@stacksjs/ts-cloud 0.16.10 → 0.16.11

package/dist/bin/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import{T,Mt,n,r,a,hr,e,m,i,o,I,d,fo,c,Yr,he,Cs,As,Is,Rs,g}from"./chunk-23a7gckt.js";import{_s,V,wr,C,U,yo,l,s,E,Ls,Ms,Us,Pe,Le,B,S,_,Ze,D,pe,bo,Me,Bt,mi,ve,vo,gi,Ft,Et,Fs,js}from"./chunk-gxwsq3k0.js";import{ke,k,ln,y,dn,Ei,un,ko,Ir,tt,Ie,pn,mn,gn,fn,hn,yn,Sn,bn,te,Ht,Wt,vn,Rr,Tn,En,wn,Cn,An,In,Rn,Pn,rt,Gt,Kt,Ct,Pr,Jt,Xt,wi,At,Nn,se,Dn,kn,xn,Nr,Dr,_n,kr,Qt,Yt,nt,It,Rt,xr,ae,$n,na,ia,Zt,oa,z,Ci,Ue,it,ot,On,_r,$r,Ln,Mn,Un,Or,xo,ce,me,xe,ge,Bn,er}from"./chunk-917m9nzt.js";import{u,Ps}from"./chunk-bhw14ry9.js";import{ie,h,Er}from"./chunk-rm6fm3r9.js";import{yr,bt,Sr,br,vr,Tr,Zr}from"./chunk-8qhjwthr.js";import{b,Nt,Hn,qo,cr,la,da,ua,Wn,Gn,dt,Vr,Dt,zr,ut,Ve,$e,ze,pt,lr,Oe,qe,Kn,Jn,He,qr,Hr,Ui,Fi,pr,kt,mt,xt,X,qi,Yn,Zn,rs}from"./chunk-4r3thj0q.js";import{Ge,_t,Ke,Ki,Ji,Xi,Qi,Yi,Zi,q,$t,O,ti}from"./chunk-92nf1z52.js";import{H,R,io,us,ps,Oa,La,ii,ht,oi}from"./chunk-hyz0w30r.js";import{v}from"./chunk-46gwe1s8.js";import{K}from"./chunk-anpefq1s.js";import{St,f}from"./chunk-mpz3spf2.js";import{Be,_o,le,Ai,jn,Ii,Ri,Lr,Pi,Ni,fe,J,Fe,Re,Mr,tr,je,rr,Ur,at,de,ct,ir,or,sr,Br,ar,x,ki,xi,Vn,$o,Fr,Oo,Lo,sa,_i,Mo,Uo,Bo,Fo,lt,jo,$i,Oi}from"./chunk-p875a551.js";import"./chunk-f15wfrvq.js";import{P}from"./chunk-6zbq64ed.js";import{ue}from"./chunk-jxcgrzh4.js";import{W,yt,mo}from"./chunk-ass0atp3.js";import{ne,Q,Fa,ja,Xe}from"./chunk-hckq0sty.js";import{zt,an,qt,vi,cn,Do}from"./chunk-wmwwbd0t.js";import"./chunk-jc63ybbb.js";import{w}from"./chunk-xkc1w47e.js";import{st}from"./chunk-1s44qfb8.js";import{Y,ye}from"./chunk-6ecg74kd.js";import{F}from"./chunk-5s9qckt2.js";import"./chunk-3x4mrxpv.js";import{Ti}from"./chunk-63c6vagk.js";import"./chunk-yqtnf05n.js";import{ei}from"./chunk-3rxkhwvt.js";import{mr}from"./chunk-v3jss9ck.js";import{gt}from"./chunk-cvykzja8.js";import{M}from"./chunk-r4teb3g4.js";import{existsSync as Fd}from"node:fs";import Zs from"node:fs/promises";import tl from"node:os";import Qs from"node:path";import oo from"node:process";import{EventEmitter as Bd}from"node:events";import Vi from"node:process";import nl from"node:process";import ta from"node:process";import gs from"node:process";import Wo from"node:process";import sl from"node:tty";import Ru,{stdin as Pg,stdout as xg}from"node:process";class al{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let N=tl.homedir(),t=Qs.join(N,".config","clapp");this.configPath=Qs.join(t,"telemetry.json")}async isEnabled(){if(oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true")return!1;if(oo.env.NO_TELEMETRY==="1"||oo.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let N=await this.loadConfig();if(N.enabled=!0,!N.userId)N.userId=this.generateUserId();await this.saveConfig(N)}async disable(){let N=await this.loadConfig();N.enabled=!1,await this.saveConfig(N)}async track(N,t){if(!await this.isEnabled())return;let A={event:N,...t,timestamp:Date.now(),platform:tl.platform(),nodeVersion:oo.