@stacksjs/ts-cloud 0.14.0 → 0.15.1

package/dist/bin/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import{T,Mt,n,r,a,Er,e,m,i,o,I,d,fo,c,tn,ye,As,Is,Rs,Ps,g}from"./chunk-n56c0j1e.js";import{_s,V,wr,C,U,yo,l,s,E,Ls,Ms,Us,Pe,Le,B,S,_,Ze,D,pe,bo,Me,Bt,mi,ve,vo,gi,Ft,Et,Fs,js}from"./chunk-gxwsq3k0.js";import{ke,k,ln,y,dn,Ei,un,ko,Ir,tt,Ie,pn,mn,gn,fn,hn,yn,Sn,bn,te,Ht,Wt,vn,Rr,Tn,En,wn,Cn,An,In,Rn,Pn,rt,Gt,Kt,Ct,Pr,Jt,Xt,wi,At,Nn,se,Dn,kn,xn,Nr,Dr,_n,kr,Qt,Yt,nt,It,Rt,xr,ae,$n,na,ia,Zt,oa,z,Ci,Ue,it,ot,On,_r,$r,Ln,Mn,Un,Or,xo,ce,me,xe,ge,Bn,er}from"./chunk-22c3pk8s.js";import{u,Ns}from"./chunk-pdw0qjq1.js";import{ie,h,Tr}from"./chunk-8bbw6qc2.js";import{hr,St,yr,Sr,br,vr,Yr}from"./chunk-m5sjzxm3.js";import{b,Pt,jn,Oo,tr,sa,aa,ca,Vn,zn,st,Lr,Nt,Mr,at,Be,$e,Fe,ct,rr,Oe,je,qn,Hn,Ve,Ur,Br,Ri,Ni,or,Dt,lt,kt,J,_i,Kn,Jn,Go}from"./chunk-dk38j1qr.js";import{ze,xt,qe,Oi,Li,Mi,Ui,Bi,Fi,q,_t,L,Xn}from"./chunk-k8wscjd9.js";import{W,P,so,fs,hs,Ma,Ua,oi,ht,si}from"./chunk-x4gsw45d.js";import{v}from"./chunk-pd8v6bpd.js";import{K}from"./chunk-9jmnmhpy.js";import{yt,f}from"./chunk-k3er0h4j.js";import{We,rs,de,qi,Yn,Hi,Wi,Vr,Gi,Ki,fe,Q,Ge,Re,zr,sr,Ke,ar,qr,pt,ue,mt,lr,dr,ur,Hr,pr,x,Xi,Qi,Zn,ns,Wr,is,os,xa,Yi,ss,as,cs,ls,gt,ds,Zi,eo}from"./chunk-hwp5xp1c.js";import"./chunk-fbycbnvj.js";import{R}from"./chunk-y1r1evt0.js";import{le}from"./chunk-t7seq21w.js";import{H,ut,Vi}from"./chunk-rzt92fwv.js";import{ne,X,Da,ka,He}from"./chunk-xs62dg7t.js";import{zt,an,qt,vi,cn,Do}from"./chunk-9qndhwbe.js";import"./chunk-e1cxh9rj.js";import{w}from"./chunk-pthfzst7.js";import{dt}from"./chunk-kxa4t4wh.js";import{Y,he}from"./chunk-b48j6k55.js";import{F}from"./chunk-mcqkjhgp.js";import"./chunk-94cfdvrn.js";import{Ti}from"./chunk-fr69rgea.js";import"./chunk-vwzgtsn9.js";import{ri}from"./chunk-edaq5jef.js";import{mr}from"./chunk-f35pte64.js";import{O}from"./chunk-p197a99s.js";import{bt}from"./chunk-7jwxgxxf.js";import{existsSync as Fd}from"node:fs";import Zs from"node:fs/promises";import tl from"node:os";import Qs from"node:path";import oo from"node:process";import{EventEmitter as Bd}from"node:events";import Di from"node:process";import nl from"node:process";import ta from"node:process";import ps from"node:process";import jo from"node:process";import sl from"node:tty";import Ru,{stdin as Ig,stdout as Pg}from"node:process";class al{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let N=tl.homedir(),t=Qs.join(N,".config","clapp");this.configPath=Qs.join(t,"telemetry.json")}async isEnabled(){if(oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true")return!1;if(oo.env.NO_TELEMETRY==="1"||oo.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let N=await this.loadConfig();if(N.enabled=!0,!N.userId)N.userId=this.generateUserId();await this.saveConfig(N)}async disable(){let N=await this.loadConfig();N.enabled=!1,await this.saveConfig(N)}async track(N,t){if(!await this.isEnabled())return;let A={event:N,...t,timestamp:Date.now(),platform:tl.platform(),nodeVersion:oo.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(N,t){await this.track("command",{command:N,duration:t})}async trackError(N,t){await this.track("error",{error:N,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(N){return new Promise((t)=>setTimeout(t,N))}async status(){let N=await this.loadConfig();return{enabled:N.enabled,doNotTrack:oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:N.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Fd(this.configPath)){let N=await Zs.readFile(this.configPath,"utf-8");return this.config=JSON.parse(N),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(N){this.config=N;try{let t=Qs.dirname(this.configPath);await Zs.mkdir(t,{recursive:!0}),await Zs.writeFile(this.configPath,JSON.stringify(N,null,2),"utf-8")}catch{}}generateUserId(){let N=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${N}-${t}`}}var fg=new al;function ea(N){return N.replace(/[<[].+/,"").trim()}function Md(N){let t=/<([^>]+)>/g,p=/\[([^\]]+)\]/g,A=[],j=(Z)=>{let ee=!1,re=Z[1];if(re.startsWith("..."))re=re.slice(3),ee=!0;return{required:Z[0].startsWith("<"),value:re,variadic:ee}},M;while(M=t.exec(N))A.push(j(M));let G;while(G=p.exec(N))A.push(j(G));return A}function _d(N){let t={alias:{},boolean:[]};for(let[p,A]of N.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!N.some((M,G)=>G!==p&&M.names.some((Z)=>A.names.includes(Z))&&typeof M.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function rl(N){return N.reduce((t,p)=>t.length>=p.length?t:p,"")}function Xs(N,t){return N.length>=t?N:`${N}${" ".repeat(t-N.length)}`}function ms(N){return N.replace(/([a-z])-([a-z])/g,(t,p,A)=>p+A.toUpperCase())}function zd(N,t,p){let A=0,j=t.length,M=N,G;for(;A<j;++A)G=M[t[A]],M=M[t[A]]=A===j-1?p:G!=null?G:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function Ud(N,t){for(let p of Object.keys(t)){let A=t[p];if(A.shouldTransform){if(N[p]=Array.prototype.concat.call([],N[p]),typeof A.transformFunction==="function")N[p]=N[p].map(A.transformFunction)}}}function Vd(N){let t=/([^\\/]+)$/.exec(N);return t?t[1]:""}function Fo(N){return N.split(".").map((t,p)=>p===0?ms(t):t).join(".")}class Bo extends Error{exitCode=2;isUsageError=!0;usage;constructor(N,t){super(N);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(N).stack}format(N=!1){if(N&&this.stack)return`${this.message}
+import{T,Mt,n,r,a,Er,e,m,i,o,I,d,fo,c,tn,ye,As,Is,Rs,Ps,g}from"./chunk-n56c0j1e.js";import{_s,V,wr,C,U,yo,l,s,E,Ls,Ms,Us,Pe,Le,B,S,_,Ze,D,pe,bo,Me,Bt,mi,ve,vo,gi,Ft,Et,Fs,js}from"./chunk-gxwsq3k0.js";import{ke,k,ln,y,dn,Ei,un,ko,Ir,tt,Ie,pn,mn,gn,fn,hn,yn,Sn,bn,te,Ht,Wt,vn,Rr,Tn,En,wn,Cn,An,In,Rn,Pn,rt,Gt,Kt,Ct,Pr,Jt,Xt,wi,At,Nn,se,Dn,kn,xn,Nr,Dr,_n,kr,Qt,Yt,nt,It,Rt,xr,ae,$n,na,ia,Zt,oa,z,Ci,Ue,it,ot,On,_r,$r,Ln,Mn,Un,Or,xo,ce,me,xe,ge,Bn,er}from"./chunk-22c3pk8s.js";import{u,Ns}from"./chunk-pdw0qjq1.js";import{ie,h,Tr}from"./chunk-8bbw6qc2.js";import{hr,St,yr,Sr,br,vr,Yr}from"./chunk-m5sjzxm3.js";import{b,Pt,jn,Oo,tr,sa,aa,ca,Vn,zn,st,Lr,Nt,Mr,at,Be,$e,Fe,ct,rr,Oe,je,qn,Hn,Ve,Ur,Br,Ri,Ni,or,Dt,lt,kt,J,_i,Kn,Jn,Go}from"./chunk-dk38j1qr.js";import{ze,xt,qe,Oi,Li,Mi,Ui,Bi,Fi,q,_t,L,Xn}from"./chunk-p9em7chg.js";import{W,P,so,fs,hs,Ma,Ua,oi,ht,si}from"./chunk-x4gsw45d.js";import{v}from"./chunk-pd8v6bpd.js";import{K}from"./chunk-9jmnmhpy.js";import{yt,f}from"./chunk-k3er0h4j.js";import{We,rs,de,qi,Yn,Hi,Wi,Vr,Gi,Ki,fe,Q,Ge,Re,zr,sr,Ke,ar,qr,pt,ue,mt,lr,dr,ur,Hr,pr,x,Xi,Qi,Zn,ns,Wr,is,os,xa,Yi,ss,as,cs,ls,gt,ds,Zi,eo}from"./chunk-hwp5xp1c.js";import"./chunk-fbycbnvj.js";import{R}from"./chunk-y1r1evt0.js";import{le}from"./chunk-t7seq21w.js";import{H,ut,Vi}from"./chunk-rzt92fwv.js";import{ne,X,Da,ka,He}from"./chunk-xs62dg7t.js";import{zt,an,qt,vi,cn,Do}from"./chunk-9qndhwbe.js";import"./chunk-e1cxh9rj.js";import{w}from"./chunk-pthfzst7.js";import{dt}from"./chunk-kxa4t4wh.js";import{Y,he}from"./chunk-b48j6k55.js";import{F}from"./chunk-mcqkjhgp.js";import"./chunk-94cfdvrn.js";import{Ti}from"./chunk-ryhfvrsd.js";import"./chunk-vwzgtsn9.js";import{ri}from"./chunk-edaq5jef.js";import{mr}from"./chunk-f35pte64.js";import{O}from"./chunk-p197a99s.js";import{bt}from"./chunk-7jwxgxxf.js";import{existsSync as Fd}from"node:fs";import Zs from"node:fs/promises";import tl from"node:os";import Qs from"node:path";import oo from"node:process";import{EventEmitter as Bd}from"node:events";import Di from"node:process";import nl from"node:process";import ta from"node:process";import ps from"node:process";import jo from"node:process";import sl from"node:tty";import Ru,{stdin as Ig,stdout as Pg}from"node:process";class al{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let N=tl.homedir(),t=Qs.join(N,".config","clapp");this.configPath=Qs.join(t,"telemetry.json")}async isEnabled(){if(oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true")return!1;if(oo.env.NO_TELEMETRY==="1"||oo.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let N=await this.loadConfig();if(N.enabled=!0,!N.userId)N.userId=this.generateUserId();await this.saveConfig(N)}async disable(){let N=await this.loadConfig();N.enabled=!1,await this.saveConfig(N)}async track(N,t){if(!await this.isEnabled())return;let A={event:N,...t,timestamp:Date.now(),platform:tl.platform(),nodeVersion:oo.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(N,t){await this.track("command",{command:N,duration:t})}async trackError(N,t){await this.track("error",{error:N,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(N){return new Promise((t)=>setTimeout(t,N))}async status(){let N=await this.loadConfig();return{enabled:N.enabled,doNotTrack:oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:N.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Fd(this.configPath)){let N=await Zs.readFile(this.configPath,"utf-8");return this.config=JSON.parse(N),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(N){this.config=N;try{let t=Qs.dirname(this.configPath);await Zs.mkdir(t,{recursive:!0}),await Zs.writeFile(this.configPath,JSON.stringify(N,null,2),"utf-8")}catch{}}generateUserId(){let N=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${N}-${t}`}}var fg=new al;function ea(N){return N.replace(/[<[].+/,"").trim()}function Md(N){let t=/<([^>]+)>/g,p=/\[([^\]]+)\]/g,A=[],j=(Z)=>{let ee=!1,re=Z[1];if(re.startsWith("..."))re=re.slice(3),ee=!0;return{required:Z[0].startsWith("<"),value:re,variadic:ee}},M;while(M=t.exec(N))A.push(j(M));let G;while(G=p.exec(N))A.push(j(G));return A}function _d(N){let t={alias:{},boolean:[]};for(let[p,A]of N.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!N.some((M,G)=>G!==p&&M.names.some((Z)=>A.names.includes(Z))&&typeof M.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function rl(N){return N.reduce((t,p)=>t.length>=p.length?t:p,"")}function Xs(N,t){return N.length>=t?N:`${N}${" ".repeat(t-N.length)}`}function ms(N){return N.replace(/([a-z])-([a-z])/g,(t,p,A)=>p+A.toUpperCase())}function zd(N,t,p){let A=0,j=t.length,M=N,G;for(;A<j;++A)G=M[t[A]],M=M[t[A]]=A===j-1?p:G!=null?G:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function Ud(N,t){for(let p of Object.keys(t)){let A=t[p];if(A.shouldTransform){if(N[p]=Array.prototype.concat.call([],N[p]),typeof A.transformFunction==="function")N[p]=N[p].map(A.transformFunction)}}}function Vd(N){let t=/([^\\/]+)$/.exec(N);return t?t[1]:""}function Fo(N){return N.split(".").map((t,p)=>p===0?ms(t):t).join(".")}class Bo extends Error{exitCode=2;isUsageError=!0;usage;constructor(N,t){super(N);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(N).stack}format(N=!1){if(N&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function Wd(N){if(N instanceof Bo)return!0;return!!N&&typeof N==="object"&&N.name==="ClappError"&&typeof N.message==="string"}function qd(){let{env:N}=nl,{TERM:t,TERM_PROGRAM:p}=N;if(nl.platform!=="win32")return t!=="linux";return Boolean(N.WT_SESSION)||Boolean(N.TERMINUS_SUBLIME)||N.ConEmuTask==="{cmd::Cmder}"||p==="Terminus-Sublime"||p==="vscode"||t==="xterm-256color"||t==="alacritty"||t==="rxvt-unicode"||t==="rxvt-unicode-256color"||N.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var gs="\x1B",Wn=`${gs}[`;var il={to(N,t){if(!t)return`${Wn}${N+1}G`;return`${Wn}${t+1};${N+1}H`},move(N,t){let p="";if(N<0)p+=`${Wn}${-N}D`;else if(N>0)p+=`${Wn}${N}C`;if(t<0)p+=`${Wn}${-t}A`;else if(t>0)p+=`${Wn}${t}B`;return p},up:(N=1)=>`${Wn}${N}A`,down:(N=1)=>`${Wn}${N}B`,forward:(N=1)=>`${Wn}${N}C`,backward:(N=1)=>`${Wn}${N}D`,nextLine:(N=1)=>`${Wn}E`.repeat(N),prevLine:(N=1)=>`${Wn}F`.repeat(N),left:`${Wn}G`,hide:`${Wn}?25l`,show:`${Wn}?25h`,save:`${gs}7`,restore:`${gs}8`};var vg={screen:`${Wn}2J`,up:(N=1)=>`${Wn}1J`.repeat(N),down:(N=1)=>`${Wn}J`.repeat(N),line:`${Wn}2K`,lineEnd:`${Wn}K`,lineStart:`${Wn}1K`,lines(N){let t="";for(let p=0;p<N;p++)t+=this.line+(p<N-1?il.up():"");if(N)t+=il.left;return t}},bg={screen:`${gs}c`};function Hd(N,t){let p=[];for(let A=0;A<=t.length;A++)p[A]=[A];for(let A=0;A<=N.length;A++)p[0][A]=A;for(let A=1;A<=t.length;A++)for(let j=1;j<=N.length;j++)if(t.charAt(A-1)===N.charAt(j-1))p[A][j]=p[A-1][j-1];else p[A][j]=Math.min(p[A-1][j-1]+1,p[A][j-1]+1,p[A-1][j]+1);return p[t.length][N.length]}function cl(N,t,p=2,A=3){return t.map((j)=>({cmd:j,distance:Hd(N,j)})).filter(({distance:j})=>j<=p).sort((j,M)=>j.distance-M.distance).slice(0,A).map(({cmd:j})=>j)}function Gd(N,t={}){let p={_:[]},A=t.alias||{},j=new Set(t.boolean||[]),M={};for(let ee of Object.keys(A))for(let re of A[ee])M[re]=ee;for(let ee of j)if(A[ee])for(let re of A[ee])j.add(re);function G(ee,re){if(ee===void 0)return re;if(typeof re==="boolean")return re;return Array.isArray(ee)?[...ee,re]:[ee,re]}function Z(ee,re){let oe=M[ee]||ee,be=G(p[oe],re);if(p[oe]=be,A[oe])for(let we of A[oe])p[we]=be;if(M[ee]&&A[M[ee]])for(let we of A[M[ee]])p[we]=be;p[ee]=be}for(let ee=0;ee<N.length;ee++){let re=N[ee];if(re==="--"){p._.push(...N.slice(ee+1));break}if(re.startsWith("--")){let oe=re.indexOf("=");if(oe!==-1){let be=ms(re.slice(2,oe)),we=re.slice(oe+1);Z(be,we)}else{let be=re.slice(2);if(be.startsWith("no-")){let Ee=ms(be.slice(3));Z(Ee,!1);continue}let we=ms(be),Ce=M[we]||we;if(j.has(Ce)||j.has(we))Z(we,!0);else{let Ee=N[ee+1];if(Ee!==void 0&&!Ee.startsWith("-"))Z(we,Ee),ee++;else Z(we,!0)}}}else if(re.startsWith("-")&&re.length>1){let oe=re.slice(1);for(let be=0;be<oe.length;be++){let we=oe[be],Ce=M[we]||we;if(be===oe.length-1&&!j.has(Ce)&&!j.has(we)){let Ee=N[ee+1];if(Ee!==void 0&&!Ee.startsWith("-"))Z(we,Ee),ee++;else Z(we,!0)}else Z(we,!0)}}else p._.push(re)}return p}class ll{rawName;description;name;names;isBoolean;required;config;negated;constructor(N,t,p){if(this.rawName=N,this.description=t,this.config=Object.assign({},p),N=N.replace(/\.\*/g,""),this.negated=!1,this.names=ea(N).split(",").map((A)=>{let j=A.trim().replace(/^-{1,2}/,"");if(j.startsWith("no-"))this.negated=!0,j=j.replace(/^no-/,"");return Fo(j)}).sort((A,j)=>A.length>j.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(N.includes("<"))this.required=!0;else if(N.includes("["))this.required=!1;else this.isBoolean=!0}}var Sg=ta.argv,Kd=`${ta.platform}-${ta.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,ol=ps.argv,Jd=`${ps.platform}-${ps.arch} node-${ps.version}`;class ra{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(N,t,p,A){this.rawName=N,this.description=t,this.config=p,this.cli=A,this.options=[],this.aliasNames=[],this.name=ea(N);let j=ea(N),M=j.indexOf(":");if(M>0)this.namespace=j.substring(0,M),this.name=j.substring(M+1);if(this.args=Md(N),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!p)this.config={}}usage(N){return this.usageText=N,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(N,t="-v, --version"){return this.versionNumber=N,this.option(t,"Display version number"),this}example(N){return this.examples.push(N),this}option(N,t,p){let A=new ll(N,t,p);return this.options.push(A),this}alias(N){return this.aliasNames.push(N),this}action(N){return this.commandAction=N,this}before(N){return this.beforeHooks.push(N),this}after(N){return this.afterHooks.push(N),this}use(N){return this.middleware.push(N),this}isMatched(N){if(this.aliasNames.includes(N))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===N;return this.name===N}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof la}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(N){let t=Fo(N.split(".")[0]);return!!this.options.find((p)=>p.names.some((A)=>Fo(A)===t))}outputHelp(){let{name:N,commands:t}=this.cli,{versionNumber:p,options:A,helpCallback:j}=this.cli.globalCommand,M=[{body:`${N}${p?`/${p}`:""}`}];if(M.push({title:"Usage",body:`  $ ${N} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&t.length>0){let re=rl(t.map((Ee)=>Ee.rawName)),oe=new Map,be=[];for(let Ee of t)if(Ee.namespace){if(!oe.has(Ee.namespace))oe.set(Ee.namespace,[]);oe.get(Ee.namespace).push(Ee)}else be.push(Ee);let we="";if(be.sort((Ee,Se)=>Ee.rawName<Se.rawName?-1:Ee.rawName>Se.rawName?1:0),be.length>0)we+=be.map((Ee)=>`  ${Xs(Ee.rawName,re.length)}  ${Ee.description}`).join(`
@@ -28,7 +28,7 @@ Received ${p}, cleaning up...`),N)try{await N()}catch(A){console.error("Error du
 `)),this.enableDidYouMean){let t=[];for(let A of this.commands){if(A.displayName)t.push(A.displayName);if(A.aliasNames)t.push(...A.aliasNames)}let p=cl(N,t);if(p.length>0)console.log(Lo.yellow("Did you mean one of these?")),p.forEach((A)=>console.log(`  ${Lo.dim("•")} ${this.name} ${A}`)),console.log("")}console.log(Lo.dim("Run"),`${this.name} --help`,Lo.dim("to see all available commands")),Di.exit(1)}async parse(N=ol,t={}){let{run:p=!0,exitOnError:A=!1}=t;if(A)try{return await this.parse(N,{run:p})}catch(ee){throw this.handleUsageError(ee),ee}if(this.rawArgs=N,!this.name)this.name=N[1]?Vd(N[1]):"cli";let j=!0,M=N.slice(2),G=M[0];if(G&&!G.startsWith("-")){for(let ee of this.commands)if(ee.isMatched(G)){let re=this.mri(M,ee);j=!1;let oe={...re,args:re.args.slice(1)};this.setParsedInfo(oe,ee,G),this.emit(`command:${G}`,ee);break}if(j){let ee=M[1];if(ee&&!ee.startsWith("-")){let re=`${G}:${ee}`;for(let oe of this.commands)if(oe.isMatched(re)){let be=this.mri(M,oe);j=!1;let we={...be,args:be.args.slice(2)};this.setParsedInfo(we,oe,re),this.emit(`command:${re}`,oe);break}}}}if(j){for(let ee of this.commands)if(ee.name===""){j=!1;let re=this.mri(M,ee);this.setParsedInfo(re,ee),this.emit("command:!",ee);break}}if(j){let ee=this.mri(N.slice(2));this.setParsedInfo(ee)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),p=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),p=!1,this.unsetMatchedCommand();let Z={args:this.args,options:this.options};if(p)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return Z}mri(N,t){let p=[...this.globalCommand.options,...t?t.options:[]],A=_d(p),j=[],M=N.indexOf("--");if(M>-1)j=N.slice(M+1),N=N.slice(0,M);let G=Gd(N,A),Z={_:G._};for(let we of Object.keys(G))if(we!=="_")Z[Fo(we)]=G[we];let ee=Z._,re={"--":j},oe=t&&t.config.ignoreOptionDefaultValue?t.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,be=Object.create(null);for(let we of p){if(!oe&&we.config.default!==void 0)for(let Ce of we.names)re[Ce]=we.config.default;if(Array.isArray(we.config.type)){if(be[we.name]===void 0)be[we.name]={shouldTransform:!0,transformFunction:we.config.type[0]}}}for(let we of Object.keys(Z))if(we!=="_"){let Ce=we.split(".");zd(re,Ce,Z[we]),Ud(re,be)}return{args:ee,options:re}}async run(N=ol){return this.parse(N,{run:!0,exitOnError:!0})}handleUsageError(N){if(!Wd(N)||N.isUsageError===!1)return;let t=N.message||"command-line error",p=this.name?`${this.name}: `:"",A=/--help/.test(t)?"":N.usage?`
 Usage: ${N.usage}`:`
 Run \`${this.name??"cli"} --help\` for usage.`;Di.stderr.write(`${p}${t}${A}
