@stacksjs/ts-cloud 0.12.9 → 0.12.10

package/dist/aws/index.js

@@ -1 +1 @@
-import{$e as Fa,Ae as ea,Af as eb,Be as fa,Bf as fb,Ce as ga,Cf as gb,De as ha,Df as hb,Ee as ia,Ef as ib,Fe as ja,Ff as jb,Ge as ka,Gf as kb,He as la,Hf as lb,Ie as ma,If as mb,Je as na,Jf as nb,Ke as oa,Kf as ob,Le as pa,Lf as pb,Me as qa,Mf as qb,Ne as ra,Nf as rb,Oe as sa,Of as sb,Pe as ta,Pf as tb,Qe as ua,Re as va,Se as wa,Te as xa,Ue as ya,Ve as za,We as Aa,Xe as Ba,Ye as Ca,Ze as Da,_e as Ea,af as Ga,bf as Ha,cf as Ia,df as Ja,ef as Ka,ff as La,gf as Ma,hf as Na,ie as k,if as Oa,je as l,jf as Pa,ke as m,kf as Qa,le as n,lf as Ra,me as o,mf as Sa,ne as p,nf as Ta,oe as q,of as Ua,pe as r,pf as Va,qe as t,qf as Wa,re as w,rf as Xa,se as V,sf as Ya,te as X,tf as Za,ue as Y,uf as _a,ve as Z,vf as $a,we as _,wf as ab,xe as aa,xf as bb,ye as ba,yf as cb,ze as ca,zf as db}from"../chunk-a5213256.js";import{Qf as e,Rf as h,Sf as i,Tf as j}from"../chunk-82gezmen.js";import{Uf as v}from"../chunk-7j100g7w.js";import{Vf as U}from"../chunk-jphewtbx.js";import{Wf as da}from"../chunk-fbwpm0zm.js";import{$f as A,Xf as x,Yf as y,Zf as z,ag as B,bg as C,cg as D,dg as E,eg as F,fg as G,gg as H,hg as I,ig as J,jg as K,kg as L,lg as M,mg as N,ng as O,og as P,pg as Q,qg as R,rg as S,sg as T}from"../chunk-rg7d67xk.js";import{tg as f}from"../chunk-982rye5b.js";import{qi as u,ri as W}from"../chunk-557qj7q9.js";import{si as s}from"../chunk-c8cadhgc.js";import{ui as g}from"../chunk-70v77sqv.js";import{vi as a,wi as b,xi as c,yi as d}from"../chunk-a368cs92.js";import"../chunk-0hw5wjjg.js";export{S as ACMClient,T as ACMDnsValidator,b as AWSClient,Wa as ApplicationAutoScalingClient,l as AwsBackupClient,ka as BedrockAgentClient,ja as BedrockAgentRuntimeClient,ia as BedrockClient,ha as BedrockRuntimeClient,s as CloudFormationClient,v as CloudFrontClient,aa as CloudWatchLogsClient,A as CloudflareProvider,pa as ComprehendClient,ba as ConnectClient,t as CostExplorerClient,Q as DnsProviderFactory,ea as DynamoDBClient,u as EC2Client,U as ECRClient,V as ECSClient,tb as EFSClient,ca as ELBv2Client,Ua as ElastiCacheClient,i as EmailClient,Ta as EventBridgeClient,z as GoDaddyProvider,e as IAMClient,Xa as ImapServer,Qa as KendraClient,_ as LambdaClient,fa as OpenSearchClient,x as PROXIABLE_RECORD_TYPES,Ka as PersonalizeClient,Ma as PersonalizeEventsClient,La as PersonalizeRuntimeClient,Ca as PollyClient,y as PorkbunProvider,da as RDSClient,ua as RekognitionClient,f as Route53Client,w as Route53DomainsClient,F as Route53Provider,g as S3Client,h as SESClient,Y as SNSClient,Z as SQSClient,W as SSMClient,k as STSClient,Va as SchedulerClient,X as SecretsManagerClient,$a as SmsClient,sb as SmsVoiceClient,Za as SmtpServer,nb as SupportClient,ob as SupportTemplates,ya as TextractClient,ga as TranscribeClient,Ga as TranslateClient,K as UnifiedDnsValidator,jb as VoiceClient,qa as analyzeSentiment,I as applyZoneMigration,c as buildQueryParams,na as completeWithClaude,ta as containsPii,wa as countFacesInS3Image,db as createDeliveryReceiptHandler,O as createDnsProvider,M as createGoDaddyValidator,r as createObjectStorageClient,L as createPorkbunValidator,lb as createRecordingHandler,N as createRoute53Validator,Fa as createSSML,bb as createScheduledSmsHandler,cb as createSmsClient,ab as createSmsInboxHandler,rb as createSmsInfrastructure,mb as createVoiceClient,kb as createVoicemailHandler,d as detectCredentialSource,P as detectDnsProvider,va as detectLabelsFromS3,sa as detectLanguage,R as dnsProviders,j as email,G as exportRoute53Zone,ra as extractEntities,Aa as extractFormsFromS3,Ba as extractTablesFromS3,za as extractTextFromS3,fb as formatPhoneNumber,oa as generateEmbeddings,hb as getCountryCode,Na as getRecommendations,Oa as getSimilarItems,qb as getSmsInfrastructureStatus,xa as isContentSafe,ib as isSamePhoneNumber,gb as isValidPhoneNumber,n as keyMatchesFilters,ma as listClaudeModels,Ja as listLanguages,Ea as listVoices,o as migrateObjectStorage,eb as normalizePhoneNumber,H as planZoneMigration,B as policyTag,p as providerEndpoint,C as qualifyName,E as reconcileDeclaredRecords,m as remapKey,la as requestModelAccess,D as resolveDeclaredRecords,q as resolveObjectStorage,a as resolveS3Endpoint,Sa as retrieveForRag,Ra as search,pb as setupSmsInfrastructure,Ya as startImapServer,_a as startSmtpServer,Da as textToSpeech,Pa as trackEvent,Ha as translate,Ia as translateToMultiple,J as verifyZoneParity};
+import{$e as Fa,Ae as ea,Af as eb,Be as fa,Bf as fb,Ce as ga,Cf as gb,De as ha,Df as hb,Ee as ia,Ef as ib,Fe as ja,Ff as jb,Ge as ka,Gf as kb,He as la,Hf as lb,Ie as ma,If as mb,Je as na,Jf as nb,Ke as oa,Kf as ob,Le as pa,Lf as pb,Me as qa,Mf as qb,Ne as ra,Nf as rb,Oe as sa,Of as sb,Pe as ta,Pf as tb,Qe as ua,Re as va,Se as wa,Te as xa,Ue as ya,Ve as za,We as Aa,Xe as Ba,Ye as Ca,Ze as Da,_e as Ea,af as Ga,bf as Ha,cf as Ia,df as Ja,ef as Ka,ff as La,gf as Ma,hf as Na,ie as k,if as Oa,je as l,jf as Pa,ke as m,kf as Qa,le as n,lf as Ra,me as o,mf as Sa,ne as p,nf as Ta,oe as q,of as Ua,pe as r,pf as Va,qe as t,qf as Wa,re as w,rf as Xa,se as V,sf as Ya,te as X,tf as Za,ue as Y,uf as _a,ve as Z,vf as $a,we as _,wf as ab,xe as aa,xf as bb,ye as ba,yf as cb,ze as ca,zf as db}from"../chunk-gkj1tpsn.js";import{Qf as e,Rf as h,Sf as i,Tf as j}from"../chunk-82gezmen.js";import{Uf as v}from"../chunk-7j100g7w.js";import{Vf as U}from"../chunk-jphewtbx.js";import{Wf as da}from"../chunk-fbwpm0zm.js";import{$f as A,Xf as x,Yf as y,Zf as z,ag as B,bg as C,cg as D,dg as E,eg as F,fg as G,gg as H,hg as I,ig as J,jg as K,kg as L,lg as M,mg as N,ng as O,og as P,pg as Q,qg as R,rg as S,sg as T}from"../chunk-rg7d67xk.js";import{tg as f}from"../chunk-982rye5b.js";import{qi as u,ri as W}from"../chunk-557qj7q9.js";import{si as s}from"../chunk-c8cadhgc.js";import{ui as g}from"../chunk-70v77sqv.js";import{vi as a,wi as b,xi as c,yi as d}from"../chunk-a368cs92.js";import"../chunk-0hw5wjjg.js";export{S as ACMClient,T as ACMDnsValidator,b as AWSClient,Wa as ApplicationAutoScalingClient,l as AwsBackupClient,ka as BedrockAgentClient,ja as BedrockAgentRuntimeClient,ia as BedrockClient,ha as BedrockRuntimeClient,s as CloudFormationClient,v as CloudFrontClient,aa as CloudWatchLogsClient,A as CloudflareProvider,pa as ComprehendClient,ba as ConnectClient,t as CostExplorerClient,Q as DnsProviderFactory,ea as DynamoDBClient,u as EC2Client,U as ECRClient,V as ECSClient,tb as EFSClient,ca as ELBv2Client,Ua as ElastiCacheClient,i as EmailClient,Ta as EventBridgeClient,z as GoDaddyProvider,e as IAMClient,Xa as ImapServer,Qa as KendraClient,_ as LambdaClient,fa as OpenSearchClient,x as PROXIABLE_RECORD_TYPES,Ka as PersonalizeClient,Ma as PersonalizeEventsClient,La as PersonalizeRuntimeClient,Ca as PollyClient,y as PorkbunProvider,da as RDSClient,ua as RekognitionClient,f as Route53Client,w as Route53DomainsClient,F as Route53Provider,g as S3Client,h as SESClient,Y as SNSClient,Z as SQSClient,W as SSMClient,k as STSClient,Va as SchedulerClient,X as SecretsManagerClient,$a as SmsClient,sb as SmsVoiceClient,Za as SmtpServer,nb as SupportClient,ob as SupportTemplates,ya as TextractClient,ga as TranscribeClient,Ga as TranslateClient,K as UnifiedDnsValidator,jb as VoiceClient,qa as analyzeSentiment,I as applyZoneMigration,c as buildQueryParams,na as completeWithClaude,ta as containsPii,wa as countFacesInS3Image,db as createDeliveryReceiptHandler,O as createDnsProvider,M as createGoDaddyValidator,r as createObjectStorageClient,L as createPorkbunValidator,lb as createRecordingHandler,N as createRoute53Validator,Fa as createSSML,bb as createScheduledSmsHandler,cb as createSmsClient,ab as createSmsInboxHandler,rb as createSmsInfrastructure,mb as createVoiceClient,kb as createVoicemailHandler,d as detectCredentialSource,P as detectDnsProvider,va as detectLabelsFromS3,sa as detectLanguage,R as dnsProviders,j as email,G as exportRoute53Zone,ra as extractEntities,Aa as extractFormsFromS3,Ba as extractTablesFromS3,za as extractTextFromS3,fb as formatPhoneNumber,oa as generateEmbeddings,hb as getCountryCode,Na as getRecommendations,Oa as getSimilarItems,qb as getSmsInfrastructureStatus,xa as isContentSafe,ib as isSamePhoneNumber,gb as isValidPhoneNumber,n as keyMatchesFilters,ma as listClaudeModels,Ja as listLanguages,Ea as listVoices,o as migrateObjectStorage,eb as normalizePhoneNumber,H as planZoneMigration,B as policyTag,p as providerEndpoint,C as qualifyName,E as reconcileDeclaredRecords,m as remapKey,la as requestModelAccess,D as resolveDeclaredRecords,q as resolveObjectStorage,a as resolveS3Endpoint,Sa as retrieveForRag,Ra as search,pb as setupSmsInfrastructure,Ya as startImapServer,_a as startSmtpServer,Da as textToSpeech,Pa as trackEvent,Ha as translate,Ia as translateToMultiple,J as verifyZoneParity};

package/dist/aws/sms-voice.d.ts

@@ -27,6 +27,30 @@ export interface DescribePhoneNumbersResult {
     PhoneNumbers: OriginationPhoneNumber[];
     NextToken?: string;
 }
+/**
+ * A destination number verified for the End User Messaging sandbox.