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(N,t){await this.track("command",{command:N,duration:t})}async trackError(N,t){await this.track("error",{error:N,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(N){return new Promise((t)=>setTimeout(t,N))}async status(){let N=await this.loadConfig();return{enabled:N.enabled,doNotTrack:oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:N.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Fd(this.configPath)){let N=await Zs.readFile(this.configPath,"utf-8");return this.config=JSON.parse(N),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(N){this.config=N;try{let t=Qs.dirname(this.configPath);await Zs.mkdir(t,{recursive:!0}),await Zs.writeFile(this.configPath,JSON.stringify(N,null,2),"utf-8")}catch{}}generateUserId(){let N=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${N}-${t}`}}var gg=new al;function ea(N){return N.replace(/[<[].+/,"").trim()}function Md(N){let t=/<([^>]+)>/g,p=/\[([^\]]+)\]/g,A=[],L=(Z)=>{let ee=!1,re=Z[1];if(re.startsWith("..."))re=re.slice(3),ee=!0;return{required:Z[0].startsWith("<"),value:re,variadic:ee}},j;while(j=t.exec(N))A.push(L(j));let G;while(G=p.exec(N))A.push(L(G));return A}function _d(N){let t={alias:{},boolean:[]};for(let[p,A]of N.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!N.some((j,G)=>G!==p&&j.names.some((Z)=>A.names.includes(Z))&&typeof j.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function rl(N){return N.reduce((t,p)=>t.length>=p.length?t:p,"")}function Xs(N,t){return N.length>=t?N:`${N}${" ".repeat(t-N.length)}`}function fs(N){return N.replace(/([a-z])-([a-z])/g,(t,p,A)=>p+A.toUpperCase())}function zd(N,t,p){let A=0,L=t.length,j=N,G;for(;A<L;++A)G=j[t[A]],j=j[t[A]]=A===L-1?p:G!=null?G:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function Ud(N,t){for(let p of Object.keys(t)){let A=t[p];if(A.shouldTransform){if(N[p]=Array.prototype.concat.call([],N[p]),typeof A.transformFunction==="function")N[p]=N[p].map(A.transformFunction)}}}function Vd(N){let t=/([^\\/]+)$/.exec(N);return t?t[1]:""}function Ho(N){return N.split(".").map((t,p)=>p===0?fs(t):t).join(".")}class Go extends Error{exitCode=2;isUsageError=!0;usage;constructor(N,t){super(N);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(N).stack}format(N=!1){if(N&&this.stack)return`${this.message}
+import{T,Mt,n,r,a,hr,e,m,i,o,I,d,fo,c,Yr,he,Cs,As,Is,Rs,g}from"./chunk-23a7gckt.js";import{_s,V,wr,C,U,yo,l,s,E,Ls,Ms,Us,Pe,Le,B,S,_,Ze,D,pe,bo,Me,Bt,mi,ve,vo,gi,Ft,Et,Fs,js}from"./chunk-gxwsq3k0.js";import{ke,k,ln,y,dn,Ei,un,ko,Ir,tt,Ie,pn,mn,gn,fn,hn,yn,Sn,bn,te,Ht,Wt,vn,Rr,Tn,En,wn,Cn,An,In,Rn,Pn,rt,Gt,Kt,Ct,Pr,Jt,Xt,wi,At,Nn,se,Dn,kn,xn,Nr,Dr,_n,kr,Qt,Yt,nt,It,Rt,xr,ae,$n,na,ia,Zt,oa,z,Ci,Ue,it,ot,On,_r,$r,Ln,Mn,Un,Or,xo,ce,me,xe,ge,Bn,er}from"./chunk-917m9nzt.js";import{u,Ps}from"./chunk-bhw14ry9.js";import{ie,h,Er}from"./chunk-rm6fm3r9.js";import{yr,bt,Sr,br,vr,Tr,Zr}from"./chunk-8qhjwthr.js";import{b,Nt,Hn,qo,cr,la,da,ua,Wn,Gn,dt,Vr,Dt,zr,ut,Ve,$e,ze,pt,lr,Oe,qe,Kn,Jn,He,qr,Hr,Ui,Fi,pr,kt,mt,xt,X,qi,Yn,Zn,rs}from"./chunk-4r3thj0q.js";import{Ge,_t,Ke,Ki,Ji,Xi,Qi,Yi,Zi,q,$t,O,ti}from"./chunk-rrts8hnz.js";import{H,R,io,us,ps,Oa,La,ii,ht,oi}from"./chunk-hyz0w30r.js";import{v}from"./chunk-46gwe1s8.js";import{