@stacksjs/ts-cloud 0.11.7 → 0.12.1

package/dist/bin/chunk-qsdf5kzk.js

@@ -0,0 +1,2 @@
+import{dh as w}from"./chunk-xyt490vp.js";class x{client;region;constructor(b="us-east-1",j){this.region=b,this.client=new w(void 0,{profile:j})}async createRepository(b){let j={repositoryName:b.repositoryName};if(b.imageTagMutability)j.imageTagMutability=b.imageTagMutability;if(b.imageScanningConfiguration)j.imageScanningConfiguration=b.imageScanningConfiguration;if(b.encryptionConfiguration)j.encryptionConfiguration=b.encryptionConfiguration;if(b.tags&&b.tags.length>0)j.tags=b.tags;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.CreateRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{repository:q.repository?this.parseRepository(q.repository):void 0}}async describeRepositories(b){let j={};if(b?.repositoryNames&&b.repositoryNames.length>0)j.repositoryNames=b.repositoryNames;if(b?.registryId)j.registryId=b.registryId;if(b?.maxResults)j.maxResults=b.maxResults;if(b?.nextToken)j.nextToken=b.nextToken;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeRepositories","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{repositories:q.repositories?.map((v)=>this.parseRepository(v)),nextToken:q.nextToken}}async getAuthorizationToken(b){let j={};if(b&&b.length>0)j.registryIds=b;return{authorizationData:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)})).authorizationData?.map((v)=>({authorizationToken:v.authorizationToken,expiresAt:v.expiresAt,proxyEndpoint:v.proxyEndpoint}))}}async deleteRepository(b){let j={repositoryName:b.repositoryName};if(b.registryId)j.registryId=b.registryId;if(b.force!==void 0)j.force=b.force;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DeleteRepository","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{repository:q.repository?this.parseRepository(q.repository):void 0}}async describeImages(b){let j={repositoryName:b.repositoryName};if(b.registryId)j.registryId=b.registryId;if(b.imageIds&&b.imageIds.length>0)j.imageIds=b.imageIds;if(b.filter)j.filter=b.filter;if(b.maxResults)j.maxResults=b.maxResults;if(b.nextToken)j.nextToken=b.nextToken;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.DescribeImages","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{imageDetails:q.imageDetails?.map((v)=>this.parseImageDetail(v)),nextToken:q.nextToken}}async batchDeleteImage(b){let j={repositoryName:b.repositoryName,imageIds:b.imageIds};if(b.registryId)j.registryId=b.registryId;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.BatchDeleteImage","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{imageIds:q.imageIds,failures:q.failures}}async putLifecyclePolicy(b){let j={repositoryName:b.repositoryName,lifecyclePolicyText:b.lifecyclePolicyText};if(b.registryId)j.registryId=b.registryId;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.PutLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{registryId:q.registryId,repositoryName:q.repositoryName,lifecyclePolicyText:q.lifecyclePolicyText}}async getLifecyclePolicy(b){let j={repositoryName:b.repositoryName};if(b.registryId)j.registryId=b.registryId;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetLifecyclePolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{registryId:q.registryId,repositoryName:q.repositoryName,lifecyclePolicyText:q.lifecyclePolicyText,lastEvaluatedAt:q.lastEvaluatedAt}}async setRepositoryPolicy(b){let j={repositoryName:b.repositoryName,policyText:b.policyText};if(b.registryId)j.registryId=b.registryId;if(b.force!==void 0)j.force=b.force;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.SetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{registryId:q.registryId,repositoryName:q.repositoryName,policyText:q.policyText}}async getRepositoryPolicy(b){let j={repositoryName:b.repositoryName};if(b.registryId)j.registryId=b.registryId;let q=await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.GetRepositoryPolicy","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)});return{registryId:q.registryId,repositoryName:q.repositoryName,policyText:q.policyText}}async tagResource(b){let j={resourceArn:b.resourceArn,tags:b.tags};await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.TagResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)})}async listTagsForResource(b){let j={resourceArn:b};return{tags:(await this.client.request({service:"ecr",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerRegistry_V20150921.ListTagsForResource","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(j)})).tags}}createLifecyclePolicyText(b){return JSON.stringify({rules:b.map((j)=>({rulePriority:j.rulePriority,description:j.description,selection:j.selection,action:j.action}))})}async getDockerLoginCommand(){let b=await this.getAuthorizationToken();if(!b.authorizationData?.[0])throw Error("Failed to get authorization token");let j=b.authorizationData[0],q=j.authorizationToken||"",v=j.proxyEndpoint||"";return`echo "${Buffer.from(q,"base64").toString("utf8").split(":")[1]}" | docker login --username AWS --password-stdin ${v}`}getRegistryUri(b){return`${b}.dkr.ecr.${this.region}.amazonaws.com`}parseRepository(b){return{repositoryArn:b.repositoryArn,registryId:b.registryId,repositoryName:b.repositoryName,repositoryUri:b.repositoryUri,createdAt:b.createdAt,imageTagMutability:b.imageTagMutability,imageScanningConfiguration:b.imageScanningConfiguration,encryptionConfiguration:b.encryptionConfiguration}}parseImageDetail(b){return{registryId:b.registryId,repositoryName:b.repositoryName,imageDigest:b.imageDigest,imageTags:b.imageTags,imageSizeInBytes:b.imageSizeInBytes,imagePushedAt:b.imagePushedAt,imageScanStatus:b.imageScanStatus,imageScanFindingsSummary:b.imageScanFindingsSummary}}}
+export{x as Ig};

package/dist/bin/chunk-r61qmhv1.js

@@ -0,0 +1,2 @@
+import{dh as V}from"./chunk-xyt490vp.js";import{deflateRawSync as Z}from"zlib";function Q(G,k){let J=typeof k==="string"?Buffer.from(k,"utf-8"):k,K=Z(J),U=E(J),Y=new Date,M=(Y.getHours()<<11|Y.getMinutes()<<5|Y.getSeconds()>>1)&65535,$=(Y.getFullYear()-1980<<9|Y.getMonth()+1<<5|Y.getDate())&65535,O=Buffer.from(G,"utf-8"),_=Buffer.alloc(30+O.length);_.writeUInt32LE(67324752,0),_.writeUInt16LE(20,4),_.writeUInt16LE(0,6),_.writeUInt16LE(8,8),_.writeUInt16LE(M,10),_.writeUInt16LE($,12),_.writeUInt32LE(U,14),_.writeUInt32LE(K.length,18),_.writeUInt32LE(J.length,22),_.writeUInt16LE(O.length,26),_.writeUInt16LE(0,28),O.copy(_,30);let X=Buffer.alloc(46+O.length);X.writeUInt32LE(33639248,0),X.writeUInt16LE(20,4),X.writeUInt16LE(20,6),X.writeUInt16LE(0,8),X.writeUInt16LE(8,10),X.writeUInt16LE(M,12),X.writeUInt16LE($,14),X.writeUInt32LE(U,16),X.writeUInt32LE(K.length,20),X.writeUInt32LE(J.length,24),X.writeUInt16LE(O.length,28),X.writeUInt16LE(0,30),X.writeUInt16LE(0,32),X.writeUInt16LE(0,34),X.writeUInt16LE(0,36),X.writeUInt32LE(0,38),X.writeUInt32LE(0,42),O.copy(X,46);let h=_.length+K.length,j=X.length,A=Buffer.alloc(22);return A.writeUInt32LE(101010256,0),A.writeUInt16LE(0,4),A.writeUInt16LE(0,6),A.writeUInt16LE(1,8),A.writeUInt16LE(1,10),A.writeUInt32LE(j,12),A.writeUInt32LE(h,16),A.writeUInt16LE(0,20),Buffer.concat([_,K,X,A])}function E(G){let k=[];for(let K=0;K<256;K++){let U=K;for(let Y=0;Y<8;Y++)U=U&1?3988292384^U>>>1:U>>>1;k[K]=U}let J=4294967295;for(let K=0;K<G.length;K++)J=k[(J^G[K])&255]^J>>>8;return(J^4294967295)>>>0}class I{client;region;constructor(G="us-east-1",k){this.region=G,this.client=new V(void 0,{profile:k})}async createFunction(G){return await this.client.request({service:"lambda",region:this.region,method:"POST",path:"/2015-03-31/functions",headers:{"Content-Type":"application/json"},body:JSON.stringify(G)})}async getFunction(G){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(G)}`,headers:{"Content-Type":"application/json"}})}async updateFunctionCode(G){let{FunctionName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(k)}/code`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async updateFunctionCodeInline(G,k,J="index.js"){let K=Q(J,k);return this.updateFunctionCode({FunctionName:G,ZipFile:K.toString("base64")})}async updateFunctionConfiguration(G){let{FunctionName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(k)}/configuration`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async deleteFunction(G){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(G)}`,headers:{"Content-Type":"application/json"}})}async invoke(G){let{FunctionName:k,InvocationType:J="RequestResponse",Payload:K,LogType:U}=G,Y={"Content-Type":"application/json","X-Amz-Invocation-Type":J};if(U)Y["X-Amz-Log-Type"]=U;let M=K?typeof K==="string"?K:JSON.stringify(K):void 0,$=await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(k)}/invocations`,headers:Y,body:M,returnHeaders:!0});return{StatusCode:$.statusCode||200,FunctionError:$.headers?.["x-amz-function-error"],LogResult:$.headers?.["x-amz-log-result"],Payload:typeof $.body==="string"?$.body:JSON.stringify($.body),ExecutedVersion:$.headers?.["x-amz-executed-version"]}}async listFunctions(G){let k={};if(G?.MaxItems)k.MaxItems=String(G.MaxItems);if(G?.Marker)k.Marker=G.Marker;if(G?.FunctionVersion)k.FunctionVersion=G.FunctionVersion;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:"/2015-03-31/functions",queryParams:Object.keys(k).length>0?k:void 0,headers:{"Content-Type":"application/json"}})}async addPermission(G){let{FunctionName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(k)}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async removePermission(G,k){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2015-03-31/functions/${encodeURIComponent(G)}/policy/${encodeURIComponent(k)}`,headers:{"Content-Type":"application/json"}})}async publishVersion(G){let{FunctionName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(k)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async createAlias(G){let{FunctionName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2015-03-31/functions/${encodeURIComponent(k)}/aliases`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async updateAlias(G){let{FunctionName:k,Name:J,...K}=G;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2015-03-31/functions/${encodeURIComponent(k)}/aliases/${encodeURIComponent(J)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(K)})}async getAlias(G,k){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2015-03-31/functions/${encodeURIComponent(G)}/aliases/${encodeURIComponent(k)}`})}catch(J){if(/ResourceNotFound/i.test(String(J?.message)))return null;throw J}}async getProvisionedConcurrencyConfig(G,k){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2019-09-30/functions/${encodeURIComponent(G)}/provisioned-concurrency`,queryParams:{Qualifier:k}})}catch(J){if(/ProvisionedConcurrencyConfigNotFound|ResourceNotFound/i.test(String(J?.message)))return null;throw J}}async putProvisionedConcurrencyConfig(G){let{FunctionName:k,Qualifier:J,ProvisionedConcurrentExecutions:K}=G;return this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2019-09-30/functions/${encodeURIComponent(k)}/provisioned-concurrency`,queryParams:{Qualifier:J},headers:{"Content-Type":"application/json"},body:JSON.stringify({ProvisionedConcurrentExecutions:K})})}async getFunctionConcurrency(G){try{return(await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2019-10-31/functions/${encodeURIComponent(G)}/concurrency`}))?.ReservedConcurrentExecutions??null}catch(k){if(/ResourceNotFound|ProvisionedConcurrencyConfigNotFound/i.test(String(k?.message)))return null;throw k}}async putFunctionConcurrency(G,k){await this.client.request({service:"lambda",region:this.region,method:"PUT",path:`/2019-10-31/functions/${encodeURIComponent(G)}/concurrency`,headers:{"Content-Type":"application/json"},body:JSON.stringify({ReservedConcurrentExecutions:k})})}async deleteFunctionConcurrency(G){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2019-10-31/functions/${encodeURIComponent(G)}/concurrency`})}async deleteProvisionedConcurrencyConfig(G,k){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2019-09-30/functions/${encodeURIComponent(G)}/provisioned-concurrency`,queryParams:{Qualifier:k}})}async waitForFunctionActive(G,k=60){let J=Date.now(),K=k*1000;while(Date.now()-J<K)try{let U=await this.getFunction(G),Y=U.Configuration?.State;if(Y==="Active")return U.Configuration;if(Y==="Failed")throw Error(`Function ${G} failed: ${U.Configuration?.StateReason}`);await new Promise((M)=>setTimeout(M,2000))}catch(U){if(U.code==="ResourceNotFoundException"){await new Promise((Y)=>setTimeout(Y,2000));continue}throw U}throw Error(`Timeout waiting for function ${G} to become active`)}async functionExists(G){try{return await this.getFunction(G),!0}catch(k){if(k.code==="ResourceNotFoundException"||k.statusCode===404)return!1;throw k}}async createFunctionUrl(G){let{FunctionName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2021-10-31/functions/${encodeURIComponent(k)}/url`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async getFunctionUrl(G){try{return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2021-10-31/functions/${encodeURIComponent(G)}/url`,headers:{"Content-Type":"application/json"}})}catch(k){if(k.statusCode===404)return null;throw k}}async deleteFunctionUrl(G){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2021-10-31/functions/${encodeURIComponent(G)}/url`,headers:{"Content-Type":"application/json"}})}async createFunctionWithCode(G){let{Code:k,Filename:J="index.js",...K}=G,U=Q(J,k);return this.createFunction({...K,Code:{ZipFile:U.toString("base64")}})}async addFunctionUrlPermission(G){return this.addPermission({FunctionName:G,StatementId:"FunctionURLAllowPublicAccess",Action:"lambda:InvokeFunctionUrl",Principal:"*",FunctionUrlAuthType:"NONE"})}async publishLayerVersion(G){let{LayerName:k,...J}=G;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(k)}/versions`,headers:{"Content-Type":"application/json"},body:JSON.stringify(J)})}async listLayerVersions(G,k){let J={};if(k?.CompatibleRuntime)J.CompatibleRuntime=k.CompatibleRuntime;if(k?.CompatibleArchitecture)J.CompatibleArchitecture=k.CompatibleArchitecture;if(k?.MaxItems)J.MaxItems=String(k.MaxItems);if(k?.Marker)J.Marker=k.Marker;return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(G)}/versions`,queryParams:Object.keys(J).length>0?J:void 0,headers:{"Content-Type":"application/json"}})}async getLayerVersion(G,k){return await this.client.request({service:"lambda",region:this.region,method:"GET",path:`/2018-10-31/layers/${encodeURIComponent(G)}/versions/${k}`,headers:{"Content-Type":"application/json"}})}async addLayerVersionPermission(G){let{LayerName:k,VersionNumber:J,...K}=G;return await this.client.request({service:"lambda",region:this.region,method:"POST",path:`/2018-10-31/layers/${encodeURIComponent(k)}/versions/${J}/policy`,headers:{"Content-Type":"application/json"},body:JSON.stringify(K)})}async deleteLayerVersion(G,k){await this.client.request({service:"lambda",region:this.region,method:"DELETE",path:`/2018-10-31/layers/${encodeURIComponent(G)}/versions/${k}`,headers:{"Content-Type":"application/json"}})}}
+export{I as _d};

package/dist/bin/chunk-r6gdcz5c.js

@@ -0,0 +1 @@
+import{Hg as a}from"./chunk-d5a3vheh.js";import"./chunk-qsdf5kzk.js";import"./chunk-xjp3v95e.js";import"./chunk-xyt490vp.js";import"./chunk-5bhx3bsa.js";import"./chunk-c8sypnbe.js";export{a as buildAndPushServerlessImage};

package/dist/bin/chunk-satwnr42.js

@@ -0,0 +1,2 @@
+function q(b){let g=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(b).replace(g,(k)=>`\\u${k.charCodeAt(0).toString(16).padStart(4,"0")}`)}
+export{q as Xa};

