as z,Tm as A,Am as B,Yh as C,nE as D,Rm as E,Gi as F,Od as G,_d as H,Fd as I,Ud as J,Jd as K,Hd as L,Md as M,Ld as N,jd as O,ji as P,Fi as Q,Ic as R,Fp as S,Ko as T,Cc as U,Ec as V,Tc as W,Ac as X,kc as Y,Pc as Z,xc as _,Dc as $,Xn as aa,Oc as ba,Va as ca,Hn as da,Ao as ea,ko as fa,$i as ga,Zl as ha,Vn as ia,Ra as ja,Ut as ka,Da as la,_a as ma,$a as na,Io as oa,ca as pa,Cu as qa,da as ra,no as sa,Di as ta,ln as ua,Qi as va,Xi as wa,Hs as xa,Kt as ya,Af as za,u$ as Aa,l$ as Ba,Gs as Ca,f$ as Da,Rn as Ea,ll as Fa,jo as Ga,hn as Ha,yn as Ia,uc as Ja,mc as Ka,lc as La,pc as Ma,bc as Na,vc as Oa,Ho as Pa,JO as Qa,Gd as Ra,Kd as Sa,nf as Ta,cr as Ua,Fu as Va,fB as Wa};