K}from"./chunk-anpefq1s.js";import{St,f}from"./chunk-mpz3spf2.js";import{Be,_o,le,Ai,jn,Ii,Ri,Lr,Pi,Ni,fe,J,Fe,Re,Mr,tr,je,rr,Ur,at,de,ct,ir,or,sr,Br,ar,x,ki,xi,Vn,$o,Fr,Oo,Lo,sa,_i,Mo,Uo,Bo,Fo,lt,jo,$i,Oi}from"./chunk-p875a551.js";import"./chunk-f15wfrvq.js";import{P}from"./chunk-6zbq64ed.js";import{ue}from"./chunk-jxcgrzh4.js";import{W,yt,mo}from"./chunk-ass0atp3.js";import{ne,Q,Fa,ja,Xe}from"./chunk-hckq0sty.js";import{zt,an,qt,vi,cn,Do}from"./chunk-wmwwbd0t.js";import"./chunk-jc63ybbb.js";import{w}from"./chunk-xkc1w47e.js";import{st}from"./chunk-1s44qfb8.js";import{Y,ye}from"./chunk-6ecg74kd.js";import{F}from"./chunk-5s9qckt2.js";import"./chunk-3x4mrxpv.js";import{Ti}from"./chunk-3rwca7kr.js";import"./chunk-yqtnf05n.js";import{ei}from"./chunk-3rxkhwvt.js";import{mr}from"./chunk-v3jss9ck.js";import{gt}from"./chunk-cvykzja8.js";import{M}from"./chunk-r4teb3g4.js";import{existsSync as Fd}from"node:fs";import Zs from"node:fs/promises";import tl from"node:os";import Qs from"node:path";import oo from"node:process";import{EventEmitter as Bd}from"node:events";import Vi from"node:process";import nl from"node:process";import ta from"node:process";import gs from"node:process";import Wo from"node:process";import sl from"node:tty";import Ru,{stdin as Pg,stdout as xg}from"node:process";class al{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let N=tl.homedir(),t=Qs.join(N,".config","clapp");this.configPath=Qs.join(t,"telemetry.json")}async isEnabled(){if(oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true")return!1;if(oo.env.NO_TELEMETRY==="1"||oo.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let N=await this.loadConfig();if(N.enabled=!0,!N.userId)N.userId=this.generateUserId();await this.saveConfig(N)}async disable(){let N=await this.loadConfig();N.enabled=!1,await this.saveConfig(N)}async track(N,t){if(!await this.isEnabled())return;let A={event:N,...t,timestamp:Date.now(),platform:tl.platform(),nodeVersion:oo.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(N,t){await this.track("command",{command:N,duration:t})}async trackError(N,t){await this.track("error",{error:N,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(N){return new Promise((t)=>setTimeout(t,N))}async status(){let N=await this.loadConfig();return{enabled:N.enabled,doNotTrack:oo.env.DO_NOT_TRACK==="1"||oo.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:N.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Fd(this.configPath)){let N=await Zs.readFile(this.configPath,"utf-8");return this.config=JSON.parse(N),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(N){this.config=N;try{let t=Qs.dirname(this.configPath);await Zs.mkdir(t,{recursive:!0}),await Zs.writeFile(this.configPath,JSON.stringify(N,null,2),"utf-8")}catch{}}generateUserId(){let N=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${N}-${t}`}}var gg=new al;function ea(N){return N.replace(/[<[].+/,"").trim()}function Md(N){let t=/<([^>]+)>/g,p=/\[([^\]]+)\]/g,A=[],L=(Z)=>{let ee=!1,re=Z[1];if(re.startsWith("..."))re=re.slice(3),ee=!0;return{required:Z[0].startsWith("<"),value:re,variadic:ee}},j;while(j=t.exec(N))A.push(L(j));let G;while(G=p.exec(N))A.push(L(G));return A}function _d(N){let t={alias:{},boolean:[]};for(let[p,A]of N.