package/dist/bin/{chunk-dz1ec589.js → chunk-scqmd4qv.js}

@@ -1,4 +1,4 @@
-import{Bh as ie}from"./chunk-4q6tad44.js";var C=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","billing:read","billing:manage","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],K=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read","billing:read"],se={owner:new Set(C),admin:new Set(C.filter((e)=>e!=="users:transfer-ownership")),deployer:new Set([...K,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...K,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(K),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])};function I(e){return se[e]}function P(e,t){if(e.type==="organization")return e.id===void 0||e.id===t.organizationId;if(!e.id)return!1;if(e.type==="project")return e.id===t.projectId;if(e.type==="environment")return e.id===t.environmentId;return e.id===t.resourceId}function Z(e){let{membership:t,capability:r,target:i}=e;if(!t||t.status!=="active"||t.organizationId!==i.organizationId)return{allowed:!1,reason:"inactive-membership"};let a=e.grants.filter((s)=>s.organizationId===i.organizationId&&s.membershipId===t.id&&s.capability===r&&P(s.scope,i)),E=a.find((s)=>s.effect==="deny");if(E)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:E.id,scope:E.scope}};let T=a.find((s)=>s.effect==="allow");if(T)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:T.id,scope:T.scope}};if(!P(t.scope,i))return{allowed:!1,reason:"scope-mismatch"};if(I(t.roleTemplate).has(r))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:t.id,scope:t.scope}};return{allowed:!1,reason:"missing-capability"}}function de(e){return C.filter((t)=>Z({...e,capability:t}).allowed)}import{createHash as h,randomBytes as Ne}from"node:crypto";import{chmodSync as H,existsSync as ee,mkdirSync as ce,statSync as Le}from"node:fs";import{dirname as te}from"node:path";import{Database as _e}from"bun:sqlite";var l=40,j=[{version:1,name:"core_control_plane",sql:`
+import{Bh as TE}from"./chunk-5bhx3bsa.js";var X=["project:read","config:read","config:write","deployments:read","deployments:create","deployments:cancel","deployments:rollback","runtime:read","runtime:restart","runtime:logs","runtime:terminal","data:read","data:write","data:admin","backups:read","backups:create","backups:restore","secrets:read","secrets:write","fleet:read","fleet:manage","users:read","users:manage","users:transfer-ownership","audit:read","billing:read","billing:manage","security:read","security:manage","security:waive","sources:read","sources:manage","applications:read","applications:manage","automation:read","automation:manage","tags:manage"],Y=["project:read","config:read","deployments:read","runtime:read","runtime:logs","data:read","backups:read","security:read","sources:read","applications:read","billing:read"],_E={owner:new Set(X),admin:new Set(X.filter((E)=>E!=="users:transfer-ownership")),deployer:new Set([...Y,"deployments:create","deployments:cancel","deployments:rollback","sources:manage","applications:manage"]),operator:new Set([...Y,"runtime:restart","backups:create","security:manage","sources:manage","applications:manage"]),viewer:new Set(Y),auditor:new Set(["project:read","config:read","deployments:read","runtime:read","data:read","backups:read","audit:read","security:read","sources:read","applications:read"])};function u(E){return _E[E]}function x(E,T){if(E.type==="organization")return E.id===void 0||E.id===T.organizationId;if(!E.id)return!1;if(E.type==="project")return E.id===T.projectId;if(E.type==="environment")return E.id===T.environmentId;return E.id===T.resourceId}function V(E){let{membership:T,capability:N,target:e}=E;if(!T||T.status!=="active"||T.organizationId!==e.organizationId)return{allowed:!1,reason:"inactive-membership"};let L=E.grants.filter((s)=>s.organizationId===e.organizationId&&s.membershipId===T.id&&s.capability===N&&x(s.scope,e)),t=L.find((s)=>s.effect==="deny");if(t)return{allowed:!1,reason:"explicit-deny",inheritedFrom:{kind:"grant",id:t.id,scope:t.scope}};let _=L.find((s)=>s.effect==="allow");if(_)return{allowed:!0,reason:"explicit-allow",inheritedFrom:{kind:"grant",id:_.id,scope:_.scope}};if(!x(T.scope,e))return{allowed:!1,reason:"scope-mismatch"};if(u(T.roleTemplate).has(N))return{allowed:!0,reason:"role-template",inheritedFrom:{kind:"membership",id:T.id,scope:T.scope}};return{allowed:!1,reason:"missing-capability"}}function sE(E){return X.filter((T)=>V({...E,capability:T}).allowed)}import{createHash as g,randomBytes as dE}from"node:crypto";import{chmodSync as B,existsSync as w,mkdirSync as rE,statSync as nE}from"node:fs";import{dirname as EE}from"node:path";import{Database as oE}from"bun:sqlite";var C=40,G=[{version:1,name:"core_control_plane",sql:`
       CREATE TABLE projects (
         id TEXT PRIMARY KEY,
         slug TEXT NOT NULL UNIQUE,
@@ -1475,33 +1475,33 @@ import{Bh as ie}from"./chunk-4q6tad44.js";var C=["project:read","config:read","c
       -- once a minute, forever.
       CREATE INDEX telemetry_kind_scope_time_idx
         ON telemetry_records(project_id, kind, timestamp);
-    `}];class p extends Error{constructor(e,t,r){super(`${e} ${t} changed since version ${r}`);this.name="OptimisticConcurrencyError"}}class x extends Error{constructor(e,t){super(`Operation cannot transition from ${e} to ${t}`);this.name="InvalidOperationTransitionError"}}class S extends Error{constructor(e,t){super(`Control-plane schema version ${e} is newer than supported version ${t}`);this.name="UnsupportedSchemaVersionError"}}var re=65536,q=16384,le=["succeeded","failed","cancelled","timed_out"],pe={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},ue=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,ae=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi;function _(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function d(e){return typeof e==="string"?e:void 0}function G(e,t){if(t&&ue.test(t))return"[REDACTED]";if(e===null||typeof e==="boolean"||typeof e==="number")return e;if(typeof e==="string")return e.replace(ae,"[REDACTED]");if(Array.isArray(e))return e.map((r)=>G(r));if(e&&typeof e==="object"){let r={};for(let[i,a]of Object.entries(e))r[i]=G(a,i);return r}return String(e??"")}function ne(e,t=re){let r=G(e),i=JSON.stringify(r);if(Buffer.byteLength(i)<=t)return r;return{truncated:!0,originalBytes:Buffer.byteLength(i),preview:i.slice(0,Math.max(0,t-128))}}function N(e){return JSON.stringify(ne(e))}function M(e){if(!e)return;let t=e.replace(ae,"[REDACTED]");return Buffer.byteLength(t)<=q?t:`${t.slice(0,q-24)}
-[output truncated]`}function v(e){return{id:String(e.id),slug:String(e.slug),name:String(e.name),description:d(e.description),organizationId:d(e.organization_id),desiredConfigHash:d(e.desired_config_hash),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function D(e){return{id:String(e.id),projectId:String(e.project_id),slug:String(e.slug),name:String(e.name),kind:String(e.kind),region:d(e.region),desiredState:_(e.desired_state),discoveredState:_(e.discovered_state),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function y(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:d(e.environment_id),kind:String(e.kind),slug:String(e.slug),name:String(e.name),provider:d(e.provider),providerId:d(e.provider_id),desiredState:_(e.desired_state),discoveredState:_(e.discovered_state),metadata:_(e.metadata),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function f(e){return{id:String(e.id),kind:String(e.kind),externalId:d(e.external_id),displayName:String(e.display_name),metadata:_(e.metadata),disabledAt:d(e.disabled_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function u(e){return{id:String(e.id),projectId:d(e.project_id),environmentId:d(e.environment_id),resourceId:d(e.resource_id),actorId:d(e.actor_id),kind:String(e.kind),state:String(e.state),correlationId:String(e.correlation_id),idempotencyKey:d(e.idempotency_key),input:_(e.input),output:_(e.output),error:d(e.error),attempt:Number(e.attempt),priority:Number(e.priority),leaseOwner:d(e.lease_owner),leaseExpiresAt:d(e.lease_expires_at),cancelRequestedAt:d(e.cancel_requested_at),startedAt:d(e.started_at),finishedAt:d(e.finished_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Y(e){return{id:String(e.id),sequence:Number(e.sequence),organizationId:d(e.organization_id),projectId:d(e.project_id),operationId:d(e.operation_id),resourceId:d(e.resource_id),actorId:d(e.actor_id),correlationId:String(e.correlation_id),type:String(e.type),level:String(e.level),payload:_(e.payload),createdAt:String(e.created_at)}}function R(e){return{id:String(e.id),projectId:String(e.project_id),name:String(e.name),normalizedName:String(e.normalized_name),color:String(e.color),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function b(e){return{id:String(e.id),actorKey:String(e.actor_key),name:String(e.name),routeId:String(e.route_id),query:_(e.query),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function F(e){return{actorKey:String(e.actor_key),entityType:String(e.entity_type),entityId:String(e.entity_id),favorite:Number(e.favorite)===1,lastVisitedAt:String(e.last_visited_at),visitCount:Number(e.visit_count)}}function z(e){return{id:String(e.id),slug:String(e.slug),name:String(e.name),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function B(e){let t=String(e.scope_type);return{type:t,...t==="organization"?{}:{id:String(e.scope_id)}}}function k(e){return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),roleTemplate:String(e.role_template),scope:B(e),source:String(e.source??"manual"),status:String(e.status),sessionVersion:Number(e.session_version),lastActiveAt:d(e.last_active_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function g(e,t){let r=d(e.accepted_at),i=d(e.revoked_at),a=String(e.expires_at),E=i?"revoked":r?"accepted":a<=t?"expired":"pending";return{id:String(e.id),organizationId:String(e.organization_id),email:String(e.email),roleTemplate:String(e.role_template),scope:B(e),invitedByActorId:d(e.invited_by_actor_id),acceptedByActorId:d(e.accepted_by_actor_id),expiresAt:a,acceptedAt:r,revokedAt:i,state:E,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function w(e){return{id:String(e.id),organizationId:String(e.organization_id),membershipId:String(e.membership_id),effect:String(e.effect),capability:String(e.capability),scope:B(e),source:String(e.source??"manual"),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function U(e){return{type:e.type,id:e.id??null}}function Ce(e){return Array.from({length:e},()=>"?").join(", ")}function o(e,t,r){return e.run(t,r)}class Ee{path;database;nowFn;idFn;constructor(e={}){this.path=e.path??ie(e.cwd??process.cwd(),"control-plane.sqlite"),this.nowFn=e.now??(()=>new Date),this.idFn=e.id??(()=>crypto.randomUUID());let t=this.path===":memory:";if(!t){ce(te(this.path),{recursive:!0,mode:448});try{H(te(this.path),448)}catch{}}if(this.database=new _e(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,e.busyTimeoutMs??5000)}`),!t)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!t)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let e of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!ee(e))continue;try{H(e,384)}catch{}}}backupTo(e){this.database.run("VACUUM INTO ?",[e]);try{H(e,384)}catch{}}migrate(){let e=this.database.query("PRAGMA user_version").get(),t=Number(e?.user_version??0);if(t>l)throw new S(t,l);if(t===l)return;let r;if(t>0&&this.path!==":memory:")r=`${this.path}.v${t}.${Date.now()}.bak`,this.backupTo(r);try{if(this.database.transaction(()=>{for(let a of j){if(a.version<=t)continue;this.database.run(a.sql),o(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[a.version,a.name,this.now()]),this.database.run(`PRAGMA user_version = ${a.version}`)}}).exclusive(),r)this.setSetting("storage.last_backup",{path:r,createdAt:this.now(),reason:"pre-migration"})}catch(i){let a=r?` Restore from ${r}.`:"";throw Error(`Control-plane migration from schema ${t} failed.${a} ${i instanceof Error?i.message:String(i)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(e){return this.database.transaction(e).immediate()}createProject(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[t,e.slug,e.name,e.description??null,e.organizationId??null,e.desiredConfigHash??null,r,r]),this.getProject(t)}getProject(e){let t=this.database.query("SELECT * FROM projects WHERE id = ?").get(e);return t?v(t):void 0}getProjectBySlug(e){let t=this.database.query("SELECT * FROM projects WHERE slug = ?").get(e);return t?v(t):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(v)}updateProject(e,t,r){let i=this.getProject(e);if(!i||i.version!==t)throw new p("Project",e,t);if(o(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
-      WHERE id = ? AND version = ?`,[r.name??i.name,r.description===null?null:r.description??i.description??null,r.organizationId===null?null:r.organizationId??i.organizationId??null,r.desiredConfigHash===null?null:r.desiredConfigHash??i.desiredConfigHash??null,this.now(),e,t]).changes!==1)throw new p("Project",e,t);return this.getProject(e)}createEnvironment(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,e.projectId,e.slug,e.name,e.kind,e.region??null,N(e.desiredState??{}),N(e.discoveredState??{}),r,r]),D(this.database.query("SELECT * FROM environments WHERE id = ?").get(t))}listEnvironments(e){return this.database.query("SELECT * FROM environments WHERE project_id = ? ORDER BY name COLLATE NOCASE, id").all(e).map(D)}getEnvironmentBySlug(e,t){let r=this.database.query("SELECT * FROM environments WHERE project_id = ? AND slug = ?").get(e,t);return r?D(r):void 0}createResource(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,e.projectId,e.environmentId??null,e.kind,e.slug,e.name,e.provider??null,e.providerId??null,N(e.desiredState??{}),N(e.discoveredState??{}),N(e.metadata??{}),r,r]),y(this.database.query("SELECT * FROM resources WHERE id = ?").get(t))}listResources(e,t){return(t?this.database.query("SELECT * FROM resources WHERE project_id = ? AND environment_id = ? ORDER BY kind, name COLLATE NOCASE").all(e,t):this.database.query("SELECT * FROM resources WHERE project_id = ? ORDER BY kind, name COLLATE NOCASE").all(e)).map(y)}getResource(e){let t=this.database.query("SELECT * FROM resources WHERE id = ?").get(e);return t?y(t):void 0}updateResource(e,t,r){let i=this.getResource(e);if(!i||i.version!==t)throw new p("Resource",e,t);if(o(this.database,`UPDATE resources SET name = ?, provider = ?, provider_id = ?, desired_state = ?, discovered_state = ?, metadata = ?,
-      version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,[r.name??i.name,r.provider===null?null:r.provider??i.provider??null,r.providerId===null?null:r.providerId??i.providerId??null,N(r.desiredState??i.desiredState),N(r.discoveredState??i.discoveredState),N(r.metadata??i.metadata),this.now(),e,t]).changes!==1)throw new p("Resource",e,t);return this.getResource(e)}createActor(e){let t=e.id??this.idFn(),r=this.now();return o(this.database,"INSERT INTO actors (id, kind, external_id, display_name, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[t,e.kind,e.externalId??null,e.displayName,N(e.metadata??{}),r,r]),f(this.database.query("SELECT * FROM actors WHERE id = ?").get(t))}getActorByExternalId(e,t){let r=this.database.query("SELECT * FROM actors WHERE kind = ? AND external_id = ?").get(e,t);return r?f(r):void 0}getActor(e){let t=this.database.query("SELECT * FROM actors WHERE id = ?").get(e);return t?f(t):void 0}createOrganization(e){let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(t))throw Error("Organization slugs must contain 3-64 lowercase letters, numbers, or dashes");let r=e.name.trim();if(!r||r.length>100)throw Error("Organization names must contain 1-100 characters");let i=e.id??this.idFn(),a=this.now();return o(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[i,t,r,a,a]),this.getOrganization(i)}getOrganization(e){let t=this.database.query("SELECT * FROM organizations WHERE id = ?").get(e);return t?z(t):void 0}getOrganizationBySlug(e){let t=this.database.query("SELECT * FROM organizations WHERE slug = ?").get(e.trim().toLowerCase());return t?z(t):void 0}listOrganizations(e){return(e?this.database.query(`SELECT organizations.* FROM organizations JOIN organization_memberships ON organization_memberships.organization_id = organizations.id
-          WHERE organization_memberships.actor_id = ? AND organization_memberships.status = 'active' ORDER BY organizations.name COLLATE NOCASE`).all(e):this.database.query("SELECT * FROM organizations ORDER BY name COLLATE NOCASE").all()).map(z)}normalizeAuthorizationScope(e,t={type:"organization"}){if(t.type==="organization"){if(t.id&&t.id!==e)throw Error("Organization scope does not match the requested organization");return{type:"organization"}}if(!t.id)throw Error(`${t.type} scopes require an ID`);if(!this.resolveAuthorizationTarget(e,t))throw Error("Authorization scope was not found in this organization");return{type:t.type,id:t.id}}resolveAuthorizationTarget(e,t){if(!this.getOrganization(e))return;if(t.type==="organization")return{organizationId:e};if(!t.id)return;if(t.type==="project"){let i=this.database.query("SELECT id FROM projects WHERE id = ? AND organization_id = ?").get(t.id,e);return i?{organizationId:e,projectId:String(i.id)}:void 0}if(t.type==="environment"){let i=this.database.query("SELECT environments.id, environments.project_id FROM environments JOIN projects ON projects.id = environments.project_id WHERE environments.id = ? AND projects.organization_id = ?").get(t.id,e);return i?{organizationId:e,projectId:String(i.project_id),environmentId:String(i.id)}:void 0}let r=this.database.query(`SELECT resources.id, resources.project_id, resources.environment_id FROM resources