-`),Di.exit(N.exitCode??2)}async runMatchedCommand(){let{args:N,options:t,matchedCommand:p}=this;if(!p||!p.commandAction)return;p.checkUnknownOptions(),p.checkOptionValue(),p.checkRequiredArgs();let A=[];p.args.forEach((Z,ee)=>{if(Z.variadic)A.push(N.slice(ee));else A.push(N[ee])}),A.push(t);let j={command:p,args:A,options:t};for(let Z of p.beforeHooks)await Z(j);let M,G=async()=>{let Z=p.commandAction.apply(this,A);if(Z instanceof Promise)M=await Z;else M=Z;return M};if(p.middleware.length>0){let Z=0,ee=async()=>{if(Z<p.middleware.length){let re=p.middleware[Z++];await re({...j,next:ee})}else await G()};await ee()}else await G();for(let Z of p.afterHooks)await Z(j);return M}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Di.removeAllListeners("SIGINT"),Di.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class dl{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(N){if(!this.enabled){this.misses++;return}let t=this.cache.get(N);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(N),this.misses++;return}return this.hits++,t.value}set(N,t,p=5000){if(!this.enabled)return;this.cache.set(N,{value:t,timestamp:Date.now(),ttl:p})}has(N){if(!this.enabled)return!1;let t=this.cache.get(N);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(N),!1;return!0}delete(N){this.cache.delete(N)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let N=Date.now();for(let[t,p]of this.cache.entries())if(N-p.timestamp>p.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Cg=new dl;function Xd(){if("FORCE_COLOR"in jo.env)return jo.env.FORCE_COLOR!=="0";if("NO_COLOR"in jo.env||jo.env.TERM==="dumb")return!1;if(jo.platform==="win32")return!0;return sl.isatty(1)&&sl.isatty(2)}var ul=Xd();function Fn(N,t){if(!ul)return(p)=>p;return(p)=>N+p+t}var eu=Fn("\x1B[0m","\x1B[0m"),tu=Fn("\x1B[31m","\x1B[39m"),nu=Fn("\x1B[32m","\x1B[39m"),ru=Fn("\x1B[33m","\x1B[39m"),iu=Fn("\x1B[34m","\x1B[39m"),ou=Fn("\x1B[35m","\x1B[39m"),su=Fn("\x1B[36m","\x1B[39m"),au=Fn("\x1B[37m","\x1B[39m"),cu=Fn("\x1B[90m","\x1B[39m"),lu=Fn("\x1B[1m","\x1B[22m"),du=Fn("\x1B[3m","\x1B[23m"),uu=Fn("\x1B[4m","\x1B[24m"),mu=Fn("\x1B[2m","\x1B[22m"),pu=Fn("\x1B[7m","\x1B[27m"),fu=Fn("\x1B[8m","\x1B[28m"),gu=Fn("\x1B[9m","\x1B[29m"),hu=Fn("\x1B[41m","\x1B[49m"),yu=Fn("\x1B[42m","\x1B[49m"),vu=Fn("\x1B[43m","\x1B[49m"),bu=Fn("\x1B[44m","\x1B[49m"),wu=Fn("\x1B[45m","\x1B[49m"),Su=Fn("\x1B[46m","\x1B[49m"),$u=Fn("\x1B[47m","\x1B[49m"),Cu=ul,Au={reset:eu,red:tu,green:nu,yellow:ru,blue:iu,magenta:ou,cyan:su,white:au,gray:cu,bold:lu,italic:du,underline:uu,dim:mu,inverse:pu,hidden:fu,strikethrough:gu,bgRed:hu,bgGreen:yu,bgYellow:vu,bgBlue:bu,bgMagenta:wu,bgCyan:Su,bgWhite:$u,isColorSupported:Cu},ku=Au,Iu=["up","down","left","right","space","enter","cancel"],xg={actions:new Set(Iu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var Eg=Ru.platform.startsWith("win"),Dg=Symbol("clapp:cancel");var Pu=qd();var sn=(N,t)=>Pu?N:t,Tg=sn("◆","*"),Ng=sn("■","x"),Og=sn("▲","x"),Lg=sn("◇","o"),jg=sn("┌","T"),xu=sn("│","|"),Fg=sn("└","—"),Bg=sn("●",">"),Mg=sn("○"," "),_g=sn("◻","[•]"),zg=sn("◼","[+]"),Ug=sn("◻","[ ]"),Vg=sn("▪","•"),Wg=sn("─","-"),qg=sn("╮","+"),Hg=sn("├","+"),Gg=sn("╯","+"),Kg=sn("●","•"),Jg=sn("◆","*"),Yg=sn("▲","!"),Zg=sn("■","x");var Qg={light:sn("─","-"),heavy:sn("━","="),block:sn("█","#")};function Eu(){return`${ku.gray(xu)}  `}var Xg=Eu();var ua="0.14.0";import{existsSync as ma}from"node:fs";import{mkdir as Tu,writeFile as ml}from"node:fs/promises";function pa(N){N.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),ma("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let p=t?.name||await I("Project name","my-app"),A=t?.mode||await fo("Select deployment mode",["serverless","server"]),j=t?.region||await fo("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),M=new o("Creating configuration file...");M.start();let G=`import { defineConfig } from '@ts-cloud/core'
+`),Di.exit(N.exitCode??2)}async runMatchedCommand(){let{args:N,options:t,matchedCommand:p}=this;if(!p||!p.commandAction)return;p.checkUnknownOptions(),p.checkOptionValue(),p.checkRequiredArgs();let A=[];p.args.forEach((Z,ee)=>{if(Z.variadic)A.push(N.slice(ee));else A.push(N[ee])}),A.push(t);let j={command:p,args:A,options:t};for(let Z of p.beforeHooks)await Z(j);let M,G=async()=>{let Z=p.commandAction.apply(this,A);if(Z instanceof Promise)M=await Z;else M=Z;return M};if(p.middleware.length>0){let Z=0,ee=async()=>{if(Z<p.middleware.length){let re=p.middleware[Z++];await re({...j,next:ee})}else await G()};await ee()}else await G();for(let Z of p.afterHooks)await Z(j);return M}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Di.removeAllListeners("SIGINT"),Di.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class dl{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(N){if(!this.enabled){this.misses++;return}let t=this.cache.get(N);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(N),this.misses++;return}return this.hits++,t.value}set(N,t,p=5000){if(!this.enabled)return;this.cache.set(N,{value:t,timestamp:Date.now(),ttl:p})}has(N){if(!this.enabled)return!1;let t=this.cache.get(N);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(N),!1;return!0}delete(N){this.cache.delete(N)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let N=Date.now();for(let[t,p]of this.cache.entries())if(N-p.timestamp>p.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Cg=new dl;function Xd(){if("FORCE_COLOR"in jo.env)return jo.env.FORCE_COLOR!=="0";if("NO_COLOR"in jo.env||jo.env.TERM==="dumb")return!1;if(jo.platform==="win32")return!0;return sl.isatty(1)&&sl.isatty(2)}var ul=Xd();function Fn(N,t){if(!ul)return(p)=>p;return(p)=>N+p+t}var eu=Fn("\x1B[0m","\x1B[0m"),tu=Fn("\x1B[31m","\x1B[39m"),nu=Fn("\x1B[32m","\x1B[39m"),ru=Fn("\x1B[33m","\x1B[39m"),iu=Fn("\x1B[34m","\x1B[39m"),ou=Fn("\x1B[35m","\x1B[39m"),su=Fn("\x1B[36m","\x1B[39m"),au=Fn("\x1B[37m","\x1B[39m"),cu=Fn("\x1B[90m","\x1B[39m"),lu=Fn("\x1B[1m","\x1B[22m"),du=Fn("\x1B[3m","\x1B[23m"),uu=Fn("\x1B[4m","\x1B[24m"),mu=Fn("\x1B[2m","\x1B[22m"),pu=Fn("\x1B[7m","\x1B[27m"),fu=Fn("\x1B[8m","\x1B[28m"),gu=Fn("\x1B[9m","\x1B[29m"),hu=Fn("\x1B[41m","\x1B[49m"),yu=Fn("\x1B[42m","\x1B[49m"),vu=Fn("\x1B[43m","\x1B[49m"),bu=Fn("\x1B[44m","\x1B[49m"),wu=Fn("\x1B[45m","\x1B[49m"),Su=Fn("\x1B[46m","\x1B[49m"),$u=Fn("\x1B[47m","\x1B[49m"),Cu=ul,Au={reset:eu,red:tu,green:nu,yellow:ru,blue:iu,magenta:ou,cyan:su,white:au,gray:cu,bold:lu,italic:du,underline:uu,dim:mu,inverse:pu,hidden:fu,strikethrough:gu,bgRed:hu,bgGreen:yu,bgYellow:vu,bgBlue:bu,bgMagenta:wu,bgCyan:Su,bgWhite:$u,isColorSupported:Cu},ku=Au,Iu=["up","down","left","right","space","enter","cancel"],xg={actions:new Set(Iu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var Eg=Ru.platform.startsWith("win"),Dg=Symbol("clapp:cancel");var Pu=qd();var sn=(N,t)=>Pu?N:t,Tg=sn("◆","*"),Ng=sn("■","x"),Og=sn("▲","x"),Lg=sn("◇","o"),jg=sn("┌","T"),xu=sn("│","|"),Fg=sn("└","—"),Bg=sn("●",">"),Mg=sn("○"," "),_g=sn("◻","[•]"),zg=sn("◼","[+]"),Ug=sn("◻","[ ]"),Vg=sn("▪","•"),Wg=sn("─","-"),qg=sn("╮","+"),Hg=sn("├","+"),Gg=sn("╯","+"),Kg=sn("●","•"),Jg=sn("◆","*"),Yg=sn("▲","!"),Zg=sn("■","x");var Qg={light:sn("─","-"),heavy:sn("━","="),block:sn("█","#")};function Eu(){return`${ku.gray(xu)}  `}var Xg=Eu();var ua="0.15.1";import{existsSync as ma}from"node:fs";import{mkdir as Tu,writeFile as ml}from"node:fs/promises";function pa(N){N.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),ma("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let p=t?.name||await I("Project name","my-app"),A=t?.mode||await fo("Select deployment mode",["serverless","server"]),j=t?.region||await fo("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),M=new o("Creating configuration file...");M.start();let G=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -315,7 +315,7 @@ Resources to create: ${Ne}`);let Xe={};for(let Ye of Object.values(re.Resources|
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
 `),De.length>0){n(`Resources to add (${De.length}):`);for(let Te of De){let Ne=Ce[Te].Type;e(`  + ${Te} (${Ne})`)}console.log()}if(Je.length>0){r(`Resources to remove (${Je.length}):`);for(let Te of Je){let Ne=we[Te].Type;e(`  - ${Te} (${Ne})`)}console.log()}if(Ae.length>0){a(`Resources to modify (${Ae.length}):`);for(let Te of Ae){let Ne=Ce[Te].Type;e(`  ~ ${Te} (${Ne})`)}console.log()}e("Summary:"),e(`  - Add: ${De.length}`),e(`  - Remove: ${Je.length}`),e(`  - Modify: ${Ae.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(p){r(`Diff failed: ${p.message}`)}})}function zi(N,t=0){let p=Number(N);return Number.isFinite(p)?p:t}function wa(N){return zi(N)*1024}function dm(N){let t=N?.date?.trim(),p=N?.time?.trim();if(!t||!p)return null;let A=new Date(`${t}T${p}Z`);return Number.isFinite(A.getTime())?A.toISOString():null}function um(N,t,p){let A;try{A=JSON.parse(N)}catch{return[]}let j=(A?.sysstat?.hosts??[]).flatMap((G)=>G.statistics??[]),M=[];for(let G of j){let Z=dm(G.timestamp);if(!Z)continue;let ee=new Date(Z).getTime();if(ee<t.getTime()||ee>p.getTime())continue;let re=G["cpu-load"]?.find((be)=>be.cpu==="all")??G["cpu-load"]?.[0],oe=zi(re?.idle,100);M.push({timestamp:Z,cpuUsedPercent:Math.max(0,Math.min(100,100-oe)),cpuUserPercent:zi(re?.user),cpuSystemPercent:zi(re?.system),cpuIowaitPercent:zi(re?.iowait),memoryUsedPercent:zi(G.memory?.["memused-percent"]),memoryUsedBytes:wa(G.memory?.memused),memoryAvailableBytes:wa(G.memory?.avail),swapUsedPercent:zi(G.memory?.["swpused-percent"]),swapUsedBytes:wa(G.memory?.swpused)})}return M.sort((G,Z)=>G.timestamp.localeCompare(Z.timestamp))}function mm(N){return Object.fromEntries(Object.entries(N.time_series??{}).map(([t,p])=>[t,(p.values??[]).map(([A,j])=>({timestamp:new Date(Number(A)*1000).toISOString(),value:zi(j,Number.NaN)})).filter((A)=>Number.isFinite(A.value))]))}function Rl(N){return N.length?N.reduce((t,p)=>t+p,0)/N.length:null}function Sa(N){return N.length?Math.max(...N):null}function pm(N){return N.length?Math.min(...N):null}async function Il(N){let[t,p]=await Promise.all([N.client.getServerMetrics(N.serverId,{types:["cpu","disk","network"],start:N.from,end:N.to,step:N.step}),Re(N.remote.host,"LC_ALL=C sadf -j -- -u -r -S",N.remote).catch(()=>"")]),A=um(p,N.from,N.to),j=mm(t),G=(j.cpu??[]).map((be)=>Math.max(0,Math.min(100,be.value/Math.max(1,N.cores)))),Z=A.map((be)=>be.cpuUsedPercent),ee=G.length?G:Z,re=A.map((be)=>be.memoryUsedPercent),oe=A.map((be)=>be.swapUsedPercent);return{from:N.from.toISOString(),to:N.to.toISOString(),cores:N.cores,host:A,provider:j,summary:{cpuAveragePercent:Rl(ee),cpuPeakPercent:Sa(ee),memoryAveragePercent:Rl(re),memoryPeakPercent:Sa(re),memoryMinimumAvailableBytes:pm(A.map((be)=>be.memoryAvailableBytes)),swapPeakPercent:Sa(oe)}}}function fm(N){if(N.length===0)throw Error("A server name cannot be empty.");if(N.length>253)throw Error(`'${N}' is longer than the 253 characters a hostname allows.`);for(let t of N.split(".")){if(t.length===0)throw Error(`'${N}' has an empty label — a hostname cannot contain '..'.`);if(t.length>63)throw Error(`'${t}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(t))throw Error(`'${t}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function Pl(N,t,p){if(fm(t),N===t)throw Error(`'${N}' is already named that.`);if((await p.takenNames()).some((M)=>M===t&&M!==N))throw Error(`'${t}' is already taken. Server names have to be unique within a provider project.`);let j=[];if(p.providerName&&p.renameProvider){let{providerName:M,renameProvider:G}=p;j.push({id:"provider",title:"Rename the server at the provider",change:{from:N,to:t},satisfied:async()=>await M()===t,apply:()=>G(t)})}if(p.stateName&&p.writeStateName){let{stateName:M,writeStateName:G}=p;j.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:N,to:t},satisfied:async()=>{let Z=await M();return Z===void 0||Z===t},apply:()=>G(t)})}if(p.remoteHostname&&p.setRemoteHostname){let{remoteHostname:M,setRemoteHostname:G}=p;j.push({id:"hostname",title:"Set the hostname on the box",change:{from:N,to:t},satisfied:async()=>await M()===t,apply:()=>G(t)})}return j.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:N,to:t},satisfied:async()=>p.inventoryName()===t,apply:async()=>{await p.renameInventory(t)}}),{operation:"server:rename",target:N,steps:j}}function xl(N){let t=`'${N.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${t} 2>/dev/null || { echo ${t} > /etc/hostname && hostname ${t}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${N}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${t} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}async function gm(){let N=await _e(),t=y(process.cwd(),N),p=new Ie(t.store),A=new pn(p,[new tt("aws"),new tt("hetzner"),new tt("ssh")]);return{controlPlane:t,store:p,service:A}}async function yi(N){let t=await gm();try{return await N(t)}finally{t.controlPlane.store.close()}}var Ji=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error(`Server ${t} was not found.`);return p},gr=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};function $a(N,t){let p=Number.parseInt(N??"",10);return Number.isFinite(p)&&p>=0?p:t}function hm(N="3h"){let t=N.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let p=Number(t[1])*(t[2]==="h"?3600000:60000);if(p<300000||p>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return p}function Uo(N,t="%"){return N==null?"unavailable":`${N.toFixed(1)}${t}`}async function ym(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",j=E(p,A),M=await ue(j);if(!M?.serverId)throw Error(`No pinned Hetzner server was found for ${j}.`);if(![M.serverName,String(M.serverId),M.stackName].includes(N))throw Error(`Refusing to read ${N}: project state is pinned to ${M.serverName}.`);let G=sr(p),Z=new Ke({apiToken:ar(G.apiToken,p)}),ee=await Z.getServer(M.serverId),re=M.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=new Date,be=new Date(oe.getTime()-hm(t.range)),we=Math.min(3600,Math.max(60,$a(t.step,60))),Ce=await Il({client:Z,serverId:ee.id,cores:Math.max(1,Number(ee.server_type.cores)||1),from:be,to:oe,step:we,remote:{host:re,user:M.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:ee.name,result:Ce},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[ee.name,`${Ce.from} to ${Ce.to}`,`${Uo(Ce.summary.cpuAveragePercent)} / ${Uo(Ce.summary.cpuPeakPercent)}`,`${Uo(Ce.summary.memoryAveragePercent)} / ${Uo(Ce.summary.memoryPeakPercent)}`,Ce.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(Ce.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,Uo(Ce.summary.swapPeakPercent)]])}function El(N){let t=N.targetType.prices?.find((p)=>p.location===N.location);return{serverId:N.serverId,serverName:N.serverName,location:N.location,from:N.currentType.name,to:N.targetType.name,capacityAvailable:N.capacityAvailable,alreadyComplete:N.alreadyComplete,upgradeDisk:N.upgradeDisk,target:{cores:N.targetType.cores,memoryGb:N.targetType.memory,diskGb:N.targetType.disk,architecture:N.targetType.architecture,cpuType:N.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function vm(N){let t=El(N);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function bm(N,t,p){let A=await _e();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let j=p.env??process.env.CLOUD_ENV??"production",M=E(A,j),G=await ue(M),Z=sr(A),ee=new Ke({apiToken:ar(Z.apiToken,A)}),oe=G&&(N===G.serverName||N===String(G.serverId)||N===G.stackName)?await ee.getServer(G.serverId):(await ee.listServers()).find((Ye)=>Ye.name===N||String(Ye.id)===N);if(!oe)throw Error(`Hetzner server ${N} was not found.`);if(G?.serverId&&G.serverId!==oe.id)throw Error(`Refusing to resize ${N}: project state is pinned to server ${G.serverId}.`);let be=pt(t),we=p.upgradeDisk!==!1,Ce=await Zn(ee,oe.id,be,we);if(p.json)console.log(JSON.stringify({schemaVersion:1,plan:El(Ce)},null,2));else vm(Ce);if(!p.apply){if(!p.json)e(`Preview only. Re-run with --apply --confirm ${oe.name} to execute.`);return}if(p.confirm!==oe.name)throw Error(`Resize requires --confirm ${oe.name}.`);let Ee=G?.publicIp??oe.public_net.ipv4?.ip;if(!Ee)throw Error(`Server ${oe.name} has no public IPv4 address for verification.`);let Se={host:Ee,user:G?.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},De=await ls(M),Je=new Date().toISOString(),Ae={schemaVersion:1,operationId:De?.targetType===be&&De.serverId===oe.id?De.operationId:crypto.randomUUID(),stackName:M,serverId:oe.id,serverName:oe.name,sourceType:Ce.currentType.name,targetType:be,upgradeDisk:we,phase:"planning",status:"running",attempts:De?.targetType===be?De.attempts:0,startedAt:De?.targetType===be?De.startedAt:Je,updatedAt:Je,manifest:De?.targetType===be?De.manifest:void 0};await gt(Ae);let Te=$a(p.pollSeconds,900)*1000,Ne=$a(p.maxWaitMinutes,0)*60000,Xe=Date.now();for(;;){let Ye=await Zn(ee,oe.id,be,we);if(!Ye.capacityAvailable&&!Ye.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await gt(Ae),!p.wait){if(!p.json)e(`${be} has no capacity in ${Ye.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Ne>0&&Date.now()-Xe>=Ne)throw Error(`Timed out waiting for ${be} capacity in ${Ye.location}.`);if(!p.json)e(`Waiting ${Math.round(Te/1000)} seconds for ${be} capacity...`);await Bun.sleep(Te);continue}let Qe=await ds(M);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await gt(Ae),await ns({client:ee,serverId:oe.id,targetType:be,upgradeDisk:we,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let $t=await is(Se);return Ae={...Ae,manifest:$t,updatedAt:new Date().toISOString()},await gt(Ae),$t},afterBoot:async($t,wt,Ot,Ut)=>os(Se,wt,Ot,Ut),onPhase:async($t,wt)=>{if(Ae={...Ae,phase:$t,status:$t==="waiting-capacity"?"waiting-capacity":$t==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await gt(Ae),!p.json)e(`${$t}${wt?` ${JSON.stringify(wt)}`:""}`)}}})}finally{await Qe()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await gt(Ae),p.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${oe.name} is on ${be} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&p.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Te/1000)} seconds before retry.`),await Bun.sleep(Te);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await gt(Ae),et}}}async function wm(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",j=E(p,A),M=await ue(j);if(!M?.serverId)throw Error(`No pinned Hetzner server was found for ${j}.`);if(![M.serverName,String(M.serverId),M.stackName].includes(N))throw Error(`Refusing to optimize ${N}: project state is pinned to ${M.serverName}.`);let G=sr(p),Z=new Ke({apiToken:ar(G.apiToken,p)}),ee=await Z.getServer(M.serverId),re=M.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=Yi(p);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:ee.name,plan:oe},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[ee.name,oe.firewallPorts.join(","),oe.monitoring?"on":"off",oe.autoUpdates?"on":"off",`${oe.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${ee.name} to execute.`);return}if(t.confirm!==ee.name)throw Error(`Optimization requires --confirm ${ee.name}.`);let be={host:re,user:M.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15},we=await Wr(be),Ce=we.routeProbes.filter((Ot)=>!Ot.ok),Ee=p.infrastructure?.compute,Se=Q(Ee)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,De=we.failedUnits.filter((Ot)=>!Se.has(Ot));if(De.length>0)throw Error(`Preflight found failed services: ${De.join(", ")}`);if(Ce.length>0)throw Error(`Preflight found unhealthy routes: ${Ce.map((Ot)=>Ot.domain).join(", ")}`);let Je=Q(Ee)?[]:Object.values(p.sites??{}).flatMap((Ot)=>typeof Ot?.port==="number"&&![80,443].includes(Ot.port)?[Ot.port]:[]),Ae=qr({allowSsh:Ee?.allowSsh!==!1,sitePorts:Je,allowedPorts:Ee?.firewall?.allowedPorts}),Te=(M.firewallId?(await Z.listFirewalls()).find((Ot)=>Ot.id===M.firewallId):void 0)??(await Z.listFirewalls()).find((Ot)=>Ot.name===`${p.project.slug}-${A}-app-fw`);if(!Te)throw Error(`Managed firewall for ${ee.name} was not found.`);let Ne=await Z.setFirewallRules(Te.id,Ae);await Promise.all(Ne.map((Ot)=>Z.waitForAction(Ot.id))),await ss(p,be);let[Xe,Ye]=await Promise.all([Wr(be),as(be)]),Qe=cs(oe,Ye),et=xa(we,Xe),$t=Xe.routeProbes.filter((Ot)=>!Ot.ok);if(et.stoppedServices.length>0)Qe.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Qe.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Qe.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Qe.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Qe.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if($t.length>0)Qe.push(`unhealthy routes: ${$t.map((Ot)=>Ot.domain).join(", ")}`);if(Qe.length>0)throw Error(`Host optimization verification failed: ${Qe.join("; ")}`);let wt={serverId:ee.id,serverName:ee.name,services:Xe.runningServices.length,routes:Xe.routeIds.length,healthyDomains:Xe.routeProbes.length,releaseLinks:Xe.releaseLinks.length,databasesAndVolumes:Xe.dataCatalog.length,report:Ye};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:wt},null,2));else n(`${ee.name} passed full host, rpx route, service, release, and data verification.`)}async function Sm(N,t,p){let A=await _e(),j=p.env??"production",M=E(A,j);await yi(async(G)=>{let Z=Ji(G,N),ee=G.store.list(G.controlPlane.project.id,!0),re=Z.provider==="hetzner"&&Z.providerId?(()=>{try{let Te=sr(A);return new Ke({apiToken:ar(Te.apiToken,A)})}catch{return null}})():null,oe=Z.providerId?Number(Z.providerId):Number.NaN,be=await ue(M),we=be!=null&&be.serverId===oe,Ce=new Ir,Ee=Z.trustState==="pinned",Se={takenNames:async()=>{let Te=ee.map((Ne)=>Ne.name);if(re)Te.push(...(await re.listServers()).map((Ne)=>Ne.name));return Te},inventoryName:()=>G.store.get(Z.id)?.name??Z.name,renameInventory:(Te)=>{G.store.update(Z.id,{name:Te})},...re&&Number.isFinite(oe)?{providerName:async()=>(await re.getServer(oe)).name,renameProvider:async(Te)=>{await re.renameServer(oe,Te)}}:{},...we?{stateName:async()=>(await ue(M))?.serverName,writeStateName:async(Te)=>{let Ne=await ue(M);if(Ne)await mt(M,{...Ne,serverName:Te})}}:{},...Ee?{remoteHostname:async()=>{let Te=await Ce.exec(Z,"hostname");return Te.code===0?Te.stdout.trim():void 0},setRemoteHostname:async(Te)=>{let Ne=await Ce.exec(Z,xl(Te));if(Ne.code!==0)throw Error(Ne.stderr.trim()||`hostname exited ${Ne.code}`)}}:{}},De=await Pl(Z.name,t,Se),Je=await vs(De);if(!p.apply){let Te=[re?"":"provider record (no provider id or no API token)",we?"":"local state pin (none points at this server)",Ee?