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!N.some((j,G)=>G!==p&&j.names.some((Z)=>A.names.includes(Z))&&typeof j.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function rl(N){return N.reduce((t,p)=>t.length>=p.length?t:p,"")}function Xs(N,t){return N.length>=t?N:`${N}${" ".repeat(t-N.length)}`}function fs(N){return N.replace(/([a-z])-([a-z])/g,(t,p,A)=>p+A.toUpperCase())}function zd(N,t,p){let A=0,L=t.length,j=N,G;for(;A<L;++A)G=j[t[A]],j=j[t[A]]=A===L-1?p:G!=null?G:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function Ud(N,t){for(let p of Object.keys(t)){let A=t[p];if(A.shouldTransform){if(N[p]=Array.prototype.concat.call([],N[p]),typeof A.transformFunction==="function")N[p]=N[p].map(A.transformFunction)}}}function Vd(N){let t=/([^\\/]+)$/.exec(N);return t?t[1]:""}function Ho(N){return N.split(".").map((t,p)=>p===0?fs(t):t).join(".")}class Go extends Error{exitCode=2;isUsageError=!0;usage;constructor(N,t){super(N);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(N).stack}format(N=!1){if(N&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function Wd(N){if(N instanceof Go)return!0;return!!N&&typeof N==="object"&&N.name==="ClappError"&&typeof N.message==="string"}function qd(){let{env:N}=nl,{TERM:t,TERM_PROGRAM:p}=N;if(nl.platform!=="win32")return t!=="linux";return Boolean(N.WT_SESSION)||Boolean(N.TERMINUS_SUBLIME)||N.ConEmuTask==="{cmd::Cmder}"||p==="Terminus-Sublime"||p==="vscode"||t==="xterm-256color"||t==="alacritty"||t==="rxvt-unicode"||t==="rxvt-unicode-256color"||N.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var hs="\x1B",Fn=`${hs}[`;var il={to(N,t){if(!t)return`${Fn}${N+1}G`;return`${Fn}${t+1};${N+1}H`},move(N,t){let p="";if(N<0)p+=`${Fn}${-N}D`;else if(N>0)p+=`${Fn}${N}C`;if(t<0)p+=`${Fn}${-t}A`;else if(t>0)p+=`${Fn}${t}B`;return p},up:(N=1)=>`${Fn}${N}A`,down:(N=1)=>`${Fn}${N}B`,forward:(N=1)=>`${Fn}${N}C`,backward:(N=1)=>`${Fn}${N}D`,nextLine:(N=1)=>`${Fn}E`.repeat(N),prevLine:(N=1)=>`${Fn}F`.repeat(N),left:`${Fn}G`,hide:`${Fn}?25l`,show:`${Fn}?25h`,save:`${hs}7`,restore:`${hs}8`};var bg={screen:`${Fn}2J`,up:(N=1)=>`${Fn}1J`.repeat(N),down:(N=1)=>`${Fn}J`.repeat(N),line:`${Fn}2K`,lineEnd:`${Fn}K`,lineStart:`${Fn}1K`,lines(N){let t="";for(let p=0;p<N;p++)t+=this.line+(p<N-1?il.up():"");if(N)t+=il.left;return t}},wg={screen:`${hs}c`};function Hd(N,t){let p=[];for(let A=0;A<=t.length;A++)p[A]=[A];for(let A=0;A<=N.length;A++)p[0][A]=A;for(let A=1;A<=t.length;A++)for(let L=1;L<=N.length;L++)if(t.charAt(A-1)===N.charAt(L-1))p[A][L]=p[A-1][L-1];else p[A][L]=Math.min(p[A-1][L-1]+1,p[A][L-1]+1,p[A-1][L]+1);return p[t.length][N.length]}function cl(N,t,p=2,A=3){return t.map((L)=>({cmd:L,distance:Hd(N,L)})).filter(({distance:L})=>L<=p).sort((L,j)=>L.distance-j.distance).slice(0,A).map(({cmd:L})=>L)}function Gd(N,t={}){let p={_:[]},A=t.alias||{},L=new Set(t.boolean||[]),j={};for(let ee of Object.keys(A))for(let re of A[ee])j[re]=ee;for(let ee of L)if(A[ee])for(let re of A[ee])L.add(re);function G(ee,re){if(ee===void 0)return re;if(typeof re==="boolean")return re;return Array.isArray(ee)?