-      JOIN projects ON projects.id = resources.project_id WHERE resources.id = ? AND projects.organization_id = ?`).get(t.id,e);return r?{organizationId:e,projectId:String(r.project_id),environmentId:d(r.environment_id),resourceId:String(r.id)}:void 0}createMembership(e){if(!this.getActor(e.actorId))throw Error("Membership actor was not found");let t=this.normalizeAuthorizationScope(e.organizationId,e.scope);if(e.roleTemplate==="owner"&&t.type!=="organization")throw Error("Owners must be scoped to the organization");let r=e.id??this.idFn(),i=this.now();o(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, source, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.organizationId,e.actorId,e.roleTemplate,t.type,t.id??null,e.source??"manual",i,i]);let a=this.getMembership(r);return this.appendEvent({organizationId:e.organizationId,actorId:e.performedByActorId,type:"organization.membership.created",payload:{membershipId:r,actorId:e.actorId,roleTemplate:e.roleTemplate,scope:U(t)}}),a}getMembership(e){let t=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(e);return t?k(t):void 0}getMembershipForActor(e,t){let r=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(e,t);return r?k(r):void 0}listMemberships(e,t={}){let r=t.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${r} ORDER BY created_at, id`).all(e).map(k)}updateMembership(e){let t=this.getMembership(e.id);if(!t)throw Error("Membership was not found");let r=this.normalizeAuthorizationScope(t.organizationId,e.scope??t.scope);if(e.roleTemplate==="owner"&&r.type!=="organization")throw Error("Owners must be scoped to the organization");if(t.roleTemplate==="owner"&&t.status==="active"&&(e.roleTemplate!=="owner"||r.type!=="organization"))this.assertAnotherOwner(t);return o(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[e.roleTemplate,r.type,r.id??null,this.now(),t.id]),this.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"organization.membership.updated",payload:{membershipId:t.id,from:{roleTemplate:t.roleTemplate,scope:U(t.scope)},to:{roleTemplate:e.roleTemplate,scope:U(r)}}}),this.getMembership(t.id)}revokeMembership(e,t){let r=this.getMembership(e);if(!r)throw Error("Membership was not found");if(r.status==="revoked")return r;if(r.roleTemplate==="owner")this.assertAnotherOwner(r);return o(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),e]),this.appendEvent({organizationId:r.organizationId,actorId:t,type:"organization.membership.revoked",payload:{membershipId:e}}),this.getMembership(e)}touchMembership(e){let t=this.now();o(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[t,t,e,"active"]);let r=this.getMembership(e);if(!r)throw Error("Membership was not found");return r}assertAnotherOwner(e){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(e.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(e){let t=e.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid invitation email is required");let r=this.normalizeAuthorizationScope(e.organizationId,e.scope);if(e.roleTemplate==="owner"&&r.type!=="organization")throw Error("Owners must be scoped to the organization");let i=Ne(32).toString("base64url"),a=h("sha256").update(i).digest("hex"),E=e.id??this.idFn(),T=this.now(),s=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,e.expiresInMs??604800000))).toISOString();return o(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[E,e.organizationId,t,e.roleTemplate,r.type,r.id??null,a,e.invitedByActorId??null,s,T,T]),this.appendEvent({organizationId:e.organizationId,actorId:e.invitedByActorId,type:"organization.invitation.created",payload:{invitationId:E,email:t,roleTemplate:e.roleTemplate,scope:U(r),expiresAt:s}}),{invitation:this.getInvitation(E),token:i}}getInvitation(e){let t=this.database.query("SELECT * FROM organization_invitations WHERE id = ?").get(e);return t?g(t,this.now()):void 0}listInvitations(e){return this.database.query("SELECT * FROM organization_invitations WHERE organization_id = ? ORDER BY created_at DESC").all(e).map((t)=>g(t,this.now()))}inspectInvitationToken(e){let t=h("sha256").update(e).digest("hex"),r=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(t);return r?g(r,this.now()):void 0}acceptInvitation(e,t){let r=h("sha256").update(e).digest("hex");return this.transaction(()=>{let i=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(r);if(!i)throw Error("Invitation is invalid");let a=g(i,this.now());if(a.state!=="pending")throw Error(`Invitation is ${a.state}`);if(!this.getActor(t))throw Error("Invitation actor was not found");if(o(this.database,"UPDATE organization_invitations SET accepted_by_actor_id = ?, accepted_at = ?, updated_at = ? WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?",[t,this.now(),this.now(),a.id,this.now()]).changes!==1)throw Error("Invitation is no longer available");let T=this.getMembershipForActor(a.organizationId,t),s=T??this.createMembership({organizationId:a.organizationId,actorId:t,roleTemplate:a.roleTemplate,scope:a.scope,source:"invitation"});if(T&&a.roleTemplate==="owner"&&T.roleTemplate!=="owner")s=this.updateMembership({id:T.id,roleTemplate:"owner",scope:{type:"organization"},actorId:t});else if(T)for(let c of I(a.roleTemplate))this.upsertGrant({organizationId:a.organizationId,membershipId:T.id,effect:"allow",capability:c,scope:a.scope,source:"invitation"});return this.appendEvent({organizationId:a.organizationId,actorId:t,type:"organization.invitation.accepted",payload:{invitationId:a.id,membershipId:s.id}}),{invitation:this.getInvitation(a.id),membership:this.getMembership(s.id)}})}revokeInvitation(e,t){let r=this.getInvitation(e);if(!r)throw Error("Invitation was not found");if(r.acceptedAt)throw Error("Accepted invitations cannot be revoked");if(!r.revokedAt)o(this.database,"UPDATE organization_invitations SET revoked_at = ?, updated_at = ? WHERE id = ?",[this.now(),this.now(),e]);return this.appendEvent({organizationId:r.organizationId,actorId:t,type:"organization.invitation.revoked",payload:{invitationId:e}}),this.getInvitation(e)}reissueInvitation(e,t){let r=this.getInvitation(e);if(!r)throw Error("Invitation was not found");if(r.state==="accepted")throw Error("Accepted invitations cannot be reissued");return this.revokeInvitation(e,t),this.createInvitation({organizationId:r.organizationId,email:r.email,roleTemplate:r.roleTemplate,scope:r.scope,invitedByActorId:t})}upsertGrant(e){if(!C.includes(e.capability))throw Error("Unknown authorization capability");let t=this.getMembership(e.membershipId);if(!t||t.organizationId!==e.organizationId)throw Error("Grant membership was not found in this organization");let r=this.normalizeAuthorizationScope(e.organizationId,e.scope),i=this.now(),a=this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? AND effect = ? AND capability = ? AND scope_type = ? AND scope_id IS ?").get(e.membershipId,e.effect,e.capability,r.type,r.id??null);if(a)return w(a);let E=e.id??this.idFn();return o(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[E,e.organizationId,e.membershipId,e.effect,e.capability,r.type,r.id??null,e.source??"manual",i,i]),o(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[i,e.membershipId]),this.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"organization.grant.created",payload:{grantId:E,membershipId:e.membershipId,effect:e.effect,capability:e.capability,scope:U(r)}}),this.getGrant(E)}getGrant(e){let t=this.database.query("SELECT * FROM authorization_grants WHERE id = ?").get(e);return t?w(t):void 0}listGrants(e){return this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? ORDER BY effect DESC, capability, scope_type, scope_id").all(e).map(w)}removeGrant(e,t){let r=this.getGrant(e);if(!r)return!1;let i=o(this.database,"DELETE FROM authorization_grants WHERE id = ?",[e]).changes===1;if(i)o(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),r.membershipId]),this.appendEvent({organizationId:r.organizationId,actorId:t,type:"organization.grant.removed",payload:{grantId:e,membershipId:r.membershipId}});return i}createOperation(e){if(e.idempotencyKey){let a=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(e.idempotencyKey);if(a)return u(a)}let t=e.id??this.idFn(),r=e.correlationId??this.idFn(),i=this.now();try{return this.transaction(()=>(o(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key, input, output, priority, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[t,e.projectId??null,e.environmentId??null,e.resourceId??null,e.actorId??null,e.kind,r,e.idempotencyKey??null,N(e.input??{}),e.priority??0,i,i]),this.appendEvent({projectId:e.projectId,operationId:t,resourceId:e.resourceId,actorId:e.actorId,correlationId:r,type:"operation.queued",payload:{kind:e.kind}}),this.getOperation(t)))}catch(a){if(e.idempotencyKey){let E=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(e.idempotencyKey);if(E)return u(E)}throw a}}getOperation(e){let t=this.database.query("SELECT * FROM operations WHERE id = ?").get(e);return t?u(t):void 0}listOperations(e={}){let t=[],r=[];if(e.projectId)t.push("project_id = ?"),r.push(e.projectId);if(e.state)t.push("state = ?"),r.push(e.state);if(e.kind)t.push("kind = ?"),r.push(e.kind);if(e.before)t.push("created_at < ?"),r.push(e.before);let i=Math.min(500,Math.max(1,e.limit??100));r.push(i);let a=t.length?`WHERE ${t.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${a} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...r).map(u)}claimNextOperation(e,t=60000,r){let i=this.now(),a=new Date(this.nowFn().getTime()+t).toISOString();return this.transaction(()=>{let E=r?.length?`AND kind IN (${Ce(r.length)})`:"",T=r?[...r]:[],s=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${E} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(...T);if(!s)return;let c=u(s);if(o(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
-        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[e,a,i,i,c.id,c.version]).changes!==1)return;return this.appendEvent({projectId:c.projectId,operationId:c.id,resourceId:c.resourceId,actorId:c.actorId,correlationId:c.correlationId,type:"operation.running",payload:{attempt:c.attempt+1,workerId:e}}),this.getOperation(c.id)})}claimOperation(e,t,r=60000){let i=this.now(),a=new Date(this.nowFn().getTime()+r).toISOString();return this.transaction(()=>{let E=this.getOperation(e);if(!E||E.state!=="queued")return;if(o(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
-        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[t,a,i,i,E.id,E.version]).changes!==1)return;return this.appendEvent({projectId:E.projectId,operationId:E.id,resourceId:E.resourceId,actorId:E.actorId,correlationId:E.correlationId,type:"operation.running",payload:{attempt:E.attempt+1,workerId:t}}),this.getOperation(E.id)})}transitionOperation(e,t){return this.transaction(()=>{let r=this.getOperation(e);if(!r)throw Error(`Operation ${e} was not found`);let i=t.expectedVersion??r.version;if(r.version!==i)throw new p("Operation",e,i);if(!pe[r.state].includes(t.to))throw new x(r.state,t.to);let a=this.now(),E=le.includes(t.to),T=t.to==="queued";if(o(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
-        finished_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND version = ?`,[t.to,N(t.output??r.output),M(t.error)??null,T||E?null:t.leaseOwner??r.leaseOwner??null,T||E?null:t.leaseExpiresAt??r.leaseExpiresAt??null,E?a:null,a,e,i]).changes!==1)throw new p("Operation",e,i);return this.appendEvent({projectId:r.projectId,operationId:e,resourceId:r.resourceId,actorId:r.actorId,correlationId:r.correlationId,type:`operation.${t.to}`,level:t.to==="failed"?"error":"info",payload:{from:r.state,to:t.to,error:M(t.error)??null}}),this.getOperation(e)})}requestCancellation(e){let t=this.now();o(this.database,"UPDATE operations SET cancel_requested_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND state IN ('queued', 'running')",[t,t,e]);let r=this.getOperation(e);if(!r)throw Error(`Operation ${e} was not found`);return r}reconcileOrphanedOperations(e={}){let t=(e.now??this.nowFn()).toISOString(),r=e.policy??"fail",i=this.database.query("SELECT * FROM operations WHERE state = 'running' AND (lease_expires_at IS NULL OR lease_expires_at <= ?)").all(t).map(u),a=0,E=0;for(let T of i)if(r==="requeue")this.transitionOperation(T.id,{to:"queued",expectedVersion:T.version,error:"Worker lease expired; operation requeued after restart."}),a++;else this.transitionOperation(T.id,{to:"failed",expectedVersion:T.version,error:"Worker lease expired or dashboard restarted before completion."}),E++;return{requeued:a,failed:E}}appendEvent(e){let t=e.id??this.idFn(),r=e.correlationId??this.idFn(),i=e.organizationId??(e.projectId?d(this.database.query("SELECT organization_id FROM projects WHERE id = ?").get(e.projectId)?.organization_id):void 0);return o(this.database,`INSERT INTO events (id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,i??null,e.projectId??null,e.operationId??null,e.resourceId??null,e.actorId??null,r,e.type,e.level??"info",N(e.payload??{}),this.now()]),Y(this.database.query("SELECT * FROM events WHERE id = ?").get(t))}listEvents(e={}){let t=[],r=[];if(e.organizationId)t.push("organization_id = ?"),r.push(e.organizationId);if(e.projectId)t.push("project_id = ?"),r.push(e.projectId);if(e.operationId)t.push("operation_id = ?"),r.push(e.operationId);if(e.resourceId)t.push("resource_id = ?"),r.push(e.resourceId);if(e.correlationId)t.push("correlation_id = ?"),r.push(e.correlationId);if(e.afterSequence!==void 0)t.push("sequence > ?"),r.push(e.afterSequence);let i=Math.min(1000,Math.max(1,e.limit??200));r.push(i);let a=t.length?`WHERE ${t.join(" AND ")}`:"";return this.database.query(`SELECT * FROM events ${a} ORDER BY sequence ASC LIMIT ?`).all(...r).map(Y)}setSetting(e,t){o(this.database,`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
-      ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,[e,N(t),this.now()])}getSetting(e){let t=this.database.query("SELECT value FROM settings WHERE key = ?").get(e);return t?_(t.value):void 0}upsertTag(e,t,r="#5a8be0"){let i=t.trim().toLowerCase().replace(/\s+/g,"-");if(!/^[a-z0-9][a-z0-9-]{0,31}$/.test(i))throw Error("Tag names must contain 1-32 letters, numbers, or dashes");if(!/^#[0-9a-f]{6}$/i.test(r))throw Error("Tag colors must be six-digit hex colors");let a=this.now(),E=this.database.query("SELECT * FROM tags WHERE project_id = ? AND normalized_name = ?").get(e,i);if(E)return o(this.database,"UPDATE tags SET name = ?, color = ?, updated_at = ? WHERE id = ?",[t.trim(),r.toLowerCase(),a,String(E.id)]),R(this.database.query("SELECT * FROM tags WHERE id = ?").get(String(E.id)));let T=this.idFn();return o(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T,e,t.trim(),i,r.toLowerCase(),a,a]),R(this.database.query("SELECT * FROM tags WHERE id = ?").get(T))}listTags(e){return this.database.query("SELECT * FROM tags WHERE project_id = ? ORDER BY normalized_name").all(e).map(R)}assignTag(e,t){if(!this.database.query("SELECT tags.id FROM tags JOIN resources ON resources.project_id = tags.project_id WHERE tags.id = ? AND resources.id = ?").get(t,e))throw Error("The tag and resource must belong to the same project");o(this.database,"INSERT OR IGNORE INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[e,t,this.now()])}removeTag(e,t){o(this.database,"DELETE FROM resource_tags WHERE resource_id = ? AND tag_id = ?",[e,t])}listResourceTags(e){return this.database.query(`SELECT resource_tags.resource_id, tags.* FROM resource_tags JOIN tags ON tags.id = resource_tags.tag_id
-      WHERE tags.project_id = ? ORDER BY tags.normalized_name`).all(e).map((r)=>({resourceId:String(r.resource_id),tag:R(r)}))}saveFilter(e,t,r,i){let a=t.trim();if(!a||a.length>64)throw Error("Saved filter names must contain 1-64 characters");if(!r||r.length>160||/^[a-z][a-z0-9+.-]*:|^\/\//i.test(r))throw Error("Saved filter routes must be local route IDs or paths");let E=N(i);if(E.length>8192)throw Error("Saved filter queries must be smaller than 8 KB");let T=this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? AND name = ?").get(e,a),s=this.now();if(T)return o(this.database,"UPDATE saved_filters SET route_id = ?, query = ?, updated_at = ? WHERE id = ?",[r,E,s,String(T.id)]),b(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(String(T.id)));let c=this.idFn();return o(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[c,e,a,r,E,s,s]),b(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(c))}listSavedFilters(e){return this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? ORDER BY updated_at DESC, name").all(e).map(b)}deleteSavedFilter(e,t){return o(this.database,"DELETE FROM saved_filters WHERE actor_key = ? AND id = ?",[e,t]).changes===1}recordNavigation(e,t,r){let i=this.now();return o(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, last_visited_at) VALUES (?, ?, ?, ?)
-      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET last_visited_at = excluded.last_visited_at, visit_count = visit_count + 1`,[e,t,r,i]),F(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(e,t,r))}setFavorite(e,t,r,i){let a=this.now();return o(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at) VALUES (?, ?, ?, ?, ?)