+ *
+ * Until an account leaves the sandbox, AWS only delivers to numbers that have
+ * been added here and confirmed with the code it texts them - so an
+ * unverified destination fails at send time with no obvious reason.
+ */
+export interface SandboxPhone {
+    id: string;
+    phoneNumber: string;
+    status: 'PENDING' | 'VERIFIED';
+    createdAt?: string;
+}
+export interface AddSandboxPhoneResult {
+    verifiedDestinationNumberId: string;
+    phoneNumber: string;
+    status: 'PENDING' | 'VERIFIED';
+}
+export interface VerifySandboxPhoneResult {
+    success: boolean;
+    verifiedDestinationNumberId?: string;
+    phoneNumber?: string;
+    status?: 'PENDING' | 'VERIFIED';
+}
 export declare class SmsVoiceClient {
     private client;
     private region;
@@ -38,4 +62,15 @@ export declare class SmsVoiceClient {
      * a number still `PENDING` registration will be rejected at send time.
      */
     describePhoneNumbers(params?: DescribePhoneNumbersParams): Promise<DescribePhoneNumbersResult>;
+    /**
+       * Add a destination number to the sandbox and trigger its verification text.
+       *
+       * Answers `VERIFIED` immediately when the number was already confirmed, so a
+       * caller can treat "already done" and "code sent" the same way.
+       */
+    addSandboxPhone(phoneNumber: string): Promise<AddSandboxPhoneResult>;
+    /** Confirm a sandbox number with the code AWS texted to it. */
+    verifySandboxPhone(verifiedDestinationNumberId: string, verificationCode: string): Promise<VerifySandboxPhoneResult>;
+    /** Every destination number added to the sandbox, verified or pending. */
+    listSandboxPhones(): Promise<SandboxPhone[]>;
 }

package/dist/bin/cli.js

@@ -28,7 +28,7 @@ Received ${t}, cleaning up...`),r)try{await r()}catch(n){console.error("Error du
 `)),this.enableDidYouMean){let e=[];for(let n of this.commands){if(n.displayName)e.push(n.displayName);if(n.aliasNames)e.push(...n.aliasNames)}let t=Rs(r,e);if(t.length>0)console.log(nn.yellow("Did you mean one of these?")),t.forEach((n)=>console.log(`  ${nn.dim("•")} ${this.name} ${n}`)),console.log("")}console.log(nn.dim("Run"),`${this.name} --help`,nn.dim("to see all available commands")),ut.exit(1)}async parse(r=Cs,e={}){let{run:t=!0,exitOnError:n=!1}=e;if(n)try{return await this.parse(r,{run:t})}catch(l){throw this.handleUsageError(l),l}if(this.rawArgs=r,!this.name)this.name=r[1]?xd(r[1]):"cli";let i=!0,o=r.slice(2),s=o[0];if(s&&!s.startsWith("-")){for(let l of this.commands)if(l.isMatched(s)){let d=this.mri(o,l);i=!1;let u={...d,args:d.args.slice(1)};this.setParsedInfo(u,l,s),this.emit(`command:${s}`,l);break}if(i){let l=o[1];if(l&&!l.startsWith("-")){let d=`${s}:${l}`;for(let u of this.commands)if(u.isMatched(d)){let m=this.mri(o,u);i=!1;let p={...m,args:m.args.slice(2)};this.setParsedInfo(p,u,d),this.emit(`command:${d}`,u);break}}}}if(i){for(let l of this.commands)if(l.name===""){i=!1;let d=this.mri(o,l);this.setParsedInfo(d,l),this.emit("command:!",l);break}}if(i){let l=this.mri(r.slice(2));this.setParsedInfo(l)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),t=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),t=!1,this.unsetMatchedCommand();let c={args:this.args,options:this.options};if(t)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return c}mri(r,e){let t=[...this.globalCommand.options,...e?e.options:[]],n=Rd(t),i=[],o=r.indexOf("--");if(o>-1)i=r.slice(o+1),r=r.slice(0,o);let s=Nd(r,n),c={_:s._};for(let p of Object.keys(s))if(p!=="_")c[on(p)]=s[p];let l=c._,d={"--":i},u=e&&e.config.ignoreOptionDefaultValue?e.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,m=Object.create(null);for(let p of t){if(!u&&p.config.default!==void 0)for(let y of p.names)d[y]=p.config.default;if(Array.isArray(p.config.type)){if(m[p.name]===void 0)m[p.name]={shouldTransform:!0,transformFunction:p.config.type[0]}}}for(let p of Object.keys(c))if(p!=="_"){let y=p.split(".");Id(d,y,c[p]),Pd(d,m)}return{args:l,options:d}}async run(r=Cs){return this.parse(r,{run:!0,exitOnError:!0})}handleUsageError(r){if(!Ed(r)||r.isUsageError===!1)return;let e=r.message||"command-line error",t=this.name?`${this.name}: `:"",n=/--help/.test(e)?"":r.usage?`
 Usage: ${r.usage}`:`
 Run \`${this.name??"cli"} --help\` for usage.`;ut.stderr.write(`${t}${e}${n}
-`),ut.exit(r.exitCode??2)}async runMatchedCommand(){let{args:r,options:e,matchedCommand:t}=this;if(!t||!t.commandAction)return;t.checkUnknownOptions(),t.checkOptionValue(),t.checkRequiredArgs();let n=[];t.args.forEach((c,l)=>{if(c.variadic)n.push(r.slice(l));else n.push(r[l])}),n.push(e);let i={command:t,args:n,options:e};for(let c of t.beforeHooks)await c(i);let o,s=async()=>{let c=t.commandAction.apply(this,n);if(c instanceof Promise)o=await c;else o=c;return o};if(t.middleware.length>0){let c=0,l=async()=>{if(c<t.middleware.length){let d=t.middleware[c++];await d({...i,next:l})}else await s()};await l()}else await s();for(let c of t.afterHooks)await c(i);return o}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return ut.removeAllListeners("SIGINT"),ut.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class Ps{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(r){if(!this.enabled){this.misses++;return}let e=this.cache.get(r);if(!e){this.misses++;return}if(Date.now()-e.timestamp>e.ttl){this.cache.delete(r),this.misses++;return}return this.hits++,e.value}set(r,e,t=5000){if(!this.enabled)return;this.cache.set(r,{value:e,timestamp:Date.now(),ttl:t})}has(r){if(!this.enabled)return!1;let e=this.cache.get(r);if(!e)return!1;if(Date.now()-e.timestamp>e.ttl)return this.cache.delete(r),!1;return!0}delete(r){this.cache.delete(r)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let r=Date.now();for(let[e,t]of this.cache.entries())if(r-t.timestamp>t.ttl)this.cache.delete(e)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var rg=new Ps;function Md(){if("FORCE_COLOR"in rn.env)return rn.env.FORCE_COLOR!=="0";if("NO_COLOR"in rn.env||rn.env.TERM==="dumb")return!1;if(rn.platform==="win32")return!0;return As.isatty(1)&&As.isatty(2)}var xs=Md();function te(r,e){if(!xs)return(t)=>t;return(t)=>r+t+e}var _d=te("\x1B[0m","\x1B[0m"),zd=te("\x1B[31m","\x1B[39m"),Ud=te("\x1B[32m","\x1B[39m"),Vd=te("\x1B[33m","\x1B[39m"),Wd=te("\x1B[34m","\x1B[39m"),qd=te("\x1B[35m","\x1B[39m"),Hd=te("\x1B[36m","\x1B[39m"),Gd=te("\x1B[37m","\x1B[39m"),Kd=te("\x1B[90m","\x1B[39m"),Jd=te("\x1B[1m","\x1B[22m"),Yd=te("\x1B[3m","\x1B[23m"),Zd=te("\x1B[4m","\x1B[24m"),Qd=te("\x1B[2m","\x1B[22m"),Xd=te("\x1B[7m","\x1B[27m"),eu=te("\x1B[8m","\x1B[28m"),tu=te("\x1B[9m","\x1B[29m"),nu=te("\x1B[41m","\x1B[49m"),ru=te("\x1B[42m","\x1B[49m"),iu=te("\x1B[43m","\x1B[49m"),ou=te("\x1B[44m","\x1B[49m"),su=te("\x1B[45m","\x1B[49m"),au=te("\x1B[46m","\x1B[49m"),cu=te("\x1B[47m","\x1B[49m"),lu=xs,du={reset:_d,red:zd,green:Ud,yellow:Vd,blue:Wd,magenta:qd,cyan:Hd,white:Gd,gray:Kd,bold:Jd,italic:Yd,underline:Zd,dim:Qd,inverse:Xd,hidden:eu,strikethrough:tu,bgRed:nu,bgGreen:ru,bgYellow:iu,bgBlue:ou,bgMagenta:su,bgCyan:au,bgWhite:cu,isColorSupported:lu},uu=du,pu=["up","down","left","right","space","enter","cancel"],lg={actions:new Set(pu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var dg=mu.platform.startsWith("win"),ug=Symbol("clapp:cancel");var fu=Dd();var ee=(r,e)=>fu?r:e,mg=ee("◆","*"),pg=ee("■","x"),fg=ee("▲","x"),gg=ee("◇","o"),hg=ee("┌","T"),gu=ee("│","|"),yg=ee("└","—"),vg=ee("●",">"),bg=ee("○"," "),wg=ee("◻","[•]"),Sg=ee("◼","[+]"),$g=ee("◻","[ ]"),Cg=ee("▪","•"),Ag=ee("─","-"),kg=ee("╮","+"),Rg=ee("├","+"),Ig=ee("╯","+"),Pg=ee("●","•"),xg=ee("◆","*"),Eg=ee("▲","!"),Dg=ee("■","x");var Tg={light:ee("─","-"),heavy:ee("━","="),block:ee("█","#")};function hu(){return`${uu.gray(gu)}  `}var Ng=hu();var Er="0.12.9";import{existsSync as Dr}from"node:fs";import{mkdir as vu,writeFile as Es}from"node:fs/promises";function Nr(r){r.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(e)=>{if(S("Initializing ts-cloud Project"),Dr("cloud.config.ts")){if(!await O("cloud.config.ts already exists. Overwrite?",!1)){a("Initialization cancelled");return}}let t=e?.name||await Z("Project name","my-app"),n=e?.mode||await Tr("Select deployment mode",["serverless","server"]),i=e?.region||await Tr("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),o=new A("Creating configuration file...");o.start();let s=`import { defineConfig } from '@ts-cloud/core'
+`),ut.exit(r.exitCode??2)}async runMatchedCommand(){let{args:r,options:e,matchedCommand:t}=this;if(!t||!t.commandAction)return;t.checkUnknownOptions(),t.checkOptionValue(),t.checkRequiredArgs();let n=[];t.args.forEach((c,l)=>{if(c.variadic)n.push(r.slice(l));else n.push(r[l])}),n.push(e);let i={command:t,args:n,options:e};for(let c of t.beforeHooks)await c(i);let o,s=async()=>{let c=t.commandAction.apply(this,n);if(c instanceof Promise)o=await c;else o=c;return o};if(t.middleware.length>0){let c=0,l=async()=>{if(c<t.middleware.length){let d=t.middleware[c++];await d({...i,next:l})}else await s()};await l()}else await s();for(let c of t.afterHooks)await c(i);return o}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return ut.removeAllListeners("SIGINT"),ut.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class Ps{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(r){if(!this.enabled){this.misses++;return}let e=this.cache.get(r);if(!e){this.misses++;return}if(Date.now()-e.timestamp>e.ttl){this.cache.delete(r),this.misses++;return}return this.hits++,e.value}set(r,e,t=5000){if(!this.enabled)return;this.cache.set(r,{value:e,timestamp:Date.now(),ttl:t})}has(r){if(!this.enabled)return!1;let e=this.cache.get(r);if(!e)return!1;if(Date.now()-e.timestamp>e.ttl)return this.cache.delete(r),!1;return!0}delete(r){this.cache.delete(r)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let r=Date.now();for(let[e,t]of this.cache.entries())if(r-t.timestamp>t.ttl)this.cache.delete(e)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var rg=new Ps;function Md(){if("FORCE_COLOR"in rn.env)return rn.env.FORCE_COLOR!