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(p.json){console.log(JSON.stringify({schemaVersion:1,operation:De.operation,target:De.target,rename:{from:Z.name,to:t},notCovered:Te,steps:Je.map((Ne)=>({id:Ne.step.id,title:Ne.step.title,state:Ne.state,change:Ne.step.change,reason:Ne.reason}))},null,2));return}for(let Ne of bs(De,Je))console.log(Ne);for(let Ne of Te)console.log(`  not covered: ${Ne}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await ws(De,Je,{log:(Te)=>e(Te),audit:(Te)=>G.controlPlane.store.appendEvent({projectId:G.controlPlane.project.id,resourceId:Z.resourceId,type:`${Te.operation}.${Te.step}.${Te.state}`,level:Te.state==="failed"?"error":"info",payload:{target:Te.target,renameTo:t,...Te.error?{error:Te.error}:{}}})});if(p.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Te=Ae.steps.find((Ne)=>Ne.state==="failed");throw Error(`${De.operation} stopped at '${Te?.title}': ${Te?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!p.json)n(`Renamed ${Z.name} to ${t}.`)})}function Ca(N){N.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,p)=>{try{await yi(async(A)=>{let j=t?[Ji(A,t)]:A.store.list(A.controlPlane.project.id),M=j.flatMap((G)=>Object.entries(G.capabilities).map(([Z,ee])=>({server:G.name,provider:G.provider,action:Z,...ee})));if(p.json)console.log(JSON.stringify({schemaVersion:1,targets:M},null,2));else c(["Server","Provider","Action","Support","Explanation"],M.map((G)=>[G.server,G.provider,G.action,G.supported?"supported":"unsupported",G.reason??"—"]))})}catch(A){gr(A)}}),N.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,p,A)=>{try{await bm(t,p,A)}catch(j){gr(j)}}),N.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,p)=>{try{await wm(t,p)}catch(A){gr(A)}}),N.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,p)=>{try{await ym(t,p)}catch(A){gr(A)}}),N.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await yi(async(p)=>{let A=p.store.list(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((j)=>[j.name,j.providerId??"—",`${j.provider} / ${j.region??"external"}`,`${j.status} / ${j.trustState}`,j.roles.join(","),`${j.capacity.cpu??0} / ${j.capacity.memoryBytes??0}`,j.heartbeatAt??"never"]))})}catch(p){gr(p)}}),N.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,p)=>{try{await yi(async(A)=>{let j=p.provider;if(!["aws","hetzner","ssh"].includes(j)||!p.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let M=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:j,providerId:p.providerId,endpoint:p.endpoint,sshUser:p.user??"deploy",credentialRef:p.credentialRef??"secret://fleet/agent",region:p.region,roles:String(p.roles??"application").split(","),labels:Object.fromEntries(String(p.labels??"").split(",").map((G)=>G.split("=")).filter((G)=>G[0]&&G[1]))});n(`Enrolled ${M.name} as ${M.id}; no remote mutation was performed.`)})}catch(A){gr(A)}}),N.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,p)=>{try{await yi(async(A)=>{let j=Ji(A,t);if(j=await A.service.test(j.id),j.trustState==="rotation_pending"){if(!p.acceptHostKey)throw Error(`Host key changed to ${j.pendingHostKey}; review it first.`);j=A.service.reviewHostKey(j.id,p.acceptHostKey)}let M=await A.service.validate(j.id);if(p.json)console.log(JSON.stringify(M.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(M.validation?.findings??[]).map((G)=>[G.severity,G.code,G.message,G.remediation??"—"]));if(!M.validation?.valid)process.exitCode=1})}catch(A){gr(A)}}),N.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,p)=>{try{await yi(async(A)=>{let j=A.service.bootstrap(Ji(A,t).id,!!p.apply);if(j.preview)c(["Step"],j.steps.map((M)=>[M]));else n(`Bootstrap queued: ${j.operation?.id}`)})}catch(A){gr(A)}}),N.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,p,A)=>{try{await Sm(t,p,A)}catch(j){gr(j)}}),N.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,p)=>{try{await yi(async(A)=>n(A.service.drain(Ji(A,t).id,!!p.complete).status))}catch(A){gr(A)}}),N.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await yi(async(p)=>{p.service.uncordon(Ji(p,t).id),n(`Uncordoned ${t}.`)})}catch(p){gr(p)}}),N.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,p)=>{try{await yi(async(A)=>{A.service.archive(Ji(A,t).id,p.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){gr(A)}}),N.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await yi(async(p)=>{let A=Ji(p,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let j=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),M=await j.exited;if(M)process.exitCode=M})}catch(p){gr(p)}});for(let[t,p]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])N.command(t,p).action(async(...A)=>Fr(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Dl,mkdirSync as $m,readFileSync as Cm,writeFileSync as Am}from"node:fs";import{join as Tl,resolve as km}from"node:path";var Aa=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};async function Rm(){try{return await _e()}catch{return}}function Im(N){if(N===void 0)return;let t=Number(N);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${N}'.`);return t}function Nl(N,t,p){let A=N?.ssh?.hosts?.find((j)=>j.host===t);return new pr({hosts:t?[A??{host:t}]:N?.ssh?.hosts,user:p.user,port:Im(p.port),privateKeyPath:p.key,hostKey:N?.ssh?.hostKey,sudo:N?.ssh?.sudo,profile:p.profile??N?.ssh?.profile,publicIp:N?.ssh?.publicIp,lan:N?.ssh?.lan})}var Ol=1073741824;function Ra(N){N.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,p)=>{try{let A=await Rm(),j=Nl(A,t,p),M=t??j.targetHost(),G=await j.ensureHostKey(M),{facts:Z,findings:ee}=await j.preflight(M);if(p.json)console.log(JSON.stringify({schemaVersion:1,host:M,hostKeyFingerprint:G.fingerprint,facts:Z,findings:ee},null,2));else{if(i(`Preflight ${M}`),G.pinnedNow)e(`Pinned host key ${G.fingerprint}`);if(e(`${Z.os} on ${Z.arch}, ${Z.cpuCores} cores, ${(Z.memoryBytes/Ol).toFixed(1)} GiB memory, ${(Z.diskFreeBytes/Ol).toFixed(1)} GiB free`),Z.piModel)e(Z.piModel);if(Z.lanIp)e(`LAN address ${Z.lanIp}`);if(console.log(Hr(ee)),ur(ee))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(ur(ee))process.exitCode=1}catch(A){Aa(A)}}),N.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let p=await _e(),A=t.env??"production";if(t.dryRun){let G=dr(p),[Z]=G.hosts;console.log(lr({config:p,environment:A,profile:G.profile,sudoUser:Z.user!=="root"?Z.user:void 0,lan:G.lan}));return}let j=Nl(p,void 0,{});i(`Adopt ${j.targetHost()}`);let M=await j.provisionComputeInfrastructure({config:p,environment:A});n(`${M.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(p){Aa(p)}}),N.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let p=t.os??"raspberry-pi-os";if(!(p in Xi))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${p}'.`);let A=await _e(),j=t.env??"production",M=dr(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:p==="raspberry-pi-os"?"raspberry-pi":void 0}),G=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),Z=zr(t.key??"~/.ssh/id_ed25519.pub");if(!Dl(Z))throw Error(`Public key not found at ${Z}; pass --key <path to a .pub file>.`);let ee=Cm(Z,"utf8").trim(),re;if(t.wifiSsid){let Ee=t.wifiPassphraseEnv??"WIFI_PASSWORD",Se=process.env[Ee];if(!Se)throw Error(`--wifi-ssid needs the passphrase in $${Ee} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");re={ssid:t.wifiSsid,passphrase:Se,country:t.wifiCountry}}let oe=lr({config:A,environment:j,profile:M.profile,sudoUser:G!=="root"?G:void 0,lan:M.lan}),be=Qi({hostname:t.hostname,user:G,publicKey:ee,timezone:t.timezone,locale:t.locale,wifi:re},oe,{os:p}),we=km(t.out);$m(we,{recursive:!0});let Ce=Object.keys(be.files).filter((Ee)=>Dl(Tl(we,Ee)));if(Ce.length>0&&!t.force)throw Error(`${Ce.join(", ")} already exist in ${we}; pass --force to overwrite.`);for(let[Ee,Se]of Object.entries(be.files))Am(Tl(we,Ee),Se,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(be.files).join(", ")} to ${we}`),console.log(be.instructions)}catch(p){Aa(p)}})}async function Pm(){let N=await _e(),t=y(process.cwd(),N),p=new mn(t.store),A=new gn(p,new Ie(t.store));return{controlPlane:t,store:p,service:A}}async function Vo(N){let t=await Pm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Ss=(N)=>Object.fromEntries(String(N??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Ll=(N)=>Object.fromEntries(Object.entries(Ss(N)).map(([t,p])=>[t,Number(p)]));function Ia(N){N.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>Vo((p)=>{let A=p.store.listPools(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((j)=>[j.name,j.purpose,j.backend,`${j.region??"any"} / ${j.architecture??"any"}`,j.status,JSON.stringify(j.capacity),String(j.concurrency)]))})),N.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,p)=>Vo((A)=>{let{purpose:j,backend:M}=p;if(!["application","build","worker","monitoring","backup"].includes(j)||!["server","ecs","asg"].includes(M))throw Error("Unsupported pool purpose or backend.");let G=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:j,backend:M,region:p.region,architecture:p.arch,labels:Ss(p.labels),requiredServerLabels:Ss(p.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Ll(p.capacity)},maxWorkloads:Number(p.max),costWeight:1,concurrency:Number(p.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${G.name} (${G.id}).`)})),N.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,p)=>Vo((A)=>{let j=A.store.listPools(A.controlPlane.project.id).find((G)=>G.id===t||G.name===t),M=new Ie(A.controlPlane.store).list(A.controlPlane.project.id).find((G)=>G.id===p||G.name===p);if(!j||!M)throw Error("Pool or server was not found.");A.store.addMember(j.id,M.id),n(`Attached ${M.name} to ${j.name}.`)})),N.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>Vo((p)=>{let A=p.service.explain(p.controlPlane.project.id,{purpose:t.purpose,resources:Ll(t.resources),region:t.region,architecture:t.arch,labels:Ss(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((j)=>[j.poolName,j.serverId??"provider-managed",j.eligible?"yes":"no",JSON.stringify(j.available),`${j.score.fit.toFixed(2)} / ${j.score.spread} / ${j.score.cost}`,j.reasons.join("; ")||"eligible"]))})),N.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>Vo((p)=>{let A=p.store.listPools(p.controlPlane.project.id).find((M)=>M.id===t||M.name===t);if(!A)throw Error("Pool was not found.");let j=p.service.drainPool(A.id);n(`Draining ${A.name}: moved ${j.moved.length}, blocked ${j.blocked.length} stateful placement(s).`)}))}async function xm(){let N=await _e(),t=y(process.cwd(),N),p=new fn(t.store),A=new hn(p);return{controlPlane:t,store:p,service:A}}async function co(N){let t=await xm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Wo=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error("Regional topology was not found.");return p},Em=(N)=>N.split(",").map((t,p)=>{let[A,j="aws"]=t.split(":");return{region:String(A),provider:j,role:p===0?"primary":"secondary"}}),Dm=(N)=>{let t=new Set(["s3","dynamodb","secrets"]),p=N.split(",").map((j)=>j.trim()),A=p.find((j)=>!t.has(j));if(A)throw Error(`Unsupported replication kind: ${A}`);return p};function Pa(N){N.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>co((p)=>{let A=p.store.list(p.controlPlane.project.id).map((j)=>({topology:j,targets:p.store.targets(j.id),channels:p.store.channels(j.id),route:p.store.route(j.id),executions:p.store.executions(j.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((j)=>[j.topology.name,j.topology.hostname,j.topology.activeRegion,j.topology.status,j.topology.revision??"—",`${j.channels.filter((M)=>M.status==="in_sync").length}/${j.channels.length} in sync`]))})),N.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,p)=>co((A)=>{if(!p.hostname||!p.regions)throw Error("--hostname and --regions are required.");let j=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:p.hostname,regions:Em(p.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Dm(String(p.replicate)),maxLagSeconds:Number(p.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!p.cdn,wafEnabled:!!p.waf});n(`Created ${j.name} (${j.id}); run region:rollout with an immutable manifest.`)})),N.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,p,A)=>co((j)=>c(["Step"],j.service.plan(Wo(j,t).id,p,A.target).map((M)=>[M])))),N.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,p,A)=>co(async(j)=>{let M=A.manifest?await Bun.file(A.manifest).json():{},G=j.service.enqueue({topologyId:Wo(j,t).id,kind:"rollout",revision:p,manifest:M});n(`Regional rollout queued: ${G.operation.id}`)})),N.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,p)=>co((A)=>{let j=A.service.enqueue({topologyId:Wo(A,t).id,kind:"failover",targetRegion:p});n(`Failover queued: ${j.operation.id}`)})),N.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,p)=>co((A)=>{let j=A.service.enqueue({topologyId:Wo(A,t).id,kind:"failback",targetRegion:p});n(`Failback queued: ${j.operation.id}`)})),N.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,p)=>co((A)=>{let j=A.service.enqueue({topologyId:Wo(A,t).id,kind:"destroy",confirmation:p.confirm});n(`Regional teardown queued: ${j.operation.id}; replicated data remains retained.`)}))}var qo="0.14.0";async function Nm(){let N=await _e(),t=y(process.cwd(),N),p=new yn(t.store),A=new Sn(p),j=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((M)=>new bn(M,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:p,service:A,cleanup:j}}async function Ai(N){let t=await Nm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}function Ea(N){N.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Ai((p)=>{let A={manifests:p.store.manifests(p.controlPlane.organization.id),windows:p.store.windows(p.controlPlane.project.id),campaigns:p.store.campaigns(p.controlPlane.project.id),cleanups:p.store.cleanups(p.controlPlane.project.id),drills:p.store.drills(p.controlPlane.project.id)},j=[...A.manifests.map((M)=>["update",M.version,M.compatibility.compatible?"compatible":"blocked",M.compatibility.reasons.join("; ")||M.channel]),...A.campaigns.map((M)=>["upgrade",M.id,M.status,M.currentStage??M.fromVersion]),...A.cleanups.map((M)=>["cleanup",M.kind,M.status,`${M.candidates.length} items / ${M.estimatedBytes} bytes`]),...A.drills.map((M)=>["DR drill",M.scenario,M.status,M.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],j)})),N.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,p)=>Ai(async(A)=>{let j=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(p).text()});n(`Trusted ${j.name}: ${j.fingerprint}`)})),N.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,p,A)=>Ai(async(j)=>{let M=await Bun.file(t).json(),G=(await Bun.file(p).text()).trim(),Z=j.store.importManifest({organizationId:j.controlPlane.organization.id,keyId:A,document:M,signature:G,current:{schemaVersion:j.controlPlane.store.health().schemaVersion,currentVersion:qo,platform:process.platform,architecture:process.arch}});n(`Verified ${Z.version}; ${Z.compatibility.compatible?"compatible":"blocked: "+Z.compatibility.reasons.join("; ")}`)})),N.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,p,A)=>Ai((j)=>{let M=j.store.createWindow({projectId:j.controlPlane.project.id,name:t,schedule:p,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${M.name} (${M.id}).`)})),N.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,p,A)=>Ai((j)=>{let M=new Ie(j.controlPlane.store).list(j.controlPlane.project.id).filter((ee)=>ee.status==="ready").map((ee)=>({serverId:ee.id,target:ee.name,previousVersion:ee.bootstrapVersion??qo}));if(!M.length)M.push({target:"control-plane",previousVersion:qo});let G=j.store.createCampaign({projectId:j.controlPlane.project.id,manifestId:t,fromVersion:qo,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:p,targets:M}),Z=j.service.enqueueCampaign(G.id);n(`Staged upgrade queued: ${Z.operation.id}`)})),N.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,p)=>Ai(async(A)=>{let j=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(p.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],j.candidates.map((M)=>[M.id,M.label,String(M.bytes)])),e(`Apply with: cloud cleanup:apply ${j.id} --confirm "DELETE ${j.candidates.length} ${j.kind}"`)})),N.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,p)=>Ai((A)=>{let j=A.service.enqueueCleanup(t,String(p.confirm??""));n(`Cleanup queued: ${j.operation.id}`)})),N.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,p,A)=>Ai((j)=>{let M=j.store.createDrill({projectId:j.controlPlane.project.id,scenario:t,isolatedTarget:p,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${M.id}.`)})),N.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Ai((p)=>{let A=p.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Ta(){try{return(await _e()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Na(N){N.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let p=t?.region||await Ta(),A=new R(p);try{let{Functions:j=[]}=await A.listFunctions({MaxItems:50});if(!j.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],j.map((M)=>[M.FunctionName??"-",M.Runtime??"-",M.MemorySize?`${M.MemorySize} MB`:"-",M.Timeout?`${M.Timeout}s`:"-",M.LastModified??"-"]))}catch(j){r(`Failed to list functions: ${j.message}`),process.exitCode=1}}),N.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,p)=>{i(`Invoking ${t}`);let A=p?.region||await Ta(),j=new R(A),M=new o("Invoking function...");M.start();try{let G=await j.invoke({FunctionName:t,InvocationType:p?.async?"Event":"RequestResponse",Payload:p?.payload||"{}",LogType:p?.async?"None":"Tail"});if(G.FunctionError){if(M.fail(`Function returned an error (${G.FunctionError})`),G.Payload)e(G.Payload);process.exitCode=1;return}if(M.succeed(`Invoked (status ${G.StatusCode})`),G.Payload)e(`