-      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[e,t,r,i?1:0,a]),F(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(e,t,r))}listNavigation(e,t={}){let r=t.favoritesOnly?"AND favorite = 1":"",i=Math.min(100,Math.max(1,t.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${r} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(e,i).map(F)}compact(e={}){let t=new Date(this.nowFn().getTime()-(e.eventRetentionDays??90)*86400000).toISOString(),r=new Date(this.nowFn().getTime()-(e.operationRetentionDays??365)*86400000).toISOString(),i=this.transaction(()=>{let a=o(this.database,"DELETE FROM events WHERE created_at < ?",[t]).changes,E=o(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[r]).changes;return{events:a,operations:E}});if(e.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:i.events,deletedOperations:i.operations,vacuumed:e.vacuum!==!1}}createBackup(e="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let t=`${this.path}.${Date.now()}.bak`;return this.backupTo(t),this.setSetting("storage.last_backup",{path:t,createdAt:this.now(),reason:e}),t}integrityCheck(){let e=this.database.query("PRAGMA integrity_check").all();return e.length===1&&Object.values(e[0])[0]==="ok"?"ok":"corrupt"}health(){let e=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((a)=>[a,0]));for(let a of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())e[String(a.state)]=Number(a.count);let t=this.database.query("PRAGMA journal_mode").get(),r=this.getSetting("storage.last_backup"),i=r&&!Array.isArray(r)&&typeof r==="object"&&typeof r.createdAt==="string"?r.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:l,integrity:this.integrityCheck(),journalMode:String(t?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&ee(this.path)?Le(this.path).size:this.database.serialize().byteLength,lastBackupAt:i,operations:e,pendingRetryableOperations:e.queued+e.failed+e.timed_out}}exportSnapshot(){let e={};for(let t of this.database.query("SELECT key, value FROM settings ORDER BY key").all())e[String(t.key)]=_(t.value);return{format:"ts-cloud-control-plane",schemaVersion:l,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(z),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(k),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((t)=>({...g(t,this.now()),tokenHash:String(t.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(w),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(v),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(D),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(y),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(f),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(u),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(Y),settings:e,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(R),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((t)=>({resourceId:String(t.resource_id),tagId:String(t.tag_id),createdAt:String(t.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(b),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(F)}}importSnapshot(e,t={}){if(e.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(e.schemaVersion>l)throw new S(e.schemaVersion,l);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!t.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(t.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let i of e.organizations??[])o(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[i.id,i.slug,i.name,i.createdAt,i.updatedAt]);for(let i of e.projects)o(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.slug,i.name,i.description??null,i.organizationId??null,i.desiredConfigHash??null,i.version,i.createdAt,i.updatedAt]);for(let i of e.environments)o(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.projectId,i.slug,i.name,i.kind,i.region??null,N(i.desiredState),N(i.discoveredState),i.version,i.createdAt,i.updatedAt]);for(let i of e.resources)o(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.projectId,i.environmentId??null,i.kind,i.slug,i.name,i.provider??null,i.providerId??null,N(i.desiredState),N(i.discoveredState),N(i.metadata),i.version,i.createdAt,i.updatedAt]);for(let i of e.actors)o(this.database,`INSERT INTO actors (id, kind, external_id, display_name, metadata, disabled_at, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.kind,i.externalId??null,i.displayName,N(i.metadata),i.disabledAt??null,i.version,i.createdAt,i.updatedAt]);for(let i of e.memberships??[])o(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, status, session_version, last_active_at, source, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.organizationId,i.actorId,i.roleTemplate,i.scope.type,i.scope.id??null,i.status,i.sessionVersion,i.lastActiveAt??null,i.source??"manual",i.createdAt,i.updatedAt]);for(let i of e.invitations??[]){let a=i.tokenHash??h("sha256").update(`revoked:${i.id}:${this.idFn()}`).digest("hex");o(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, accepted_by_actor_id, expires_at, accepted_at, revoked_at, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.organizationId,i.email,i.roleTemplate,i.scope.type,i.scope.id??null,a,i.invitedByActorId??null,i.acceptedByActorId??null,i.expiresAt,i.acceptedAt??null,i.tokenHash?i.revokedAt??null:i.revokedAt??this.now(),i.createdAt,i.updatedAt])}for(let i of e.grants??[])o(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.organizationId,i.membershipId,i.effect,i.capability,i.scope.type,i.scope.id??null,i.source??"manual",i.createdAt,i.updatedAt]);for(let i of e.operations)o(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key,
+    `}];class U extends Error{constructor(E,T,N){super(`${E} ${T} changed since version ${N}`);this.name="OptimisticConcurrencyError"}}class j extends Error{constructor(E,T){super(`Operation cannot transition from ${E} to ${T}`);this.name="InvalidOperationTransitionError"}}class v extends Error{constructor(E,T){super(`Control-plane schema version ${E} is newer than supported version ${T}`);this.name="UnsupportedSchemaVersionError"}}var eE=65536,q=16384,cE=["succeeded","failed","cancelled","timed_out"],CE={queued:["running","cancelled","timed_out"],running:["queued","succeeded","failed","cancelled","timed_out"],succeeded:[],failed:["queued"],cancelled:["queued"],timed_out:["queued"]},UE=/(?:^|_)(?:authorization|cookie|credential|password|passwd|secret|token|api_?key|private_?key|access_?key)(?:$|_)/i,NE=/(?:authorization|password|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;]+/gi;function c(E){if(typeof E!=="string")return{};try{return JSON.parse(E)}catch{return{}}}function d(E){return typeof E==="string"?E:void 0}function P(E,T){if(T&&UE.test(T))return"[REDACTED]";if(E===null||typeof E==="boolean"||typeof E==="number")return E;if(typeof E==="string")return E.replace(NE,"[REDACTED]");if(Array.isArray(E))return E.map((N)=>P(N));if(E&&typeof E==="object"){let N={};for(let[e,L]of Object.entries(E))N[e]=P(L,e);return N}return String(E??"")}function LE(E,T=eE){let N=P(E),e=JSON.stringify(N);if(Buffer.byteLength(e)<=T)return N;return{truncated:!0,originalBytes:Buffer.byteLength(e),preview:e.slice(0,Math.max(0,T-128))}}function r(E){return JSON.stringify(LE(E))}function z(E){if(!E)return;let T=E.replace(NE,"[REDACTED]");return Buffer.byteLength(T)<=q?T:`${T.slice(0,q-24)}
+[output truncated]`}function F(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),description:d(E.description),organizationId:d(E.organization_id),desiredConfigHash:d(E.desired_config_hash),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function y(E){return{id:String(E.id),projectId:String(E.project_id),slug:String(E.slug),name:String(E.name),kind:String(E.kind),region:d(E.region),desiredState:c(E.desired_state),discoveredState:c(E.discovered_state),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function m(E){return{id:String(E.id),projectId:String(E.project_id),environmentId:d(E.environment_id),kind:String(E.kind),slug:String(E.slug),name:String(E.name),provider:d(E.provider),providerId:d(E.provider_id),desiredState:c(E.desired_state),discoveredState:c(E.discovered_state),metadata:c(E.metadata),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function f(E){return{id:String(E.id),kind:String(E.kind),externalId:d(E.external_id),displayName:String(E.display_name),metadata:c(E.metadata),disabledAt:d(E.disabled_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function O(E){return{id:String(E.id),projectId:d(E.project_id),environmentId:d(E.environment_id),resourceId:d(E.resource_id),actorId:d(E.actor_id),kind:String(E.kind),state:String(E.state),correlationId:String(E.correlation_id),idempotencyKey:d(E.idempotency_key),input:c(E.input),output:c(E.output),error:d(E.error),attempt:Number(E.attempt),priority:Number(E.priority),leaseOwner:d(E.lease_owner),leaseExpiresAt:d(E.lease_expires_at),cancelRequestedAt:d(E.cancel_requested_at),startedAt:d(E.started_at),finishedAt:d(E.finished_at),version:Number(E.version),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function M(E){return{id:String(E.id),sequence:Number(E.sequence),organizationId:d(E.organization_id),projectId:d(E.project_id),operationId:d(E.operation_id),resourceId:d(E.resource_id),actorId:d(E.actor_id),correlationId:String(E.correlation_id),type:String(E.type),level:String(E.level),payload:c(E.payload),createdAt:String(E.created_at)}}function l(E){return{id:String(E.id),projectId:String(E.project_id),name:String(E.name),normalizedName:String(E.normalized_name),color:String(E.color),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function h(E){return{id:String(E.id),actorKey:String(E.actor_key),name:String(E.name),routeId:String(E.route_id),query:c(E.query),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function K(E){return{actorKey:String(E.actor_key),entityType:String(E.entity_type),entityId:String(E.entity_id),favorite:Number(E.favorite)===1,lastVisitedAt:String(E.last_visited_at),visitCount:Number(E.visit_count)}}function b(E){return{id:String(E.id),slug:String(E.slug),name:String(E.name),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function Q(E){let T=String(E.scope_type);return{type:T,...T==="organization"?{}:{id:String(E.scope_id)}}}function k(E){return{id:String(E.id),organizationId:String(E.organization_id),actorId:String(E.actor_id),roleTemplate:String(E.role_template),scope:Q(E),source:String(E.source??"manual"),status:String(E.status),sessionVersion:Number(E.session_version),lastActiveAt:d(E.last_active_at),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function A(E,T){let N=d(E.accepted_at),e=d(E.revoked_at),L=String(E.expires_at),t=e?"revoked":N?"accepted":L<=T?"expired":"pending";return{id:String(E.id),organizationId:String(E.organization_id),email:String(E.email),roleTemplate:String(E.role_template),scope:Q(E),invitedByActorId:d(E.invited_by_actor_id),acceptedByActorId:d(E.accepted_by_actor_id),expiresAt:L,acceptedAt:N,revokedAt:e,state:t,createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function H(E){return{id:String(E.id),organizationId:String(E.organization_id),membershipId:String(E.membership_id),effect:String(E.effect),capability:String(E.capability),scope:Q(E),source:String(E.source??"manual"),createdAt:String(E.created_at),updatedAt:String(E.updated_at)}}function D(E){return{type:E.type,id:E.id??null}}function OE(E){return Array.from({length:E},()=>"?").join(", ")}function a(E,T,N){return E.run(T,N)}class iE{path;database;nowFn;idFn;constructor(E={}){this.path=E.path??TE(E.cwd??process.cwd(),"control-plane.sqlite"),this.nowFn=E.now??(()=>new Date),this.idFn=E.id??(()=>crypto.randomUUID());let T=this.path===":memory:";if(!T){rE(EE(this.path),{recursive:!0,mode:448});try{B(EE(this.path),448)}catch{}}if(this.database=new oE(this.path,{create:!0,strict:!0}),this.database.run("PRAGMA foreign_keys = ON"),this.database.run(`PRAGMA busy_timeout = ${Math.max(100,E.busyTimeoutMs??5000)}`),!T)this.database.run("PRAGMA journal_mode = WAL"),this.database.run("PRAGMA synchronous = NORMAL");if(this.migrate(),!T)this.secureDatabaseFiles()}now(){return this.nowFn().toISOString()}secureDatabaseFiles(){for(let E of[this.path,`${this.path}-wal`,`${this.path}-shm`]){if(!w(E))continue;try{B(E,384)}catch{}}}backupTo(E){this.database.run("VACUUM INTO ?",[E]);try{B(E,384)}catch{}}migrate(){let E=this.database.query("PRAGMA user_version").get(),T=Number(E?.user_version??0);if(T>C)throw new v(T,C);if(T===C)return;let N;if(T>0&&this.path!==":memory:")N=`${this.path}.v${T}.${Date.now()}.bak`,this.backupTo(N);try{if(this.database.transaction(()=>{for(let L of G){if(L.version<=T)continue;this.database.run(L.sql),a(this.database,"INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)",[L.version,L.name,this.now()]),this.database.run(`PRAGMA user_version = ${L.version}`)}}).exclusive(),N)this.setSetting("storage.last_backup",{path:N,createdAt:this.now(),reason:"pre-migration"})}catch(e){let L=N?` Restore from ${N}.`:"";throw Error(`Control-plane migration from schema ${T} failed.${L} ${e instanceof Error?e.message:String(e)}`)}}close(){if(this.path!==":memory:")this.secureDatabaseFiles();this.database.close()}transaction(E){return this.database.transaction(E).immediate()}createProject(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,"INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",[T,E.slug,E.name,E.description??null,E.organizationId??null,E.desiredConfigHash??null,N,N]),this.getProject(T)}getProject(E){let T=this.database.query("SELECT * FROM projects WHERE id = ?").get(E);return T?F(T):void 0}getProjectBySlug(E){let T=this.database.query("SELECT * FROM projects WHERE slug = ?").get(E);return T?F(T):void 0}listProjects(){return this.database.query("SELECT * FROM projects ORDER BY name COLLATE NOCASE, id").all().map(F)}updateProject(E,T,N){let e=this.getProject(E);if(!e||e.version!==T)throw new U("Project",E,T);if(a(this.database,`UPDATE projects SET name = ?, description = ?, organization_id = ?, desired_config_hash = ?, version = version + 1, updated_at = ?
+      WHERE id = ? AND version = ?`,[N.name??e.name,N.description===null?null:N.description??e.description??null,N.organizationId===null?null:N.organizationId??e.organizationId??null,N.desiredConfigHash===null?null:N.desiredConfigHash??e.desiredConfigHash??null,this.now(),E,T]).changes!==1)throw new U("Project",E,T);return this.getProject(E)}createEnvironment(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.projectId,E.slug,E.name,E.kind,E.region??null,r(E.desiredState??{}),r(E.discoveredState??{}),N,N]),y(this.database.query("SELECT * FROM environments WHERE id = ?").get(T))}listEnvironments(E){return this.database.query("SELECT * FROM environments WHERE project_id = ? ORDER BY name COLLATE NOCASE, id").all(E).map(y)}getEnvironmentBySlug(E,T){let N=this.database.query("SELECT * FROM environments WHERE project_id = ? AND slug = ?").get(E,T);return N?y(N):void 0}createResource(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,E.projectId,E.environmentId??null,E.kind,E.slug,E.name,E.provider??null,E.providerId??null,r(E.desiredState??{}),r(E.discoveredState??{}),r(E.metadata??{}),N,N]),m(this.database.query("SELECT * FROM resources WHERE id = ?").get(T))}listResources(E,T){return(T?this.database.query("SELECT * FROM resources WHERE project_id = ? AND environment_id = ? ORDER BY kind, name COLLATE NOCASE").all(E,T):this.database.query("SELECT * FROM resources WHERE project_id = ? ORDER BY kind, name COLLATE NOCASE").all(E)).map(m)}getResource(E){let T=this.database.query("SELECT * FROM resources WHERE id = ?").get(E);return T?m(T):void 0}updateResource(E,T,N){let e=this.getResource(E);if(!e||e.version!==T)throw new U("Resource",E,T);if(a(this.database,`UPDATE resources SET name = ?, provider = ?, provider_id = ?, desired_state = ?, discovered_state = ?, metadata = ?,
+      version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,[N.name??e.name,N.provider===null?null:N.provider??e.provider??null,N.providerId===null?null:N.providerId??e.providerId??null,r(N.desiredState??e.desiredState),r(N.discoveredState??e.discoveredState),r(N.metadata??e.metadata),this.now(),E,T]).changes!==1)throw new U("Resource",E,T);return this.getResource(E)}createActor(E){let T=E.id??this.idFn(),N=this.now();return a(this.database,"INSERT INTO actors (id, kind, external_id, display_name, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[T,E.kind,E.externalId??null,E.displayName,r(E.metadata??{}),N,N]),f(this.database.query("SELECT * FROM actors WHERE id = ?").get(T))}getActorByExternalId(E,T){let N=this.database.query("SELECT * FROM actors WHERE kind = ? AND external_id = ?").get(E,T);return N?f(N):void 0}getActor(E){let T=this.database.query("SELECT * FROM actors WHERE id = ?").get(E);return T?f(T):void 0}createOrganization(E){let T=E.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/.test(T))throw Error("Organization slugs must contain 3-64 lowercase letters, numbers, or dashes");let N=E.name.trim();if(!N||N.length>100)throw Error("Organization names must contain 1-100 characters");let e=E.id??this.idFn(),L=this.now();return a(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[e,T,N,L,L]),this.getOrganization(e)}getOrganization(E){let T=this.database.query("SELECT * FROM organizations WHERE id = ?").get(E);return T?b(T):void 0}getOrganizationBySlug(E){let T=this.database.query("SELECT * FROM organizations WHERE slug = ?").get(E.trim().toLowerCase());return T?b(T):void 0}listOrganizations(E){return(E?this.database.query(`SELECT organizations.* FROM organizations JOIN organization_memberships ON organization_memberships.organization_id = organizations.id
+          WHERE organization_memberships.actor_id = ? AND organization_memberships.status = 'active' ORDER BY organizations.name COLLATE NOCASE`).all(E):this.database.query("SELECT * FROM organizations ORDER BY name COLLATE NOCASE").all()).map(b)}normalizeAuthorizationScope(E,T={type:"organization"}){if(T.type==="organization"){if(T.id&&T.id!==E)throw Error("Organization scope does not match the requested organization");return{type:"organization"}}if(!T.id)throw Error(`${T.type} scopes require an ID`);if(!this.resolveAuthorizationTarget(E,T))throw Error("Authorization scope was not found in this organization");return{type:T.type,id:T.id}}resolveAuthorizationTarget(E,T){if(!this.getOrganization(E))return;if(T.type==="organization")return{organizationId:E};if(!T.id)return;if(T.type==="project"){let e=this.database.query("SELECT id FROM projects WHERE id = ? AND organization_id = ?").get(T.id,E);return e?{organizationId:E,projectId:String(e.id)}:void 0}if(T.type==="environment"){let e=this.database.query("SELECT environments.id, environments.project_id FROM environments JOIN projects ON projects.id = environments.project_id WHERE environments.id = ? AND projects.organization_id = ?").get(T.id,E);return e?{organizationId:E,projectId:String(e.project_id),environmentId:String(e.id)}:void 0}let N=this.database.query(`SELECT resources.id, resources.project_id, resources.environment_id FROM resources