=="0";if("NO_COLOR"in rn.env||rn.env.TERM==="dumb")return!1;if(rn.platform==="win32")return!0;return As.isatty(1)&&As.isatty(2)}var xs=Md();function te(r,e){if(!xs)return(t)=>t;return(t)=>r+t+e}var _d=te("\x1B[0m","\x1B[0m"),zd=te("\x1B[31m","\x1B[39m"),Ud=te("\x1B[32m","\x1B[39m"),Vd=te("\x1B[33m","\x1B[39m"),Wd=te("\x1B[34m","\x1B[39m"),qd=te("\x1B[35m","\x1B[39m"),Hd=te("\x1B[36m","\x1B[39m"),Gd=te("\x1B[37m","\x1B[39m"),Kd=te("\x1B[90m","\x1B[39m"),Jd=te("\x1B[1m","\x1B[22m"),Yd=te("\x1B[3m","\x1B[23m"),Zd=te("\x1B[4m","\x1B[24m"),Qd=te("\x1B[2m","\x1B[22m"),Xd=te("\x1B[7m","\x1B[27m"),eu=te("\x1B[8m","\x1B[28m"),tu=te("\x1B[9m","\x1B[29m"),nu=te("\x1B[41m","\x1B[49m"),ru=te("\x1B[42m","\x1B[49m"),iu=te("\x1B[43m","\x1B[49m"),ou=te("\x1B[44m","\x1B[49m"),su=te("\x1B[45m","\x1B[49m"),au=te("\x1B[46m","\x1B[49m"),cu=te("\x1B[47m","\x1B[49m"),lu=xs,du={reset:_d,red:zd,green:Ud,yellow:Vd,blue:Wd,magenta:qd,cyan:Hd,white:Gd,gray:Kd,bold:Jd,italic:Yd,underline:Zd,dim:Qd,inverse:Xd,hidden:eu,strikethrough:tu,bgRed:nu,bgGreen:ru,bgYellow:iu,bgBlue:ou,bgMagenta:su,bgCyan:au,bgWhite:cu,isColorSupported:lu},uu=du,pu=["up","down","left","right","space","enter","cancel"],lg={actions:new Set(pu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var dg=mu.platform.startsWith("win"),ug=Symbol("clapp:cancel");var fu=Dd();var ee=(r,e)=>fu?r:e,mg=ee("◆","*"),pg=ee("■","x"),fg=ee("▲","x"),gg=ee("◇","o"),hg=ee("┌","T"),gu=ee("│","|"),yg=ee("└","—"),vg=ee("●",">"),bg=ee("○"," "),wg=ee("◻","[•]"),Sg=ee("◼","[+]"),$g=ee("◻","[ ]"),Cg=ee("▪","•"),Ag=ee("─","-"),kg=ee("╮","+"),Rg=ee("├","+"),Ig=ee("╯","+"),Pg=ee("●","•"),xg=ee("◆","*"),Eg=ee("▲","!"),Dg=ee("■","x");var Tg={light:ee("─","-"),heavy:ee("━","="),block:ee("█","#")};function hu(){return`${uu.gray(gu)}  `}var Ng=hu();var Er="0.12.10";import{existsSync as Dr}from"node:fs";import{mkdir as vu,writeFile as Es}from"node:fs/promises";function Nr(r){r.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(e)=>{if(S("Initializing ts-cloud Project"),Dr("cloud.config.ts")){if(!await O("cloud.config.ts already exists. Overwrite?",!1)){a("Initialization cancelled");return}}let t=e?.name||await Z("Project name","my-app"),n=e?.mode||await Tr("Select deployment mode",["serverless","server"]),i=e?.region||await Tr("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),o=new A("Creating configuration file...");o.start();let s=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -315,7 +315,7 @@ Resources to create: ${k}`);let T={};for(let E of Object.values(d.Resources||{})
 No changes detected - infrastructure is up to date`);return}if(a(`
 Changes detected:
 `),b.length>0){h(`Resources to add (${b.length}):`);for(let C of b){let k=y[C].Type;a(`  + ${C} (${k})`)}console.log()}if(I.length>0){f(`Resources to remove (${I.length}):`);for(let C of I){let k=p[C].Type;a(`  - ${C} (${k})`)}console.log()}if(v.length>0){R(`Resources to modify (${v.length}):`);for(let C of v){let k=y[C].Type;a(`  ~ ${C} (${k})`)}console.log()}a("Summary:"),a(`  - Add: ${b.length}`),a(`  - Remove: ${I.length}`),a(`  - Modify: ${v.length}`),a("\nRun `cloud deploy` to apply these changes")}catch(t){f(`Diff failed: ${t.message}`)}})}function gt(r,e=0){let t=Number(r);return Number.isFinite(t)?t:e}function Yr(r){return gt(r)*1024}function Yu(r){let e=r?.date?.trim(),t=r?.time?.trim();if(!e||!t)return null;let n=new Date(`${e}T${t}Z`);return Number.isFinite(n.getTime())?n.toISOString():null}function Zu(r,e,t){let n;try{n=JSON.parse(r)}catch{return[]}let i=(n?.sysstat?.hosts??[]).flatMap((s)=>s.statistics??[]),o=[];for(let s of i){let c=Yu(s.timestamp);if(!c)continue;let l=new Date(c).getTime();if(l<e.getTime()||l>t.getTime())continue;let d=s["cpu-load"]?.find((m)=>m.cpu==="all")??s["cpu-load"]?.[0],u=gt(d?.idle,100);o.push({timestamp:c,cpuUsedPercent:Math.max(0,Math.min(100,100-u)),cpuUserPercent:gt(d?.user),cpuSystemPercent:gt(d?.system),cpuIowaitPercent:gt(d?.iowait),memoryUsedPercent:gt(s.memory?.["memused-percent"]),memoryUsedBytes:Yr(s.memory?.memused),memoryAvailableBytes:Yr(s.memory?.avail),swapUsedPercent:gt(s.memory?.["swpused-percent"]),swapUsedBytes:Yr(s.memory?.swpused)})}return o.sort((s,c)=>s.timestamp.localeCompare(c.timestamp))}function Qu(r){return Object.fromEntries(Object.entries(r.time_series??{}).map(([e,t])=>[e,(t.values??[]).map(([n,i])=>({timestamp:new Date(Number(n)*1000).toISOString(),value:gt(i,Number.NaN)})).filter((n)=>Number.isFinite(n.value))]))}function ha(r){return r.length?r.reduce((e,t)=>e+t,0)/r.length:null}function Zr(r){return r.length?Math.max(...r):null}function Xu(r){return r.length?Math.min(...r):null}async function ya(r){let[e,t]=await Promise.all([r.client.getServerMetrics(r.serverId,{types:["cpu","disk","network"],start:r.from,end:r.to,step:r.step}),Qr(r.remote.host,"LC_ALL=C sadf -j -- -u -r -S",r.remote).catch(()=>"")]),n=Zu(t,r.from,r.to),i=Qu(e),s=(i.cpu??[]).map((m)=>Math.max(0,Math.min(100,m.value/Math.max(1,r.cores)))),c=n.map((m)=>m.cpuUsedPercent),l=s.length?s:c,d=n.map((m)=>m.memoryUsedPercent),u=n.map((m)=>m.swapUsedPercent);return{from:r.from.toISOString(),to:r.to.toISOString(),cores:r.cores,host:n,provider:i,summary:{cpuAveragePercent:ha(l),cpuPeakPercent:Zr(l),memoryAveragePercent:ha(d),memoryPeakPercent:Zr(d),memoryMinimumAvailableBytes:Xu(n.map((m)=>m.memoryAvailableBytes)),swapPeakPercent:Zr(u)}}}function em(r){if(r.length===0)throw Error("A server name cannot be empty.");if(r.length>253)throw Error(`'${r}' is longer than the 253 characters a hostname allows.`);for(let e of r.split(".")){if(e.length===0)throw Error(`'${r}' has an empty label — a hostname cannot contain '..'.`);if(e.length>63)throw Error(`'${e}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(e))throw Error(`'${e}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function va(r,e,t){if(em(e),r===e)throw Error(`'${r}' is already named that.`);if((await t.takenNames()).some((o)=>o===e&&o!==r))throw Error(`'${e}' is already taken. Server names have to be unique within a provider project.`);let i=[];if(t.providerName&&t.renameProvider){let{providerName:o,renameProvider:s}=t;i.push({id:"provider",title:"Rename the server at the provider",change:{from:r,to:e},satisfied:async()=>await o()===e,apply:()=>s(e)})}if(t.stateName&&t.writeStateName){let{stateName:o,writeStateName:s}=t;i.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:r,to:e},satisfied:async()=>{let c=await o();return c===void 0||c===e},apply:()=>s(e)})}if(t.remoteHostname&&t.setRemoteHostname){let{remoteHostname:o,setRemoteHostname:s}=t;i.push({id:"hostname",title:"Set the hostname on the box",change:{from:r,to:e},satisfied:async()=>await o()===e,apply:()=>s(e)})}return i.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:r,to:e},satisfied:async()=>t.inventoryName()===e,apply:async()=>{await t.renameInventory(e)}}),{operation:"server:rename",target:r,steps:i}}function ba(r){let e=`'${r.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${e} 2>/dev/null || { echo ${e} > /etc/hostname && hostname ${e}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${r}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${e} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}async function tm(){let r=await P(),e=q(process.cwd(),r),t=new et(e.store),n=new Na(t,[new qn("aws"),new qn("hetzner"),new qn("ssh")]);return{controlPlane:e,store:t,service:n}}async function Ve(r){let e=await tm();try{return await r(e)}finally{e.controlPlane.store.close()}}var yt=(r,e)=>{let t=r.store.list(r.controlPlane.project.id).find((n)=>n.id===e||n.name===e);if(!t)throw Error(`Server ${e} was not found.`);return t},fe=(r)=>{f(r instanceof Error?r.message:String(r)),process.exitCode=1};function ni(r,e){let t=Number.parseInt(r??"",10);return Number.isFinite(t)&&t>=0?t:e}function nm(r="3h"){let e=r.match(/^(\d+)(m|h)$/);if(!e)throw Error("--range must use minutes or hours, for example 30m or 3h.");let t=Number(e[1])*(e[2]==="h"?3600000:60000);if(t<300000||t>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return t}function un(r,e="%"){return r==null?"unavailable":`${r.toFixed(1)}${e}`}async function rm(r,e){let t=await P();if(t.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let n=e.env??process.env.CLOUD_ENV??"production",i=we(t,n),o=await Rt(i);if(!o?.serverId)throw Error(`No pinned Hetzner server was found for ${i}.`);if(![o.serverName,String(o.serverId),o.stackName].includes(r))throw Error(`Refusing to read ${r}: project state is pinned to ${o.serverName}.`);let s=mn(t),c=new Vt({apiToken:Wt(s.apiToken,t)}),l=await c.getServer(o.serverId),d=o.publicIp??l.public_net.ipv4?.ip;if(!d)throw Error(`Server ${l.name} has no public IPv4 address.`);let u=new Date,m=new Date(u.getTime()-nm(e.range)),p=Math.min(3600,Math.max(60,ni(e.step,60))),y=await ya({client:c,serverId:l.id,cores:Math.max(1,Number(l.server_type.cores)||1),from:m,to:u,step:p,remote:{host:d,user:o.sshUser??s.sshUser,identityFile:s.sshPrivateKeyPath,connectTimeoutSec:15}});if(e.json){console.log(JSON.stringify({schemaVersion:1,server:l.name,result:y},null,2));return}x(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[l.name,`${y.from} to ${y.to}`,`${un(y.summary.cpuAveragePercent)} / ${un(y.summary.cpuPeakPercent)}`,`${un(y.summary.memoryAveragePercent)} / ${un(y.summary.memoryPeakPercent)}`,y.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(y.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,un(y.summary.swapPeakPercent)]])}function Oa(r){let e=r.targetType.prices?.find((t)=>t.location===r.location);return{serverId:r.serverId,serverName:r.serverName,location:r.location,from:r.currentType.name,to:r.targetType.name,capacityAvailable:r.capacityAvailable,alreadyComplete:r.alreadyComplete,upgradeDisk:r.upgradeDisk,target:{cores:r.targetType.cores,memoryGb:r.targetType.memory,diskGb:r.targetType.disk,architecture:r.targetType.architecture,cpuType:r.targetType.cpu_type},price:e?{hourlyNet:e.price_hourly.net,hourlyGross:e.price_hourly.gross,monthlyNet:e.price_monthly.net,monthlyGross:e.price_monthly.gross}:void 0}}function im(r){let e=Oa(r);x(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${e.serverName} (${e.serverId})`,e.location,`${e.from} -> ${e.to}`,e.capacityAvailable?"available":"waiting",`${e.target.cores??0} / ${e.target.memoryGb??0} GB / ${e.target.diskGb??0} GB`,e.price?.monthlyGross??e.price?.monthlyNet??"not reported"]])}async function om(r,e,t){let n=await P();if(n.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let i=t.env??process.env.CLOUD_ENV??"production",o=we(n,i),s=await Rt(o),c=mn(n),l=new Vt({apiToken:Wt(c.apiToken,n)}),u=s&&(r===s.serverName||r===String(s.serverId)||r===s.stackName)?await l.getServer(s.serverId):(await l.listServers()).find((E)=>E.name===r||String(E.id)===r);if(!u)throw Error(`Hetzner server ${r} was not found.`);if(s?.serverId&&s.serverId!==u.id)throw Error(`Refusing to resize ${r}: project state is pinned to server ${s.serverId}.`);let m=Sa(e),p=t.upgradeDisk!==!1,y=await ei(l,u.id,m,p);if(t.json)console.log(JSON.stringify({schemaVersion:1,plan:Oa(y)},null,2));else im(y);if(!t.apply){if(!t.json)a(`Preview only. Re-run with --apply --confirm ${u.name} to execute.`);return}if(t.confirm!==u.name)throw Error(`Resize requires --confirm ${u.name}.`);let w=s?.publicIp??u.public_net.ipv4?.ip;if(!w)throw Error(`Server ${u.name} has no public IPv4 address for verification.