+`)}async function gm(){let N=await _e(),t=y(process.cwd(),N),p=new Ie(t.store),A=new pn(p,[new tt("aws"),new tt("hetzner"),new tt("ssh")]);return{controlPlane:t,store:p,service:A}}async function yi(N){let t=await gm();try{return await N(t)}finally{t.controlPlane.store.close()}}var Ji=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error(`Server ${t} was not found.`);return p},gr=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};function $a(N,t){let p=Number.parseInt(N??"",10);return Number.isFinite(p)&&p>=0?p:t}function hm(N="3h"){let t=N.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let p=Number(t[1])*(t[2]==="h"?3600000:60000);if(p<300000||p>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return p}function Uo(N,t="%"){return N==null?"unavailable":`${N.toFixed(1)}${t}`}async function ym(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",j=E(p,A),M=await ue(j);if(!M?.serverId)throw Error(`No pinned Hetzner server was found for ${j}.`);if(![M.serverName,String(M.serverId),M.stackName].includes(N))throw Error(`Refusing to read ${N}: project state is pinned to ${M.serverName}.`);let G=sr(p),Z=new Ke({apiToken:ar(G.apiToken,p)}),ee=await Z.getServer(M.serverId),re=M.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=new Date,be=new Date(oe.getTime()-hm(t.range)),we=Math.min(3600,Math.max(60,$a(t.step,60))),Ce=await Il({client:Z,serverId:ee.id,cores:Math.max(1,Number(ee.server_type.cores)||1),from:be,to:oe,step:we,remote:{host:re,user:M.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:ee.name,result:Ce},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[ee.name,`${Ce.from} to ${Ce.to}`,`${Uo(Ce.summary.cpuAveragePercent)} / ${Uo(Ce.summary.cpuPeakPercent)}`,`${Uo(Ce.summary.memoryAveragePercent)} / ${Uo(Ce.summary.memoryPeakPercent)}`,Ce.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(Ce.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,Uo(Ce.summary.swapPeakPercent)]])}function El(N){let t=N.targetType.prices?.find((p)=>p.location===N.location);return{serverId:N.serverId,serverName:N.serverName,location:N.location,from:N.currentType.name,to:N.targetType.name,capacityAvailable:N.capacityAvailable,alreadyComplete:N.alreadyComplete,upgradeDisk:N.upgradeDisk,target:{cores:N.targetType.cores,memoryGb:N.targetType.memory,diskGb:N.targetType.disk,architecture:N.targetType.architecture,cpuType:N.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function vm(N){let t=El(N);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function bm(N,t,p){let A=await _e();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let j=p.env??process.env.CLOUD_ENV??"production",M=E(A,j),G=await ue(M),Z=sr(A),ee=new Ke({apiToken:ar(Z.apiToken,A)}),oe=G&&(N===G.serverName||N===String(G.serverId)||N===G.stackName)?await ee.getServer(G.serverId):(await ee.listServers()).find((Ye)=>Ye.name===N||String(Ye.id)===N);if(!oe)throw Error(`Hetzner server ${N} was not found.`);if(G?.serverId&&G.serverId!==oe.id)throw Error(`Refusing to resize ${N}: project state is pinned to server ${G.serverId}.`);let be=pt(t),we=p.upgradeDisk!==!1,Ce=await Zn(ee,oe.id,be,we);if(p.json)console.log(JSON.stringify({schemaVersion:1,plan:El(Ce)},null,2));else vm(Ce);if(!p.apply){if(!p.json)e(`Preview only. Re-run with --apply --confirm ${oe.name} to execute.`);return}if(p.confirm!==oe.name)throw Error(`Resize requires --confirm ${oe.name}.`);let Ee=G?.publicIp??oe.public_net.ipv4?.ip;if(!Ee)throw Error(`Server ${oe.name} has no public IPv4 address for verification.`);let Se={host:Ee,user:G?.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},De=await ls(M),Je=new Date().toISOString(),Ae={schemaVersion:1,operationId:De?.targetType===be&&De.serverId===oe.id?De.operationId:crypto.randomUUID(),stackName:M,serverId:oe.id,serverName:oe.name,sourceType:Ce.currentType.name,targetType:be,upgradeDisk:we,phase:"planning",status:"running",attempts:De?.targetType===be?De.attempts:0,startedAt:De?.targetType===be?De.startedAt:Je,updatedAt:Je,manifest:De?.targetType===be?De.manifest:void 0};await gt(Ae);let Te=$a(p.pollSeconds,900)*1000,Ne=$a(p.maxWaitMinutes,0)*60000,Xe=Date.now();for(;;){let Ye=await Zn(ee,oe.id,be,we);if(!Ye.capacityAvailable&&!Ye.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await gt(Ae),!p.wait){if(!p.json)e(`${be} has no capacity in ${Ye.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Ne>0&&Date.now()-Xe>=Ne)throw Error(`Timed out waiting for ${be} capacity in ${Ye.location}.`);if(!p.json)e(`Waiting ${Math.round(Te/1000)} seconds for ${be} capacity...`);await Bun.sleep(Te);continue}let Qe=await ds(M);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await gt(Ae),await ns({client:ee,serverId:oe.id,targetType:be,upgradeDisk:we,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let $t=await is(Se);return Ae={...Ae,manifest:$t,updatedAt:new Date().toISOString()},await gt(Ae),$t},afterBoot:async($t,wt,Ot,Ut)=>os(Se,wt,Ot,Ut),onPhase:async($t,wt)=>{if(Ae={...Ae,phase:$t,status:$t==="waiting-capacity"?"waiting-capacity":$t==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await gt(Ae),!p.json)e(`${$t}${wt?` ${JSON.stringify(wt)}`:""}`)}}})}finally{await Qe()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await gt(Ae),p.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${oe.name} is on ${be} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&p.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Te/1000)} seconds before retry.`),await Bun.sleep(Te);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await gt(Ae),et}}}async function wm(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",j=E(p,A),M=await ue(j);if(!M?.serverId)throw Error(`No pinned Hetzner server was found for ${j}.`);if(![M.serverName,String(M.serverId),M.stackName].includes(N))throw Error(`Refusing to optimize ${N}: project state is pinned to ${M.serverName}.`);let G=sr(p),Z=new Ke({apiToken:ar(G.apiToken,p)}),ee=await Z.getServer(M.serverId),re=M.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=Yi(p);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:ee.name,plan:oe},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[ee.name,oe.firewallPorts.join(","),oe.monitoring?"on":"off",oe.autoUpdates?"on":"off",`${oe.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${ee.name} to execute.`);return}if(t.confirm!==ee.name)throw Error(`Optimization requires --confirm ${ee.name}.`);let be={host:re,user:M.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15},we=await Wr(be),Ce=we.routeProbes.filter((Ot)=>!Ot.ok),Ee=p.infrastructure?.compute,Se=Q(Ee)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,De=we.failedUnits.filter((Ot)=>!Se.has(Ot));if(De.length>0)throw Error(`Preflight found failed services: ${De.join(", ")}`);if(Ce.length>0)throw Error(`Preflight found unhealthy routes: ${Ce.map((Ot)=>Ot.domain).join(", ")}`);let Je=Q(Ee)?[]:Object.values(p.sites??{}).flatMap((Ot)=>typeof Ot?.port==="number"&&![80,443].includes(Ot.port)?[Ot.port]:[]),Ae=qr({allowSsh:Ee?.allowSsh!==!1,sitePorts:Je,allowedPorts:Ee?.firewall?.allowedPorts}),Te=(M.firewallId?(await Z.listFirewalls()).find((Ot)=>Ot.id===M.firewallId):void 0)??(await Z.listFirewalls()).find((Ot)=>Ot.name===`${p.project.slug}-${A}-app-fw`);if(!Te)throw Error(`Managed firewall for ${ee.name} was not found.`);let Ne=await Z.setFirewallRules(Te.id,Ae);await Promise.all(Ne.map((Ot)=>Z.waitForAction(Ot.id))),await ss(p,be);let[Xe,Ye]=await Promise.all([Wr(be),as(be)]),Qe=cs(oe,Ye),et=xa(we,Xe),$t=Xe.routeProbes.filter((Ot)=>!Ot.ok);if(et.stoppedServices.length>0)Qe.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Qe.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Qe.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Qe.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Qe.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if($t.length>0)Qe.push(`unhealthy routes: ${$t.map((Ot)=>Ot.domain).join(", ")}`);if(Qe.length>0)throw Error(`Host optimization verification failed: ${Qe.join("; ")}`);let wt={serverId:ee.id,serverName:ee.name,services:Xe.runningServices.length,routes:Xe.routeIds.length,healthyDomains:Xe.routeProbes.length,releaseLinks:Xe.releaseLinks.length,databasesAndVolumes:Xe.dataCatalog.length,report:Ye};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:wt},null,2));else n(`${ee.name} passed full host, rpx route, service, release, and data verification.`)}async function Sm(N,t,p){let A=await _e(),j=p.env??"production",M=E(A,j);await yi(async(G)=>{let Z=Ji(G,N),ee=G.store.list(G.controlPlane.project.id,!0),re=Z.provider==="hetzner"&&Z.providerId?(()=>{try{let Te=sr(A);return new Ke({apiToken:ar(Te.apiToken,A)})}catch{return null}})():null,oe=Z.providerId?Number(Z.providerId):Number.NaN,be=await ue(M),we=be!=null&&be.serverId===oe,Ce=new Ir,Ee=Z.trustState==="pinned",Se={takenNames:async()=>{let Te=ee.map((Ne)=>Ne.name);if(re)Te.push(...(await re.listServers()).map((Ne)=>Ne.name));return Te},inventoryName:()=>G.store.get(Z.id)?.name??Z.name,renameInventory:(Te)=>{G.store.update(Z.id,{name:Te})},...re&&Number.isFinite(oe)?{providerName:async()=>(await re.getServer(oe)).name,renameProvider:async(Te)=>{await re.renameServer(oe,Te)}}:{},...we?{stateName:async()=>(await ue(M))?.serverName,writeStateName:async(Te)=>{let Ne=await ue(M);if(Ne)await mt(M,{...Ne,serverName:Te})}}:{},...Ee?{remoteHostname:async()=>{let Te=await Ce.exec(Z,"hostname");return Te.code===0?Te.stdout.trim():void 0},setRemoteHostname:async(Te)=>{let Ne=await Ce.exec(Z,xl(Te));if(Ne.code!==0)throw Error(Ne.stderr.trim()||`hostname exited ${Ne.code}`)}}:{}},De=await Pl(Z.name,t,Se),Je=await vs(De);if(!p.apply){let Te=[re?"":"provider record (no provider id or no API token)",we?"":"local state pin (none points at this server)",Ee?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(p.json){console.log(JSON.stringify({schemaVersion:1,operation:De.operation,target:De.target,rename:{from:Z.name,to:t},notCovered:Te,steps:Je.map((Ne)=>({id:Ne.step.id,title:Ne.step.title,state:Ne.state,change:Ne.step.change,reason:Ne.reason}))},null,2));return}for(let Ne of bs(De,Je))console.log(Ne);for(let Ne of Te)console.log(`  not covered: ${Ne}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await ws(De,Je,{log:(Te)=>e(Te),audit:(Te)=>G.controlPlane.store.appendEvent({projectId:G.controlPlane.project.id,resourceId:Z.resourceId,type:`${Te.operation}.${Te.step}.${Te.state}`,level:Te.state==="failed"?"error":"info",payload:{target:Te.target,renameTo:t,...Te.error?{error:Te.error}:{}}})});if(p.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Te=Ae.steps.find((Ne)=>Ne.state==="failed");throw Error(`${De.operation} stopped at '${Te?.title}': ${Te?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!p.json)n(`Renamed ${Z.name} to ${t}.`)})}function Ca(N){N.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,p)=>{try{await yi(async(A)=>{let j=t?[Ji(A,t)]:A.store.list(A.controlPlane.project.id),M=j.flatMap((G)=>Object.entries(G.capabilities).map(([Z,ee])=>({server:G.name,provider:G.provider,action:Z,...ee})));if(p.json)console.log(JSON.stringify({schemaVersion:1,targets:M},null,2));else c(["Server","Provider","Action","Support","Explanation"],M.map((G)=>[G.server,G.provider,G.action,G.supported?"supported":"unsupported",G.reason??"—"]))})}catch(A){gr(A)}}),N.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,p,A)=>{try{await bm(t,p,A)}catch(j){gr(j)}}),N.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,p)=>{try{await wm(t,p)}catch(A){gr(A)}}),N.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,p)=>{try{await ym(t,p)}catch(A){gr(A)}}),N.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await yi(async(p)=>{let A=p.store.list(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((j)=>[j.name,j.providerId??"—",`${j.provider} / ${j.region??"external"}`,`${j.status} / ${j.trustState}`,j.roles.join(","),`${j.capacity.cpu??0} / ${j.capacity.memoryBytes??0}`,j.heartbeatAt??"never"]))})}catch(p){gr(p)}}),N.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,p)=>{try{await yi(async(A)=>{let j=p.provider;if(!["aws","hetzner","ssh"].includes(j)||!p.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let M=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:j,providerId:p.providerId,endpoint:p.endpoint,sshUser:p.user??"deploy",credentialRef:p.credentialRef??"secret://fleet/agent",region:p.region,roles:String(p.roles??"application").split(","),labels:Object.fromEntries(String(p.labels??"").split(",").map((G)=>G.split("=")).filter((G)=>G[0]&&G[1]))});n(`Enrolled ${M.name} as ${M.id}; no remote mutation was performed.`)})}catch(A){gr(A)}}),N.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,p)=>{try{await yi(async(A)=>{let j=Ji(A,t);if(j=await A.service.test(j.id),j.trustState==="rotation_pending"){if(!p.acceptHostKey)throw Error(`Host key changed to ${j.pendingHostKey}; review it first.`);j=A.service.reviewHostKey(j.id,p.acceptHostKey)}let M=await A.service.validate(j.id);if(p.json)console.log(JSON.stringify(M.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(M.validation?.findings??[]).map((G)=>[G.severity,G.code,G.message,G.remediation??"—"]));if(!M.validation?.valid)process.exitCode=1})}catch(A){gr(A)}}),N.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,p)=>{try{await yi(async(A)=>{let j=A.service.bootstrap(Ji(A,t).id,!!p.apply);if(j.preview)c(["Step"],j.steps.map((M)=>[M]));else n(`Bootstrap queued: ${j.operation?.id}`)})}catch(A){gr(A)}}),N.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,p,A)=>{try{await Sm(t,p,A)}catch(j){gr(j)}}),N.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,p)=>{try{await yi(async(A)=>n(A.service.drain(Ji(A,t).id,!!p.complete).status))}catch(A){gr(A)}}),N.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await yi(async(p)=>{p.service.uncordon(Ji(p,t).id),n(`Uncordoned ${t}.`)})}catch(p){gr(p)}}),N.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,p)=>{try{await yi(async(A)=>{A.service.archive(Ji(A,t).id,p.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){gr(A)}}),N.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await yi(async(p)=>{let A=Ji(p,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let j=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),M=await j.exited;if(M)process.exitCode=M})}catch(p){gr(p)}});for(let[t,p]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])N.command(t,p).action(async(...A)=>Fr(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Dl,mkdirSync as $m,readFileSync as Cm,writeFileSync as Am}from"node:fs";import{join as Tl,resolve as km}from"node:path";var Aa=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};async function Rm(){try{return await _e()}catch{return}}function Im(N){if(N===void 0)return;let t=Number(N);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${N}'.`);return t}function Nl(N,t,p){let A=N?.ssh?.hosts?.find((j)=>j.host===t);return new pr({hosts:t?[A??{host:t}]:N?.ssh?.hosts,user:p.user,port:Im(p.port),privateKeyPath:p.key,hostKey:N?.ssh?.hostKey,sudo:N?.ssh?.sudo,profile:p.profile??N?.ssh?.profile,publicIp:N?.ssh?.publicIp,lan:N?.ssh?.lan})}var Ol=1073741824;function Ra(N){N.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,p)=>{try{let A=await Rm(),j=Nl(A,t,p),M=t??j.targetHost(),G=await j.ensureHostKey(M),{facts:Z,findings:ee}=await j.preflight(M);if(p.json)console.log(JSON.stringify({schemaVersion:1,host:M,hostKeyFingerprint:G.fingerprint,facts:Z,findings:ee},null,2));else{if(i(`Preflight ${M}`),G.pinnedNow)e(`Pinned host key ${G.fingerprint}`);if(e(`${Z.os} on ${Z.arch}, ${Z.cpuCores} cores, ${(Z.memoryBytes/Ol).toFixed(1)} GiB memory, ${(Z.diskFreeBytes/Ol).toFixed(1)} GiB free`),Z.piModel)e(Z.piModel);if(Z.lanIp)e(`LAN address ${Z.lanIp}`);if(console.log(Hr(ee)),ur(ee))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(ur(ee))process.exitCode=1}catch(A){Aa(A)}}),N.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let p=await _e(),A=t.env??"production";if(t.dryRun){let G=dr(p),[Z]=G.hosts;console.log(lr({config:p,environment:A,profile:G.profile,sudoUser:Z.user!=="root"?Z.user:void 0,lan:G.lan}));return}let j=Nl(p,void 0,{});i(`Adopt ${j.targetHost()}`);let M=await j.provisionComputeInfrastructure({config:p,environment:A});n(`${M.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(p){Aa(p)}}),N.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let p=t.os??"raspberry-pi-os";if(!(p in Xi))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${p}'.`);let A=await _e(),j=t.env??"production",M=dr(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:p==="raspberry-pi-os"?"raspberry-pi":void 0}),G=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),Z=zr(t.key??"~/.ssh/id_ed25519.pub");if(!Dl(Z))throw Error(`Public key not found at ${Z}; pass --key <path to a .pub file>.`);let ee=Cm(Z,"utf8").trim(),re;if(t.wifiSsid){let Ee=t.wifiPassphraseEnv??"WIFI_PASSWORD",Se=process.env[Ee];if(!Se)throw Error(`--wifi-ssid needs the passphrase in $${Ee} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");re={ssid:t.wifiSsid,passphrase:Se,country:t.wifiCountry}}let oe=lr({config:A,environment:j,profile:M.profile,sudoUser:G!=="root"?G:void 0,lan:M.lan}),be=Qi({hostname:t.hostname,user:G,publicKey:ee,timezone:t.timezone,locale:t.locale,wifi:re},oe,{os:p}),we=km(t.out);$m(we,{recursive:!0});let Ce=Object.keys(be.files).filter((Ee)=>Dl(Tl(we,Ee)));if(Ce.length>0&&!t.force)throw Error(`${Ce.join(", ")} already exist in ${we}; pass --force to overwrite.`);for(let[Ee,Se]of Object.entries(be.files))Am(Tl(we,Ee),Se,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(be.files).join(", ")} to ${we}`),console.log(be.instructions)}catch(p){Aa(p)}})}async function Pm(){let N=await _e(),t=y(process.cwd(),N),p=new mn(t.store),A=new gn(p,new Ie(t.store));return{controlPlane:t,store:p,service:A}}async function Vo(N){let t=await Pm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Ss=(N)=>Object.fromEntries(String(N??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Ll=(N)=>Object.fromEntries(Object.entries(Ss(N)).map(([t,p])=>[t,Number(p)]));function Ia(N){N.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>Vo((p)=>{let A=p.store.listPools(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((j)=>[j.name,j.purpose,j.backend,`${j.region??"any"} / ${j.architecture??"any"}`,j.status,JSON.stringify(j.capacity),String(j.concurrency)]))})),N.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,p)=>Vo((A)=>{let{purpose:j,backend:M}=p;if(!["application","build","worker","monitoring","backup"].includes(j)||!["server","ecs","asg"].includes(M))throw Error("Unsupported pool purpose or backend.");let G=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:j,backend:M,region:p.region,architecture:p.arch,labels:Ss(p.labels),requiredServerLabels:Ss(p.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Ll(p.capacity)},maxWorkloads:Number(p.max),costWeight:1,concurrency:Number(p.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${G.name} (${G.id}).`)})),N.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,p)=>Vo((A)=>{let j=A.store.listPools(A.controlPlane.project.id).find((G)=>G.id===t||G.name===t),M=new Ie(A.controlPlane.store).list(A.controlPlane.project.id).find((G)=>G.id===p||G.name===p);if(!j||!M)throw Error("Pool or server was not found.");A.store.addMember(j.id,M.id),n(`Attached ${M.name} to ${j.name}.`)})),N.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>Vo((p)=>{let A=p.service.explain(p.controlPlane.project.id,{purpose:t.purpose,resources:Ll(t.resources),region:t.region,architecture:t.arch,labels:Ss(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((j)=>[j.poolName,j.serverId??"provider-managed",j.eligible?"yes":"no",JSON.stringify(j.available),`${j.score.fit.toFixed(2)} / ${j.score.spread} / ${j.score.cost}`,j.reasons.join("; ")||"eligible"]))})),N.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>Vo((p)=>{let A=p.store.listPools(p.controlPlane.project.id).find((M)=>M.id===t||M.name===t);if(!A)throw Error("Pool was not found.");let j=p.service.drainPool(A.id);n(`Draining ${A.name}: moved ${j.moved.length}, blocked ${j.blocked.length} stateful placement(s).`)}))}async function xm(){let N=await _e(),t=y(process.cwd(),N),p=new fn(t.store),A=new hn(p);return{controlPlane:t,store:p,service:A}}async function co(N){let t=await xm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Wo=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error("Regional topology was not found.");return p},Em=(N)=>N.split(",").map((t,p)=>{let[A,j="aws"]=t.split(":");return{region:String(A),provider:j,role:p===0?"primary":"secondary"}}),Dm=(N)=>{let t=new Set(["s3","dynamodb","secrets"]),p=N.split(",").map((j)=>j.trim()),A=p.find((j)=>!t.has(j));if(A)throw Error(`Unsupported replication kind: ${A}`);return p};function Pa(N){N.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>co((p)=>{let A=p.store.list(p.controlPlane.project.id).map((j)=>({topology:j,targets:p.store.targets(j.id),channels:p.store.channels(j.id),route:p.store.route(j.id),executions:p.store.executions(j.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((j)=>[j.topology.name,j.topology.hostname,j.topology.activeRegion,j.topology.status,j.topology.revision??"—",`${j.channels.filter((M)=>M.status==="in_sync").length}/${j.channels.length} in sync`]))})),N.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,p)=>co((A)=>{if(!p.hostname||!p.regions)throw Error("--hostname and --regions are required.");let j=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:p.hostname,regions:Em(p.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Dm(String(p.replicate)),maxLagSeconds:Number(p.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!p.cdn,wafEnabled:!!p.waf});n(`Created ${j.name} (${j.id}); run region:rollout with an immutable manifest.`)})),N.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,p,A)=>co((j)=>c(["Step"],j.service.plan(Wo(j,t).id,p,A.target).map((M)=>[M])))),N.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,p,A)=>co(async(j)=>{let M=A.manifest?await Bun.file(A.manifest).json():{},G=j.service.enqueue({topologyId:Wo(j,t).id,kind:"rollout",revision:p,manifest:M});n(`Regional rollout queued: ${G.operation.id}`)})),N.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,p)=>co((A)=>{let j=A.service.enqueue({topologyId:Wo(A,t).id,kind:"failover",targetRegion:p});n(`Failover queued: ${j.operation.id}`)})),N.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,p)=>co((A)=>{let j=A.service.enqueue({topologyId:Wo(A,t).id,kind:"failback",targetRegion:p});n(`Failback queued: ${j.operation.id}`)})),N.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,p)=>co((A)=>{let j=A.service.enqueue({topologyId:Wo(A,t).id,kind:"destroy",confirmation:p.confirm});n(`Regional teardown queued: ${j.operation.id}; replicated data remains retained.`)}))}var qo="0.15.1";async function Nm(){let N=await _e(),t=y(process.cwd(),N),p=new yn(t.store),A=new Sn(p),j=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((M)=>new bn(M,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:p,service:A,cleanup:j}}async function Ai(N){let t=await Nm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}function Ea(N){N.