+      JOIN projects ON projects.id = resources.project_id WHERE resources.id = ? AND projects.organization_id = ?`).get(T.id,E);return N?{organizationId:E,projectId:String(N.project_id),environmentId:d(N.environment_id),resourceId:String(N.id)}:void 0}createMembership(E){if(!this.getActor(E.actorId))throw Error("Membership actor was not found");let T=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&T.type!=="organization")throw Error("Owners must be scoped to the organization");let N=E.id??this.idFn(),e=this.now();a(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, source, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[N,E.organizationId,E.actorId,E.roleTemplate,T.type,T.id??null,E.source??"manual",e,e]);let L=this.getMembership(N);return this.appendEvent({organizationId:E.organizationId,actorId:E.performedByActorId,type:"organization.membership.created",payload:{membershipId:N,actorId:E.actorId,roleTemplate:E.roleTemplate,scope:D(T)}}),L}getMembership(E){let T=this.database.query("SELECT * FROM organization_memberships WHERE id = ?").get(E);return T?k(T):void 0}getMembershipForActor(E,T){let N=this.database.query("SELECT * FROM organization_memberships WHERE organization_id = ? AND actor_id = ?").get(E,T);return N?k(N):void 0}listMemberships(E,T={}){let N=T.includeRevoked?"":"AND status = 'active'";return this.database.query(`SELECT * FROM organization_memberships WHERE organization_id = ? ${N} ORDER BY created_at, id`).all(E).map(k)}updateMembership(E){let T=this.getMembership(E.id);if(!T)throw Error("Membership was not found");let N=this.normalizeAuthorizationScope(T.organizationId,E.scope??T.scope);if(E.roleTemplate==="owner"&&N.type!=="organization")throw Error("Owners must be scoped to the organization");if(T.roleTemplate==="owner"&&T.status==="active"&&(E.roleTemplate!=="owner"||N.type!=="organization"))this.assertAnotherOwner(T);return a(this.database,"UPDATE organization_memberships SET role_template = ?, scope_type = ?, scope_id = ?, session_version = session_version + 1, updated_at = ? WHERE id = ?",[E.roleTemplate,N.type,N.id??null,this.now(),T.id]),this.appendEvent({organizationId:T.organizationId,actorId:E.actorId,type:"organization.membership.updated",payload:{membershipId:T.id,from:{roleTemplate:T.roleTemplate,scope:D(T.scope)},to:{roleTemplate:E.roleTemplate,scope:D(N)}}}),this.getMembership(T.id)}revokeMembership(E,T){let N=this.getMembership(E);if(!N)throw Error("Membership was not found");if(N.status==="revoked")return N;if(N.roleTemplate==="owner")this.assertAnotherOwner(N);return a(this.database,"UPDATE organization_memberships SET status = 'revoked', session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),E]),this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.membership.revoked",payload:{membershipId:E}}),this.getMembership(E)}touchMembership(E){let T=this.now();a(this.database,"UPDATE organization_memberships SET last_active_at = ?, updated_at = ? WHERE id = ? AND status = ?",[T,T,E,"active"]);let N=this.getMembership(E);if(!N)throw Error("Membership was not found");return N}assertAnotherOwner(E){if(Number(this.database.query("SELECT COUNT(*) AS count FROM organization_memberships WHERE organization_id = ? AND status = ? AND role_template = 'owner'").get(E.organizationId,"active")?.count??0)<=1)throw Error("Cannot remove or demote the last organization owner")}createInvitation(E){let T=E.email.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(T)||T.length>254)throw Error("A valid invitation email is required");let N=this.normalizeAuthorizationScope(E.organizationId,E.scope);if(E.roleTemplate==="owner"&&N.type!=="organization")throw Error("Owners must be scoped to the organization");let e=dE(32).toString("base64url"),L=g("sha256").update(e).digest("hex"),t=E.id??this.idFn(),_=this.now(),s=new Date(this.nowFn().getTime()+Math.min(2592000000,Math.max(60000,E.expiresInMs??604800000))).toISOString();return a(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, expires_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,T,E.roleTemplate,N.type,N.id??null,L,E.invitedByActorId??null,s,_,_]),this.appendEvent({organizationId:E.organizationId,actorId:E.invitedByActorId,type:"organization.invitation.created",payload:{invitationId:t,email:T,roleTemplate:E.roleTemplate,scope:D(N),expiresAt:s}}),{invitation:this.getInvitation(t),token:e}}getInvitation(E){let T=this.database.query("SELECT * FROM organization_invitations WHERE id = ?").get(E);return T?A(T,this.now()):void 0}listInvitations(E){return this.database.query("SELECT * FROM organization_invitations WHERE organization_id = ? ORDER BY created_at DESC").all(E).map((T)=>A(T,this.now()))}inspectInvitationToken(E){let T=g("sha256").update(E).digest("hex"),N=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(T);return N?A(N,this.now()):void 0}acceptInvitation(E,T){let N=g("sha256").update(E).digest("hex");return this.transaction(()=>{let e=this.database.query("SELECT * FROM organization_invitations WHERE token_hash = ?").get(N);if(!e)throw Error("Invitation is invalid");let L=A(e,this.now());if(L.state!=="pending")throw Error(`Invitation is ${L.state}`);if(!this.getActor(T))throw Error("Invitation actor was not found");if(a(this.database,"UPDATE organization_invitations SET accepted_by_actor_id = ?, accepted_at = ?, updated_at = ? WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?",[T,this.now(),this.now(),L.id,this.now()]).changes!==1)throw Error("Invitation is no longer available");let _=this.getMembershipForActor(L.organizationId,T),s=_??this.createMembership({organizationId:L.organizationId,actorId:T,roleTemplate:L.roleTemplate,scope:L.scope,source:"invitation"});if(_&&L.roleTemplate==="owner"&&_.roleTemplate!=="owner")s=this.updateMembership({id:_.id,roleTemplate:"owner",scope:{type:"organization"},actorId:T});else if(_)for(let n of u(L.roleTemplate))this.upsertGrant({organizationId:L.organizationId,membershipId:_.id,effect:"allow",capability:n,scope:L.scope,source:"invitation"});return this.appendEvent({organizationId:L.organizationId,actorId:T,type:"organization.invitation.accepted",payload:{invitationId:L.id,membershipId:s.id}}),{invitation:this.getInvitation(L.id),membership:this.getMembership(s.id)}})}revokeInvitation(E,T){let N=this.getInvitation(E);if(!N)throw Error("Invitation was not found");if(N.acceptedAt)throw Error("Accepted invitations cannot be revoked");if(!N.revokedAt)a(this.database,"UPDATE organization_invitations SET revoked_at = ?, updated_at = ? WHERE id = ?",[this.now(),this.now(),E]);return this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.invitation.revoked",payload:{invitationId:E}}),this.getInvitation(E)}reissueInvitation(E,T){let N=this.getInvitation(E);if(!N)throw Error("Invitation was not found");if(N.state==="accepted")throw Error("Accepted invitations cannot be reissued");return this.revokeInvitation(E,T),this.createInvitation({organizationId:N.organizationId,email:N.email,roleTemplate:N.roleTemplate,scope:N.scope,invitedByActorId:T})}upsertGrant(E){if(!X.includes(E.capability))throw Error("Unknown authorization capability");let T=this.getMembership(E.membershipId);if(!T||T.organizationId!==E.organizationId)throw Error("Grant membership was not found in this organization");let N=this.normalizeAuthorizationScope(E.organizationId,E.scope),e=this.now(),L=this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? AND effect = ? AND capability = ? AND scope_type = ? AND scope_id IS ?").get(E.membershipId,E.effect,E.capability,N.type,N.id??null);if(L)return H(L);let t=E.id??this.idFn();return a(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[t,E.organizationId,E.membershipId,E.effect,E.capability,N.type,N.id??null,E.source??"manual",e,e]),a(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[e,E.membershipId]),this.appendEvent({organizationId:E.organizationId,actorId:E.actorId,type:"organization.grant.created",payload:{grantId:t,membershipId:E.membershipId,effect:E.effect,capability:E.capability,scope:D(N)}}),this.getGrant(t)}getGrant(E){let T=this.database.query("SELECT * FROM authorization_grants WHERE id = ?").get(E);return T?H(T):void 0}listGrants(E){return this.database.query("SELECT * FROM authorization_grants WHERE membership_id = ? ORDER BY effect DESC, capability, scope_type, scope_id").all(E).map(H)}removeGrant(E,T){let N=this.getGrant(E);if(!N)return!1;let e=a(this.database,"DELETE FROM authorization_grants WHERE id = ?",[E]).changes===1;if(e)a(this.database,"UPDATE organization_memberships SET session_version = session_version + 1, updated_at = ? WHERE id = ?",[this.now(),N.membershipId]),this.appendEvent({organizationId:N.organizationId,actorId:T,type:"organization.grant.removed",payload:{grantId:E,membershipId:N.membershipId}});return e}createOperation(E){if(E.idempotencyKey){let L=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(L)return O(L)}let T=E.id??this.idFn(),N=E.correlationId??this.idFn(),e=this.now();try{return this.transaction(()=>{return a(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key, input, output, priority, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, '{}', ?, ?, ?)`,[T,E.projectId??null,E.environmentId??null,E.resourceId??null,E.actorId??null,E.kind,N,E.idempotencyKey??null,r(E.input??{}),E.priority??0,e,e]),this.appendEvent({projectId:E.projectId,operationId:T,resourceId:E.resourceId,actorId:E.actorId,correlationId:N,type:"operation.queued",payload:{kind:E.kind}}),this.getOperation(T)})}catch(L){if(E.idempotencyKey){let t=this.database.query("SELECT * FROM operations WHERE idempotency_key = ?").get(E.idempotencyKey);if(t)return O(t)}throw L}}getOperation(E){let T=this.database.query("SELECT * FROM operations WHERE id = ?").get(E);return T?O(T):void 0}listOperations(E={}){let T=[],N=[];if(E.projectId)T.push("project_id = ?"),N.push(E.projectId);if(E.state)T.push("state = ?"),N.push(E.state);if(E.kind)T.push("kind = ?"),N.push(E.kind);if(E.before)T.push("created_at < ?"),N.push(E.before);let e=Math.min(500,Math.max(1,E.limit??100));N.push(e);let L=T.length?`WHERE ${T.join(" AND ")}`:"";return this.database.query(`SELECT * FROM operations ${L} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...N).map(O)}claimNextOperation(E,T=60000,N){let e=this.now(),L=new Date(this.nowFn().getTime()+T).toISOString();return this.transaction(()=>{let t=N?.length?`AND kind IN (${OE(N.length)})`:"",_=N?[...N]:[],s=this.database.query(`SELECT * FROM operations WHERE state = 'queued' ${t} ORDER BY priority DESC, created_at ASC, id ASC LIMIT 1`).get(..._);if(!s)return;let n=O(s);if(a(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[E,L,e,e,n.id,n.version]).changes!==1)return;return this.appendEvent({projectId:n.projectId,operationId:n.id,resourceId:n.resourceId,actorId:n.actorId,correlationId:n.correlationId,type:"operation.running",payload:{attempt:n.attempt+1,workerId:E}}),this.getOperation(n.id)})}claimOperation(E,T,N=60000){let e=this.now(),L=new Date(this.nowFn().getTime()+N).toISOString();return this.transaction(()=>{let t=this.getOperation(E);if(!t||t.state!=="queued")return;if(a(this.database,`UPDATE operations SET state = 'running', attempt = attempt + 1, lease_owner = ?, lease_expires_at = ?,
+        started_at = COALESCE(started_at, ?), updated_at = ?, version = version + 1 WHERE id = ? AND state = 'queued' AND version = ?`,[T,L,e,e,t.id,t.version]).changes!==1)return;return this.appendEvent({projectId:t.projectId,operationId:t.id,resourceId:t.resourceId,actorId:t.actorId,correlationId:t.correlationId,type:"operation.running",payload:{attempt:t.attempt+1,workerId:T}}),this.getOperation(t.id)})}transitionOperation(E,T){return this.transaction(()=>{let N=this.getOperation(E);if(!N)throw Error(`Operation ${E} was not found`);let e=T.expectedVersion??N.version;if(N.version!==e)throw new U("Operation",E,e);if(!CE[N.state].includes(T.to))throw new j(N.state,T.to);let L=this.now(),t=cE.includes(T.to),_=T.to==="queued";if(a(this.database,`UPDATE operations SET state = ?, output = ?, error = ?, lease_owner = ?, lease_expires_at = ?,
+        finished_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND version = ?`,[T.to,r(T.output??N.output),z(T.error)??null,_||t?null:T.leaseOwner??N.leaseOwner??null,_||t?null:T.leaseExpiresAt??N.leaseExpiresAt??null,t?L:null,L,E,e]).changes!==1)throw new U("Operation",E,e);return this.appendEvent({projectId:N.projectId,operationId:E,resourceId:N.resourceId,actorId:N.actorId,correlationId:N.correlationId,type:`operation.${T.to}`,level:T.to==="failed"?"error":"info",payload:{from:N.state,to:T.to,error:z(T.error)??null}}),this.getOperation(E)})}requestCancellation(E){let T=this.now();a(this.database,"UPDATE operations SET cancel_requested_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND state IN ('queued', 'running')",[T,T,E]);let N=this.getOperation(E);if(!N)throw Error(`Operation ${E} was not found`);return N}reconcileOrphanedOperations(E={}){let T=(E.now??this.nowFn()).toISOString(),N=E.policy??"fail",e=this.database.query("SELECT * FROM operations WHERE state = 'running' AND (lease_expires_at IS NULL OR lease_expires_at <= ?)").all(T).map(O),L=0,t=0;for(let _ of e)if(N==="requeue")this.transitionOperation(_.id,{to:"queued",expectedVersion:_.version,error:"Worker lease expired; operation requeued after restart."}),L++;else this.transitionOperation(_.id,{to:"failed",expectedVersion:_.version,error:"Worker lease expired or dashboard restarted before completion."}),t++;return{requeued:L,failed:t}}appendEvent(E){let T=E.id??this.idFn(),N=E.correlationId??this.idFn(),e=E.organizationId??(E.projectId?d(this.database.query("SELECT organization_id FROM projects WHERE id = ?").get(E.projectId)?.organization_id):void 0);return a(this.database,`INSERT INTO events (id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[T,e??null,E.projectId??null,E.operationId??null,E.resourceId??null,E.actorId??null,N,E.type,E.level??"info",r(E.payload??{}),this.now()]),M(this.database.query("SELECT * FROM events WHERE id = ?").get(T))}listEvents(E={}){let T=[],N=[];if(E.organizationId)T.push("organization_id = ?"),N.push(E.organizationId);if(E.projectId)T.push("project_id = ?"),N.push(E.projectId);if(E.operationId)T.push("operation_id = ?"),N.push(E.operationId);if(E.resourceId)T.push("resource_id = ?"),N.push(E.resourceId);if(E.correlationId)T.push("correlation_id = ?"),N.push(E.correlationId);if(E.afterSequence!==void 0)T.push("sequence > ?"),N.push(E.afterSequence);let e=Math.min(1000,Math.max(1,E.limit??200));N.push(e);let L=T.length?`WHERE ${T.join(" AND ")}`:"";return this.database.query(`SELECT * FROM events ${L} ORDER BY sequence ASC LIMIT ?`).all(...N).map(M)}setSetting(E,T){a(this.database,`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,[E,r(T),this.now()])}getSetting(E){let T=this.database.query("SELECT value FROM settings WHERE key = ?").get(E);return T?c(T.value):void 0}upsertTag(E,T,N="#5a8be0"){let e=T.trim().toLowerCase().replace(/\s+/g,"-");if(!/^[a-z0-9][a-z0-9-]{0,31}$/.test(e))throw Error("Tag names must contain 1-32 letters, numbers, or dashes");if(!/^#[0-9a-f]{6}$/i.test(N))throw Error("Tag colors must be six-digit hex colors");let L=this.now(),t=this.database.query("SELECT * FROM tags WHERE project_id = ? AND normalized_name = ?").get(E,e);if(t)return a(this.database,"UPDATE tags SET name = ?, color = ?, updated_at = ? WHERE id = ?",[T.trim(),N.toLowerCase(),L,String(t.id)]),l(this.database.query("SELECT * FROM tags WHERE id = ?").get(String(t.id)));let _=this.idFn();return a(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[_,E,T.trim(),e,N.toLowerCase(),L,L]),l(this.database.query("SELECT * FROM tags WHERE id = ?").get(_))}listTags(E){return this.database.query("SELECT * FROM tags WHERE project_id = ? ORDER BY normalized_name").all(E).map(l)}assignTag(E,T){if(!this.database.query("SELECT tags.id FROM tags JOIN resources ON resources.project_id = tags.project_id WHERE tags.id = ? AND resources.id = ?").get(T,E))throw Error("The tag and resource must belong to the same project");a(this.database,"INSERT OR IGNORE INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[E,T,this.now()])}removeTag(E,T){a(this.database,"DELETE FROM resource_tags WHERE resource_id = ? AND tag_id = ?",[E,T])}listResourceTags(E){return this.database.query(`SELECT resource_tags.resource_id, tags.* FROM resource_tags JOIN tags ON tags.id = resource_tags.tag_id