`);let g={host:w,user:s?.sshUser??c.sshUser,identityFile:c.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},b=await Da(o),I=new Date().toISOString(),v={schemaVersion:1,operationId:b?.targetType===m&&b.serverId===u.id?b.operationId:crypto.randomUUID(),stackName:o,serverId:u.id,serverName:u.name,sourceType:y.currentType.name,targetType:m,upgradeDisk:p,phase:"planning",status:"running",attempts:b?.targetType===m?b.attempts:0,startedAt:b?.targetType===m?b.startedAt:I,updatedAt:I,manifest:b?.targetType===m?b.manifest:void 0};await ht(v);let C=ni(t.pollSeconds,900)*1000,k=ni(t.maxWaitMinutes,0)*60000,T=Date.now();for(;;){let E=await ei(l,u.id,m,p);if(!E.capacityAvailable&&!E.alreadyComplete){if(v={...v,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await ht(v),!t.wait){if(!t.json)a(`${m} has no capacity in ${E.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(k>0&&Date.now()-T>=k)throw Error(`Timed out waiting for ${m} capacity in ${E.location}.`);if(!t.json)a(`Waiting ${Math.round(C/1000)} seconds for ${m} capacity...`);await Bun.sleep(C);continue}let D=await Ta(o);try{let N=await(async()=>{try{return v={...v,status:"running",attempts:v.attempts+1,updatedAt:new Date().toISOString()},await ht(v),await Ca({client:l,serverId:u.id,targetType:m,upgradeDisk:p,resumeFromOff:v.phase==="shutting-down"||v.phase==="resizing"||v.phase==="powering-on"||v.phase==="verifying",manifest:v.manifest,hooks:{preflight:async()=>{let _=await Aa(g);return v={...v,manifest:_,updatedAt:new Date().toISOString()},await ht(v),_},afterBoot:async(_,M,V,G)=>ka(g,M,V,G),onPhase:async(_,M)=>{if(v={...v,phase:_,status:_==="waiting-capacity"?"waiting-capacity":_==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await ht(v),!t.json)a(`${_}${M?` ${JSON.stringify(M)}`:""}`)}}})}finally{await D()}})();if(v={...v,status:N.status==="completed"||N.status==="already-complete"?"completed":N.status==="recovered"?"recovered":"waiting-capacity",lastError:N.status==="recovered"?N.error:void 0,updatedAt:new Date().toISOString()},await ht(v),t.json)console.log(JSON.stringify({schemaVersion:1,result:N},null,2));else if(N.status==="completed"||N.status==="already-complete")h(`${u.name} is on ${m} and passed full post-boot verification.`);else if(N.status==="recovered"&&N.retryable&&t.wait){a(`Capacity race recovered safely. Waiting ${Math.round(C/1000)} seconds before retry.`),await Bun.sleep(C);continue}else if(N.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${N.error}`);return}catch(N){throw v={...v,status:"failed",lastError:N instanceof Error?N.message:String(N),updatedAt:new Date().toISOString()},await ht(v),N}}}async function sm(r,e){let t=await P();if(t.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let n=e.env??process.env.CLOUD_ENV??"production",i=we(t,n),o=await Rt(i);if(!o?.serverId)throw Error(`No pinned Hetzner server was found for ${i}.`);if(![o.serverName,String(o.serverId),o.stackName].includes(r))throw Error(`Refusing to optimize ${r}: project state is pinned to ${o.serverName}.`);let s=mn(t),c=new Vt({apiToken:Wt(s.apiToken,t)}),l=await c.getServer(o.serverId),d=o.publicIp??l.public_net.ipv4?.ip;if(!d)throw Error(`Server ${l.name} has no public IPv4 address.`);let u=Ia(t);if(e.json)console.log(JSON.stringify({schemaVersion:1,server:l.name,plan:u},null,2));else x(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[l.name,u.firewallPorts.join(","),u.monitoring?"on":"off",u.autoUpdates?"on":"off",`${u.swapGb} GB`,"disabled"]]);if(!e.apply){if(!e.json)a(`Preview only. Re-run with --apply --confirm ${l.name} to execute.`);return}if(e.confirm!==l.name)throw Error(`Optimization requires --confirm ${l.name}.`);let m={host:d,user:o.sshUser??s.sshUser,identityFile:s.sshPrivateKeyPath,connectTimeoutSec:15},p=await ti(m),y=p.routeProbes.filter((V)=>!V.ok),w=t.infrastructure?.compute,g=Xr(w)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,b=p.failedUnits.filter((V)=>!g.has(V));if(b.length>0)throw Error(`Preflight found failed services: ${b.join(", ")}`);if(y.length>0)throw Error(`Preflight found unhealthy routes: ${y.map((V)=>V.domain).join(", ")}`);let I=Xr(w)?[]:Object.values(t.sites??{}).flatMap((V)=>typeof V?.port==="number"&&![80,443].includes(V.port)?[V.port]:[]),v=wa({allowSsh:w?.allowSsh!==!1,sitePorts:I,allowedPorts:w?.firewall?.allowedPorts}),C=(o.firewallId?(await c.listFirewalls()).find((V)=>V.id===o.firewallId):void 0)??(await c.listFirewalls()).find((V)=>V.name===`${t.project.slug}-${n}-app-fw`);if(!C)throw Error(`Managed firewall for ${l.name} was not found.`);let k=await c.setFirewallRules(C.id,v);await Promise.all(k.map((V)=>c.waitForAction(V.id))),await Pa(t,m);let[T,E]=await Promise.all([ti(m),xa(m)]),D=Ea(u,E),N=Ra(p,T),_=T.routeProbes.filter((V)=>!V.ok);if(N.stoppedServices.length>0)D.push(`services stopped: ${N.stoppedServices.join(", ")}`);if(N.changedRouteFragments.length>0)D.push(`route fragments changed: ${N.changedRouteFragments.join(", ")}`);if(N.missingRouteIds.length>0)D.push(`routes disappeared: ${N.missingRouteIds.join(", ")}`);if(N.changedReleaseLinks.length>0)D.push(`release links changed: ${N.changedReleaseLinks.join(", ")}`);if(N.missingData.length>0)D.push(`databases or volumes disappeared: ${N.missingData.join(", ")}`);if(_.length>0)D.push(`unhealthy routes: ${_.map((V)=>V.domain).join(", ")}`);if(D.length>0)throw Error(`Host optimization verification failed: ${D.join("; ")}`);let M={serverId:l.id,serverName:l.name,services:T.runningServices.length,routes:T.routeIds.length,healthyDomains:T.routeProbes.length,releaseLinks:T.releaseLinks.length,databasesAndVolumes:T.dataCatalog.length,report:E};if(e.json)console.log(JSON.stringify({schemaVersion:1,result:M},null,2));else h(`${l.name} passed full host, rpx route, service, release, and data verification.`)}async function am(r,e,t){let n=await P(),i=t.env??"production",o=we(n,i);await Ve(async(s)=>{let c=yt(s,r),l=s.store.list(s.controlPlane.project.id,!0),d=c.provider==="hetzner"&&c.providerId?(()=>{try{let C=mn(n);return new Vt({apiToken:Wt(C.apiToken,n)})}catch{return null}})():null,u=c.providerId?Number(c.providerId):Number.NaN,m=await Rt(o),p=m!=null&&m.serverId===u,y=new zn,w=c.trustState==="pinned",g={takenNames:async()=>{let C=l.map((k)=>k.name);if(d)C.push(...(await d.listServers()).map((k)=>k.name));return C},inventoryName:()=>s.store.get(c.id)?.name??c.name,renameInventory:(C)=>{s.store.update(c.id,{name:C})},...d&&Number.isFinite(u)?{providerName:async()=>(await d.getServer(u)).name,renameProvider:async(C)=>{await d.renameServer(u,C)}}:{},...p?{stateName:async()=>(await Rt(o))?.serverName,writeStateName:async(C)=>{let k=await Rt(o);if(k)await $a(o,{...k,serverName:C})}}:{},...w?{remoteHostname:async()=>{let C=await y.exec(c,"hostname");return C.code===0?C.stdout.trim():void 0},setRemoteHostname:async(C)=>{let k=await y.exec(c,ba(C));if(k.code!==0)throw Error(k.stderr.trim()||`hostname exited ${k.code}`)}}:{}},b=await va(c.name,e,g),I=await Fn(b);if(!t.apply){let C=[d?"":"provider record (no provider id or no API token)",p?"":"local state pin (none points at this server)",w?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(t.json){console.log(JSON.stringify({schemaVersion:1,operation:b.operation,target:b.target,rename:{from:c.name,to:e},notCovered:C,steps:I.map((k)=>({id:k.step.id,title:k.step.title,state:k.state,change:k.step.change,reason:k.reason}))},null,2));return}for(let k of Bn(b,I))console.log(k);for(let k of C)console.log(`  not covered: ${k}`);console.log("  Re-run with --apply to perform it.");return}let v=await Mn(b,I,{log:(C)=>a(C),audit:(C)=>s.controlPlane.store.appendEvent({projectId:s.controlPlane.project.id,resourceId:c.resourceId,type:`${C.operation}.${C.step}.${C.state}`,level:C.state==="failed"?"error":"info",payload:{target:C.target,renameTo:e,...C.error?{error:C.error}:{}}})});if(t.json)console.log(JSON.stringify({schemaVersion:1,outcome:v},null,2));if(!v.success){let C=v.steps.find((k)=>k.state==="failed");throw Error(`${b.operation} stopped at '${C?.title}': ${C?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!t.json)h(`Renamed ${c.name} to ${e}.`)})}function ri(r){r.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(e,t)=>{try{await Ve(async(n)=>{let i=e?[yt(n,e)]:n.store.list(n.controlPlane.project.id),o=i.flatMap((s)=>Object.entries(s.capabilities).map(([c,l])=>({server:s.name,provider:s.provider,action:c,...l})));if(t.json)console.log(JSON.stringify({schemaVersion:1,targets:o},null,2));else x(["Server","Provider","Action","Support","Explanation"],o.map((s)=>[s.server,s.provider,s.action,s.supported?"supported":"unsupported",s.reason??"—"]))})}catch(n){fe(n)}}),r.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(e,t,n)=>{try{await om(e,t,n)}catch(i){fe(i)}}),r.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(e,t)=>{try{await sm(e,t)}catch(n){fe(n)}}),r.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(e,t)=>{try{await rm(e,t)}catch(n){fe(n)}}),r.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(e)=>{try{await Ve(async(t)=>{let n=t.store.list(t.controlPlane.project.id);if(e.json)console.log(JSON.stringify(n,null,2));else x(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],n.map((i)=>[i.name,i.providerId??"—",`${i.provider} / ${i.region??"external"}`,`${i.status} / ${i.trustState}`,i.roles.join(","),`${i.capacity.cpu??0} / ${i.capacity.memoryBytes??0}`,i.heartbeatAt??"never"]))})}catch(t){fe(t)}}),r.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(e,t)=>{try{await Ve(async(n)=>{let i=t.provider;if(!["aws","hetzner","ssh"].includes(i)||!t.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let o=n.service.enroll({organizationId:n.controlPlane.organization.id,projectId:n.controlPlane.project.id,name:e,provider:i,providerId:t.providerId,endpoint:t.endpoint,sshUser:t.user??"deploy",credentialRef:t.credentialRef??"secret://fleet/agent",region:t.region,roles:String(t.roles??"application").split(","),labels:Object.fromEntries(String(t.labels??"").split(",").map((s)=>s.split("=")).filter((s)=>s[0]&&s[1]))});h(`Enrolled ${o.name} as ${o.id}; no remote mutation was performed.`)})}catch(n){fe(n)}}),r.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(e,t)=>{try{await Ve(async(n)=>{let i=yt(n,e);if(i=await n.service.test(i.id),i.trustState==="rotation_pending"){if(!t.acceptHostKey)throw Error(`Host key changed to ${i.pendingHostKey}; review it first.`);i=n.service.reviewHostKey(i.id,t.acceptHostKey)}let o=await n.service.validate(i.id);if(t.json)console.log(JSON.stringify(o.validation,null,2));else x(["Severity","Code","Finding","Remediation"],(o.validation?.findings??