[...ee,re]:[ee,re]}function Z(ee,re){let oe=j[ee]||ee,be=G(p[oe],re);if(p[oe]=be,A[oe])for(let we of A[oe])p[we]=be;if(j[ee]&&A[j[ee]])for(let we of A[j[ee]])p[we]=be;p[ee]=be}for(let ee=0;ee<N.length;ee++){let re=N[ee];if(re==="--"){p._.push(...N.slice(ee+1));break}if(re.startsWith("--")){let oe=re.indexOf("=");if(oe!==-1){let be=fs(re.slice(2,oe)),we=re.slice(oe+1);Z(be,we)}else{let be=re.slice(2);if(be.startsWith("no-")){let De=fs(be.slice(3));Z(De,!1);continue}let we=fs(be),Ce=j[we]||we;if(L.has(Ce)||L.has(we))Z(we,!0);else{let De=N[ee+1];if(De!==void 0&&!De.startsWith("-"))Z(we,De),ee++;else Z(we,!0)}}}else if(re.startsWith("-")&&re.length>1){let oe=re.slice(1);for(let be=0;be<oe.length;be++){let we=oe[be],Ce=j[we]||we;if(be===oe.length-1&&!L.has(Ce)&&!L.has(we)){let De=N[ee+1];if(De!==void 0&&!De.startsWith("-"))Z(we,De),ee++;else Z(we,!0)}else Z(we,!0)}}else p._.push(re)}return p}class ll{rawName;description;name;names;isBoolean;required;config;negated;constructor(N,t,p){if(this.rawName=N,this.description=t,this.config=Object.assign({},p),N=N.replace(/\.\*/g,""),this.negated=!1,this.names=ea(N).split(",").map((A)=>{let L=A.trim().replace(/^-{1,2}/,"");if(L.startsWith("no-"))this.negated=!0,L=L.replace(/^no-/,"");return Ho(L)}).sort((A,L)=>A.length>L.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(N.includes("<"))this.required=!0;else if(N.includes("["))this.required=!1;else this.isBoolean=!0}}var $g=ta.argv,Kd=`${ta.platform}-${ta.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,ol=gs.argv,Jd=`${gs.platform}-${gs.arch} node-${gs.version}`;class ra{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(N,t,p,A){this.rawName=N,this.description=t,this.config=p,this.cli=A,this.options=[],this.aliasNames=[],this.name=ea(N);let L=ea(N),j=L.indexOf(":");if(j>0)this.namespace=L.substring(0,j),this.name=L.substring(j+1);if(this.args=Md(N),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!p)this.config={}}usage(N){return this.usageText=N,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(N,t="-v, --version"){return this.versionNumber=N,this.option(t,"Display version number"),this}example(N){return this.examples.push(N),this}option(N,t,p){let A=new ll(N,t,p);return this.options.push(A),this}alias(N){return this.aliasNames.push(N),this}action(N){return this.commandAction=N,this}before(N){return this.beforeHooks.push(N),this}after(N){return this.afterHooks.push(N),this}use(N){return this.middleware.push(N),this}isMatched(N){if(this.aliasNames.includes(N))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===N;return this.name===N}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof aa}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(N){let t=Ho(N.split(".")[0]);return!!this.options.find((p)=>p.names.some((A)=>Ho(A)===t))}outputHelp(){let{name:N,commands:t}=this.cli,{versionNumber:p,options:A,helpCallback:L}=this.cli.globalCommand,j=[{body:`${N}${p?`/${p}`:""}`}];if(j.push({title:"Usage",body:`  $ ${N} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&t.length>0){let re=rl(t.map((De)=>De.rawName)),oe=new Map,be=[];for(let De of t)if(De.namespace){if(!oe.has(De.namespace))oe.set(De.namespace,[]);oe.get(De.namespace).push(De)}else be.push(De);let we="";if(be.sort((De,Se)=>De.rawName<Se.rawName?-1:De.rawName>Se.rawName?1:0),be.length>0)we+=be.map((De)=>`  ${Xs(De.rawName,re.length)}  ${De.description}`).join(`