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Ai((p)=>{let A={manifests:p.store.manifests(p.controlPlane.organization.id),windows:p.store.windows(p.controlPlane.project.id),campaigns:p.store.campaigns(p.controlPlane.project.id),cleanups:p.store.cleanups(p.controlPlane.project.id),drills:p.store.drills(p.controlPlane.project.id)},j=[...A.manifests.map((M)=>["update",M.version,M.compatibility.compatible?"compatible":"blocked",M.compatibility.reasons.join("; ")||M.channel]),...A.campaigns.map((M)=>["upgrade",M.id,M.status,M.currentStage??M.fromVersion]),...A.cleanups.map((M)=>["cleanup",M.kind,M.status,`${M.candidates.length} items / ${M.estimatedBytes} bytes`]),...A.drills.map((M)=>["DR drill",M.scenario,M.status,M.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],j)})),N.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,p)=>Ai(async(A)=>{let j=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(p).text()});n(`Trusted ${j.name}: ${j.fingerprint}`)})),N.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,p,A)=>Ai(async(j)=>{let M=await Bun.file(t).json(),G=(await Bun.file(p).text()).trim(),Z=j.store.importManifest({organizationId:j.controlPlane.organization.id,keyId:A,document:M,signature:G,current:{schemaVersion:j.controlPlane.store.health().schemaVersion,currentVersion:qo,platform:process.platform,architecture:process.arch}});n(`Verified ${Z.version}; ${Z.compatibility.compatible?"compatible":"blocked: "+Z.compatibility.reasons.join("; ")}`)})),N.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,p,A)=>Ai((j)=>{let M=j.store.createWindow({projectId:j.controlPlane.project.id,name:t,schedule:p,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${M.name} (${M.id}).`)})),N.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,p,A)=>Ai((j)=>{let M=new Ie(j.controlPlane.store).list(j.controlPlane.project.id).filter((ee)=>ee.status==="ready").map((ee)=>({serverId:ee.id,target:ee.name,previousVersion:ee.bootstrapVersion??qo}));if(!M.length)M.push({target:"control-plane",previousVersion:qo});let G=j.store.createCampaign({projectId:j.controlPlane.project.id,manifestId:t,fromVersion:qo,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:p,targets:M}),Z=j.service.enqueueCampaign(G.id);n(`Staged upgrade queued: ${Z.operation.id}`)})),N.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,p)=>Ai(async(A)=>{let j=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(p.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],j.candidates.map((M)=>[M.id,M.label,String(M.bytes)])),e(`Apply with: cloud cleanup:apply ${j.id} --confirm "DELETE ${j.candidates.length} ${j.kind}"`)})),N.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,p)=>Ai((A)=>{let j=A.service.enqueueCleanup(t,String(p.confirm??""));n(`Cleanup queued: ${j.operation.id}`)})),N.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,p,A)=>Ai((j)=>{let M=j.store.createDrill({projectId:j.controlPlane.project.id,scenario:t,isolatedTarget:p,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${M.id}.`)})),N.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Ai((p)=>{let A=p.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Ta(){try{return(await _e()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Na(N){N.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let p=t?.region||await Ta(),A=new R(p);try{let{Functions:j=[]}=await A.listFunctions({MaxItems:50});if(!j.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],j.map((M)=>[M.FunctionName??"-",M.Runtime??"-",M.MemorySize?`${M.MemorySize} MB`:"-",M.Timeout?`${M.Timeout}s`:"-",M.LastModified??"-"]))}catch(j){r(`Failed to list functions: ${j.message}`),process.exitCode=1}}),N.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,p)=>{i(`Invoking ${t}`);let A=p?.region||await Ta(),j=new R(A),M=new o("Invoking function...");M.start();try{let G=await j.invoke({FunctionName:t,InvocationType:p?.async?"Event":"RequestResponse",Payload:p?.payload||"{}",LogType:p?.async?"None":"Tail"});if(G.FunctionError){if(M.fail(`Function returned an error (${G.FunctionError})`),G.Payload)e(G.Payload);process.exitCode=1;return}if(M.succeed(`Invoked (status ${G.StatusCode})`),G.Payload)e(`
 Response:`),e(G.Payload);if(G.LogResult)e(`
 Logs:`),e(Buffer.from(G.LogResult,"base64").toString("utf-8"))}catch(G){M.fail(`Invocation failed: ${G.message}`),process.exitCode=1}}),N.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(t,p)=>{i(`Logs for ${t}`);let A=p?.region||await Ta(),j=new ne(A),M=t.startsWith("/aws/lambda/")?t:`/aws/lambda/${t}`,G=Number(p?.since??15),Z=(ee)=>{for(let re of ee){let oe=re.timestamp?new Date(re.timestamp).toISOString():"";e(`${oe}  ${(re.message??"").trimEnd()}`)}};try{let ee=Date.now()-G*60000,{events:re=[]}=await j.filterLogEvents({logGroupName:M,startTime:ee,filterPattern:p?.filter,limit:200});if(Z(re),re.length)ee=(re[re.length-1].timestamp??ee)+1;if(p?.tail){e(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((be)=>setTimeout(be,3000));let{events:oe=[]}=await j.filterLogEvents({logGroupName:M,startTime:ee,filterPattern:p?.filter,limit:200});if(oe.length)Z(oe),ee=(oe[oe.length-1].timestamp??ee)+1}}}catch(ee){r(`Failed to read logs: ${ee.message}`),process.exitCode=1}})}async function jl(N){let t=Bun.spawn(["docker",...N],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[p,A]=await Promise.all([t.exited,new Response(t.stderr).text()]);return{ok:p===0,exitCode:p,command:["docker",...N].join(" "),stderr:A.trim()}}function Oa(N){N.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(t)=>{let p=["build","--file",t.file??"Dockerfile","--tag",t.tag??"latest","."];if(t.dryRun){console.log(`docker ${p.join(" ")}`);return}let A=await jl(p);if(t.json)console.log(JSON.stringify(A));if(!A.ok)r(A.stderr||`docker exited ${A.exitCode}`),process.exitCode=A.exitCode;else n(`Built ${t.tag??"latest"}.`)}),N.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(t)=>{if(!t.image){r("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(t.dryRun){console.log(`docker push ${t.image}`);return}let p=await jl(["push",t.image]);if(t.json)console.log(JSON.stringify(p));if(!p.ok)r(p.stderr),process.exitCode=p.exitCode;else n(`Pushed ${t.image}.`)}),N.command("container:deploy","Deploy a container image").action(async()=>Fr("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function La(N){N.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t)=>{i("Domains");try{let p=pi(t?.provider),A=ir(t?.provider)?.provider||"unknown",j=new o(`Fetching domains from ${A}...`);j.start();let M=await p.listDomains();if(j.succeed(`Found ${M.length} domain(s)`),M.length===0){e("No domains found in this provider");return}let G=M.map((Z)=>[Z,"Active","-",A.charAt(0).toUpperCase()+A.slice(1)]);c(["Domain","Status","SSL","Provider"],G)}catch(p){r(`Failed to list domains: ${p instanceof Error?p.message:String(p)}`)}}),N.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,p)=>{i(`Adding Domain: ${t}`);try{let A=pi(p?.provider),j=ir(p?.provider)?.provider||"unknown",M=new o(`Checking if ${j} can manage ${t}...`);if(M.start(),await A.canManageDomain(t))M.succeed(`Domain ${t} is already available in ${j}`),e(`
@@ -393,7 +393,7 @@ Resources: ${Ot}
 
 View in console:
 https://console.aws.amazon.com/cloudformation/home?region=${we}#/stacks/stackinfo?stackId=${encodeURIComponent(be)}`,"green"),Object.keys(Vt).length>0){e(`
-Stack Outputs:`);for(let[vt,Lt]of Object.entries(Vt))e(`  - ${vt}: ${Lt}`)}if(G.infrastructure?.storage)for(let[vt,Lt]of Object.entries(G.infrastructure.storage)){if(!Lt.website||!Lt.root)continue;let cr=Vt[`${vt}BucketName`]||Vt.FrontendBucketName,nr=Vt[`${vt}CloudFrontDistributionId`];if(!cr){a(`Could not find bucket name for storage '${vt}' — skipping file upload`);continue}if(!Cr(Lt.root)){a(`Source directory not found: ${Lt.root} — skipping file upload for '${vt}'`);continue}m(`Uploading files from ${Lt.root} to s3://${cr}...`);let{uploadStaticFiles:di,invalidateCache:ho}=await import("./chunk-1qn174w2.js"),Ar=await di({sourceDir:Lt.root,bucket:cr,region:we,onProgress:(nn,on,Qr)=>{if(nn%10===0||nn===on)e(`  ${nn}/${on}: ${Qr}`)}});if(Ar.errors.length>0)a(`Upload completed with errors: ${Ar.errors.join(", ")}`);else{let nn=Ar.skipped>0?`Uploaded ${Ar.uploaded} files (${Ar.skipped} unchanged)`:`Uploaded ${Ar.uploaded} files`;n(nn)}if(nr&&Ar.uploaded>0){m("Invalidating CloudFront cache...");let{invalidationId:nn}=await ho(nr);n(`Cache invalidation created: ${nn}`)}}if(G.infrastructure?.compute)await bc(G,A,we,t?.site);if(G.infrastructure?.compute&&G.sites){let vt=Object.values(G.sites).map((Lt)=>Lt.domain).filter((Lt)=>!!Lt);if(vt.length>0)m("Syncing CloudFront dynamic HTTP methods for app domains..."),await Bs(vt)}}catch(M){if(r(`Deployment failed: ${M.message}`),process.exitCode=1,M.stack)e(`
+Stack Outputs:`);for(let[vt,Lt]of Object.entries(Vt))e(`  - ${vt}: ${Lt}`)}if(G.infrastructure?.storage)for(let[vt,Lt]of Object.entries(G.infrastructure.storage)){if(!Lt.website||!Lt.root)continue;let cr=Vt[`${vt}BucketName`]||Vt.FrontendBucketName,nr=Vt[`${vt}CloudFrontDistributionId`];if(!cr){a(`Could not find bucket name for storage '${vt}' — skipping file upload`);continue}if(!Cr(Lt.root)){a(`Source directory not found: ${Lt.root} — skipping file upload for '${vt}'`);continue}m(`Uploading files from ${Lt.root} to s3://${cr}...`);let{uploadStaticFiles:di,invalidateCache:ho}=await import("./chunk-8dt5ehyk.js"),Ar=await di({sourceDir:Lt.root,bucket:cr,region:we,onProgress:(nn,on,Qr)=>{if(nn%10===0||nn===on)e(`  ${nn}/${on}: ${Qr}`)}});if(Ar.errors.length>0)a(`Upload completed with errors: ${Ar.errors.join(", ")}`);else{let nn=Ar.skipped>0?`Uploaded ${Ar.uploaded} files (${Ar.skipped} unchanged)`:`Uploaded ${Ar.uploaded} files`;n(nn)}if(nr&&Ar.uploaded>0){m("Invalidating CloudFront cache...");let{invalidationId:nn}=await ho(nr);n(`Cache invalidation created: ${nn}`)}}if(G.infrastructure?.compute)await bc(G,A,we,t?.site);if(G.infrastructure?.compute&&G.sites){let vt=Object.values(G.sites).map((Lt)=>Lt.domain).filter((Lt)=>!!Lt);if(vt.length>0)m("Syncing CloudFront dynamic HTTP methods for app domains..."),await Bs(vt)}}catch(M){if(r(`Deployment failed: ${M.message}`),process.exitCode=1,M.stack)e(`
 Stack trace:`),console.error(M.stack)}finally{if(j)await j()}}),N.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async(t)=>{i("Deploying Server Infrastructure");try{let p=await _e(),A=t?.env||"production",j=p.project.region||"us-east-1",M=wr(p);if(M){r(M),process.exitCode=1;return}if(!so(p)){r("No `infrastructure.compute` configured — nothing to deploy as a server."),e("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(e(`Region: ${j}`),e(`Environment: ${A}`),!await bc(p,A,j,t?.site)){process.exitCode=1;return}if(p.sites){let Z=Object.values(p.sites).map((ee)=>ee.domain).filter((ee)=>!!ee);if(Z.length>0)m("Syncing CloudFront dynamic HTTP methods for app domains..."),await Bs(Z)}n(`
 Server deployment complete!`)}catch(p){r(`Deployment failed: ${p.message}`),process.exitCode=1}}),N.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let p=await _e(),A=t?.env||"production",j=wr(p);if(j){r(j),process.exitCode=1;return}let{deployServerlessApp:M,redeployServerlessApp:G}=await import("./chunk-xtp2zf3j.js");if(t?.redeploy){await G(p,A);return}await M(p,A,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(p){r(`Deployment failed: ${p.message}`),process.exitCode=1}}),N.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let p=await _e(),A=t?.env||"production",{rollbackServerlessApp:j}=await import("./chunk-xtp2zf3j.js");await j(p,A)}catch(p){r(`Rollback failed: ${p.message}`),process.exitCode=1}}),N.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").action(async(t,p)=>{i("Rolling Back Release");try{let A=await _e(),j=p?.env||"production",M=t||Object.keys(A.sites||{})[0];if(!M){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:G}=await import("./chunk-2synp9gh.js"),Z=await G({driver:x({config:A}),slug:A.project.slug,environment:j,logger:g},{siteName:M,to:p?.to});if(!Z.success){r(`Rollback failed: ${Z.error||"unknown error"}`),process.exitCode=1;return}for(let ee of Z.perInstance||[])e(`  ${ee.instanceId}: ${ee.output?.trim()||ee.status}`)}catch(A){r(`Rollback failed: ${A.message}`),process.exitCode=1}}),N.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,p)=>{i("Deployment History");try{let A=await _e(),j=p?.env||"production",M=t||Object.keys(A.sites||{})[0];if(!M){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:G}=await import("./chunk-2synp9gh.js"),Z=await G({driver:x({config:A}),slug:A.project.slug,environment:j,logger:g},{siteName:M,limit:Number.parseInt(p?.limit||"20",10)||20});if(!Z.success){r(`Could not read history: ${Z.error||"unknown error"}`),process.exitCode=1;return}for(let ee of Z.perInstance||[])e(`
 ${ee.instanceId}:`),e(ee.output?.trimEnd()||"(no output)")}catch(A){r(`History lookup failed: ${A.message}`),process.exitCode=1}}),N.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(t,p,A)=>{i(`Running Recipe: ${t}`);try{if(!Cr(p)){r(`Recipe script not found: ${p}`),process.exitCode=1;return}let j=await _e(),M=A?.env||"production",G=Sc(p,"utf8").split(`
@@ -629,7 +629,7 @@ Full Event Record:`);let re=JSON.parse(ee.CloudTrailEvent);console.log(JSON.stri
 Create this trail?`,!0)){e("Operation cancelled");return}let M=new o("Creating trail...");M.start();let G=await A.createTrail({Name:t,S3BucketName:p.bucket,S3KeyPrefix:p.prefix,IsMultiRegionTrail:p.multiRegion,EnableLogFileValidation:p.validation,IncludeGlobalServiceEvents:p.globalEvents??!0});M.text="Starting logging...",await A.startLogging(t),M.succeed("Trail created and logging started"),n(`
 Trail ARN: ${G.TrailARN}`),e(`S3 Bucket: ${G.S3BucketName}`)}catch(A){r(`Failed to create trail: ${A.message}`),process.exit(1)}}),N.command("audit:start <trailName>","Start CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,p)=>{i("Start CloudTrail Logging");try{let A=await no(p.region),j=new o("Starting logging...");j.start(),await A.startLogging(t),j.succeed("Logging started")}catch(A){r(`Failed to start logging: ${A.message}`),process.exit(1)}}),N.command("audit:stop <trailName>","Stop CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,p)=>{i("Stop CloudTrail Logging");try{let A=await no(p.region);if(a(`This will stop logging for trail: ${t}`),!await d(`
 Stop logging?`,!1)){e("Operation cancelled");return}let M=new o("Stopping logging...");M.start(),await A.stopLogging(t),M.succeed("Logging stopped")}catch(A){r(`Failed to stop logging: ${A.message}`),process.exit(1)}}),N.command("audit:delete <trailName>","Delete a CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,p)=>{i("Delete CloudTrail Trail");try{let A=await no(p.region);if(a(`This will permanently delete trail: ${t}`),!await d(`
-Delete this trail?`,!1)){e("Operation cancelled");return}let M=new o("Deleting trail...");M.start(),await A.deleteTrail(t),M.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function qc(N){N.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let p=await _e(),A=t.region||p.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${p.project.name||"Unknown"}`),e("");let j=[],M=new o("Checking EC2 instances...");M.start();try{let{EC2Client:Se}=await import("./chunk-j3w462ep.js"),Je=await new Se(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Te=0,Ne=0;for(let Xe of Je.Reservations||[])for(let Ye of Xe.Instances||[])if(Ne++,Ye.State?.Name==="running")Ae++;else if(Ye.State?.Name==="stopped")Te++;M.succeed("EC2 instances checked"),j.push({name:"EC2 Instances",status:Ae>0?"OK":Ne>0?"WARN":"INFO",details:`${Ae} running, ${Te} stopped, ${Ne} total`})}catch(Se){M.fail("EC2 check failed"),j.push({name:"EC2 Instances",status:"ERROR",details:Se.message})}let G=new o("Checking RDS instances...");G.start();try{let{RDSClient:Se}=await import("./chunk-t8n2961n.js"),Ae=(await new Se(A).describeDBInstances()).DBInstances||[],Te=Ae.filter((Ne)=>Ne.DBInstanceStatus==="available").length;G.succeed("RDS instances checked"),j.push({name:"RDS Databases",status:Ae.length>0&&Te===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Te} available, ${Ae.length} total`})}catch(Se){G.fail("RDS check failed"),j.push({name:"RDS Databases",status:"ERROR",details:Se.message})}let Z=new o("Checking Lambda functions...");Z.start();try{let{LambdaClient:Se}=await import("./chunk-fbe5kk6w.js"),Ae=(await new Se(A).listFunctions()).Functions||[];Z.succeed("Lambda functions checked"),j.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(Se){Z.fail("Lambda check failed"),j.push({name:"Lambda Functions",status:"ERROR",details:Se.message})}let ee=new o("Checking S3 buckets...");ee.start();try{let{S3Client:Se}=await import("./chunk-ntahmgqg.js"),Ae=(await new Se(A).listBuckets()).Buckets||[];ee.succeed("S3 buckets checked"),j.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(Se){ee.fail("S3 check failed"),j.push({name:"S3 Buckets",status:"ERROR",details:Se.message})}let re=new o("Checking CloudFront distributions...");re.start();try{let{CloudFrontClient:Se}=await import("./chunk-9yra64dd.js"),Je=await new Se().listDistributions(),Ae=Je.filter((Te)=>Te.Status==="Deployed").length;re.succeed("CloudFront checked"),j.push({name:"CloudFront",status:Je.length>0&&Ae===Je.length?"OK":Je.length>0?"WARN":"INFO",details:`${Ae} deployed, ${Je.length} total`})}catch(Se){re.fail("CloudFront check failed"),j.push({name:"CloudFront",status:"ERROR",details:Se.message})}let oe=new o("Checking SQS queues...");oe.start();try{let{SQSClient:Se}=await import("./chunk-t1eft7s7.js"),Ae=(await new Se(A).listQueues()).QueueUrls||[];oe.succeed("SQS queues checked"),j.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(Se){oe.fail("SQS check failed"),j.push({name:"SQS Queues",status:"ERROR",details:Se.message})}let be=new o("Checking CloudFormation stacks...");be.start();try{let{CloudFormationClient:Se}=await import("./chunk-4qzpqmhe.js"),Ae=(await new Se(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Te=Ae.filter((Ye)=>Ye.StackStatus==="CREATE_COMPLETE"||Ye.StackStatus==="UPDATE_COMPLETE").length,Ne=Ae.filter((Ye)=>Ye.StackStatus?.includes("IN_PROGRESS")).length,Xe=Ae.filter((Ye)=>Ye.StackStatus?.includes("ROLLBACK")).length;be.succeed("CloudFormation checked"),j.push({name:"CloudFormation",status:Xe>0?"WARN":Ne>0?"INFO":"OK",details:`${Te} healthy, ${Ne} in progress, ${Xe} rolled back`})}catch(Se){be.fail("CloudFormation check failed"),j.push({name:"CloudFormation",status:"ERROR",details:Se.message})}let we=new o("Checking SSL certificates...");we.start();try{let{ACMClient:Se}=await import("./chunk-kdk3jhyc.js"),De=new Se("us-east-1"),Ae=(await De.listCertificates()).CertificateSummaryList||[],Te=await Promise.all(Ae.map((Qe)=>De.describeCertificate({CertificateArn:Qe.CertificateArn}))),Ne=Te.filter((Qe)=>Qe.Status==="ISSUED").length,Xe=Te.filter((Qe)=>Qe.Status==="PENDING_VALIDATION").length,Ye=Te.filter((Qe)=>{if(Qe.NotAfter)return(new Date(Qe.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;we.succeed("SSL certificates checked"),j.push({name:"SSL Certificates",status:Ye>0?"WARN":Xe>0?"INFO":"OK",details:`${Ne} issued, ${Xe} pending${Ye>0?`, ${Ye} expiring soon`:""}`})}catch(Se){we.fail("ACM check failed"),j.push({name:"SSL Certificates",status:"ERROR",details:Se.message})}e(`