[]).map((s)=>[s.severity,s.code,s.message,s.remediation??"—"]));if(!o.validation?.valid)process.exitCode=1})}catch(n){fe(n)}}),r.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(e,t)=>{try{await Ve(async(n)=>{let i=n.service.bootstrap(yt(n,e).id,!!t.apply);if(i.preview)x(["Step"],i.steps.map((o)=>[o]));else h(`Bootstrap queued: ${i.operation?.id}`)})}catch(n){fe(n)}}),r.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(e,t,n)=>{try{await am(e,t,n)}catch(i){fe(i)}}),r.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(e,t)=>{try{await Ve(async(n)=>h(n.service.drain(yt(n,e).id,!!t.complete).status))}catch(n){fe(n)}}),r.command("server:uncordon <name>","Return a server to scheduling").action(async(e)=>{try{await Ve(async(t)=>{t.service.uncordon(yt(t,e).id),h(`Uncordoned ${e}.`)})}catch(t){fe(t)}}),r.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(e,t)=>{try{await Ve(async(n)=>{n.service.archive(yt(n,e).id,t.confirm??""),h(`Archived ${e}; provider infrastructure was not terminated.`)})}catch(n){fe(n)}}),r.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(e)=>{try{await Ve(async(t)=>{let n=yt(t,e);if(n.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let i=Bun.spawn(["ssh","-p",String(n.sshPort),"-o","StrictHostKeyChecking=yes",`${n.sshUser}@${n.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),o=await i.exited;if(o)process.exitCode=o})}catch(t){fe(t)}});for(let[e,t]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])r.command(e,t).action(async(...n)=>be(e.split(" ")[0],{target:String(n[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}async function cm(){let r=await P(),e=q(process.cwd(),r),t=new ja(e.store),n=new Fa(t,new et(e.store));return{controlPlane:e,store:t,service:n}}async function pn(r){let e=await cm();try{await r(e)}catch(t){f(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{e.controlPlane.store.close()}}var Hn=(r)=>Object.fromEntries(String(r??"").split(",").map((e)=>e.split("=")).filter((e)=>e[0]&&e[1])),La=(r)=>Object.fromEntries(Object.entries(Hn(r)).map(([e,t])=>[e,Number(t)]));function ii(r){r.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(e)=>pn((t)=>{let n=t.store.listPools(t.controlPlane.project.id);if(e.json)console.log(JSON.stringify(n,null,2));else x(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],n.map((i)=>[i.name,i.purpose,i.backend,`${i.region??"any"} / ${i.architecture??"any"}`,i.status,JSON.stringify(i.capacity),String(i.concurrency)]))})),r.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(e,t)=>pn((n)=>{let{purpose:i,backend:o}=t;if(!["application","build","worker","monitoring","backup"].includes(i)||!["server","ecs","asg"].includes(o))throw Error("Unsupported pool purpose or backend.");let s=n.store.createPool({organizationId:n.controlPlane.organization.id,projectId:n.controlPlane.project.id,name:e,purpose:i,backend:o,region:t.region,architecture:t.arch,labels:Hn(t.labels),requiredServerLabels:Hn(t.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...La(t.capacity)},maxWorkloads:Number(t.max),costWeight:1,concurrency:Number(t.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});h(`Created ${s.name} (${s.id}).`)})),r.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(e,t)=>pn((n)=>{let i=n.store.listPools(n.controlPlane.project.id).find((s)=>s.id===e||s.name===e),o=new et(n.controlPlane.store).list(n.controlPlane.project.id).find((s)=>s.id===t||s.name===t);if(!i||!o)throw Error("Pool or server was not found.");n.store.addMember(i.id,o.id),h(`Attached ${o.name} to ${i.name}.`)})),r.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(e)=>pn((t)=>{let n=t.service.explain(t.controlPlane.project.id,{purpose:e.purpose,resources:La(e.resources),region:e.region,architecture:e.arch,labels:Hn(e.labels)});if(e.json)console.log(JSON.stringify(n,null,2));else x(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],n.map((i)=>[i.poolName,i.serverId??"provider-managed",i.eligible?"yes":"no",JSON.stringify(i.available),`${i.score.fit.toFixed(2)} / ${i.score.spread} / ${i.score.cost}`,i.reasons.join("; ")||"eligible"]))})),r.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(e)=>pn((t)=>{let n=t.store.listPools(t.controlPlane.project.id).find((o)=>o.id===e||o.name===e);if(!n)throw Error("Pool was not found.");let i=t.service.drainPool(n.id);h(`Draining ${n.name}: moved ${i.moved.length}, blocked ${i.blocked.length} stateful placement(s).`)}))}async function lm(){let r=await P(),e=q(process.cwd(),r),t=new Ba(e.store),n=new Ma(t);return{controlPlane:e,store:t,service:n}}async function It(r){let e=await lm();try{await r(e)}catch(t){f(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{e.controlPlane.store.close()}}var fn=(r,e)=>{let t=r.store.list(r.controlPlane.project.id).find((n)=>n.id===e||n.name===e);if(!t)throw Error("Regional topology was not found.");return t},dm=(r)=>r.split(",").map((e,t)=>{let[n,i="aws"]=e.split(":");return{region:String(n),provider:i,role:t===0?"primary":"secondary"}}),um=(r)=>{let e=new Set(["s3","dynamodb","secrets"]),t=r.split(",").map((i)=>i.trim()),n=t.find((i)=>!e.has(i));if(n)throw Error(`Unsupported replication kind: ${n}`);return t};function oi(r){r.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(e)=>It((t)=>{let n=t.store.list(t.controlPlane.project.id).map((i)=>({topology:i,targets:t.store.targets(i.id),channels:t.store.channels(i.id),route:t.store.route(i.id),executions:t.store.executions(i.id)}));if(e.json)console.log(JSON.stringify(n,null,2));else x(["Name","Hostname","Active","Status","Revision","Replication"],n.map((i)=>[i.topology.name,i.topology.hostname,i.topology.activeRegion,i.topology.status,i.topology.revision??"—",`${i.channels.filter((o)=>o.status==="in_sync").length}/${i.channels.length} in sync`]))})),r.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(e,t)=>It((n)=>{if(!t.hostname||!t.regions)throw Error("--hostname and --regions are required.");let i=n.service.create({organizationId:n.controlPlane.organization.id,projectId:n.controlPlane.project.id,name:e,hostname:t.hostname,regions:dm(t.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:um(String(t.replicate)),maxLagSeconds:Number(t.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!t.cdn,wafEnabled:!!t.waf});h(`Created ${i.name} (${i.id}); run region:rollout with an immutable manifest.`)})),r.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(e,t,n)=>It((i)=>x(["Step"],i.service.plan(fn(i,e).id,t,n.target).map((o)=>[o])))),r.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(e,t,n)=>It(async(i)=>{let o=n.manifest?await Bun.file(n.manifest).json():{},s=i.service.enqueue({topologyId:fn(i,e).id,kind:"rollout",revision:t,manifest:o});h(`Regional rollout queued: ${s.operation.id}`)})),r.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(e,t)=>It((n)=>{let i=n.service.enqueue({topologyId:fn(n,e).id,kind:"failover",targetRegion:t});h(`Failover queued: ${i.operation.id}`)})),r.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(e,t)=>It((n)=>{let i=n.service.enqueue({topologyId:fn(n,e).id,kind:"failback",targetRegion:t});h(`Failback queued: ${i.operation.id}`)})),r.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(e,t)=>It((n)=>{let i=n.service.enqueue({topologyId:fn(n,e).id,kind:"destroy",confirmation:t.confirm});h(`Regional teardown queued: ${i.operation.id}; replicated data remains retained.`)}))}var gn="0.12.9";async function pm(){let r=await P(),e=q(process.cwd(),r),t=new _a(e.store),n=new za(t),i=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((o)=>new Ua(o,e.store,e.project.id,e.organization.id));return{controlPlane:e,store:t,service:n,cleanup:i}}async function tt(r){let e=await pm();try{await r(e)}catch(t){f(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{e.controlPlane.store.close()}}function si(r){r.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(e)=>tt((t)=>{let n={manifests:t.store.manifests(t.controlPlane.organization.id),windows:t.store.windows(t.controlPlane.project.id),campaigns:t.store.campaigns(t.controlPlane.project.id),cleanups:t.store.cleanups(t.controlPlane.project.id),drills:t.store.drills(t.controlPlane.project.id)},i=[...n.manifests.map((o)=>["update",o.version,o.compatibility.compatible?"compatible":"blocked",o.compatibility.reasons.join("; ")||o.channel]),...n.campaigns.map((o)=>["upgrade",o.id,o.status,o.currentStage??o.fromVersion]),...n.cleanups.map((o)=>["cleanup",o.kind,o.status,`${o.candidates.length} items / ${o.estimatedBytes} bytes`]),...n.drills.map((o)=>["DR drill",o.scenario,o.status,o.isolatedTarget])];if(e.json)console.log(JSON.stringify(n,null,2));else x(["Area","Name / version","Status","Detail"],i)})),r.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(e,t)=>tt(async(n)=>{let i=n.store.addTrustedKey({organizationId:n.controlPlane.organization.id,name:e,publicKeyPem:await Bun.file(t).text()});h(`Trusted ${i.name}: ${i.fingerprint}`)})),r.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(e,t,n)=>tt(async(i)=>{let o=await Bun.file(e).json(),s=(await Bun.file(t).text()).trim(),c=i.store.importManifest({organizationId:i.controlPlane.organization.id,keyId:n,document:o,signature:s,current:{schemaVersion:i.controlPlane.store.health().schemaVersion,currentVersion:gn,platform:process.platform,architecture:process.arch}});h(`Verified ${c.version}; ${c.compatibility.compatible?"compatible":"blocked: "+c.compatibility.reasons.join("; ")}`)})),r.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(e,t,n)=>tt((i)=>{let o=i.store.createWindow({projectId:i.controlPlane.project.id,name:e,schedule:t,timezone:n.timezone,durationMinutes:Number(n.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});h(`Created ${o.name} (${o.id}).`)})),r.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(e,t,n)=>tt((i)=>{let o=new et(i.controlPlane.store).list(i.controlPlane.project.id).filter((l)=>l.status==="ready").map((l)=>({serverId:l.id,target:l.name,previousVersion:l.bootstrapVersion??gn}));if(!o.length)o.push({target:"control-plane",previousVersion:gn});let s=i.store.createCampaign({projectId:i.controlPlane.project.id,manifestId:e,fromVersion:gn,strategy:n.strategy==="rolling"?"rolling":"canary",batchSize:Number(n.batch),healthGate:{kind:"platform"},backupId:t,targets:o}),c=i.service.enqueueCampaign(s.id);h(`Staged upgrade queued: ${c.operation.id}`)})),r.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(e,t)=>tt(async(n)=>{let i=await n.service.previewCleanup({projectId:n.controlPlane.project.id,kind:e,criteria:{olderThanDays:Number(t.olderThan)}},n.cleanup);x(["ID","Candidate","Bytes"],i.candidates.map((o)=>[o.id,o.label,String(o.bytes)])),a(`Apply with: cloud cleanup:apply ${i.id} --confirm "DELETE ${i.candidates.length} ${i.kind}"`)})),r.