+      WHERE tags.project_id = ? ORDER BY tags.normalized_name`).all(E).map((N)=>({resourceId:String(N.resource_id),tag:l(N)}))}saveFilter(E,T,N,e){let L=T.trim();if(!L||L.length>64)throw Error("Saved filter names must contain 1-64 characters");if(!N||N.length>160||/^[a-z][a-z0-9+.-]*:|^\/\//i.test(N))throw Error("Saved filter routes must be local route IDs or paths");let t=r(e);if(t.length>8192)throw Error("Saved filter queries must be smaller than 8 KB");let _=this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? AND name = ?").get(E,L),s=this.now();if(_)return a(this.database,"UPDATE saved_filters SET route_id = ?, query = ?, updated_at = ? WHERE id = ?",[N,t,s,String(_.id)]),h(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(String(_.id)));let n=this.idFn();return a(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,E,L,N,t,s,s]),h(this.database.query("SELECT * FROM saved_filters WHERE id = ?").get(n))}listSavedFilters(E){return this.database.query("SELECT * FROM saved_filters WHERE actor_key = ? ORDER BY updated_at DESC, name").all(E).map(h)}deleteSavedFilter(E,T){return a(this.database,"DELETE FROM saved_filters WHERE actor_key = ? AND id = ?",[E,T]).changes===1}recordNavigation(E,T,N){let e=this.now();return a(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, last_visited_at) VALUES (?, ?, ?, ?)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET last_visited_at = excluded.last_visited_at, visit_count = visit_count + 1`,[E,T,N,e]),K(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,T,N))}setFavorite(E,T,N,e){let L=this.now();return a(this.database,`INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(actor_key, entity_type, entity_id) DO UPDATE SET favorite = excluded.favorite`,[E,T,N,e?1:0,L]),K(this.database.query("SELECT * FROM navigation_items WHERE actor_key = ? AND entity_type = ? AND entity_id = ?").get(E,T,N))}listNavigation(E,T={}){let N=T.favoritesOnly?"AND favorite = 1":"",e=Math.min(100,Math.max(1,T.limit??20));return this.database.query(`SELECT * FROM navigation_items WHERE actor_key = ? ${N} ORDER BY favorite DESC, last_visited_at DESC LIMIT ?`).all(E,e).map(K)}compact(E={}){let T=new Date(this.nowFn().getTime()-(E.eventRetentionDays??90)*86400000).toISOString(),N=new Date(this.nowFn().getTime()-(E.operationRetentionDays??365)*86400000).toISOString(),e=this.transaction(()=>{let L=a(this.database,"DELETE FROM events WHERE created_at < ?",[T]).changes,t=a(this.database,"DELETE FROM operations WHERE created_at < ? AND state IN ('succeeded', 'failed', 'cancelled', 'timed_out')",[N]).changes;return{events:L,operations:t}});if(E.vacuum!==!1)this.database.run("VACUUM");return{deletedEvents:e.events,deletedOperations:e.operations,vacuumed:E.vacuum!==!1}}createBackup(E="manual"){if(this.path===":memory:")throw Error("Cannot create a filesystem backup for an in-memory control plane");let T=`${this.path}.${Date.now()}.bak`;return this.backupTo(T),this.setSetting("storage.last_backup",{path:T,createdAt:this.now(),reason:E}),T}integrityCheck(){let E=this.database.query("PRAGMA integrity_check").all();return E.length===1&&Object.values(E[0])[0]==="ok"?"ok":"corrupt"}health(){let E=Object.fromEntries(["queued","running","succeeded","failed","cancelled","timed_out"].map((L)=>[L,0]));for(let L of this.database.query("SELECT state, COUNT(*) AS count FROM operations GROUP BY state").all())E[String(L.state)]=Number(L.count);let T=this.database.query("PRAGMA journal_mode").get(),N=this.getSetting("storage.last_backup"),e=N&&!Array.isArray(N)&&typeof N==="object"&&typeof N.createdAt==="string"?N.createdAt:void 0;return{path:this.path,schemaVersion:Number(this.database.query("PRAGMA user_version").get()?.user_version??0),supportedSchemaVersion:C,integrity:this.integrityCheck(),journalMode:String(T?.journal_mode??"unknown"),databaseBytes:this.path!==":memory:"&&w(this.path)?nE(this.path).size:this.database.serialize().byteLength,lastBackupAt:e,operations:E,pendingRetryableOperations:E.queued+E.failed+E.timed_out}}exportSnapshot(){let E={};for(let T of this.database.query("SELECT key, value FROM settings ORDER BY key").all())E[String(T.key)]=c(T.value);return{format:"ts-cloud-control-plane",schemaVersion:C,exportedAt:this.now(),organizations:this.database.query("SELECT * FROM organizations ORDER BY id").all().map(b),memberships:this.database.query("SELECT * FROM organization_memberships ORDER BY id").all().map(k),invitations:this.database.query("SELECT * FROM organization_invitations ORDER BY id").all().map((T)=>({...A(T,this.now()),tokenHash:String(T.token_hash)})),grants:this.database.query("SELECT * FROM authorization_grants ORDER BY id").all().map(H),projects:this.database.query("SELECT * FROM projects ORDER BY id").all().map(F),environments:this.database.query("SELECT * FROM environments ORDER BY id").all().map(y),resources:this.database.query("SELECT * FROM resources ORDER BY id").all().map(m),actors:this.database.query("SELECT * FROM actors ORDER BY id").all().map(f),operations:this.database.query("SELECT * FROM operations ORDER BY id").all().map(O),events:this.database.query("SELECT * FROM events ORDER BY sequence").all().map(M),settings:E,tags:this.database.query("SELECT * FROM tags ORDER BY id").all().map(l),resourceTags:this.database.query("SELECT * FROM resource_tags ORDER BY resource_id, tag_id").all().map((T)=>({resourceId:String(T.resource_id),tagId:String(T.tag_id),createdAt:String(T.created_at)})),savedFilters:this.database.query("SELECT * FROM saved_filters ORDER BY id").all().map(h),navigationItems:this.database.query("SELECT * FROM navigation_items ORDER BY actor_key, entity_type, entity_id").all().map(K)}}importSnapshot(E,T={}){if(E.format!=="ts-cloud-control-plane")throw Error("Unsupported control-plane snapshot format");if(E.schemaVersion>C)throw new v(E.schemaVersion,C);this.transaction(()=>{if((Number(this.database.query("SELECT COUNT(*) AS count FROM projects").get()?.count??0)>0||Number(this.database.query("SELECT COUNT(*) AS count FROM operations").get()?.count??0)>0)&&!T.replace)throw Error("Control plane is not empty; pass replace: true to import this snapshot");if(T.replace)this.database.run("DELETE FROM authorization_grants"),this.database.run("DELETE FROM organization_invitations"),this.database.run("DELETE FROM organization_memberships"),this.database.run("DELETE FROM resource_tags"),this.database.run("DELETE FROM tags"),this.database.run("DELETE FROM saved_filters"),this.database.run("DELETE FROM navigation_items"),this.database.run("DELETE FROM events"),this.database.run("DELETE FROM operations"),this.database.run("DELETE FROM resources"),this.database.run("DELETE FROM environments"),this.database.run("DELETE FROM projects"),this.database.run("DELETE FROM actors"),this.database.run("DELETE FROM organizations"),this.database.run("DELETE FROM settings");for(let e of E.organizations??[])a(this.database,"INSERT INTO organizations (id, slug, name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",[e.id,e.slug,e.name,e.createdAt,e.updatedAt]);for(let e of E.projects)a(this.database,`INSERT INTO projects (id, slug, name, description, organization_id, desired_config_hash, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.slug,e.name,e.description??null,e.organizationId??null,e.desiredConfigHash??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.environments)a(this.database,`INSERT INTO environments (id, project_id, slug, name, kind, region, desired_state, discovered_state, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId,e.slug,e.name,e.kind,e.region??null,r(e.desiredState),r(e.discoveredState),e.version,e.createdAt,e.updatedAt]);for(let e of E.resources)a(this.database,`INSERT INTO resources (id, project_id, environment_id, kind, slug, name, provider, provider_id, desired_state, discovered_state, metadata, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId,e.environmentId??null,e.kind,e.slug,e.name,e.provider??null,e.providerId??null,r(e.desiredState),r(e.discoveredState),r(e.metadata),e.version,e.createdAt,e.updatedAt]);for(let e of E.actors)a(this.database,`INSERT INTO actors (id, kind, external_id, display_name, metadata, disabled_at, version, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.kind,e.externalId??null,e.displayName,r(e.metadata),e.disabledAt??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.memberships??[])a(this.database,`INSERT INTO organization_memberships (id, organization_id, actor_id, role_template, scope_type, scope_id, status, session_version, last_active_at, source, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.actorId,e.roleTemplate,e.scope.type,e.scope.id??null,e.status,e.sessionVersion,e.lastActiveAt??null,e.source??"manual",e.createdAt,e.updatedAt]);for(let e of E.invitations??[]){let L=e.tokenHash??g("sha256").update(`revoked:${e.id}:${this.idFn()}`).digest("hex");a(this.database,`INSERT INTO organization_invitations (id, organization_id, email, role_template, scope_type, scope_id, token_hash, invited_by_actor_id, accepted_by_actor_id, expires_at, accepted_at, revoked_at, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.email,e.roleTemplate,e.scope.type,e.scope.id??null,L,e.invitedByActorId??null,e.acceptedByActorId??null,e.expiresAt,e.acceptedAt??null,e.tokenHash?e.revokedAt??null:e.revokedAt??this.now(),e.createdAt,e.updatedAt])}for(let e of E.grants??[])a(this.database,`INSERT INTO authorization_grants (id, organization_id, membership_id, effect, capability, scope_type, scope_id, source, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.organizationId,e.membershipId,e.effect,e.capability,e.scope.type,e.scope.id??null,e.source??"manual",e.createdAt,e.updatedAt]);for(let e of E.operations)a(this.database,`INSERT INTO operations (id, project_id, environment_id, resource_id, actor_id, kind, state, correlation_id, idempotency_key,
           input, output, error, attempt, priority, lease_owner, lease_expires_at, cancel_requested_at, started_at, finished_at, version, created_at, updated_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.id,i.projectId??null,i.environmentId??null,i.resourceId??null,i.actorId??null,i.kind,i.state,i.correlationId,i.idempotencyKey??null,N(i.input),N(i.output),M(i.error)??null,i.attempt,i.priority,i.leaseOwner??null,i.leaseExpiresAt??null,i.cancelRequestedAt??null,i.startedAt??null,i.finishedAt??null,i.version,i.createdAt,i.updatedAt]);for(let i of e.events)o(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i.sequence,i.id,i.organizationId??null,i.projectId??null,i.operationId??null,i.resourceId??null,i.actorId??null,i.correlationId,i.type,i.level,N(i.payload),i.createdAt]);for(let[i,a]of Object.entries(e.settings))o(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[i,N(a),this.now()]);for(let i of e.tags??[])o(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i.id,i.projectId,i.name,i.normalizedName,i.color,i.createdAt,i.updatedAt]);for(let i of e.resourceTags??[])o(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[i.resourceId,i.tagId,i.createdAt]);for(let i of e.savedFilters??[])o(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i.id,i.actorKey,i.name,i.routeId,N(i.query),i.createdAt,i.updatedAt]);for(let i of e.navigationItems??[])o(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[i.actorKey,i.entityType,i.entityId,i.favorite?1:0,i.lastVisitedAt,i.visitCount])})}}var Oe=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),Re=new Set(["sha","commit","commitsha","release","releaseid"]);function oe(e,t){if(!e||typeof e!=="object"||Array.isArray(e))return[];let r=[];for(let[i,a]of Object.entries(e)){if(!t.has(i.toLowerCase()))continue;if(typeof a==="string")r.push(a);else if(Array.isArray(a))r.push(...a.filter((E)=>typeof E==="string"))}return r}function Q(e){return e.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function W(e,t,r){let i=Q(e),a=Q(t),E=Q(r);if(!i)return 0;if(a===i)return 1000;if(a.startsWith(i))return 800-Math.min(100,a.length-i.length);if(a.includes(i))return 650-Math.min(100,a.indexOf(i));let T=i.split(/\s+/).filter(Boolean);if(T.every((c)=>E.includes(c)))return 400+T.length*10;let s=0;for(let c of i){if(s=E.indexOf(c,s),s<0)return 0;s++}return Math.max(1,180-Math.floor(E.length/20))}function ge(e,t){let r=e.kind.toLowerCase();if(r==="server"||r==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(t)}`};if(r.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(r))return{type:"database",href:`/server/database?env=${encodeURIComponent(t)}&database=${encodeURIComponent(e.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(t)}&service=${encodeURIComponent(e.slug)}`}}function Ue(e,t){let r=e.getProject(t.projectId);if(!r)return[];let i=e.listEnvironments(r.id),a=new Map(i.map((n)=>[n.id,n])),E=e.listResourceTags(r.id),T=new Map;for(let n of E){let L=T.get(n.resourceId)??[];L.push({id:n.tag.id,name:n.tag.name,color:n.tag.color}),T.set(n.resourceId,L)}let s=[],c=t.allowedResourceSlugs!==void 0;if(!c){s.push({type:"project",id:r.id,title:r.name,subtitle:r.slug,href:`/?project=${encodeURIComponent(r.slug)}`,tags:[],score:0});for(let n of i)s.push({type:"environment",id:n.id,title:n.name,subtitle:`${r.name} · ${n.kind}`,href:`/?env=${encodeURIComponent(n.slug)}`,environment:n.slug,tags:[],score:0})}let V=e.listResources(r.id).filter((n)=>!t.allowedResourceSlugs||t.allowedResourceSlugs.has(n.slug));for(let n of V){let L=n.environmentId?a.get(n.environmentId):void 0,O=T.get(n.id)??[],A=oe(n.desiredState,Oe),m=[n.name,n.slug,n.kind,n.provider,n.providerId,L?.slug,...A,...O.map((Te)=>Te.name)].filter(Boolean).join(" "),X=ge(n,L?.slug??i[0]?.slug??"");s.push({type:X.type,id:n.id,title:n.name,subtitle:[n.kind,...A.slice(0,2)].join(" · "),href:X.href,environment:L?.slug,provider:n.provider,tags:O,score:W(t.query,n.name,m)})}if(!c)for(let n of e.listOperations({projectId:r.id,limit:500})){let L=n.environmentId?a.get(n.environmentId):void 0,O=oe(n.input,Re),A=n.kind.includes("deploy"),m=O[0]??n.kind,X=[n.kind,n.id,n.correlationId,n.state,...O].join(" ");s.push({type:A?"deployment":"operation",id:n.id,title:m,subtitle:`${n.kind} · ${n.state}`,href:`/server/activity?env=${encodeURIComponent(L?.slug??i[0]?.slug??"")}&operation=${encodeURIComponent(n.id)}`,environment:L?.slug,status:n.state,tags:[],score:W(t.query,m,X)})}for(let n of s)if(n.score===0)n.score=W(t.query,n.title,`${n.title} ${n.subtitle} ${n.environment??""} ${n.provider??""}`);let J={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return s.filter((n)=>n.score>0).sort((n,L)=>L.score-n.score||J[n.type]-J[L.type]||n.title.localeCompare(L.title)||n.id.localeCompare(L.id)).slice(0,Math.min(50,Math.max(1,t.limit??20)))}export{C as Ag,I as Bg,Z as Cg,de as Dg,ne as Eg,Ee as Fg,Ue as Gg};
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.id,e.projectId??null,e.environmentId??null,e.resourceId??null,e.actorId??null,e.kind,e.state,e.correlationId,e.idempotencyKey??null,r(e.input),r(e.output),z(e.error)??null,e.attempt,e.priority,e.leaseOwner??null,e.leaseExpiresAt??null,e.cancelRequestedAt??null,e.startedAt??null,e.finishedAt??null,e.version,e.createdAt,e.updatedAt]);for(let e of E.events)a(this.database,`INSERT INTO events (sequence, id, organization_id, project_id, operation_id, resource_id, actor_id, correlation_id, type, level, payload, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[e.sequence,e.id,e.organizationId??null,e.projectId??null,e.operationId??null,e.resourceId??null,e.actorId??null,e.correlationId,e.type,e.level,r(e.payload),e.createdAt]);for(let[e,L]of Object.entries(E.settings))a(this.database,"INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)",[e,r(L),this.now()]);for(let e of E.tags??[])a(this.database,"INSERT INTO tags (id, project_id, name, normalized_name, color, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e.id,e.projectId,e.name,e.normalizedName,e.color,e.createdAt,e.updatedAt]);for(let e of E.resourceTags??[])a(this.database,"INSERT INTO resource_tags (resource_id, tag_id, created_at) VALUES (?, ?, ?)",[e.resourceId,e.tagId,e.createdAt]);for(let e of E.savedFilters??[])a(this.database,"INSERT INTO saved_filters (id, actor_key, name, route_id, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[e.id,e.actorKey,e.name,e.routeId,r(e.query),e.createdAt,e.updatedAt]);for(let e of E.navigationItems??[])a(this.database,"INSERT INTO navigation_items (actor_key, entity_type, entity_id, favorite, last_visited_at, visit_count) VALUES (?, ?, ?, ?, ?, ?)",[e.actorKey,e.entityType,e.entityId,e.favorite?1:0,e.lastVisitedAt,e.visitCount])})}}var XE=new Set(["domain","domains","hostname","hostnames","url","repository","repo","image","label","labels"]),RE=new Set(["sha","commit","commitsha","release","releaseid"]);function tE(E,T){if(!E||typeof E!=="object"||Array.isArray(E))return[];let N=[];for(let[e,L]of Object.entries(E)){if(!T.has(e.toLowerCase()))continue;if(typeof L==="string")N.push(L);else if(Array.isArray(L))N.push(...L.filter((t)=>typeof t==="string"))}return N}function W(E){return E.toLowerCase().trim().replace(/[^a-z0-9._:/@-]+/g," ")}function $(E,T,N){let e=W(E),L=W(T),t=W(N);if(!e)return 0;if(L===e)return 1000;if(L.startsWith(e))return 800-Math.min(100,L.length-e.length);if(L.includes(e))return 650-Math.min(100,L.indexOf(e));let _=e.split(/\s+/).filter(Boolean);if(_.every((n)=>t.includes(n)))return 400+_.length*10;let s=0;for(let n of e){if(s=t.indexOf(n,s),s<0)return 0;s++}return Math.max(1,180-Math.floor(t.length/20))}function lE(E,T){let N=E.kind.toLowerCase();if(N==="server"||N==="compute")return{type:"server",href:`/server/metrics?env=${encodeURIComponent(T)}`};if(N.includes("database")||["mysql","postgres","postgresql","sqlite","redis"].includes(N))return{type:"database",href:`/server/database?env=${encodeURIComponent(T)}&database=${encodeURIComponent(E.slug)}`};return{type:"service",href:`/server/sites?env=${encodeURIComponent(T)}&service=${encodeURIComponent(E.slug)}`}}function AE(E,T){let N=E.getProject(T.projectId);if(!N)return[];let e=E.listEnvironments(N.id),L=new Map(e.map((i)=>[i.id,i])),t=E.listResourceTags(N.id),_=new Map;for(let i of t){let o=_.get(i.resourceId)??[];o.push({id:i.tag.id,name:i.tag.name,color:i.tag.color}),_.set(i.resourceId,o)}let s=[],n=T.allowedResourceSlugs!==void 0;if(!n){s.push({type:"project",id:N.id,title:N.name,subtitle:N.slug,href:`/?project=${encodeURIComponent(N.slug)}`,tags:[],score:0});for(let i of e)s.push({type:"environment",id:i.id,title:i.name,subtitle:`${N.name} · ${i.kind}`,href:`/?env=${encodeURIComponent(i.slug)}`,environment:i.slug,tags:[],score:0})}let Z=E.listResources(N.id).filter((i)=>!T.allowedResourceSlugs||T.allowedResourceSlugs.has(i.slug));for(let i of Z){let o=i.environmentId?L.get(i.environmentId):void 0,R=_.get(i.id)??[],S=tE(i.desiredState,XE),I=[i.name,i.slug,i.kind,i.provider,i.providerId,o?.slug,...S,...R.map((aE)=>aE.name)].filter(Boolean).join(" "),p=lE(i,o?.slug??e[0]?.slug??"");s.push({type:p.type,id:i.id,title:i.name,subtitle:[i.kind,...S.slice(0,2)].join(" · "),href:p.href,environment:o?.slug,provider:i.provider,tags:R,score:$(T.query,i.name,I)})}if(!n)for(let i of E.listOperations({projectId:N.id,limit:500})){let o=i.environmentId?L.get(i.environmentId):void 0,R=tE(i.input,RE),S=i.kind.includes("deploy"),I=R[0]??i.kind,p=[i.kind,i.id,i.correlationId,i.state,...R].join(" ");s.push({type:S?"deployment":"operation",id:i.id,title:I,subtitle:`${i.kind} · ${i.state}`,href:`/server/activity?env=${encodeURIComponent(o?.slug??e[0]?.slug??"")}&operation=${encodeURIComponent(i.id)}`,environment:o?.slug,status:i.state,tags:[],score:$(T.query,I,p)})}for(let i of s)if(i.score===0)i.score=$(T.query,i.title,`${i.title} ${i.subtitle} ${i.environment??""} ${i.provider??""}`);let J={service:0,server:1,database:2,deployment:3,environment:4,project:5,operation:6};return s.filter((i)=>i.score>0).sort((i,o)=>o.score-i.score||J[i.type]-J[o.type]||i.title.localeCompare(o.title)||i.id.localeCompare(o.id)).slice(0,Math.min(50,Math.max(1,T.limit??20)))}export{X as Ag,u as Bg,V as Cg,sE as Dg,LE as Eg,iE as Fg,AE as Gg};