+Delete this trail?`,!1)){e("Operation cancelled");return}let M=new o("Deleting trail...");M.start(),await A.deleteTrail(t),M.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function qc(N){N.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let p=await _e(),A=t.region||p.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${p.project.name||"Unknown"}`),e("");let j=[],M=new o("Checking EC2 instances...");M.start();try{let{EC2Client:Se}=await import("./chunk-j3w462ep.js"),Je=await new Se(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Te=0,Ne=0;for(let Xe of Je.Reservations||[])for(let Ye of Xe.Instances||[])if(Ne++,Ye.State?.Name==="running")Ae++;else if(Ye.State?.Name==="stopped")Te++;M.succeed("EC2 instances checked"),j.push({name:"EC2 Instances",status:Ae>0?"OK":Ne>0?"WARN":"INFO",details:`${Ae} running, ${Te} stopped, ${Ne} total`})}catch(Se){M.fail("EC2 check failed"),j.push({name:"EC2 Instances",status:"ERROR",details:Se.message})}let G=new o("Checking RDS instances...");G.start();try{let{RDSClient:Se}=await import("./chunk-t8n2961n.js"),Ae=(await new Se(A).describeDBInstances()).DBInstances||[],Te=Ae.filter((Ne)=>Ne.DBInstanceStatus==="available").length;G.succeed("RDS instances checked"),j.push({name:"RDS Databases",status:Ae.length>0&&Te===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Te} available, ${Ae.length} total`})}catch(Se){G.fail("RDS check failed"),j.push({name:"RDS Databases",status:"ERROR",details:Se.message})}let Z=new o("Checking Lambda functions...");Z.start();try{let{LambdaClient:Se}=await import("./chunk-fbe5kk6w.js"),Ae=(await new Se(A).listFunctions()).Functions||[];Z.succeed("Lambda functions checked"),j.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(Se){Z.fail("Lambda check failed"),j.push({name:"Lambda Functions",status:"ERROR",details:Se.message})}let ee=new o("Checking S3 buckets...");ee.start();try{let{S3Client:Se}=await import("./chunk-ntahmgqg.js"),Ae=(await new Se(A).listBuckets()).Buckets||[];ee.succeed("S3 buckets checked"),j.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(Se){ee.fail("S3 check failed"),j.push({name:"S3 Buckets",status:"ERROR",details:Se.message})}let re=new o("Checking CloudFront distributions...");re.start();try{let{CloudFrontClient:Se}=await import("./chunk-9yra64dd.js"),Je=await new Se().listDistributions(),Ae=Je.filter((Te)=>Te.Status==="Deployed").length;re.succeed("CloudFront checked"),j.push({name:"CloudFront",status:Je.length>0&&Ae===Je.length?"OK":Je.length>0?"WARN":"INFO",details:`${Ae} deployed, ${Je.length} total`})}catch(Se){re.fail("CloudFront check failed"),j.push({name:"CloudFront",status:"ERROR",details:Se.message})}let oe=new o("Checking SQS queues...");oe.start();try{let{SQSClient:Se}=await import("./chunk-t1eft7s7.js"),Ae=(await new Se(A).listQueues()).QueueUrls||[];oe.succeed("SQS queues checked"),j.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(Se){oe.fail("SQS check failed"),j.push({name:"SQS Queues",status:"ERROR",details:Se.message})}let be=new o("Checking CloudFormation stacks...");be.start();try{let{CloudFormationClient:Se}=await import("./chunk-4qzpqmhe.js"),Ae=(await new Se(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Te=Ae.filter((Ye)=>Ye.StackStatus==="CREATE_COMPLETE"||Ye.StackStatus==="UPDATE_COMPLETE").length,Ne=Ae.filter((Ye)=>Ye.StackStatus?.includes("IN_PROGRESS")).length,Xe=Ae.filter((Ye)=>Ye.StackStatus?.includes("ROLLBACK")).length;be.succeed("CloudFormation checked"),j.push({name:"CloudFormation",status:Xe>0?"WARN":Ne>0?"INFO":"OK",details:`${Te} healthy, ${Ne} in progress, ${Xe} rolled back`})}catch(Se){be.fail("CloudFormation check failed"),j.push({name:"CloudFormation",status:"ERROR",details:Se.message})}let we=new o("Checking SSL certificates...");we.start();try{let{ACMClient:Se}=await import("./chunk-k9pb99tr.js"),De=new Se("us-east-1"),Ae=(await De.listCertificates()).CertificateSummaryList||[],Te=await Promise.all(Ae.map((Qe)=>De.describeCertificate({CertificateArn:Qe.CertificateArn}))),Ne=Te.filter((Qe)=>Qe.Status==="ISSUED").length,Xe=Te.filter((Qe)=>Qe.Status==="PENDING_VALIDATION").length,Ye=Te.filter((Qe)=>{if(Qe.NotAfter)return(new Date(Qe.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;we.succeed("SSL certificates checked"),j.push({name:"SSL Certificates",status:Ye>0?"WARN":Xe>0?"INFO":"OK",details:`${Ne} issued, ${Xe} pending${Ye>0?`, ${Ye} expiring soon`:""}`})}catch(Se){we.fail("ACM check failed"),j.push({name:"SSL Certificates",status:"ERROR",details:Se.message})}e(`
 `+"=".repeat(60)),e("HEALTH SUMMARY"),e("=".repeat(60)+`
 `);for(let Se of j){let De="";if(Se.status==="OK")De=`${T.green}[OK]${T.reset}`;else if(Se.status==="WARN")De=`${T.yellow}[WARN]${T.reset}`;else if(Se.status==="ERROR")De=`${T.red}[ERROR]${T.reset}`;else De=`${T.blue}[INFO]${T.reset}`;console.log(`${De} ${Se.name.padEnd(20)} ${Se.details}`)}let Ce=j.some((Se)=>Se.status==="ERROR"),Ee=j.some((Se)=>Se.status==="WARN");if(e(""),Ce)r("Some services have errors. Check the details above.");else if(Ee)a("Some services need attention. Check the warnings above.");else n("All services are healthy!")}catch(p){r(`Failed to get status: ${p.message}`),process.exit(1)}}),N.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(t)=>{i("Cost Summary");try{e("Fetching cost data from AWS Cost Explorer..."),e("");let p=new Date,A=new Date(p.getFullYear(),p.getMonth(),1),j=new Date(p.getFullYear(),p.getMonth()+1,0);e(`Period: ${A.toISOString().split("T")[0]} to ${j.toISOString().split("T")[0]}`),e(""),e("Note: Cost data requires AWS Cost Explorer API access."),e("Run `cloud cost` for detailed cost analysis.")}catch(p){r(`Failed to get cost summary: ${p.message}`),process.exit(1)}}),N.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");try{let p=await _e(),A=t.region||p.project.region||"us-east-1",{AWSClient:j}=await import("./chunk-zs8bfer0.js");class M{client;region;constructor(Ce){this.region=Ce,this.client=new j}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let G=new M(A),Z=new o("Fetching alarms...");Z.start();let re=(await G.describeAlarms()).MetricAlarms||[];if(Z.succeed(`Found ${re.length} alarm(s)`),re.length===0){e("No CloudWatch alarms configured");return}let oe=re.filter((Ce)=>Ce.StateValue==="ALARM"),be=re.filter((Ce)=>Ce.StateValue==="OK"),we=re.filter((Ce)=>Ce.StateValue==="INSUFFICIENT_DATA");if(e(""),e(`Alarming: ${oe.length}`),e(`OK: ${be.length}`),e(`Insufficient Data: ${we.length}`),oe.length>0){e(`
 Alarms in ALARM state:`);for(let Ce of oe)r(`  - ${Ce.AlarmName}: ${Ce.AlarmDescription||"No description"}`)}}catch(p){r(`Failed to get alarms: ${p.message}`),process.exit(1)}})}async function ci(N){let{AWSClient:t}=await import("./chunk-zs8bfer0.js");class p{client;region;constructor(A){this.region=A,this.client=new t}async jsonRpcRequest(A,j){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${A}`},body:JSON.stringify(j)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(A,j){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:A,...j})}async describeBackupVault(A){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:A})}async getBackupPlan(A){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:A})}async createBackupVault(A,j){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:A,...j})}async deleteBackupVault(A){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:A})}async createBackupPlan(A){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:A})}async deleteBackupPlan(A){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:A})}async startBackupJob(A){return this.jsonRpcRequest("StartBackupJob",A)}async startRestoreJob(A){return this.jsonRpcRequest("StartRestoreJob",A)}async describeBackupJob(A){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:A})}async describeRestoreJob(A){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:A})}async listBackupJobs(A){return this.jsonRpcRequest("ListBackupJobs",A||{})}async listRestoreJobs(A){return this.jsonRpcRequest("ListRestoreJobs",A||{})}async createBackupSelection(A,j){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:A,BackupSelection:j})}async listBackupSelections(A){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:A})}}return new p(N)}function Hc(N){N.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(t)=>{i("Backup Vaults");try{let p=await _e(),A=t.region||p.project.region||"us-east-1",j=await ci(A),M=new o("Fetching vaults...");M.start();let Z=(await j.listBackupVaults()).BackupVaultList||[];if(M.succeed(`Found ${Z.length} vault(s)`),Z.length===0){e("No backup vaults found"),e("Use `cloud backup:create-vault` to create a new vault");return}c(["Vault Name","Recovery Points","Created","Encrypted"],Z.map((ee)=>[ee.BackupVaultName||"N/A",(ee.NumberOfRecoveryPoints||0).toString(),ee.CreationDate?new Date(ee.CreationDate).toLocaleDateString():"N/A",ee.EncryptionKeyArn?"Yes":"Default"]))}catch(p){r(`Failed to list vaults: ${p.message}`),process.exit(1)}}),N.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(t)=>{i("Backup Plans");try{let p=await _e(),A=t.region||p.project.region||"us-east-1",j=await ci(A),M=new o("Fetching backup plans...");M.start();let Z=(await j.listBackupPlans()).BackupPlansList||[];if(M.succeed(`Found ${Z.length} backup plan(s)`),Z.length===0){e("No backup plans found"),e("Use `cloud backup:create` to create a backup plan");return}c(["Plan Name","Plan ID","Version","Created"],Z.map((ee)=>[ee.BackupPlanName||"N/A",ee.BackupPlanId||"N/A",ee.VersionId?.substring(0,8)||"N/A",ee.CreationDate?new Date(ee.CreationDate).toLocaleDateString():"N/A"]))}catch(p){r(`Failed to list backup plans: ${p.message}`),process.exit(1)}}),N.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(t,p)=>{i(`Recovery Points: ${t}`);try{let A=await _e(),j=p.region||A.project.region||"us-east-1",M=await ci(j),G=new o("Fetching recovery points...");G.start();let ee=(await M.listRecoveryPointsByBackupVault(t,{MaxResults:Number.parseInt(p.limit)})).RecoveryPoints||[];if(G.succeed(`Found ${ee.length} recovery point(s)`),ee.length===0){e("No recovery points found");return}c(["Resource","Status","Created","Size","Lifecycle"],ee.map((re)=>[re.ResourceArn?.split(":").pop()||"N/A",re.Status||"N/A",re.CreationDate?new Date(re.CreationDate).toLocaleString():"N/A",re.BackupSizeInBytes?Td(re.BackupSizeInBytes):"N/A",re.Lifecycle?.DeleteAfterDays?`${re.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(A){r(`Failed to list recovery points: ${A.message}`),process.exit(1)}}),N.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(t,p)=>{i("Create Backup Vault");try{let A=await ci(p.region);if(e(`Vault Name: ${t}`),e(`Region: ${p.region}`),e(`Encryption: ${p.kmsKey?"Custom KMS":"AWS Managed"}`),!await d(`

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-gxwsq3k0.js";import"./chunk-8bbw6qc2.js";import"./chunk-dk38j1qr.js";import{er}from"./chunk-22c3pk8s.js";import"./chunk-pdw0qjq1.js";import"./chunk-t7seq21w.js";import"./chunk-k3er0h4j.js";import"./chunk-m5sjzxm3.js";import"./chunk-hwp5xp1c.js";import"./chunk-pd8v6bpd.js";import"./chunk-xs62dg7t.js";import"./chunk-9jmnmhpy.js";import"./chunk-pthfzst7.js";import"./chunk-k8wscjd9.js";import"./chunk-kxa4t4wh.js";import"./chunk-b48j6k55.js";import"./chunk-mcqkjhgp.js";import"./chunk-y1r1evt0.js";import"./chunk-x4gsw45d.js";import"./chunk-fbycbnvj.js";import"./chunk-n56c0j1e.js";import"./chunk-rzt92fwv.js";import"./chunk-e1cxh9rj.js";import"./chunk-94cfdvrn.js";import"./chunk-p197a99s.js";import"./chunk-7jwxgxxf.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await er({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-gxwsq3k0.js";import"./chunk-8bbw6qc2.js";import"./chunk-dk38j1qr.js";import{er}from"./chunk-22c3pk8s.js";import"./chunk-pdw0qjq1.js";import"./chunk-t7seq21w.js";import"./chunk-k3er0h4j.js";import"./chunk-m5sjzxm3.js";import"./chunk-hwp5xp1c.js";import"./chunk-pd8v6bpd.js";import"./chunk-xs62dg7t.js";import"./chunk-9jmnmhpy.js";import"./chunk-pthfzst7.js";import"./chunk-p9em7chg.js";import"./chunk-kxa4t4wh.js";import"./chunk-b48j6k55.js";import"./chunk-mcqkjhgp.js";import"./chunk-y1r1evt0.js";import"./chunk-x4gsw45d.js";import"./chunk-fbycbnvj.js";import"./chunk-n56c0j1e.js";import"./chunk-rzt92fwv.js";import"./chunk-e1cxh9rj.js";import"./chunk-94cfdvrn.js";import"./chunk-p197a99s.js";import"./chunk-7jwxgxxf.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await er({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/{chunk-kggfqsgn.js → chunk-5f26x0x9.js}

@@ -1,4 +1,4 @@
-import{nd,_,d,sd,O,p,de,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-b9pm7mbd.js";import{B,u}from"./chunk-xacvkpf8.js";import{ce,Bt,w,xt,s,ti,ws,br,wc,Rc,J,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-mgkgsp9f.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-jnt7ab86.js";import{pe,Xt,es,Xe,V,re,C,ge,er,Ze,rr}from"./chunk-bkv2p4hp.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-b2b79jtk.js";import{me}from"./chunk-srh0ctd4.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(ZS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),h=e.configText.slice(r.end),I=m.endsWith("{")?`
+import{nd,_,d,sd,O,p,de,g,Ft,ld,Js,gd,md,Ad,Mr,io,qt,yd,Id,wd,Rd}from"./chunk-b9pm7mbd.js";import{B,u}from"./chunk-xacvkpf8.js";import{ce,Bt,w,xt,s,ti,ws,br,wc,Rc,J,c,Ps,Ue,Er,Dc,_t,ks,Pc,vr,Bs,Tr,ii,$t,ci,di,Qe,Mt,Jc,Xc,ui,pi,lt,Vs,i,gi,zs,Ks}from"./chunk-dky93h4d.js";import{n,l}from"./chunk-4w8d2mf0.js";import{kt,a}from"./chunk-t5e5phth.js";import{sn}from"./chunk-f9pzjzye.js";import{on,Kl,Wi,P,v,Ji,Wl}from"./chunk-jnt7ab86.js";import{pe,Xt,es,Xe,V,re,C,ge,er,Ze,rr}from"./chunk-bkv2p4hp.js";import{j}from"./chunk-1bxqrj7m.js";import{b,cr,hs,Dt,dr,ou,za,Le,it,Dn,k,Pt,_u,Nt,fr}from"./chunk-b2b79jtk.js";import{me}from"./chunk-srh0ctd4.js";import{y}from"./chunk-sxtgx8fj.js";import{ke}from"./chunk-cwjskpj4.js";import{Ce}from"./chunk-etmbw4er.js";import{f}from"./chunk-trsaqsgv.js";function Jr(e){let t=Mc(e.name),r=Ju(e.configText);if(ZS(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let o=vm({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),h=e.configText.slice(r.end),I=m.endsWith("{")?`
 `:m.endsWith(",")?`
 
 `:`,

package/dist/chunk-azcvwr5m.js

@@ -0,0 +1,2 @@
+import{n}from"./chunk-4w8d2mf0.js";import{h}from"./chunk-t054j0zn.js";var tt=new Set(["A","AAAA","CNAME"]);function N(e,t=""){return e===408||e===409||e===425||e===429||e>=500||/rate limit|temporar|timed? ?out|try again/i.test(t)}async function P(e,t){let r=t?.headers.get("retry-after"),s=r===null||r===void 0?void 0:Number(r)*1000,o=Number.isFinite(s)?Math.max(0,s):Math.min(1000*2**(e-1),30000);await new Promise((i)=>setTimeout(i,o))}class ie{name="porkbun";apiKey;secretKey;requestTimeoutMs;constructor(e,t,r=15000){this.apiKey=e,this.secretKey=t,this.requestTimeoutMs=r}async request(e,t={}){let r;for(let s=1;s<=8;s+=1){let o,i=new AbortController,a=setTimeout(()=>{i.abort(Error(`Porkbun API request timed out after ${this.requestTimeoutMs}ms`))},this.requestTimeoutMs);try{o=await fetch(`https://api.porkbun.com/api/json/v3${e}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({apikey:this.apiKey,secretapikey:this.secretKey,...t}),signal:i.signal})}catch(d){if(r=d,s===8)throw d;await P(s);continue}finally{clearTimeout(a)}if(!o.ok){if(r=Error(`Porkbun API error: ${o.status} ${o.statusText}`),!N(o.status)||s===8)throw r;await P(s,o);continue}let c=await o.json();if(c.status==="ERROR"){if(r=Error(`Porkbun API error: ${c.message||"Unknown error"}`),!N(0,c.message)||s===8)throw r;await P(s,o);continue}return c}throw r}getSubdomain(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(r===s)return"";if(r.endsWith(`.${s}`))return r.slice(0,-(s.length+1));return r}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}static ADDRESS_TYPES=new Set(["A","AAAA"]);async clearConflictingAliases(e,t){if(!ie.ADDRESS_TYPES.has(t.type))return[];let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return[`could not list records to clear ALIAS/CNAME conflicts: ${o.message??"unknown provider error"}`];let i=[];for(let a of o.records){if(a.type!=="ALIAS"&&a.type!=="CNAME")continue;if(this.getSubdomain(a.name,r)!==s)continue;let c=await this.deleteRecord(e,a);if(!c.success)i.push(`could not remove conflicting ${a.type} on ${a.name}: ${c.message??"unknown provider error"}`)}return i}async addressRecordExists(e,t){let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return!0;return o.records.some((i)=>i.type===t.type&&this.getSubdomain(i.name,r)===s&&i.content===t.content)}async createRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o={type:t.type,content:t.content,ttl:String(t.ttl||600)};if(s)o.name=s;if((t.type==="MX"||t.type==="SRV")&&t.priority!==void 0)o.prio=String(t.priority);if(t.type==="SRV"&&t.weight!==void 0&&t.port!==void 0)o.content=`${t.weight} ${t.port} ${t.content}`;let i=await this.clearConflictingAliases(e,t),a=await this.request(`/dns/create/${r}`,o);if(ie.ADDRESS_TYPES.has(t.type)&&!await this.addressRecordExists(e,t))return{success:!1,message:`Porkbun reported success but no ${t.type} record for ${t.name} exists${i.length>0?` (${i.join("; ")})`:""}. A conflicting ALIAS/CNAME on the same name silently voids the write.`};return{success:!0,id:a.id?.toString(),message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.listRecords(e,t.type);if(o.success){let i=o.records.find((a)=>this.getSubdomain(a.name,r)===s&&a.type===t.type);if(i?.id){let a={type:t.type,content:t.content,ttl:String(t.ttl||600)};if(s)a.name=s;if((t.type==="MX"||t.type==="SRV")&&t.priority!==void 0)a.prio=String(t.priority);if(t.type==="SRV"&&t.weight!==void 0&&t.port!==void 0)a.content=`${t.weight} ${t.port} ${t.content}`;return await this.request(`/dns/edit/${r}/${i.id}`,a),{success:!0,id:i.id,message:"Record updated successfully"}}}return this.createRecord(e,t)}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=this.getRootDomain(e);if("id"in t&&t.id)return await this.request(`/dns/delete/${r}/${t.id}`),{success:!0,message:"Record deleted successfully"};let s=this.getSubdomain(t.name,r),o=await this.listRecords(e);if(!o.success)return{success:!1,message:"Failed to list records"};let i=o.records.find((a)=>this.getSubdomain(a.name,r)===s&&a.type===t.type&&a.content===t.content);if(!i?.id)return{success:!1,message:"Record not found"};return await this.request(`/dns/delete/${r}/${i.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=this.getRootDomain(e),s=`/dns/retrieve/${r}`;if(t)s=`/dns/retrieveByNameType/${r}/${t}`;return{success:!0,records:((await this.request(s)).records||[]).map((a)=>({id:a.id,name:a.name||r,type:a.type,content:a.content,ttl:Number.parseInt(a.ttl,10),priority:a.prio?Number.parseInt(a.prio,10):void 0}))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{let t=this.getRootDomain(e);return await this.request(`/dns/retrieve/${t}`),!0}catch{return!1}}async listDomains(){try{return((await this.request("/domain/listAll")).domains||[]).map((t)=>t.domain)}catch{return[]}}async getNameServers(e){try{let t=this.getRootDomain(e);return(await this.request(`/domain/getNs/${t}`)).ns||[]}catch{return[]}}async updateNameServers(e,t){try{let r=this.getRootDomain(e);return await this.request(`/domain/updateNs/${r}`,{ns:t}),!0}catch{return!1}}}class Be{name="godaddy";apiKey;apiSecret;baseUrl;constructor(e,t="",r="production"){this.apiKey=e,this.apiSecret=t,this.baseUrl=r==="ote"?"https://api.ote-godaddy.com":"https://api.godaddy.com"}authorization(){if(!this.apiSecret||this.apiKey.startsWith("gd_pat_"))return`Bearer ${this.apiKey}`;return`sso-key ${this.apiKey}:${this.apiSecret}`}async request(e,t,r){let s=`${this.baseUrl}${t}`,o={Authorization:this.authorization(),"Content-Type":"application/json",Accept:"application/json"},i={method:e,headers:o};if(r)i.body=JSON.stringify(r);let a=await fetch(s,i);if(a.status===204)return{};if(a.ok){let d=await a.text();if(d)return JSON.parse(d);return{}}let c=`GoDaddy API error: ${a.status} ${a.statusText}`;try{let d=await a.json();if(d.message)c=`GoDaddy API error: ${d.message}`;if(d.fields)c+=` - Fields: ${JSON.stringify(d.fields)}`}catch{}throw Error(c)}getSubdomain(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(r===s)return"@";if(r.endsWith(`.${s}`))return r.slice(0,-(s.length+1));return r}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}toGoDaddyRecord(e,t){let r=this.getRootDomain(t),s=this.getSubdomain(e.name,r),o={type:e.type,name:s,data:e.content,ttl:e.ttl||600};if(e.type==="MX"&&e.priority!==void 0)o.priority=e.priority;return o}fromGoDaddyRecord(e,t){let r=this.getRootDomain(t),s=e.name;if(s==="@")s=r;else if(!s.endsWith(r))s=`${s}.${r}`;return{name:s,type:e.type,content:e.data,ttl:e.ttl,priority:e.priority}}async createRecord(e,t){try{let r=this.getRootDomain(e),s=this.toGoDaddyRecord(t,e);return await this.request("PATCH",`/v1/domains/${r}/records`,[s]),{success:!0,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=this.getRootDomain(e),s=this.toGoDaddyRecord(t,e);return await this.request("PUT",`/v1/domains/${r}/records/${t.type}/${s.name}`,[s]),{success:!0,message:"Record upserted successfully"}}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=this.getRootDomain(e),s=this.getSubdomain(t.name,r),o=await this.request("GET",`/v1/domains/${r}/records/${t.type}/${s}`),i=o.filter((a)=>a.data!