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(e,t)=>tt((n)=>{let i=n.service.enqueueCleanup(e,String(t.confirm??""));h(`Cleanup queued: ${i.operation.id}`)})),r.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(e,t,n)=>tt((i)=>{let o=i.store.createDrill({projectId:i.controlPlane.project.id,scenario:e,isolatedTarget:t,expectedRpoMinutes:Number(n.rpo),expectedRtoMinutes:Number(n.rto),recoveryPointId:n.recoveryPoint,topologyId:n.topology});h(`Planned isolated drill ${o.id}.`)})),r.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(e)=>tt((t)=>{let n=t.service.enqueueDrill(e);h(`DR drill queued: ${n.operation.id}`)}))}async function ai(){try{return(await P()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function ci(r){r.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(e)=>{S("Lambda Functions");let t=e?.region||await ai(),n=new nt(t);try{let{Functions:i=[]}=await n.listFunctions({MaxItems:50});if(!i.length){a("No functions found");return}x(["Name","Runtime","Memory","Timeout","Last Modified"],i.map((o)=>[o.FunctionName??"-",o.Runtime??"-",o.MemorySize?`${o.MemorySize} MB`:"-",o.Timeout?`${o.Timeout}s`:"-",o.LastModified??"-"]))}catch(i){f(`Failed to list functions: ${i.message}`),process.exitCode=1}}),r.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(e,t)=>{S(`Invoking ${e}`);let n=t?.region||await ai(),i=new nt(n),o=new A("Invoking function...");o.start();try{let s=await i.invoke({FunctionName:e,InvocationType:t?.async?"Event":"RequestResponse",Payload:t?.payload||"{}",LogType:t?.async?"None":"Tail"});if(s.FunctionError){if(o.fail(`Function returned an error (${s.FunctionError})`),s.Payload)a(s.Payload);process.exitCode=1;return}if(o.succeed(`Invoked (status ${s.StatusCode})`),s.Payload)a(`
+`)}async function tm(){let r=await P(),e=q(process.cwd(),r),t=new et(e.store),n=new Na(t,[new qn("aws"),new qn("hetzner"),new qn("ssh")]);return{controlPlane:e,store:t,service:n}}async function Ve(r){let e=await tm();try{return await r(e)}finally{e.controlPlane.store.close()}}var yt=(r,e)=>{let t=r.store.list(r.controlPlane.project.id).find((n)=>n.id===e||n.name===e);if(!t)throw Error(`Server ${e} was not found.`);return t},fe=(r)=>{f(r instanceof Error?r.message:String(r)),process.exitCode=1};function ni(r,e){let t=Number.parseInt(r??"",10);return Number.isFinite(t)&&t>=0?t:e}function nm(r="3h"){let e=r.match(/^(\d+)(m|h)$/);if(!e)throw Error("--range must use minutes or hours, for example 30m or 3h.");let t=Number(e[1])*(e[2]==="h"?3600000:60000);if(t<300000||t>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return t}function un(r,e="%"){return r==null?"unavailable":`${r.toFixed(1)}${e}`}async function rm(r,e){let t=await P();if(t.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let n=e.env??process.env.CLOUD_ENV??"production",i=we(t,n),o=await Rt(i);if(!o?.serverId)throw Error(`No pinned Hetzner server was found for ${i}.`);if(![o.serverName,String(o.serverId),o.stackName].includes(r))throw Error(`Refusing to read ${r}: project state is pinned to ${o.serverName}.`);let s=mn(t),c=new Vt({apiToken:Wt(s.apiToken,t)}),l=await c.getServer(o.serverId),d=o.publicIp??l.public_net.ipv4?.ip;if(!d)throw Error(`Server ${l.name} has no public IPv4 address.`);let u=new Date,m=new Date(u.getTime()-nm(e.range)),p=Math.min(3600,Math.max(60,ni(e.step,60))),y=await ya({client:c,serverId:l.id,cores:Math.max(1,Number(l.server_type.cores)||1),from:m,to:u,step:p,remote:{host:d,user:o.sshUser??s.sshUser,identityFile:s.sshPrivateKeyPath,connectTimeoutSec:15}});if(e.json){console.log(JSON.stringify({schemaVersion:1,server:l.name,result:y},null,2));return}x(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[l.name,`${y.from} to ${y.to}`,`${un(y.summary.cpuAveragePercent)} / ${un(y.summary.cpuPeakPercent)}`,`${un(y.summary.memoryAveragePercent)} / ${un(y.summary.memoryPeakPercent)}`,y.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(y.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,un(y.summary.swapPeakPercent)]])}function Oa(r){let e=r.targetType.prices?.find((t)=>t.location===r.location);return{serverId:r.serverId,serverName:r.serverName,location:r.location,from:r.currentType.name,to:r.targetType.name,capacityAvailable:r.capacityAvailable,alreadyComplete:r.alreadyComplete,upgradeDisk:r.upgradeDisk,target:{cores:r.targetType.cores,memoryGb:r.targetType.memory,diskGb:r.targetType.disk,architecture:r.targetType.architecture,cpuType:r.targetType.cpu_type},price:e?{hourlyNet:e.price_hourly.net,hourlyGross:e.price_hourly.gross,monthlyNet:e.price_monthly.net,monthlyGross:e.price_monthly.gross}:void 0}}function im(r){let e=Oa(r);x(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${e.serverName} (${e.serverId})`,e.location,`${e.from} -> ${e.to}`,e.capacityAvailable?"available":"waiting",`${e.target.cores??0} / ${e.target.memoryGb??0} GB / ${e.target.diskGb??0} GB`,e.price?.monthlyGross??e.price?.monthlyNet??"not reported"]])}async function om(r,e,t){let n=await P();if(n.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let i=t.env??process.env.CLOUD_ENV??"production",o=we(n,i),s=await Rt(o),c=mn(n),l=new Vt({apiToken:Wt(c.apiToken,n)}),u=s&&(r===s.serverName||r===String(s.serverId)||r===s.stackName)?await l.getServer(s.serverId):(await l.listServers()).find((E)=>E.name===r||String(E.id)===r);if(!u)throw Error(`Hetzner server ${r} was not found.`);if(s?.serverId&&s.serverId!==u.id)throw Error(`Refusing to resize ${r}: project state is pinned to server ${s.serverId}.`);let m=Sa(e),p=t.upgradeDisk!==!1,y=await ei(l,u.id,m,p);if(t.json)console.log(JSON.stringify({schemaVersion:1,plan:Oa(y)},null,2));else im(y);if(!t.apply){if(!t.json)a(`Preview only. Re-run with --apply --confirm ${u.name} to execute.`);return}if(t.confirm!==u.name)throw Error(`Resize requires --confirm ${u.name}.`);let w=s?.publicIp??u.public_net.ipv4?.ip;if(!w)throw Error(`Server ${u.name} has no public IPv4 address for verification.`);let g={host:w,user:s?.sshUser??c.sshUser,identityFile:c.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},b=await Da(o),I=new Date().toISOString(),v={schemaVersion:1,operationId:b?.targetType===m&&b.serverId===u.id?b.operationId:crypto.randomUUID(),stackName:o,serverId:u.id,serverName:u.name,sourceType:y.currentType.name,targetType:m,upgradeDisk:p,phase:"planning",status:"running",attempts:b?.targetType===m?b.attempts:0,startedAt:b?.targetType===m?b.startedAt:I,updatedAt:I,manifest:b?.targetType===m?b.manifest:void 0};await ht(v);let C=ni(t.pollSeconds,900)*1000,k=ni(t.maxWaitMinutes,0)*60000,T=Date.now();for(;;){let E=await ei(l,u.id,m,p);if(!E.capacityAvailable&&!E.alreadyComplete){if(v={...v,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await ht(v),!t.wait){if(!t.json)a(`${m} has no capacity in ${E.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(k>0&&Date.now()-T>=k)throw Error(`Timed out waiting for ${m} capacity in ${E.location}.`);if(!t.json)a(`Waiting ${Math.round(C/1000)} seconds for ${m} capacity...`);await Bun.sleep(C);continue}let D=await Ta(o);try{let N=await(async()=>{try{return v={...v,status:"running",attempts:v.attempts+1,updatedAt:new Date().toISOString()},await ht(v),await Ca({client:l,serverId:u.id,targetType:m,upgradeDisk:p,resumeFromOff:v.phase==="shutting-down"||v.phase==="resizing"||v.phase==="powering-on"||v.phase==="verifying",manifest:v.manifest,hooks:{preflight:async()=>{let _=await Aa(g);return v={...v,manifest:_,updatedAt:new Date().toISOString()},await ht(v),_},afterBoot:async(_,M,V,G)=>ka(g,M,V,G),onPhase:async(_,M)=>{if(v={...v,phase:_,status:_==="waiting-capacity"?"waiting-capacity":_==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await ht(v),!t.json)a(`${_}${M?` ${JSON.stringify(M)}`:""}`)}}})}finally{await D()}})();if(v={...v,status:N.status==="completed"||N.status==="already-complete"?"completed":N.status==="recovered"?"recovered":"waiting-capacity",lastError:N.status==="recovered"?N.error:void 0,updatedAt:new Date().toISOString()},await ht(v),t.json)console.log(JSON.stringify({schemaVersion:1,result:N},null,2));else if(N.status==="completed"||N.status==="already-complete")h(`${u.name} is on ${m} and passed full post-boot verification.`);else if(N.status==="recovered"&&N.retryable&&t.wait){a(`Capacity race recovered safely. Waiting ${Math.round(C/1000)} seconds before retry.`),await Bun.sleep(C);continue}else if(N.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${N.error}`);return}catch(N){throw v={...v,status:"failed",lastError:N instanceof Error?N.message:String(N),updatedAt:new Date().toISOString()},await ht(v),N}}}async function sm(r,e){let t=await P();if(t.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let n=e.env??process.env.CLOUD_ENV??"production",i=we(t,n),o=await Rt(i);if(!o?.serverId)throw Error(`No pinned Hetzner server was found for ${i}.`);if(![o.serverName,String(o.serverId),o.stackName].includes(r))throw Error(`Refusing to optimize ${r}: project state is pinned to ${o.serverName}.`);let s=mn(t),c=new Vt({apiToken:Wt(s.apiToken,t)}),l=await c.getServer(o.serverId),d=o.publicIp??l.public_net.ipv4?.ip;if(!d)throw Error(`Server ${l.name} has no public IPv4 address.`);let u=Ia(t);if(e.json)console.log(JSON.stringify({schemaVersion:1,server:l.name,plan:u},null,2));else x(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[l.name,u.firewallPorts.join(","),u.monitoring?"on":"off",u.autoUpdates?"on":"off",`${u.swapGb} GB`,"disabled"]]);if(!e.apply){if(!e.json)a(`Preview only. Re-run with --apply --confirm ${l.name} to execute.`);return}if(e.confirm!==l.name)throw Error(`Optimization requires --confirm ${l.name}.`);let m={host:d,user:o.sshUser??s.sshUser,identityFile:s.sshPrivateKeyPath,connectTimeoutSec:15},p=await ti(m),y=p.routeProbes.filter((V)=>!V.ok),w=t.infrastructure?.compute,g=Xr(w)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,b=p.failedUnits.filter((V)=>!g.has(V));if(b.length>0)throw Error(`Preflight found failed services: ${b.join(", ")}`);if(y.length>0)throw Error(`Preflight found unhealthy routes: ${y.map((V)=>V.domain).join(", ")}`);let I=Xr(w)?[]:Object.values(t.sites??{}).flatMap((V)=>typeof V?.port==="number"&&![80,443].includes(V.port)?[V.port]:[]),v=wa({allowSsh:w?.allowSsh!==!1,sitePorts:I,allowedPorts:w?.firewall?.allowedPorts}),C=(o.firewallId?(await c.listFirewalls()).find((V)=>V.id===o.firewallId):void 0)??(await c.listFirewalls()).find((V)=>V.name===`${t.project.slug}-${n}-app-fw`);if(!C)throw Error(`Managed firewall for ${l.name} was not found.