package/dist/bin/chunk-smbycpt5.js

@@ -0,0 +1,44 @@
+var V={newConnectionsPerSecond:50,concurrentPerSource:100,synPerSecond:2000,burst:100,icmpPerSecond:5,banSeconds:600};function N(j){return{...V,...j.thresholds}}var m=/^(?:\d{1,3}\.){3}\d{1,3}(?:\/\d{1,2})?$|^[0-9a-f:]+(?:\/\d{1,3})?$/i;function I(j){if(!m.test(j))return!1;let[q,z]=j.split("/");if(q.includes(":"))return z==null||Number(z)>=0&&Number(z)<=128;let K=q.split(".");if(K.length!==4||K.some((W)=>Number(W)>255||W===""))return!1;return z==null||Number(z)>=0&&Number(z)<=32}function U(j){return[...new Set((j??[]).map((q)=>q.trim()).filter(I))]}function O(j){let q=(j??[80,443]).filter((z)=>Number.isInteger(z)&&z>=1&&z<=65535);return[...new Set(q)].sort((z,K)=>z-K)}function k(j={}){let q=N(j);return{"net.ipv4.tcp_syncookies":"1","net.ipv4.tcp_max_syn_backlog":String(Math.max(4096,q.synPerSecond*4)),"net.ipv4.tcp_synack_retries":"2","net.ipv4.tcp_abort_on_overflow":"1","net.ipv4.tcp_fin_timeout":"15","net.ipv4.tcp_keepalive_time":"300","net.ipv4.tcp_keepalive_intvl":"30","net.ipv4.tcp_keepalive_probes":"3","net.core.somaxconn":"4096","net.core.netdev_max_backlog":"16384","net.ipv4.conf.all.rp_filter":"1","net.ipv4.conf.default.rp_filter":"1","net.ipv4.conf.all.accept_source_route":"0","net.ipv4.conf.all.accept_redirects":"0","net.ipv4.conf.all.send_redirects":"0","net.ipv6.conf.all.accept_redirects":"0","net.ipv6.conf.all.accept_source_route":"0","net.ipv4.icmp_echo_ignore_broadcasts":"1","net.ipv4.icmp_ignore_bogus_error_responses":"1","net.netfilter.nf_conntrack_max":"262144","net.netfilter.nf_conntrack_tcp_timeout_established":"3600"}}function _(j={}){let q=["# Managed by ts-cloud. Edits are overwritten on the next deploy.","# Network hardening against L3/L4 floods.",""];for(let[z,K]of Object.entries(k(j)))q.push(`${z} = ${K}`);return`${q.join(`
+`)}
+`}function y(j={}){let q=N(j),z=O(j.ports),K=U(j.allowlist),W=U(j.blocklist),X=j.monitorOnly?"counter":"counter drop",M=j.originProtection?.enabled?U(j.originProtection.cdnRanges):[],Q=K.filter((J)=>!J.includes(":")),Z=K.filter((J)=>J.includes(":")),$=W.filter((J)=>!J.includes(":")),G=["#!/usr/sbin/nft -f","# Managed by ts-cloud. Edits are overwritten on the next deploy.","","table inet ts_cloud_ddos","delete table inet ts_cloud_ddos","","table inet ts_cloud_ddos {","  # Sources that tripped a limit, with a timeout so a ban self-expires.",`  set banned4 { type ipv4_addr; flags timeout; timeout ${q.banSeconds}s; }`,`  set banned6 { type ipv6_addr; flags timeout; timeout ${q.banSeconds}s; }`];if(Q.length>0)G.push(`  set allow4 { type ipv4_addr; flags interval; elements = { ${Q.join(", ")} } }`);if(Z.length>0)G.push(`  set allow6 { type ipv6_addr; flags interval; elements = { ${Z.join(", ")} } }`);if($.length>0)G.push(`  set block4 { type ipv4_addr; flags interval; elements = { ${$.join(", ")} } }`);if(M.length>0)G.push(`  set cdn4 { type ipv4_addr; flags interval; elements = { ${M.filter((J)=>!J.includes(":")).join(", ")} } }`);if(G.push("","  chain input {","    type filter hook input priority -150; policy accept;","","    # Established traffic is already paid for; never re-inspect it.","    ct state established,related accept","    iif lo accept","","    # Invalid packets are never legitimate and are cheap to drop early.","    ct state invalid counter drop"),Q.length>0)G.push("    ip saddr @allow4 accept");if(Z.length>0)G.push("    ip6 saddr @allow6 accept");if($.length>0)G.push("    ip saddr @block4 counter drop");if(G.push("    ip saddr @banned4 counter drop","    ip6 saddr @banned6 counter drop",""),G.push("    # Nonsense TCP flag combinations: scanners and stack fingerprinting.","    tcp flags & (fin|syn) == (fin|syn) counter drop","    tcp flags & (syn|rst) == (syn|rst) counter drop","    tcp flags & (fin|rst) == (fin|rst) counter drop","    tcp flags & (fin|ack) == fin counter drop","    tcp flags & (syn|fin|ack|rst|psh|urg) == 0x0 counter drop","","    # Ping stays usable, ping floods do not.",`    ip protocol icmp icmp type echo-request limit rate ${q.icmpPerSecond}/second burst ${q.burst} packets accept`,"    ip protocol icmp icmp type echo-request counter drop",""),z.length>0){let J=z.join(", ");if(G.push("    # Platform-wide SYN ceiling. Above it the kernel falls back to cookies.",`    tcp dport { ${J} } ct state new limit rate ${q.synPerSecond}/second burst ${q.burst} packets accept`,"","    # Per-source new-connection rate. This is what stops one host hammering.",`    tcp dport { ${J} } ct state new meter conn_rate4 { ip saddr limit rate over ${q.newConnectionsPerSecond}/second burst ${q.burst} packets } add @banned4 { ip saddr } ${X}`,`    tcp dport { ${J} } ct state new meter conn_rate6 { ip6 saddr limit rate over ${q.newConnectionsPerSecond}/second burst ${q.burst} packets } add @banned6 { ip6 saddr } ${X}`,"","    # Concurrency ceiling per source: the slow-loris defence.",`    tcp dport { ${J} } ct state new meter conn_count4 { ip saddr ct count over ${q.concurrentPerSource} } ${X}`,`    tcp dport { ${J} } ct state new meter conn_count6 { ip6 saddr ct count over ${q.concurrentPerSource} } ${X}`,""),M.length>0)G.push("    # Origin protection: reject traffic that skipped the CDN and came","    # straight to the box, which is how an attacker bypasses the edge.",`    tcp dport { ${J} } ip saddr != @cdn4 counter drop`,"")}return G.push("  }","}",""),G.join(`
+`)}function C(j={}){return`#!/usr/bin/env bash
+# Managed by ts-cloud. Installs L3/L4 flood mitigation.
+set -euo pipefail
+
+if ! command -v nft >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq
+  apt-get install -y -qq nftables
+fi
+
+install -d -m 0755 /etc/ts-cloud /etc/nftables.d
+cat > /etc/sysctl.d/90-ts-cloud-ddos.conf <<'SYSCTL_EOF'
+${_(j)}SYSCTL_EOF
+sysctl --system >/dev/null
+
+cat > /etc/nftables.d/ts-cloud-ddos.nft.new <<'NFT_EOF'
+${y(j)}NFT_EOF
+
+# Syntax-check before applying: a bad ruleset would leave the box unprotected.
+if ! nft -c -f /etc/nftables.d/ts-cloud-ddos.nft.new; then
+  echo "ts-cloud: generated nftables ruleset failed validation, keeping the previous one" >&2
+  rm -f /etc/nftables.d/ts-cloud-ddos.nft.new
+  exit 1
+fi
+
+mv /etc/nftables.d/ts-cloud-ddos.nft.new /etc/nftables.d/ts-cloud-ddos.nft
+nft -f /etc/nftables.d/ts-cloud-ddos.nft
+
+# Applying the ruleset does not survive a reboot on its own: nftables.service
+# loads /etc/nftables.conf, so the file has to be included from there or the box
+# comes back up unprotected and nothing says so.
+touch /etc/nftables.conf
+if ! grep -q 'ts-cloud-ddos.nft' /etc/nftables.conf; then
+  printf '
+include "/etc/nftables.d/ts-cloud-ddos.nft"
+' >> /etc/nftables.conf
+fi
+systemctl enable nftables >/dev/null 2>&1 || true
+echo "ts-cloud: L3/L4 mitigation active"
+`}var F=["off","monitor","rate_limit","challenge","lockdown"];function L(j,q=[]){let z=[],K=Math.max(1,j.baselineRequestsPerSecond),W=j.requestsPerSecond/K,X=0,M=(B,H)=>{z.push(H),X=Math.max(X,F.indexOf(B))},Q=W>=3;if(Q)M("monitor",`Traffic is ${W.toFixed(1)}x the baseline.`);let Z=j.topSourceShare>=0.25,$=j.errorRate>=0.25,G=(j.suspiciousAgentShare??0)>=0.5,J=j.uniqueSources>0&&j.requestsPerSecond/j.uniqueSources>=50;if(Q&&Z)M("rate_limit",`One source accounts for ${(j.topSourceShare*100).toFixed(0)}% of traffic.`);if(Q&&J)M("rate_limit","Request rate per unique source is far above what a browser produces.");if(Q&&$)M("challenge",`Error rate is ${(j.errorRate*100).toFixed(0)}% under load.`);if(Q&&G)M("challenge","Most requests carry no recognisable browser agent.");if(W>=20&&(Z||$||G||J))M("lockdown",`Traffic is ${W.toFixed(0)}x the baseline with attack-shaped characteristics.`);if(!Q&&j.topSourceShare>=0.6&&j.requestsPerSecond>K)M("rate_limit","A single source dominates traffic without an overall surge.");let Y=F[X],P={off:1,monitor:1,rate_limit:0.5,challenge:0.25,lockdown:0.1}[Y];return{level:Y,reasons:z,rateLimitFactor:P,challengeEnabled:Y==="challenge"||Y==="lockdown",staticOnly:Y==="lockdown",banCandidates:Y==="off"||Y==="monitor"?[]:U(q)}}function T(j,q){return Math.max(1,Math.floor(j*q.rateLimitFactor))}
+export{V as df,I as ef,k as ff,_ as gf,y as hf,C as if,L as jf,T as kf};