==t.content);if(i.length===o.length)return{success:!1,message:"Record not found"};if(i.length===0)try{await this.request("DELETE",`/v1/domains/${r}/records/${t.type}/${s}`)}catch{}else await this.request("PUT",`/v1/domains/${r}/records/${t.type}/${s}`,i);return{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=this.getRootDomain(e),s=`/v1/domains/${r}/records`;if(t)s=`/v1/domains/${r}/records/${t}`;return{success:!0,records:(await this.request("GET",s)).map((i)=>this.fromGoDaddyRecord(i,e))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{let t=this.getRootDomain(e);return await this.request("GET",`/v1/domains/${t}`),!0}catch{return!1}}async listDomains(){try{return(await this.request("GET","/v1/domains")).map((t)=>t.domain)}catch{return[]}}async getDomainDetails(e){try{let t=this.getRootDomain(e),r=await this.request("GET",`/v1/domains/${t}`);return{domain:r.domain,status:r.status,nameServers:r.nameServers,expires:r.expires}}catch{return null}}async getNameServers(e){return(await this.getDomainDetails(e))?.nameServers??[]}async updateNameServers(e,t){try{let r=this.getRootDomain(e);return await this.request("PATCH",`/v1/domains/${r}`,{nameServers:t}),!0}catch{return!1}}async checkDomainAvailability(e){try{let t=await this.request("GET",`/v1/domains/available?domain=${encodeURIComponent(e)}`);return{available:t.available,price:t.price,currency:t.currency}}catch{return{available:!1}}}}var k="https://api.cloudflare.com/client/v4",ts="[ts-cloud]";class he{name="cloudflare";apiToken;zoneCache=new Map;configuredZoneId;accountId;configuredZoneName;constructor(e,t={}){this.apiToken=e,this.configuredZoneId=t.zoneId,this.accountId=t.accountId}async request(e,t,r){let s=`${k}${t}`,o={Authorization:`Bearer ${this.apiToken}`,"Content-Type":"application/json"},i={method:e,headers:o};if(r)i.body=JSON.stringify(r);let c=await(await fetch(s,i)).json();if(!c.success){let d=c.errors.map((u)=>u.message).join(", ");throw Error(`Cloudflare API error: ${d}`)}return c}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}async resolveZone(e){let t=e.replace(/\.$/,"").toLowerCase();if(this.configuredZoneId){let a=await this.resolveConfiguredZoneName();if(a&&(t===a||t.endsWith(`.${a}`)))return{id:this.configuredZoneId,name:a}}let r=this.getRootDomain(t),s=this.zoneCache.get(r);if(s)return{id:s,name:r};let o=await this.request("GET",`/zones?name=${encodeURIComponent(r)}`);if(!o.result||o.result.length===0)throw Error(`Zone not found for domain: ${r}. `+"If the API token is scoped to a single zone, set its zone id (CLOUDFLARE_ZONE_ID) — "+"zone lookup by name needs account-wide Zone:Read.");let i=o.result[0].id;return this.zoneCache.set(r,i),{id:i,name:o.result[0].name||r}}async resolveConfiguredZoneName(){if(!this.configuredZoneId)return;if(this.configuredZoneName)return this.configuredZoneName;try{let t=(await this.request("GET",`/zones/${this.configuredZoneId}`)).result?.name?.toLowerCase();if(!t)return;return this.configuredZoneName=t,this.zoneCache.set(t,this.configuredZoneId),t}catch{return}}async getZoneId(e){return(await this.resolveZone(e)).id}getFullRecordName(e,t){let r=e.replace(/\.$/,"");if(!r||r===t||r==="@")return t;if(r.endsWith(`.${t}`))return r;return`${r}.${t}`}toCloudflareRecord(e,t,r){let s={type:e.type,name:this.getFullRecordName(e.name,t),content:e.content||e.value||"",ttl:e.ttl||1},o=r??e.proxied;if(o!==void 0&&tt.has(e.type)){if(s.proxied=o,o)s.ttl=1}if(e.type==="MX"&&e.priority!==void 0)s.priority=e.priority;if(e.type==="SRV"){let i=_(e);if(i)s.data=i,delete s.content,delete s.priority;else if(e.priority!==void 0)s.priority=e.priority}return s}fromCloudflareRecord(e){return{id:e.id,name:e.name,type:e.type,content:e.content,ttl:e.ttl,priority:e.priority,proxied:e.proxied}}async createRecord(e,t){try{let r=await this.resolveZone(e),s=this.toCloudflareRecord(t,r.name);return{success:!0,id:(await this.request("POST",`/zones/${r.id}/dns_records`,s)).result.id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=await this.resolveZone(e),s=this.getFullRecordName(t.name,r.name),i=(await this.request("GET",`/zones/${r.id}/dns_records?type=${t.type}&name=${encodeURIComponent(s)}`)).result?.[0],a=t.proxied??i?.proxied,c=this.toCloudflareRecord(t,r.name,a);if(i)return{success:!0,id:(await this.request("PUT",`/zones/${r.id}/dns_records/${i.id}`,c)).result.id,message:"Record updated successfully"};return{success:!0,id:(await this.request("POST",`/zones/${r.id}/dns_records`,c)).result.id,message:"Record created successfully"}}catch(r){return this.createRecord(e,t)}}async deleteRecord(e,t){try{let r=await this.resolveZone(e),s=r.id,o=this.getFullRecordName(t.name,r.name),i=await this.request("GET",`/zones/${s}/dns_records?type=${t.type}&name=${encodeURIComponent(o)}`);if(!i.result||i.result.length===0)return{success:!1,message:"Record not found"};let a=i.result.find((c)=>c.content===t.content);if(!a)return{success:!1,message:"Record with matching content not found"};return await this.request("DELETE",`/zones/${s}/dns_records/${a.id}`),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let s=`/zones/${await this.getZoneId(e)}/dns_records?per_page=100`;if(t)s+=`&type=${t}`;let o=[],i=1,a=!0;while(a){let c=await this.request("GET",`${s}&page=${i}`);if(o.push(...c.result||[]),c.result_info)a=i<c.result_info.total_pages,i++;else a=!1}return{success:!0,records:o.map((c)=>this.fromCloudflareRecord(c))}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){try{return await this.getZoneId(e),!0}catch{return!1}}async listDomains(){try{let e=[],t=1,r=!0;while(r){let s=await this.request("GET",`/zones?per_page=50&page=${t}`);if(e.push(...s.result||[]),s.result_info)r=t<s.result_info.total_pages,t++;else r=!1}return e.map((s)=>s.name)}catch{return[]}}async createZone(e,t={}){let r=e.replace(/\.$/,"").toLowerCase(),s=t.accountId??this.accountId;if(!s)throw Error(`Cannot create zone ${r}: no Cloudflare account id. Set CLOUDFLARE_ACCOUNT_ID, or pass accountId.`);let o=await this.getZoneDetails(r);if(o)return{...o,created:!1};try{let a=(await this.request("POST","/zones",{name:r,account:{id:s},jump_start:t.jumpStart??!1})).result;return this.zoneCache.set(a.name,a.id),{id:a.id,name:a.name,status:a.status,nameServers:a.name_servers??[],created:!0}}catch(i){let a=i instanceof Error?i.message:String(i);if(!/already exists|1061/i.test(a))throw i;let c=await this.getZoneDetails(r);if(!c)throw i;return{...c,created:!1}}}async getZoneDetails(e){try{let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}`);return{id:r.result.id,name:r.result.name,status:r.result.status,nameServers:r.result.name_servers,paused:r.result.paused}}catch{return null}}async listEdgeCertificateHosts(e){try{let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/ssl/certificate_packs?per_page=50`),s=new Set;for(let o of r.result||[]){if(o.status!=="active")continue;for(let i of o.hosts||[])s.add(i.toLowerCase())}return[...s]}catch{return null}}async purgeCache(e,t){try{let r=await this.getZoneId(e),s={};if(t?.purgeEverything)s.purge_everything=!0;else{if(t?.files)s.files=t.files;if(t?.tags)s.tags=t.tags;if(t?.hosts)s.hosts=t.hosts}if(Object.keys(s).length===0)s.purge_everything=!0;return await this.request("POST",`/zones/${r}/purge_cache`,s),!0}catch{return!1}}async getRecordProxyStatus(e,t){try{let r=await this.resolveZone(e),s=r.id,o=this.getFullRecordName(t.name,r.name),i=await this.request("GET",`/zones/${s}/dns_records?type=${t.type}&name=${encodeURIComponent(o)}`);if(i.result&&i.result.length>0)return i.result.find((c)=>c.content===t.content)?.proxied??null;return null}catch{return null}}async setRecordProxyStatus(e,t,r){try{let s=await this.resolveZone(e),o=s.id,i=this.getFullRecordName(t.name,s.name),a=await this.request("GET",`/zones/${o}/dns_records?type=${t.type}&name=${encodeURIComponent(i)}`);if(!a.result||a.result.length===0)return!1;let c=a.result.find((d)=>d.content===t.content);if(!c)return!1;return await this.request("PATCH",`/zones/${o}/dns_records/${c.id}`,{proxied:r}),!0}catch{return!1}}async zoneIdFor(e){return this.getZoneId(e)}get account(){return this.accountId}async getZoneSettings(e){let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/settings`),s={};for(let o of r.result||[])s[o.id]=o.value;return s}async applyZoneSettings(e,t){let r=await this.getZoneId(e),s=await this.getZoneSettings(e).catch(()=>({})),o=[],i=[];for(let[a,c]of Object.entries(t)){if(c===void 0)continue;let d=s[a];if(d!==void 0&&S(d,c))continue;try{await this.request("PATCH",`/zones/${r}/settings/${a}`,{value:c}),o.push({id:a,from:d,to:c})}catch(u){i.push({id:a,error:u instanceof Error?u.message:String(u)})}}return{changed:o,failed:i}}async getManagedRequestHeaders(e){let t=await this.getZoneId(e),r=await this.request("GET",`/zones/${t}/managed_headers`),s={};for(let o of r.result?.managed_request_headers||[])s[o.id]=o.enabled===!0;return s}async applyManagedRequestHeaders(e,t){let r=[],s=[],o=Object.entries(t).filter(([,d])=>d!==void 0);if(o.length===0)return{changed:r,failed:s};let i=await this.getZoneId(e),a;try{a=await this.getManagedRequestHeaders(e)}catch(d){let u=d instanceof Error?d.message:String(d);for(let[m]of o)s.push({id:m,error:`could not read managed headers — ${u}`});return{changed:r,failed:s}}let c=[];for(let[d,u]of o){if(!(d in a)){s.push({id:d,error:"not a managed request header transform on this zone"});continue}if(a[d]!==u)c.push([d,u])}if(c.length===0)return{changed:r,failed:s};try{await this.request("PATCH",`/zones/${i}/managed_headers`,{managed_request_headers:c.map(([d,u])=>({id:d,enabled:u})),managed_response_headers:[]});for(let[d,u]of c)r.push({id:d,from:a[d],to:u})}catch(d){let u=d instanceof Error?d.message:String(d);for(let[m]of c)s.push({id:m,error:u})}return{changed:r,failed:s}}async getPhaseRules(e,t){let r=await this.getZoneId(e);try{return(await this.request("GET",`/zones/${r}/rulesets/phases/${t}/entrypoint`)).result?.rules||[]}catch{return[]}}async putManagedPhaseRules(e,t,r){try{let s=await this.getZoneId(e),i=(await this.getPhaseRules(e,t)).filter((d)=>!(d.description||"").startsWith(ts)),a=r.map((d)=>({...d,description:d.description?.startsWith(ts)?d.description:`${ts} ${d.description||t}`})),c=[...i,...a].map(({id:d,...u})=>u);return await this.request("PUT",`/zones/${s}/rulesets/phases/${t}/entrypoint`,{rules:c}),{success:!0}}catch(s){return{success:!1,message:s instanceof Error?s.message:String(s)}}}}function S(e,t){if(e===t)return!0;if(typeof e!==typeof t||e===null||t===null)return!1;if(typeof e!=="object")return!1;if(Array.isArray(e)||Array.isArray(t)){if(!Array.isArray(e)||!Array.isArray(t)||e.length!==t.length)return!1;return e.every((o,i)=>S(o,t[i]))}let r=e,s=t;return Object.keys(s).every((o)=>S(r[o],s[o]))}function _(e){let t=(e.content||e.value||"").trim();if(e.weight!==void 0&&e.port!==void 0&&e.priority!==void 0&&t)return{priority:e.priority,weight:e.weight,port:e.port,target:b(t)};let r=t.split(/\s+/);if(r.length<4)return null;let[s,o,i]=r.slice(0,3).map(Number);if(![s,o,i].every(Number.isFinite))return null;return{priority:s,weight:o,port:i,target:b(r.slice(3).join(" "))}}function b(e){return e.replace(/\.$/,"")}var Z=new Set(["A","AAAA","CNAME","ALIAS"]);function Tt(e){let t=e.trim().replace(/^"|"$/g,"").toLowerCase();if(t.startsWith("v=spf1"))return"v=spf1";if(t.startsWith("v=dmarc1"))return"v=dmarc1";return}function R(e){return e.trim().replace(/^"(.*)"$/s,"$1")}function D(e){return e.replace(/\.$/,"").toLowerCase()}function hn(e,t){let r=D(t),s=(e??"@").trim();if(!s||s==="@")return r;let o=D(s);if(o===r||o.endsWith(`.${r}`))return o;return`${o}.${r}`}function rs(e,t){return e.map((r)=>({...r,name:hn(r.name,t),proxied:r.proxied??!1}))}function V(e,t){if(e.type!==t.type)return!1;if(D(e.name)!==D(t.name))return!1;if(Z.has(t.type))return!0;if(t.type==="TXT"){let r=Tt(t.content);if(r)return Tt(R(e.content))===r;return R(e.content)===R(t.content)}return R(e.content)===R(t.content)}function M(e,t){if(R(e.content)!==R(t.content))return!1;if(t.priority!==void 0&&e.priority!==t.priority)return!1;if(t.proxied!==void 0&&e.proxied!==void 0&&e.proxied!==t.proxied)return!1;return!0}async function ns(e){let{provider:t,zone:r,records:s}=e,o={outcomes:[],warnings:[]};if(s.length===0)return o;let i=await t.listRecords(r);if(!i.success)return o.warnings.push(`could not list ${r}: ${i.message||"unknown provider error"} — records not reconciled`),o;let a=i.records;for(let c of s){let d=a.filter((l)=>V(l,c));if(d.length>0&&d.every((l)=>M(l,c))){o.outcomes.push({record:c,action:"unchanged"});continue}let u={name:c.name,type:c.type,content:c.content,ttl:c.ttl??3600,...c.priority!==void 0?{priority:c.priority}:{},...c.proxied!==void 0?{proxied:c.proxied}:{}},m=c.type==="TXT"&&Tt(c.content)!==void 0;if(m)for(let l of d){let A=await t.deleteRecord(r,{name:l.name,type:l.type,content:l.content});if(!A.success)o.warnings.push(`could not remove superseded ${l.type} at ${l.name}: ${A.message||"unknown error"}`)}let p=m||d.length===0?await t.createRecord(r,u):await t.upsertRecord(r,u);if(p.success)o.outcomes.push({record:c,action:d.length>0?"updated":"created"});else o.outcomes.push({record:c,action:"failed",message:p.message})}for(let c of["MX"]){let d=new Set(s.filter((u)=>u.type===c).map((u)=>D(u.name)));for(let u of d){let m=new Set(s.filter((l)=>l.type===c&&D(l.name)===u).map((l)=>R(l.content).toLowerCase())),p=a.filter((l)=>l.type===c&&D(l.name)===u&&!m.has(R(l.content).toLowerCase()));for(let l of p)o.warnings.push(`${u} has an undeclared ${c} record (${l.content}) alongside the declared one — mail will be split between them. Remove it at the provider if it is stale.`)}}return o}function nr(e){if(!e||typeof e!=="object")return!1;let t=e;return typeof t.getNameServers==="function"&&typeof t.updateNameServers==="function"}function ir(e){return Boolean(e&&typeof e.createZone==="function")}var O=new Set(["NS"]);function v(e){return e.replace(/\.$/,"").toLowerCase()}function fn(e,t){if(e.length===0||t.length===0)return!1;let r=new Set(e.map(v)),s=new Set(t.map(v));if(r.size!==s.size)return!1;for(let o of r)if(!s.has(o))return!1;return!0}function I(e){let t=e.content.trim(),r=t.startsWith('"')&&t.endsWith('"')?t.slice(1,-1):t;return e.type==="TXT"?r:v(r)}function z(e,t){return e.type===t.type&&v(e.name)===v(t.name)&&I(e)===I(t)}async function sr(e){let{domain:t,registrar:r,host:s,dryRun:o=!1}=e,i=new Set([...e.proxiedHosts??[]].map(v)),a=[],c=await s.createZone(t,{accountId:e.accountId,jumpStart:!1}),d=await r.getNameServers(t),u={status:"ready",domain:t,zoneId:c.id,targetNameservers:c.nameServers,currentNameservers:d,records:[],missing:[],warnings:a};if(fn(d,c.nameServers))return u.status="already-delegated",u;if(c.nameServers.length===0)return a.push(`${s.name} did not report nameservers for ${t}; cannot delegate.`),u.status="blocked",u;let m=await r.listRecords(t);if(!m.success)return a.push(`Could not read ${t} from ${r.name}: ${m.message??"unknown error"}`),u.status="blocked",u;let p=[];for(let g of m.records){if(O.has(g.type)){u.records.push({record:g,status:"skipped",reason:`${g.type} describes the delegation itself; ${s.name} owns it`});continue}let y=tt.has(g.type)&&i.has(v(g.name));p.push({name:g.name,type:g.type,content:g.content,ttl:g.ttl,priority:g.priority,...tt.has(g.type)?{proxied:y}:{}})}if(o){for(let g of p)u.records.push({record:g,status:"copied",reason:"dry run"});return u}for(let g of p){let y;try{y=await s.upsertRecord(t,g)}catch(C){y={success:!1,message:C instanceof Error?C.message:String(C)}}u.records.push(y.success?{record:g,status:"copied"}:{record:g,status:"failed",reason:y.message})}let l=await s.listRecords(t);if(!l.success)return a.push(`Could not read back ${t} from ${s.name}: ${l.message??"unknown error"}`),u.status="blocked",u;for(let g of p)if(!l.records.some((y)=>z(g,y)))u.missing.push(g);if(u.missing.length>0)return a.push(`${u.missing.length} record(s) did not arrive at ${s.name}; leaving ${r.name}'s nameservers alone. Delegating now would take the domain off a complete zone and onto an incomplete one.`),u.status="blocked",u;if(!await r.updateNameServers(t,c.nameServers))return a.push(`${r.name} refused the nameserver update for ${t}.`),u.status="blocked",u;return u.status="delegated",u}var L={add_visitor_location_headers:"visitorLocationHeaders"};function E(e){return{porkbunApiKey:e.PORKBUN_API_KEY,porkbunSecretKey:e.PORKBUN_SECRET_KEY,godaddyApiKey:e.GODADDY_API_KEY,godaddyApiSecret:e.GODADDY_API_SECRET,cloudflareApiToken:e.CLOUDFLARE_API_TOKEN,cloudflareAccountId:e.CLOUDFLARE_ACCOUNT_ID}}function U(e,t){if(e==="porkbun"){if(!t.porkbunApiKey||!t.porkbunSecretKey)return"PORKBUN_API_KEY / PORKBUN_SECRET_KEY are not set";return new ie(t.porkbunApiKey,t.porkbunSecretKey)}if(!t.godaddyApiKey||!t.godaddyApiSecret)return"GODADDY_API_KEY / GODADDY_API_SECRET are not set";let r=new Be(t.godaddyApiKey,t.godaddyApiSecret);if(!nr(r))return"the GoDaddy provider cannot change nameservers";return r}async function is(e,t={}){let r=e.registrar;if(!r)return{status:"skipped",reason:"no dns.registrar configured"};if(r.delegate===!1)return{status:"skipped",reason:"dns.registrar.delegate is false"};if(!e.domain)return{status:"skipped",reason:"no dns.domain configured"};if(!e.provider||e.provider===r.provider)return{status:"skipped",reason:`dns.provider is already ${r.provider}`};if(e.provider!=="cloudflare")return{status:"skipped",reason:`delegation to ${e.provider} is not supported yet`};let s=t.credentials??E(t.env??process.env);if(!s.cloudflareApiToken)return{status:"skipped",reason:"CLOUDFLARE_API_TOKEN is not set"};let o=U(r.provider,s);if(typeof o==="string")return{status:"skipped",reason:o};let i=new he(s.cloudflareApiToken,{accountId:s.cloudflareAccountId});if(!ir(i))return{status:"skipped",reason:"the Cloudflare provider cannot create zones"};return sr({domain:e.domain,registrar:o,host:i,proxiedHosts:r.proxied,accountId:s.cloudflareAccountId,dryRun:r.dryRun})}function ss(e){if(e.status==="skipped")return[`dns: delegation skipped — ${e.reason}`];let t=[];switch(e.status){case"already-delegated":t.push(`dns: ${e.domain} already delegated to ${e.targetNameservers.join(", ")}`);break;case"delegated":t.push(`dns: ${e.domain} delegated to ${e.targetNameservers.join(", ")} (${e.records.filter((r)=>r.status==="copied").length} record(s) copied)`),t.push("dns: nameserver changes take up to 24h to propagate; the old zone answers until then");break;case"ready":t.push(`dns: ${e.domain} would delegate to ${e.targetNameservers.join(", ")} (dry run)`);break;case"blocked":t.push(`dns: ${e.domain} NOT delegated — nameservers left at ${e.currentNameservers.join(", ")}`);for(let r of e.missing)t.push(`  missing at destination: ${r.type} ${r.name}`);break}for(let r of e.warnings)t.push(`  ${r}`);return t}function q(e){let t={};if(e.ssl!==void 0)t.ssl=e.ssl;if(e.alwaysUseHttps!==void 0)t.always_use_https=e.alwaysUseHttps?"on":"off";if(e.minTlsVersion!==void 0)t.min_tls_version=e.minTlsVersion;return t}function j(e){let t={};for(let[r,s]of Object.entries(L)){let o=e[s];if(typeof o==="boolean")t[r]=o}return t}async function os(e,t={}){if(!e.zone)return{status:"skipped",reason:"no dns.zone configured"};if(!e.domain)return{status:"skipped",reason:"no dns.domain configured"};if(e.provider!=="cloudflare")return{status:"skipped",reason:`zone settings are not supported for ${e.provider??"this provider"}`};let r=q(e.zone),s=j(e.zone);if(Object.keys(r).length===0&&Object.keys(s).length===0)return{status:"skipped",reason:"dns.zone declares no settings"};let o=t.credentials??E(t.env??process.env);if(!o.cloudflareApiToken)return{status:"skipped",reason:"CLOUDFLARE_API_TOKEN is not set"};let i=new he(o.cloudflareApiToken,{accountId:o.cloudflareAccountId}),a=await i.applyZoneSettings(e.domain,r),c=Object.keys(s).length>0?await i.applyManagedRequestHeaders(e.domain,s):{changed:[],failed:[]},d=[...a.changed,...c.changed],u=[...a.failed,...c.failed];return{status:d.length>0?"applied":"unchanged",domain:e.domain,changed:d,failed:u}}function as(e){if(e.status==="skipped")return[`dns: zone settings skipped — ${e.reason}`];let t=[];for(let r of e.changed)t.push(`dns: ${e.domain} ${r.id}: ${String(r.from)} → ${String(r.to)}`);if(e.status==="unchanged"&&e.failed.length===0)t.push(`dns: ${e.domain} zone settings already as declared`);for(let r of e.failed)t.push(`dns: ${e.domain} could not set ${r.id} — ${r.error}`);return t}class fe{name="route53";client;hostedZoneCache=new Map;providedHostedZoneId;constructor(e="us-east-1",t){this.client=new h(e),this.providedHostedZoneId=t}getRootDomain(e){let t=e.replace(/\.