`);let k=await c.setFirewallRules(C.id,v);await Promise.all(k.map((V)=>c.waitForAction(V.id))),await Pa(t,m);let[T,E]=await Promise.all([ti(m),xa(m)]),D=Ea(u,E),N=Ra(p,T),_=T.routeProbes.filter((V)=>!V.ok);if(N.stoppedServices.length>0)D.push(`services stopped: ${N.stoppedServices.join(", ")}`);if(N.changedRouteFragments.length>0)D.push(`route fragments changed: ${N.changedRouteFragments.join(", ")}`);if(N.missingRouteIds.length>0)D.push(`routes disappeared: ${N.missingRouteIds.join(", ")}`);if(N.changedReleaseLinks.length>0)D.push(`release links changed: ${N.changedReleaseLinks.join(", ")}`);if(N.missingData.length>0)D.push(`databases or volumes disappeared: ${N.missingData.join(", ")}`);if(_.length>0)D.push(`unhealthy routes: ${_.map((V)=>V.domain).join(", ")}`);if(D.length>0)throw Error(`Host optimization verification failed: ${D.join("; ")}`);let M={serverId:l.id,serverName:l.name,services:T.runningServices.length,routes:T.routeIds.length,healthyDomains:T.routeProbes.length,releaseLinks:T.releaseLinks.length,databasesAndVolumes:T.dataCatalog.length,report:E};if(e.json)console.log(JSON.stringify({schemaVersion:1,result:M},null,2));else h(`${l.name} passed full host, rpx route, service, release, and data verification.`)}async function am(r,e,t){let n=await P(),i=t.env??"production",o=we(n,i);await Ve(async(s)=>{let c=yt(s,r),l=s.store.list(s.controlPlane.project.id,!0),d=c.provider==="hetzner"&&c.providerId?(()=>{try{let C=mn(n);return new Vt({apiToken:Wt(C.apiToken,n)})}catch{return null}})():null,u=c.providerId?Number(c.providerId):Number.NaN,m=await Rt(o),p=m!=null&&m.serverId===u,y=new zn,w=c.trustState==="pinned",g={takenNames:async()=>{let C=l.map((k)=>k.name);if(d)C.push(...(await d.listServers()).map((k)=>k.name));return C},inventoryName:()=>s.store.get(c.id)?.name??c.name,renameInventory:(C)=>{s.store.update(c.id,{name:C})},...d&&Number.isFinite(u)?{providerName:async()=>(await d.getServer(u)).name,renameProvider:async(C)=>{await d.renameServer(u,C)}}:{},...p?{stateName:async()=>(await Rt(o))?.serverName,writeStateName:async(C)=>{let k=await Rt(o);if(k)await $a(o,{...k,serverName:C})}}:{},...w?{remoteHostname:async()=>{let C=await y.exec(c,"hostname");return C.code===0?C.stdout.trim():void 0},setRemoteHostname:async(C)=>{let k=await y.exec(c,ba(C));if(k.code!==0)throw Error(k.stderr.trim()||`hostname exited ${k.code}`)}}:{}},b=await va(c.name,e,g),I=await Fn(b);if(!t.apply){let C=[d?"":"provider record (no provider id or no API token)",p?"":"local state pin (none points at this server)",w?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(t.json){console.log(JSON.stringify({schemaVersion:1,operation:b.operation,target:b.target,rename:{from:c.name,to:e},notCovered:C,steps:I.map((k)=>({id:k.step.id,title:k.step.title,state:k.state,change:k.step.change,reason:k.reason}))},null,2));return}for(let k of Bn(b,I))console.log(k);for(let k of C)console.log(`  not covered: ${k}`);console.log("  Re-run with --apply to perform it.");return}let v=await Mn(b,I,{log:(C)=>a(C),audit:(C)=>s.controlPlane.store.appendEvent({projectId:s.controlPlane.project.id,resourceId:c.resourceId,type:`${C.operation}.${C.step}.${C.state}`,level:C.state==="failed"?"error":"info",payload:{target:C.target,renameTo:e,...C.error?{error:C.error}:{}}})});if(t.json)console.log(JSON.stringify({schemaVersion:1,outcome:v},null,2));if(!v.success){let C=v.steps.find((k)=>k.state==="failed");throw Error(`${b.operation} stopped at '${C?.title}': ${C?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!t.json)h(`Renamed ${c.name} to ${e}.`)})}function ri(r){r.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(e,t)=>{try{await Ve(async(n)=>{let i=e?[yt(n,e)]:n.store.list(n.controlPlane.project.id),o=i.flatMap((s)=>Object.entries(s.capabilities).map(([c,l])=>({server:s.name,provider:s.provider,action:c,...l})));if(t.json)console.log(JSON.stringify({schemaVersion:1,targets:o},null,2));else x(["Server","Provider","Action","Support","Explanation"],o.map((s)=>[s.server,s.provider,s.action,s.supported?"supported":"unsupported",s.reason??"—"]))})}catch(n){fe(n)}}),r.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(e,t,n)=>{try{await om(e,t,n)}catch(i){fe(i)}}),r.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(e,t)=>{try{await sm(e,t)}catch(n){fe(n)}}),r.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(e,t)=>{try{await rm(e,t)}catch(n){fe(n)}}),r.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(e)=>{try{await Ve(async(t)=>{let n=t.store.list(t.controlPlane.project.id);if(e.json)console.log(JSON.stringify(n,null,2));else x(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],n.map((i)=>[i.name,i.providerId??"—",`${i.provider} / ${i.region??"external"}`,`${i.status} / ${i.trustState}`,i.roles.join(","),`${i.capacity.cpu??0} / ${i.capacity.memoryBytes??0}`,i.heartbeatAt??"never"]))})}catch(t){fe(t)}}),r.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(e,t)=>{try{await Ve(async(n)=>{let i=t.provider;if(!["aws","hetzner","ssh"].includes(i)||!t.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let o=n.service.enroll({organizationId:n.controlPlane.organization.id,projectId:n.controlPlane.project.id,name:e,provider:i,providerId:t.providerId,endpoint:t.endpoint,sshUser:t.user??"deploy",credentialRef:t.credentialRef??"secret://fleet/agent",region:t.region,roles:String(t.roles??"application").split(","),labels:Object.fromEntries(String(t.labels??"").split(",").map((s)=>s.split("=")).filter((s)=>s[0]&&s[1]))});h(`Enrolled ${o.name} as ${o.id}; no remote mutation was performed.`)})}catch(n){fe(n)}}),r.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(e,t)=>{try{await Ve(async(n)=>{let i=yt(n,e);if(i=await n.service.test(i.id),i.trustState==="rotation_pending"){if(!t.acceptHostKey)throw Error(`Host key changed to ${i.pendingHostKey}; review it first.`);i=n.service.reviewHostKey(i.id,t.acceptHostKey)}let o=await n.service.validate(i.id);if(t.json)console.log(JSON.stringify(o.validation,null,2));else x(["Severity","Code","Finding","Remediation"],(o.validation?.findings??[]).map((s)=>[s.severity,s.code,s.message,s.remediation??"—"]));if(!o.validation?.valid)process.exitCode=1})}catch(n){fe(n)}}),r.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(e,t)=>{try{await Ve(async(n)=>{let i=n.service.bootstrap(yt(n,e).id,!!t.apply);if(i.preview)x(["Step"],i.steps.map((o)=>[o]));else h(`Bootstrap queued: ${i.operation?.id}`)})}catch(n){fe(n)}}),r.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(e,t,n)=>{try{await am(e,t,n)}catch(i){fe(i)}}),r.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(e,t)=>{try{await Ve(async(n)=>h(n.service.drain(yt(n,e).id,!!t.complete).status))}catch(n){fe(n)}}),r.command("server:uncordon <name>","Return a server to scheduling").action(async(e)=>{try{await Ve(async(t)=>{t.service.uncordon(yt(t,e).id),h(`Uncordoned ${e}.`)})}catch(t){fe(t)}}),r.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(e,t)=>{try{await Ve(async(n)=>{n.service.archive(yt(n,e).id,t.confirm??""),h(`Archived ${e}; provider infrastructure was not terminated.`)})}catch(n){fe(n)}}),r.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(e)=>{try{await Ve(async(t)=>{let n=yt(t,e);if(n.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let i=Bun.spawn(["ssh","-p",String(n.sshPort),"-o","StrictHostKeyChecking=yes",`${n.sshUser}@${n.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),o=await i.exited;if(o)process.exitCode=o})}catch(t){fe(t)}});for(let[e,t]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])r.command(e,t).action(async(...n)=>be(e.split(" ")[0],{target:String(n[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}async function cm(){let r=await P(),e=q(process.cwd(),r),t=new ja(e.store),n=new Fa(t,new et(e.store));return{controlPlane:e,store:t,service:n}}async function pn(r){let e=await cm();try{await r(e)}catch(t){f(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{e.controlPlane.store.close()}}var Hn=(r)=>Object.fromEntries(String(r??"").split(",").map((e)=>e.split("=")).filter((e)=>e[0]&&e[1])),La=(r)=>Object.fromEntries(Object.entries(Hn(r)).map(([e,t])=>[e,Number(t)]));function ii(r){r.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(e)=>pn((t)=>{let n=t.store.listPools(t.controlPlane.project.id);if(e.json)console.log(JSON.stringify(n,null,2));else x(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],n.map((i)=>[i.name,i.purpose,i.backend,`${i.region??"any"} / ${i.architecture??"any"}`,i.status,JSON.stringify(i.capacity),String(i.concurrency)]))})),r.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(e,t)=>pn((n)=>{let{purpose:i,backend:o}=t;if(!["application","build","worker","monitoring","backup"].includes(i)||!["server","ecs","asg"].includes(o))throw Error("Unsupported pool purpose or backend.");let s=n.store.createPool({organizationId:n.controlPlane.organization.id,projectId:n.controlPlane.project.id,name:e,purpose:i,backend:o,region:t.region,architecture:t.arch,labels:Hn(t.labels),requiredServerLabels:Hn(t.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...La(t.capacity)},maxWorkloads:Number(t.max),costWeight:1,concurrency:Number(t.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});h(`Created ${s.name} (${s.id}).`)})),r.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(e,t)=>pn((n)=>{let i=n.store.listPools(n.controlPlane.project.id).find((s)=>s.id===e||s.name===e),o=new et(n.controlPlane.store).list(n.controlPlane.project.id).find((s)=>s.id===t||s.name===t);if(!i||!o)throw Error("Pool or server was not found.");n.store.addMember(i.id,o.id),h(`Attached ${o.name} to ${i.name}.`)})),r.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(e)=>pn((t)=>{let n=t.service.explain(t.controlPlane.project.id,{purpose:e.purpose,resources:La(e.resources),region:e.region,architecture:e.arch,labels:Hn(e.labels)});if(e.json)console.log(JSON.stringify(n,null,2));else x(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],n.map((i)=>[i.poolName,i.serverId??"provider-managed",i.eligible?"yes":"no",JSON.stringify(i.available),`${i.score.fit.toFixed(2)} / ${i.score.spread} / ${i.score.cost}`,i.reasons.join("; ")||"eligible"]))})),r.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(e)=>pn((t)=>{let n=t.store.listPools(t.controlPlane.project.id).find((o)=>o.id===e||o.name===e);if(!n)throw Error("Pool was not found.");let i=t.service.drainPool(n.id);h(`Draining ${n.name}: moved ${i.moved.length}, blocked ${i.blocked.length} stateful placement(s).