package/dist/bin/chunk-sn7e0sn7.js

@@ -0,0 +1,2 @@
+import{dh as T,eh as J}from"./chunk-xyt490vp.js";class U{client;region;constructor(k="us-east-1"){this.region=k,this.client=new T}async describeDBInstances(k){let w={Action:"DescribeDBInstances",Version:"2014-10-31"};if(k?.DBInstanceIdentifier)w.DBInstanceIdentifier=k.DBInstanceIdentifier;if(k?.MaxRecords)w.MaxRecords=k.MaxRecords;if(k?.Marker)w.Marker=k.Marker;if(k?.Filters)k.Filters.forEach((K,L)=>{w[`Filters.Filter.${L+1}.Name`]=K.Name,K.Values.forEach((O,R)=>{w[`Filters.Filter.${L+1}.Values.Value.${R+1}`]=O})});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E}),H=z.DescribeDBInstancesResult||z,G=H.DBInstances?.DBInstance||[];if(!Array.isArray(G))G=G?[G]:[];return{DBInstances:G,Marker:H.Marker}}async describeDBInstance(k){return(await this.describeDBInstances({DBInstanceIdentifier:k})).DBInstances?.[0]}async describeDBClusters(k){let w={Action:"DescribeDBClusters",Version:"2014-10-31"};if(k?.DBClusterIdentifier)w.DBClusterIdentifier=k.DBClusterIdentifier;if(k?.MaxRecords)w.MaxRecords=k.MaxRecords;if(k?.Marker)w.Marker=k.Marker;if(k?.Filters)k.Filters.forEach((K,L)=>{w[`Filters.Filter.${L+1}.Name`]=K.Name,K.Values.forEach((O,R)=>{w[`Filters.Filter.${L+1}.Values.Value.${R+1}`]=O})});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E}),H=z.DescribeDBClustersResult||z,G=H.DBClusters?.DBCluster||[];if(!Array.isArray(G))G=G?[G]:[];return{DBClusters:G,Marker:H.Marker}}async describeDBSnapshots(k){let w={Action:"DescribeDBSnapshots",Version:"2014-10-31"};if(k?.DBInstanceIdentifier)w.DBInstanceIdentifier=k.DBInstanceIdentifier;if(k?.DBSnapshotIdentifier)w.DBSnapshotIdentifier=k.DBSnapshotIdentifier;if(k?.SnapshotType)w.SnapshotType=k.SnapshotType;if(k?.MaxRecords)w.MaxRecords=k.MaxRecords;if(k?.Marker)w.Marker=k.Marker;let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E}),H=z.DescribeDBSnapshotsResult||z,G=H.DBSnapshots?.DBSnapshot||[];if(!Array.isArray(G))G=G?[G]:[];return{DBSnapshots:G,Marker:H.Marker}}async describeDBSubnetGroups(k){let w={Action:"DescribeDBSubnetGroups",Version:"2014-10-31"};if(k?.DBSubnetGroupName)w.DBSubnetGroupName=k.DBSubnetGroupName;if(k?.MaxRecords)w.MaxRecords=k.MaxRecords;if(k?.Marker)w.Marker=k.Marker;let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E}),H=z.DescribeDBSubnetGroupsResult||z,G=H.DBSubnetGroups?.DBSubnetGroup||[];if(!Array.isArray(G))G=G?[G]:[];return{DBSubnetGroups:G,Marker:H.Marker}}async createDBInstance(k){let w={Action:"CreateDBInstance",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier,DBInstanceClass:k.DBInstanceClass,Engine:k.Engine};if(k.DBClusterIdentifier)w.DBClusterIdentifier=k.DBClusterIdentifier;if(k.MasterUsername)w.MasterUsername=k.MasterUsername;if(k.MasterUserPassword)w.MasterUserPassword=k.MasterUserPassword;if(k.DBName)w.DBName=k.DBName;if(k.AllocatedStorage)w.AllocatedStorage=k.AllocatedStorage;if(k.DBSubnetGroupName)w.DBSubnetGroupName=k.DBSubnetGroupName;if(k.AvailabilityZone)w.AvailabilityZone=k.AvailabilityZone;if(k.PreferredMaintenanceWindow)w.PreferredMaintenanceWindow=k.PreferredMaintenanceWindow;if(k.PreferredBackupWindow)w.PreferredBackupWindow=k.PreferredBackupWindow;if(k.BackupRetentionPeriod!==void 0)w.BackupRetentionPeriod=k.BackupRetentionPeriod;if(k.MultiAZ!==void 0)w.MultiAZ=k.MultiAZ;if(k.EngineVersion)w.EngineVersion=k.EngineVersion;if(k.AutoMinorVersionUpgrade!==void 0)w.AutoMinorVersionUpgrade=k.AutoMinorVersionUpgrade;if(k.LicenseModel)w.LicenseModel=k.LicenseModel;if(k.PubliclyAccessible!==void 0)w.PubliclyAccessible=k.PubliclyAccessible;if(k.StorageType)w.StorageType=k.StorageType;if(k.StorageEncrypted!==void 0)w.StorageEncrypted=k.StorageEncrypted;if(k.KmsKeyId)w.KmsKeyId=k.KmsKeyId;if(k.DeletionProtection!==void 0)w.DeletionProtection=k.DeletionProtection;if(k.VpcSecurityGroupIds)k.VpcSecurityGroupIds.forEach((G,K)=>{w[`VpcSecurityGroupIds.VpcSecurityGroupId.${K+1}`]=G});if(k.Tags)k.Tags.forEach((G,K)=>{w[`Tags.Tag.${K+1}.Key`]=G.Key,w[`Tags.Tag.${K+1}.Value`]=G.Value});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.CreateDBInstanceResult||z).DBInstance}}async createDBCluster(k){let w={Action:"CreateDBCluster",Version:"2014-10-31",DBClusterIdentifier:k.DBClusterIdentifier,Engine:k.Engine};if(k.EngineVersion)w.EngineVersion=k.EngineVersion;if(k.MasterUsername)w.MasterUsername=k.MasterUsername;if(k.MasterUserPassword)w.MasterUserPassword=k.MasterUserPassword;if(k.DatabaseName)w.DatabaseName=k.DatabaseName;if(k.DBSubnetGroupName)w.DBSubnetGroupName=k.DBSubnetGroupName;if(k.BackupRetentionPeriod!==void 0)w.BackupRetentionPeriod=k.BackupRetentionPeriod;if(k.StorageEncrypted!==void 0)w.StorageEncrypted=k.StorageEncrypted;if(k.KmsKeyId)w.KmsKeyId=k.KmsKeyId;if(k.DeletionProtection!==void 0)w.DeletionProtection=k.DeletionProtection;if(k.ServerlessV2ScalingConfiguration)w["ServerlessV2ScalingConfiguration.MinCapacity"]=k.ServerlessV2ScalingConfiguration.MinCapacity,w["ServerlessV2ScalingConfiguration.MaxCapacity"]=k.ServerlessV2ScalingConfiguration.MaxCapacity;k.VpcSecurityGroupIds?.forEach((H,G)=>{w[`VpcSecurityGroupIds.VpcSecurityGroupId.${G+1}`]=H});let E=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J(w)).toString()});return{DBCluster:(E.CreateDBClusterResult||E).DBCluster}}async deleteDBInstance(k){let w={Action:"DeleteDBInstance",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier};if(k.SkipFinalSnapshot!==void 0)w.SkipFinalSnapshot=k.SkipFinalSnapshot;if(k.FinalDBSnapshotIdentifier)w.FinalDBSnapshotIdentifier=k.FinalDBSnapshotIdentifier;if(k.DeleteAutomatedBackups!==void 0)w.DeleteAutomatedBackups=k.DeleteAutomatedBackups;let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.DeleteDBInstanceResult||z).DBInstance}}async modifyDBInstance(k){let w={Action:"ModifyDBInstance",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier};if(k.DBInstanceClass)w.DBInstanceClass=k.DBInstanceClass;if(k.AllocatedStorage)w.AllocatedStorage=k.AllocatedStorage;if(k.MasterUserPassword)w.MasterUserPassword=k.MasterUserPassword;if(k.BackupRetentionPeriod!==void 0)w.BackupRetentionPeriod=k.BackupRetentionPeriod;if(k.PreferredBackupWindow)w.PreferredBackupWindow=k.PreferredBackupWindow;if(k.PreferredMaintenanceWindow)w.PreferredMaintenanceWindow=k.PreferredMaintenanceWindow;if(k.MultiAZ!==void 0)w.MultiAZ=k.MultiAZ;if(k.EngineVersion)w.EngineVersion=k.EngineVersion;if(k.AutoMinorVersionUpgrade!==void 0)w.AutoMinorVersionUpgrade=k.AutoMinorVersionUpgrade;if(k.PubliclyAccessible!==void 0)w.PubliclyAccessible=k.PubliclyAccessible;if(k.ApplyImmediately!==void 0)w.ApplyImmediately=k.ApplyImmediately;if(k.StorageType)w.StorageType=k.StorageType;if(k.DeletionProtection!==void 0)w.DeletionProtection=k.DeletionProtection;if(k.VpcSecurityGroupIds)k.VpcSecurityGroupIds.forEach((G,K)=>{w[`VpcSecurityGroupIds.VpcSecurityGroupId.${K+1}`]=G});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.ModifyDBInstanceResult||z).DBInstance}}async modifyDBCluster(k){let w={Action:"ModifyDBCluster",Version:"2014-10-31",DBClusterIdentifier:k.DBClusterIdentifier};if(k.ServerlessV2ScalingConfiguration)w["ServerlessV2ScalingConfiguration.MinCapacity"]=k.ServerlessV2ScalingConfiguration.MinCapacity,w["ServerlessV2ScalingConfiguration.MaxCapacity"]=k.ServerlessV2ScalingConfiguration.MaxCapacity;if(k.BackupRetentionPeriod!==void 0)w.BackupRetentionPeriod=k.BackupRetentionPeriod;if(k.EngineVersion)w.EngineVersion=k.EngineVersion;if(k.MasterUserPassword)w.MasterUserPassword=k.MasterUserPassword;if(k.DeletionProtection!==void 0)w.DeletionProtection=k.DeletionProtection;if(k.ApplyImmediately!==void 0)w.ApplyImmediately=k.ApplyImmediately;let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBCluster:(z.ModifyDBClusterResult||z).DBCluster}}async rebootDBCluster(k){let w={Action:"FailoverDBCluster",Version:"2014-10-31",DBClusterIdentifier:k},E=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J(w)).toString()});return{DBCluster:(E.FailoverDBClusterResult||E).DBCluster}}async createDBClusterSnapshot(k,w){let E={Action:"CreateDBClusterSnapshot",Version:"2014-10-31",DBClusterIdentifier:k,DBClusterSnapshotIdentifier:w};return this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J(E)).toString()})}async describeDBClusterSnapshots(k={}){let w={Action:"DescribeDBClusterSnapshots",Version:"2014-10-31",...k},E=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J(w)).toString()}),z=E.DescribeDBClusterSnapshotsResult||E,H=z.DBClusterSnapshots?.DBClusterSnapshot??z.DBClusterSnapshots??[];return{DBClusterSnapshots:Array.isArray(H)?H:[H]}}async deleteDBClusterSnapshot(k){await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J({Action:"DeleteDBClusterSnapshot",Version:"2014-10-31",DBClusterSnapshotIdentifier:k})).toString()})}async deleteDBCluster(k,w){let E={Action:"DeleteDBCluster",Version:"2014-10-31",DBClusterIdentifier:k,SkipFinalSnapshot:!w};if(w)E.FinalDBSnapshotIdentifier=w;let z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J(E)).toString()});return{DBCluster:(z.DeleteDBClusterResult||z).DBCluster}}async restoreDBClusterToPointInTime(k){let w={Action:"RestoreDBClusterToPointInTime",Version:"2014-10-31",DBClusterIdentifier:k.DBClusterIdentifier,SourceDBClusterIdentifier:k.SourceDBClusterIdentifier};if(k.RestoreToTime)w.RestoreToTime=k.RestoreToTime.toISOString();if(k.UseLatestRestorableTime)w.UseLatestRestorableTime=!0;if(k.DBSubnetGroupName)w.DBSubnetGroupName=k.DBSubnetGroupName;if(k.VpcSecurityGroupIds)k.VpcSecurityGroupIds.forEach((G,K)=>{w[`VpcSecurityGroupIds.VpcSecurityGroupId.${K+1}`]=G});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBCluster:(z.RestoreDBClusterToPointInTimeResult||z).DBCluster}}async restoreDBClusterFromSnapshot(k){let w={Action:"RestoreDBClusterFromSnapshot",Version:"2014-10-31",DBClusterIdentifier:k.DBClusterIdentifier,SnapshotIdentifier:k.SnapshotIdentifier,Engine:k.Engine};if(k.EngineVersion)w.EngineVersion=k.EngineVersion;if(k.DBSubnetGroupName)w.DBSubnetGroupName=k.DBSubnetGroupName;if(k.DeletionProtection!==void 0)w.DeletionProtection=k.DeletionProtection;if(k.VpcSecurityGroupIds?.forEach((H,G)=>{w[`VpcSecurityGroupIds.VpcSecurityGroupId.${G+1}`]=H}),k.ServerlessV2ScalingConfiguration)w["ServerlessV2ScalingConfiguration.MinCapacity"]=k.ServerlessV2ScalingConfiguration.MinCapacity,w["ServerlessV2ScalingConfiguration.MaxCapacity"]=k.ServerlessV2ScalingConfiguration.MaxCapacity;let E=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(J(w)).toString()});return{DBCluster:(E.RestoreDBClusterFromSnapshotResult||E).DBCluster}}async startDBInstance(k){let E=new URLSearchParams(J({Action:"StartDBInstance",Version:"2014-10-31",DBInstanceIdentifier:k})).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.StartDBInstanceResult||z).DBInstance}}async stopDBInstance(k){let w={Action:"StopDBInstance",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier};if(k.DBSnapshotIdentifier)w.DBSnapshotIdentifier=k.DBSnapshotIdentifier;let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.StopDBInstanceResult||z).DBInstance}}async rebootDBInstance(k){let w={Action:"RebootDBInstance",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier};if(k.ForceFailover!==void 0)w.ForceFailover=k.ForceFailover;let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.RebootDBInstanceResult||z).DBInstance}}async createDBSnapshot(k){let w={Action:"CreateDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier,DBSnapshotIdentifier:k.DBSnapshotIdentifier};if(k.Tags)k.Tags.forEach((G,K)=>{w[`Tags.Tag.${K+1}.Key`]=G.Key,w[`Tags.Tag.${K+1}.Value`]=G.Value});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBSnapshot:(z.CreateDBSnapshotResult||z).DBSnapshot}}async deleteDBSnapshot(k){let E=new URLSearchParams(J({Action:"DeleteDBSnapshot",Version:"2014-10-31",DBSnapshotIdentifier:k})).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBSnapshot:(z.DeleteDBSnapshotResult||z).DBSnapshot}}async restoreDBInstanceFromDBSnapshot(k){let w={Action:"RestoreDBInstanceFromDBSnapshot",Version:"2014-10-31",DBInstanceIdentifier:k.DBInstanceIdentifier,DBSnapshotIdentifier:k.DBSnapshotIdentifier};if(k.DBInstanceClass)w.DBInstanceClass=k.DBInstanceClass;if(k.Port)w.Port=k.Port;if(k.AvailabilityZone)w.AvailabilityZone=k.AvailabilityZone;if(k.DBSubnetGroupName)w.DBSubnetGroupName=k.DBSubnetGroupName;if(k.MultiAZ!==void 0)w.MultiAZ=k.MultiAZ;if(k.PubliclyAccessible!==void 0)w.PubliclyAccessible=k.PubliclyAccessible;if(k.AutoMinorVersionUpgrade!==void 0)w.AutoMinorVersionUpgrade=k.AutoMinorVersionUpgrade;if(k.StorageType)w.StorageType=k.StorageType;if(k.DeletionProtection!==void 0)w.DeletionProtection=k.DeletionProtection;if(k.VpcSecurityGroupIds)k.VpcSecurityGroupIds.forEach((G,K)=>{w[`VpcSecurityGroupIds.VpcSecurityGroupId.${K+1}`]=G});if(k.Tags)k.Tags.forEach((G,K)=>{w[`Tags.Tag.${K+1}.Key`]=G.Key,w[`Tags.Tag.${K+1}.Value`]=G.Value});let E=new URLSearchParams(J(w)).toString(),z=await this.client.request({service:"rds",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E});return{DBInstance:(z.RestoreDBInstanceFromDBSnapshotResult||z).DBInstance}}async waitForDBInstanceAvailable(k,w=60,E=30000){for(let z=0;z<w;z++){let H=await this.describeDBInstance(k);if(H?.DBInstanceStatus==="available")return H;if(["deleted","failed","incompatible-restore","incompatible-parameters"].includes(H?.DBInstanceStatus||""))throw Error(`DB instance ${k} is in terminal state: ${H?.DBInstanceStatus}`);await new Promise((G)=>setTimeout(G,E))}throw Error(`Timeout waiting for DB instance ${k} to become available`)}async waitForDBInstanceDeleted(k,w=60,E=30000){for(let z=0;z<w;z++)try{let H=await this.describeDBInstance(k);if(H?.DBInstanceStatus==="deleting"){await new Promise((G)=>setTimeout(G,E));continue}throw Error(`DB instance ${k} is in state: ${H?.DBInstanceStatus}`)}catch(H){if(H.code==="DBInstanceNotFound"||H.code==="DBInstanceNotFoundFault")return;throw H}throw Error(`Timeout waiting for DB instance ${k} to be deleted`)}}
+export{U as gd};

package/dist/bin/chunk-ss574pka.js

@@ -0,0 +1 @@
+import{qg as a}from"./chunk-54bqchag.js";import"./chunk-xyt490vp.js";import"./chunk-c8sypnbe.js";export{a as S3Client};