$/,"").split(".");if(t.length>=2)return t.slice(-2).join(".");return e}async getHostedZoneId(e){if(this.providedHostedZoneId)return this.providedHostedZoneId;let t=this.getRootDomain(e),r=this.hostedZoneCache.get(t);if(r)return r;let s=await this.client.findHostedZoneForDomain(e);if(s){let o=s.Id.replace("/hostedzone/","");return this.hostedZoneCache.set(t,o),o}return null}normalizeName(e,t){let r=e.replace(/\.$/,""),s=t.replace(/\.$/,"");if(!s||s==="@")return`${r}.`;if(s===r||s.endsWith(`.${r}`))return`${s}.`;return`${s}.${r}.`}async createRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=t.content;if(t.type==="TXT"&&!o.startsWith('"'))o=`"${o}"`;if(t.type==="MX"&&t.priority!==void 0)o=`${t.priority} ${o}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Created by ts-cloud DNS provider",Changes:[{Action:"CREATE",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}})).ChangeInfo?.Id,message:"Record created successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async upsertRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=t.content;if(t.type==="TXT"&&!o.startsWith('"'))o=`"${o}"`;if(t.type==="MX"&&t.priority!==void 0)o=`${t.priority} ${o}`;return{success:!0,id:(await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Upserted by ts-cloud DNS provider",Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}})).ChangeInfo?.Id,message:"Record upserted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async deleteRecord(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,message:`No hosted zone found for domain: ${e}`};let s=this.normalizeName(e,t.name),o=t.content;if(t.type==="TXT"&&!o.startsWith('"'))o=`"${o}"`;if(t.type==="MX"&&t.priority!==void 0)o=`${t.priority} ${o}`;return await this.client.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:"Deleted by ts-cloud DNS provider",Changes:[{Action:"DELETE",ResourceRecordSet:{Name:s,Type:t.type,TTL:t.ttl||300,ResourceRecords:[{Value:o}]}}]}}),{success:!0,message:"Record deleted successfully"}}catch(r){return{success:!1,message:r instanceof Error?r.message:"Unknown error"}}}async listRecords(e,t){try{let r=await this.getHostedZoneId(e);if(!r)return{success:!1,records:[],message:`No hosted zone found for domain: ${e}`};let s=await this.client.listResourceRecordSets({HostedZoneId:r,StartRecordType:t}),o=[];for(let i of s.ResourceRecordSets){if(t&&i.Type!==t)continue;if(i.AliasTarget)continue;for(let a of i.ResourceRecords||[]){let c=a.Value,d;if(i.Type==="MX"){let u=c.split(" ");if(u.length>=2)d=Number.parseInt(u[0],10),c=u.slice(1).join(" ")}if(i.Type==="TXT"&&c.startsWith('"')&&c.endsWith('"'))c=c.slice(1,-1);o.push({name:i.Name.replace(/\.$/,""),type:i.Type,content:c,ttl:i.TTL,priority:d})}}return{success:!0,records:o}}catch(r){return{success:!1,records:[],message:r instanceof Error?r.message:"Unknown error"}}}async canManageDomain(e){return await this.getHostedZoneId(e)!==null}async listDomains(){try{return(await this.client.listHostedZones()).HostedZones.map((t)=>t.Name.replace(/\.$/,""))}catch{return[]}}getRoute53Client(){return this.client}async createAliasRecord(e){try{let t=await this.getHostedZoneId(e.domain);if(!t)return{success:!1,message:`No hosted zone found for domain: ${e.domain}`};return{success:!0,id:(await this.client.createAliasRecord({HostedZoneId:t,Name:this.normalizeName(e.domain,e.name),TargetHostedZoneId:e.targetHostedZoneId,TargetDNSName:e.targetDnsName,EvaluateTargetHealth:e.evaluateTargetHealth,Type:e.type})).ChangeInfo?.Id,message:"Alias record created successfully"}}catch(t){return{success:!1,message:t instanceof Error?t.message:"Unknown error"}}}async createCloudFrontAlias(e){return this.createAliasRecord({domain:e.domain,name:e.name,targetHostedZoneId:h.CloudFrontHostedZoneId,targetDnsName:e.cloudFrontDomainName,evaluateTargetHealth:!1})}async createAlbAlias(e){let t=h.ALBHostedZoneIds[e.region];if(!t)return{success:!1,message:`Unknown region for ALB: ${e.region}`};return this.createAliasRecord({domain:e.domain,name:e.name,targetHostedZoneId:t,targetDnsName:e.albDnsName,evaluateTargetHealth:!0})}}async function cs(e,t){let r=[],s,o;for(;;){let i=await e.listResourceRecordSets({HostedZoneId:t,StartRecordName:s,StartRecordType:o,MaxItems:"100"});if(r.push(...i.ResourceRecordSets),!i.IsTruncated)break;if(s=i.NextRecordName,o=i.NextRecordType,!s)break}return r}function f(e){return e.replace(/\.$/,"").toLowerCase()}function x(e){return e.replace(/\.$/,"")}function w(e){if(e.type==="SRV"&&e.weight!==void 0&&e.port!==void 0)return`${e.weight} ${e.port} ${x(e.content)}`;return x(e.content)}function H(e){let t=e.match(/"(?:[^"\\]|\\.)*"/g);if(!t)return e;return t.map((r)=>r.slice(1,-1).replace(/\\(.)/g,"$1")).join("")}function ds(e,t){let r=f(t),s=[],o=[],i=[],a=new Set;for(let c of e){let d=f(c.Name),u=c.Type;if(u==="SOA"||u==="NS"&&d===r){o.push({name:d,type:u,reason:"owned by the destination provider"});continue}if(c.SetIdentifier){o.push({name:d,type:u,reason:`routing policy record (SetIdentifier=${c.SetIdentifier}) has no equivalent — recreate by hand`}),i.push(`${u} ${d} is part of a Route53 routing policy and was NOT migrated`);continue}if(c.AliasTarget){if(a.has(d))continue;a.add(d);let m=f(c.AliasTarget.DNSName);if(s.push({name:d,type:"CNAME",content:m,ttl:300,translatedFrom:`${u} ALIAS → ${m}`}),c.AliasTarget.EvaluateTargetHealth)i.push(`${d} was an ALIAS with health evaluation enabled; the CNAME that replaces it has no health check`);continue}for(let m of c.ResourceRecords||[]){let p=F(d,u,m.Value,c.TTL);if("reason"in p){o.push({name:d,type:u,reason:p.reason}),i.push(`${u} ${d}: ${p.reason}`);continue}s.push(p)}}return{zone:r,records:s,skipped:o,warnings:i}}function F(e,t,r,s){let o={name:e,ttl:s};switch(t){case"A":case"AAAA":case"CNAME":case"PTR":return{...o,type:t==="PTR"?"CNAME":t,content:f(r)};case"TXT":return{...o,type:"TXT",content:H(r)};case"MX":{let[i,...a]=r.trim().split(/\s+/);if(!a.length)return{reason:`malformed MX value "${r}"`};return{...o,type:"MX",content:f(a.join(" ")),priority:Number(i)}}case"SRV":{let i=r.trim().split(/\s+/);if(i.length<4)return{reason:`malformed SRV value "${r}"`};let[a,c,d]=i.slice(0,3).map(Number);return{...o,type:"SRV",content:f(i.slice(3).join(" ")),priority:a,weight:c,port:d}}case"NS":return{...o,type:"NS",content:f(r)};case"CAA":return{...o,type:"CAA",content:r.trim()};default:return{reason:`unsupported record type ${t}`}}}var K=new Set(["TXT","MX","SRV","NS","CAA"]);async function ls(e,t){let r=[],s=[],o=new Set;try{let i=await e.listRecords(t.zone);for(let a of i.records||[])o.add(`${f(a.name)}|${a.type}|${w(a)}`)}catch{}for(let i of t.records){let a={...i,proxied:!1},c=`${f(i.name)}|${i.type}|${w(i)}`;if(!K.has(i.type)){let u=await e.upsertRecord(t.zone,a);if(u.success)r.push(i);else s.push({record:i,message:u.message||"unknown provider error"});continue}if(o.has(c)){r.push(i);continue}let d=await e.createRecord(t.zone,a);if(d.success)o.add(c),r.push(i);else s.push({record:i,message:d.message||"unknown provider error"})}return{applied:r,failed:s}}async function us(e,t){let r=await e.listRecords(t.zone),s=[],o=[],i=new Map;for(let a of r.records||[]){let c=`${f(a.name)}|${a.type}`,d=i.get(c)??[];d.push(w(a)),i.set(c,d)}for(let a of t.records){let c=i.get(`${f(a.name)}|${a.type}`),d=w(a);if(c?.some((u)=>u===d))s.push(a);else o.push({record:a,found:c?.join(", ")})}return{matched:s,missing:o,ok:o.length===0}}class oe{client;region;constructor(e="us-east-1"){this.client=new n,this.region=e}async requestCertificate(e){let t={DomainName:e.DomainName,ValidationMethod:e.ValidationMethod||"DNS"};if(e.SubjectAlternativeNames)t.SubjectAlternativeNames=e.SubjectAlternativeNames;return{CertificateArn:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.RequestCertificate"},body:JSON.stringify(t)})).CertificateArn||""}}async describeCertificate(e){let r=(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DescribeCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})).Certificate||{};return{CertificateArn:r.CertificateArn||"",DomainName:r.DomainName||"",SubjectAlternativeNames:r.SubjectAlternativeNames,Status:r.Status||"PENDING_VALIDATION",Type:r.Type,DomainValidationOptions:r.DomainValidationOptions?.map((s)=>({DomainName:s.DomainName,ValidationDomain:s.ValidationDomain,ValidationStatus:s.ValidationStatus,ResourceRecord:s.ResourceRecord?{Name:s.ResourceRecord.Name,Type:s.ResourceRecord.Type,Value:s.ResourceRecord.Value}:void 0,ValidationMethod:s.ValidationMethod})),CreatedAt:r.CreatedAt,IssuedAt:r.IssuedAt,NotBefore:r.NotBefore,NotAfter:r.NotAfter}}async listCertificates(e){let t={};if(e?.CertificateStatuses)t.CertificateStatuses=e.CertificateStatuses;if(e?.MaxItems)t.MaxItems=e.MaxItems;if(e?.NextToken)t.NextToken=e.NextToken;let r=await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListCertificates"},body:JSON.stringify(t)});return{CertificateSummaryList:(r.CertificateSummaryList||[]).map((s)=>({CertificateArn:s.CertificateArn,DomainName:s.DomainName})),NextToken:r.NextToken}}async deleteCertificate(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.DeleteCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})}async listTagsForCertificate(e){return{Tags:(await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ListTagsForCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn})})).Tags||[]}}async addTagsToCertificate(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.AddTagsToCertificate"},body:JSON.stringify({CertificateArn:e.CertificateArn,Tags:e.Tags})})}async resendValidationEmail(e){await this.client.request({service:"acm",region:this.region,method:"POST",path:"/",headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":"CertificateManager.ResendValidationEmail"},body:JSON.stringify({CertificateArn:e.CertificateArn,Domain:e.Domain,ValidationDomain:e.ValidationDomain})})}async findCertificateByDomain(e){let r=(await this.listCertificates({CertificateStatuses:["ISSUED"]})).CertificateSummaryList.find((s)=>s.DomainName===e||s.DomainName===`*.${e.split(".").slice(1).join(".")}`);if(!r)return null;return this.describeCertificate({CertificateArn:r.CertificateArn})}async waitForCertificateValidation(e,t=60,r=30000){for(let s=0;s<t;s++){let o=await this.describeCertificate({CertificateArn:e});if(o.Status==="ISSUED")return o;if(o.Status==="FAILED"||o.Status==="VALIDATION_TIMED_OUT")return null;await new Promise((i)=>setTimeout(i,r))}return null}async getDnsValidationRecords(e){let t=await this.describeCertificate({CertificateArn:e});if(!t.DomainValidationOptions)return[];return t.DomainValidationOptions.filter((r)=>r.ResourceRecord&&r.ValidationMethod==="DNS").map((r)=>({domainName:r.DomainName,recordName:r.ResourceRecord.Name,recordType:r.ResourceRecord.Type,recordValue:r.ResourceRecord.Value}))}async requestCertificateWithSans(e){let t=new Set;if(t.add(e.DomainName),e.IncludeWww!==!1)t.add(`www.${e.DomainName}`);if(e.IncludeWildcard)t.add(`*.${e.DomainName}`);if(e.AdditionalSans)for(let r of e.AdditionalSans)t.add(r);return this.requestCertificate({DomainName:e.DomainName,SubjectAlternativeNames:Array.from(t),ValidationMethod:"DNS"})}async isCertificateValidForDomain(e,t){let r=await this.describeCertificate({CertificateArn:e});if(r.Status!=="ISSUED")return!1;if(r.DomainName===t)return!0;if(r.DomainName?.startsWith("*.")){let s=r.DomainName.slice(2),o=t.split("."),i=s.split(".");if(o.slice(-i.length).join(".")===s)return!0}if(r.SubjectAlternativeNames)for(let s of r.SubjectAlternativeNames){if(s===t)return!0;if(s.startsWith("*.")){let o=s.slice(2),i=t.split("."),a=o.split(".");if(i.slice(-a.length).join(".")===o)return!0}}return!1}}class or{acm;route53;dnsProvider;constructor(e="us-east-1",t){if(this.acm=new oe(e),this.route53=new h,t&&t.provider!=="route53")this.dnsProvider=T(t)}async requestAndValidate(e){let{domainName:t,hostedZoneId:r,subjectAlternativeNames:s=[],waitForValidation:o=!1,maxWaitMinutes:i=30}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let{CertificateArn:a}=await this.acm.requestCertificate({DomainName:t,SubjectAlternativeNames:s.length>0?[t,...s]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(a);let c=await this.acm.getDnsValidationRecords(a);if(this.dnsProvider)for(let d of c){let u=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!u.success)console.warn(`Failed to create validation record for ${d.domainName}: ${u.message}`)}else if(r)for(let d of c)await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`ACM DNS validation for ${d.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:d.recordName,Type:d.recordType,TTL:300,ResourceRecords:[{Value:d.recordValue}]}}]}});if(o){if(!await this.acm.waitForCertificateValidation(a,i*2,30000))throw Error(`Certificate validation timed out after ${i} minutes`)}return{certificateArn:a,validationRecords:c}}async waitForValidationOptions(e,t=30){for(let r=0;r<t;r++){let s=await this.acm.describeCertificate({CertificateArn:e});if(s.DomainValidationOptions&&s.DomainValidationOptions.length>0&&s.DomainValidationOptions[0].ResourceRecord)return;await new Promise((o)=>setTimeout(o,2000))}throw Error("Timeout waiting for DNS validation options")}async createValidationRecords(e){let{certificateArn:t,hostedZoneId:r,domain:s}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let o=await this.acm.getDnsValidationRecords(t),i=[];if(this.dnsProvider){let a=s||o[0]?.domainName;for(let c of o){let d=await this.dnsProvider.upsertRecord(a,{name:c.recordName,type:c.recordType,content:c.recordValue,ttl:300});i.push({...c,changeId:d.success?d.id:void 0})}}else if(r)for(let a of o){let c=await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`ACM DNS validation for ${a.domainName}`,Changes:[{Action:"UPSERT",ResourceRecordSet:{Name:a.recordName,Type:a.recordType,TTL:300,ResourceRecords:[{Value:a.recordValue}]}}]}});i.push({...a,changeId:c.ChangeInfo?.Id})}return i}async deleteValidationRecords(e){let{certificateArn:t,hostedZoneId:r,domain:s}=e,o=await this.acm.getDnsValidationRecords(t);if(this.dnsProvider){let i=s||o[0]?.domainName;for(let a of o)try{await this.dnsProvider.deleteRecord(i,{name:a.recordName,type:a.recordType,content:a.recordValue})}catch{}}else if(r)for(let i of o)try{await this.route53.changeResourceRecordSets({HostedZoneId:r,ChangeBatch:{Comment:`Cleanup ACM DNS validation for ${i.domainName}`,Changes:[{Action:"DELETE",ResourceRecordSet:{Name:i.recordName,Type:i.recordType,TTL:300,ResourceRecords:[{Value:i.recordValue}]}}]}})}catch{}}async findOrCreateCertificate(e){let{domainName:t,hostedZoneId:r,subjectAlternativeNames:s,waitForValidation:o=!0}=e;if(!this.dnsProvider&&!r)throw Error("Either hostedZoneId or external DNS provider configuration is required");let i=await this.acm.findCertificateByDomain(t);if(i&&i.Status==="ISSUED")return{certificateArn:i.CertificateArn,isNew:!1};let{certificateArn:a}=await this.requestAndValidate({domainName:t,hostedZoneId:r,subjectAlternativeNames:s,waitForValidation:o});return{certificateArn:a,isNew:!0}}hasExternalDnsProvider(){return this.dnsProvider!==void 0}getDnsProviderName(){return this.dnsProvider?.name||"route53"}}class se{acm;dnsProvider;constructor(e,t="us-east-1"){if(this.acm=new oe(t),"provider"in e)this.dnsProvider=T(e);else this.dnsProvider=e}getProvider(){return this.dnsProvider}async requestAndValidate(e){let{domainName:t,subjectAlternativeNames:r=[],waitForValidation:s=!1,maxWaitMinutes:o=30}=e,{CertificateArn:i}=await this.acm.requestCertificate({DomainName:t,SubjectAlternativeNames:r.length>0?[t,...r]:void 0,ValidationMethod:"DNS"});await this.waitForValidationOptions(i);let a=await this.acm.getDnsValidationRecords(i);for(let d of a){let u=await this.dnsProvider.upsertRecord(t,{name:d.recordName,type:d.recordType,content:d.recordValue,ttl:300});if(!u.success)console.warn(`Failed to create validation record for ${d.domainName}: ${u.message}`)}let c="pending";if(s)c=(await this.acm.waitForCertificateValidation(i,o*2,30000))?.Status==="ISSUED"?"issued":"failed";return{certificateArn:i,validationRecords:a.map((d)=>({domainName:d.domainName,recordName:d.recordName,recordType:d.recordType,recordValue:d.recordValue})),isNew:!0,status:c}}async createValidationRecords(e){let{certificateArn:t,domain:r}=e,s=[],o=await this.acm.getDnsValidationRecords(t);for(let i of o){let a=await this.dnsProvider.upsertRecord(r,{name:i.recordName,type:i.recordType,content:i.recordValue,ttl:300});if(!a.success)s.push(`Failed to create record for ${i.domainName}: ${a.message}`)}return{success:s.length===0,records:o.map((i)=>({domainName:i.domainName,recordName:i.recordName,recordType:i.recordType,recordValue:i.recordValue})),errors:s}}async deleteValidationRecords(e){let{certificateArn:t,domain:r}=e,s=[],o=await this.acm.getDnsValidationRecords(t);for(let i of o){let a=await this.dnsProvider.deleteRecord(r,{name:i.recordName,type:i.recordType,content:i.recordValue});if(!a.success)s.push(`Failed to delete record for ${i.domainName}: ${a.message}`)}return{success:s.length===0,errors:s}}async findOrCreateCertificate(e){let{domainName:t,subjectAlternativeNames:r=[],waitForValidation:s=!0,maxWaitMinutes:o}=e,i=await this.acm.findCertificateByDomain(t);if(i&&i.Status==="ISSUED"){let a=i.SubjectAlternativeNames||[i.DomainName],c=a.some((u)=>u===`*.${t}`);if(r.every((u)=>a.includes(u)||c))return{certificateArn:i.CertificateArn,validationRecords:[],isNew:!1,status:"issued"};console.log("Existing certificate doesn't cover all required SANs, requesting new certificate...")}return this.requestAndValidate({domainName:t,subjectAlternativeNames:r,waitForValidation:s,maxWaitMinutes:o})}async requestCertificateWithCommonSans(e){let{domainName:t,includeWww:r=!0,includeWildcard:s=!1,additionalSans:o=[],waitForValidation:i=!1}=e,a=[];if(r)a.push(`www.${t}`);if(s)a.push(`*.${t}`);return a.push(...o),this.requestAndValidate({domainName:t,subjectAlternativeNames:a,waitForValidation:i})}async waitForValidationOptions(e,t=30){for(let r=0;r<t;r++){let s=await this.acm.describeCertificate({CertificateArn:e});if(s.DomainValidationOptions&&s.DomainValidationOptions.length>0&&s.DomainValidationOptions[0].ResourceRecord)return;await new Promise((o)=>setTimeout(o,2000))}throw Error("Timeout waiting for DNS validation options")}async getCertificateStatus(e){let t=await this.acm.describeCertificate({CertificateArn:e});return{status:t.Status,domainValidations:(t.DomainValidationOptions||[]).map((r)=>({domain:r.DomainName,status:r.ValidationStatus||"UNKNOWN"}))}}}function ps(e,t,r){return new se({provider:"porkbun",apiKey:e,secretKey:t},r)}function gs(e,t,r,s){return new se({provider:"godaddy",apiKey:e,apiSecret:t,environment:s},r)}function ms(e,t,r){return new se({provider:"route53",region:e,hostedZoneId:t},r||e)}function T(e){switch(e.provider){case"route53":return new fe(e.region,e.hostedZoneId);case"porkbun":return new ie(e.apiKey,e.secretKey);case"godaddy":return new Be(e.apiKey,e.apiSecret,e.environment);case"cloudflare":return new he(e.apiToken,{zoneId:e.zoneId,accountId:e.accountId});default:throw Error(`Unknown DNS provider: ${e.provider}`)}}async function $a(e,t){for(let r of t){let s=T(r);if(await s.canManageDomain(e))return s}return null}class An{providers=new Map;configs=[];addConfig(e){return this.configs.push(e),this}addRoute53(e,t){return this.configs.push({provider:"route53",region:e,hostedZoneId:t}),this}addPorkbun(e,t){return this.configs.push({provider:"porkbun",apiKey:e,secretKey:t}),this}addGoDaddy(e,t,r){return this.configs.push({provider:"godaddy",apiKey:e,apiSecret:t,environment:r}),this}addCloudflare(e,t={}){return this.configs.push({provider:"cloudflare",apiToken:e,zoneId:t.zoneId,accountId:t.accountId}),this}loadFromEnv(){if(process.env.AWS_ACCESS_KEY_ID||process.env.AWS_REGION)this.addRoute53(process.env.AWS_REGION);let e=process.env.PORKBUN_API_KEY,t=process.env.PORKBUN_SECRET_KEY;if(e&&t)this.addPorkbun(e,t);let r=process.env.GODADDY_API_KEY,s=process.env.GODADDY_API_SECRET;if(r&&s){let i=process.env.GODADDY_ENVIRONMENT;this.addGoDaddy(r,s,i)}let o=process.env.CLOUDFLARE_API_TOKEN;if(o)this.addCloudflare(o,{zoneId:process.env.CLOUDFLARE_ZONE_ID,accountId:process.env.CLOUDFLARE_ACCOUNT_ID});return this}getProvider(e){let t=this.providers.get(e);if(t)return t;let r=this.configs.find((o)=>o.provider===e);if(!r)return null;let s=T(r);return this.providers.set(e,s),s}async getProviderForDomain(e){for(let t of this.configs){let r=T(t);if(await r.canManageDomain(e))return r}return null}getAllProviders(){return this.configs.map((e)=>T(e))}}var Ma=new An;
+export{tt,ie,Be,ts,he,Tt,hn,rs,ns,nr,ir,fn,sr,is,ss,os,as,fe,cs,ds,ls,us,se,ps,gs,ms,T,$a,An,Ma,oe,or};