`)}))}async function lm(){let r=await P(),e=q(process.cwd(),r),t=new Ba(e.store),n=new Ma(t);return{controlPlane:e,store:t,service:n}}async function It(r){let e=await lm();try{await r(e)}catch(t){f(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{e.controlPlane.store.close()}}var fn=(r,e)=>{let t=r.store.list(r.controlPlane.project.id).find((n)=>n.id===e||n.name===e);if(!t)throw Error("Regional topology was not found.");return t},dm=(r)=>r.split(",").map((e,t)=>{let[n,i="aws"]=e.split(":");return{region:String(n),provider:i,role:t===0?"primary":"secondary"}}),um=(r)=>{let e=new Set(["s3","dynamodb","secrets"]),t=r.split(",").map((i)=>i.trim()),n=t.find((i)=>!e.has(i));if(n)throw Error(`Unsupported replication kind: ${n}`);return t};function oi(r){r.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(e)=>It((t)=>{let n=t.store.list(t.controlPlane.project.id).map((i)=>({topology:i,targets:t.store.targets(i.id),channels:t.store.channels(i.id),route:t.store.route(i.id),executions:t.store.executions(i.id)}));if(e.json)console.log(JSON.stringify(n,null,2));else x(["Name","Hostname","Active","Status","Revision","Replication"],n.map((i)=>[i.topology.name,i.topology.hostname,i.topology.activeRegion,i.topology.status,i.topology.revision??"—",`${i.channels.filter((o)=>o.status==="in_sync").length}/${i.channels.length} in sync`]))})),r.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(e,t)=>It((n)=>{if(!t.hostname||!t.regions)throw Error("--hostname and --regions are required.");let i=n.service.create({organizationId:n.controlPlane.organization.id,projectId:n.controlPlane.project.id,name:e,hostname:t.hostname,regions:dm(t.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:um(String(t.replicate)),maxLagSeconds:Number(t.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!t.cdn,wafEnabled:!!t.waf});h(`Created ${i.name} (${i.id}); run region:rollout with an immutable manifest.`)})),r.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(e,t,n)=>It((i)=>x(["Step"],i.service.plan(fn(i,e).id,t,n.target).map((o)=>[o])))),r.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(e,t,n)=>It(async(i)=>{let o=n.manifest?await Bun.file(n.manifest).json():{},s=i.service.enqueue({topologyId:fn(i,e).id,kind:"rollout",revision:t,manifest:o});h(`Regional rollout queued: ${s.operation.id}`)})),r.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(e,t)=>It((n)=>{let i=n.service.enqueue({topologyId:fn(n,e).id,kind:"failover",targetRegion:t});h(`Failover queued: ${i.operation.id}`)})),r.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(e,t)=>It((n)=>{let i=n.service.enqueue({topologyId:fn(n,e).id,kind:"failback",targetRegion:t});h(`Failback queued: ${i.operation.id}`)})),r.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(e,t)=>It((n)=>{let i=n.service.enqueue({topologyId:fn(n,e).id,kind:"destroy",confirmation:t.confirm});h(`Regional teardown queued: ${i.operation.id}; replicated data remains retained.`)}))}var gn="0.12.10";async function pm(){let r=await P(),e=q(process.cwd(),r),t=new _a(e.store),n=new za(t),i=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((o)=>new Ua(o,e.store,e.project.id,e.organization.id));return{controlPlane:e,store:t,service:n,cleanup:i}}async function tt(r){let e=await pm();try{await r(e)}catch(t){f(t instanceof Error?t.message:String(t)),process.exitCode=1}finally{e.controlPlane.store.close()}}function si(r){r.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(e)=>tt((t)=>{let n={manifests:t.store.manifests(t.controlPlane.organization.id),windows:t.store.windows(t.controlPlane.project.id),campaigns:t.store.campaigns(t.controlPlane.project.id),cleanups:t.store.cleanups(t.controlPlane.project.id),drills:t.store.drills(t.controlPlane.project.id)},i=[...n.manifests.map((o)=>["update",o.version,o.compatibility.compatible?"compatible":"blocked",o.compatibility.reasons.join("; ")||o.channel]),...n.campaigns.map((o)=>["upgrade",o.id,o.status,o.currentStage??o.fromVersion]),...n.cleanups.map((o)=>["cleanup",o.kind,o.status,`${o.candidates.length} items / ${o.estimatedBytes} bytes`]),...n.drills.map((o)=>["DR drill",o.scenario,o.status,o.isolatedTarget])];if(e.json)console.log(JSON.stringify(n,null,2));else x(["Area","Name / version","Status","Detail"],i)})),r.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(e,t)=>tt(async(n)=>{let i=n.store.addTrustedKey({organizationId:n.controlPlane.organization.id,name:e,publicKeyPem:await Bun.file(t).text()});h(`Trusted ${i.name}: ${i.fingerprint}`)})),r.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(e,t,n)=>tt(async(i)=>{let o=await Bun.file(e).json(),s=(await Bun.file(t).text()).trim(),c=i.store.importManifest({organizationId:i.controlPlane.organization.id,keyId:n,document:o,signature:s,current:{schemaVersion:i.controlPlane.store.health().schemaVersion,currentVersion:gn,platform:process.platform,architecture:process.arch}});h(`Verified ${c.version}; ${c.compatibility.compatible?"compatible":"blocked: "+c.compatibility.reasons.join("; ")}`)})),r.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(e,t,n)=>tt((i)=>{let o=i.store.createWindow({projectId:i.controlPlane.project.id,name:e,schedule:t,timezone:n.timezone,durationMinutes:Number(n.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});h(`Created ${o.name} (${o.id}).`)})),r.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(e,t,n)=>tt((i)=>{let o=new et(i.controlPlane.store).list(i.controlPlane.project.id).filter((l)=>l.status==="ready").map((l)=>({serverId:l.id,target:l.name,previousVersion:l.bootstrapVersion??gn}));if(!o.length)o.push({target:"control-plane",previousVersion:gn});let s=i.store.createCampaign({projectId:i.controlPlane.project.id,manifestId:e,fromVersion:gn,strategy:n.strategy==="rolling"?"rolling":"canary",batchSize:Number(n.batch),healthGate:{kind:"platform"},backupId:t,targets:o}),c=i.service.enqueueCampaign(s.id);h(`Staged upgrade queued: ${c.operation.id}`)})),r.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(e,t)=>tt(async(n)=>{let i=await n.service.previewCleanup({projectId:n.controlPlane.project.id,kind:e,criteria:{olderThanDays:Number(t.olderThan)}},n.cleanup);x(["ID","Candidate","Bytes"],i.candidates.map((o)=>[o.id,o.label,String(o.bytes)])),a(`Apply with: cloud cleanup:apply ${i.id} --confirm "DELETE ${i.candidates.length} ${i.kind}"`)})),r.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(e,t)=>tt((n)=>{let i=n.service.enqueueCleanup(e,String(t.confirm??""));h(`Cleanup queued: ${i.operation.id}`)})),r.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(e,t,n)=>tt((i)=>{let o=i.store.createDrill({projectId:i.controlPlane.project.id,scenario:e,isolatedTarget:t,expectedRpoMinutes:Number(n.rpo),expectedRtoMinutes:Number(n.rto),recoveryPointId:n.recoveryPoint,topologyId:n.topology});h(`Planned isolated drill ${o.id}.`)})),r.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(e)=>tt((t)=>{let n=t.service.enqueueDrill(e);h(`DR drill queued: ${n.operation.id}`)}))}async function ai(){try{return(await P()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function ci(r){r.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(e)=>{S("Lambda Functions");let t=e?.region||await ai(),n=new nt(t);try{let{Functions:i=[]}=await n.listFunctions({MaxItems:50});if(!i.length){a("No functions found");return}x(["Name","Runtime","Memory","Timeout","Last Modified"],i.map((o)=>[o.FunctionName??"-",o.Runtime??"-",o.MemorySize?`${o.MemorySize} MB`:"-",o.Timeout?`${o.Timeout}s`:"-",o.LastModified??"-"]))}catch(i){f(`Failed to list functions: ${i.message}`),process.exitCode=1}}),r.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(e,t)=>{S(`Invoking ${e}`);let n=t?.region||await ai(),i=new nt(n),o=new A("Invoking function...");o.start();try{let s=await i.invoke({FunctionName:e,InvocationType:t?.async?"Event":"RequestResponse",Payload:t?.payload||"{}",LogType:t?.async?"None":"Tail"});if(s.FunctionError){if(o.fail(`Function returned an error (${s.FunctionError})`),s.Payload)a(s.Payload);process.exitCode=1;return}if(o.succeed(`Invoked (status ${s.StatusCode})`),s.Payload)a(`
 Response:`),a(s.Payload);if(s.LogResult)a(`
 Logs:`),a(Buffer.from(s.LogResult,"base64").toString("utf-8"))}catch(s){o.fail(`Invocation failed: ${s.message}`),process.exitCode=1}}),r.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(e,t)=>{S(`Logs for ${e}`);let n=t?.region||await ai(),i=new rt(n),o=e.startsWith("/aws/lambda/")?e:`/aws/lambda/${e}`,s=Number(t?.since??15),c=(l)=>{for(let d of l){let u=d.timestamp?new Date(d.timestamp).toISOString():"";a(`${u}  ${(d.message??"").trimEnd()}`)}};try{let l=Date.now()-s*60000,{events:d=[]}=await i.filterLogEvents({logGroupName:o,startTime:l,filterPattern:t?.filter,limit:200});if(c(d),d.length)l=(d[d.length-1].timestamp??l)+1;if(t?.tail){a(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((m)=>setTimeout(m,3000));let{events:u=[]}=await i.filterLogEvents({logGroupName:o,startTime:l,filterPattern:t?.filter,limit:200});if(u.length)c(u),l=(u[u.length-1].timestamp??l)+1}}}catch(l){f(`Failed to read logs: ${l.message}`),process.exitCode=1}})}async function Va(r){let e=Bun.spawn(["docker",...r],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[t,n]=await Promise.all([e.exited,new Response(e.stderr).text()]);return{ok:t===0,exitCode:t,command:["docker",...r].join(" "),stderr:n.trim()}}function li(r){r.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(e)=>{let t=["build","--file",e.file??"Dockerfile","--tag",e.tag??"latest","."];if(e.dryRun){console.log(`docker ${t.join(" ")}`);return}let n=await Va(t);if(e.json)console.log(JSON.stringify(n));if(!n.ok)f(n.stderr||`docker exited ${n.exitCode}`),process.exitCode=n.exitCode;else h(`Built ${e.tag??"latest"}.`)}),r.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(e)=>{if(!e.image){f("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(e.dryRun){console.log(`docker push ${e.image}`);return}let t=await Va(["push",e.image]);if(e.json)console.log(JSON.stringify(t));if(!t.ok)f(t.stderr),process.exitCode=t.exitCode;else h(`Pushed ${e.image}.`)}),r.command("container:deploy","Deploy a container image").action(async()=>be("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function yi(r){r.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(e)=>{S("Domains");try{let t=_e(e?.provider),n=ce(e?.provider)?.provider||"unknown",i=new A(`Fetching domains from ${n}...`);i.start();let o=await t.listDomains();if(i.succeed(`Found ${o.length} domain(s)`),o.length===0){a("No domains found in this provider");return}let s=o.map((c)=>[c,"Active","-",n.charAt(0).toUpperCase()+n.slice(1)]);x(["Domain","Status","SSL","Provider"],s)}catch(t){f(`Failed to list domains: ${t instanceof Error?t.message:String(t)}`)}}),r.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(e,t)=>{S(`Adding Domain: ${e}`);try{let n=_e(t?.provider),i=ce(t?.provider)?.provider||"unknown",o=new A(`Checking if ${i} can manage ${e}...`);if(o.start(),await n.canManageDomain(e))o.succeed(`Domain ${e} is already available in ${i}`),a(`