@@ -28,7 +28,7 @@ Received ${p}, cleaning up...`),N)try{await N()}catch(A){console.error("Error du
 `)),this.enableDidYouMean){let t=[];for(let A of this.commands){if(A.displayName)t.push(A.displayName);if(A.aliasNames)t.push(...A.aliasNames)}let p=cl(N,t);if(p.length>0)console.log(Vo.yellow("Did you mean one of these?")),p.forEach((A)=>console.log(`  ${Vo.dim("•")} ${this.name} ${A}`)),console.log("")}console.log(Vo.dim("Run"),`${this.name} --help`,Vo.dim("to see all available commands")),Vi.exit(1)}async parse(N=ol,t={}){let{run:p=!0,exitOnError:A=!1}=t;if(A)try{return await this.parse(N,{run:p})}catch(ee){throw this.handleUsageError(ee),ee}if(this.rawArgs=N,!this.name)this.name=N[1]?Vd(N[1]):"cli";let L=!0,j=N.slice(2),G=j[0];if(G&&!G.startsWith("-")){for(let ee of this.commands)if(ee.isMatched(G)){let re=this.mri(j,ee);L=!1;let oe={...re,args:re.args.slice(1)};this.setParsedInfo(oe,ee,G),this.emit(`command:${G}`,ee);break}if(L){let ee=j[1];if(ee&&!ee.startsWith("-")){let re=`${G}:${ee}`;for(let oe of this.commands)if(oe.isMatched(re)){let be=this.mri(j,oe);L=!1;let we={...be,args:be.args.slice(2)};this.setParsedInfo(we,oe,re),this.emit(`command:${re}`,oe);break}}}}if(L){for(let ee of this.commands)if(ee.name===""){L=!1;let re=this.mri(j,ee);this.setParsedInfo(re,ee),this.emit("command:!",ee);break}}if(L){let ee=this.mri(N.slice(2));this.setParsedInfo(ee)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),p=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),p=!1,this.unsetMatchedCommand();let Z={args:this.args,options:this.options};if(p)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return Z}mri(N,t){let p=[...this.globalCommand.options,...t?t.options:[]],A=_d(p),L=[],j=N.indexOf("--");if(j>-1)L=N.slice(j+1),N=N.slice(0,j);let G=Gd(N,A),Z={_:G._};for(let we of Object.keys(G))if(we!=="_")Z[Ho(we)]=G[we];let ee=Z._,re={"--":L},oe=t&&t.config.ignoreOptionDefaultValue?t.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,be=Object.create(null);for(let we of p){if(!oe&&we.config.default!==void 0)for(let Ce of we.names)re[Ce]=we.config.default;if(Array.isArray(we.config.type)){if(be[we.name]===void 0)be[we.name]={shouldTransform:!0,transformFunction:we.config.type[0]}}}for(let we of Object.keys(Z))if(we!=="_"){let Ce=we.split(".");zd(re,Ce,Z[we]),Ud(re,be)}return{args:ee,options:re}}async run(N=ol){return this.parse(N,{run:!0,exitOnError:!0})}handleUsageError(N){if(!Wd(N)||N.isUsageError===!1)return;let t=N.message||"command-line error",p=this.name?`${this.name}: `:"",A=/--help/.test(t)?"":N.usage?`
 Usage: ${N.usage}`:`
 Run \`${this.name??"cli"} --help\` for usage.`;Vi.stderr.write(`${p}${t}${A}
-`),Vi.exit(N.exitCode??2)}async runMatchedCommand(){let{args:N,options:t,matchedCommand:p}=this;if(!p||!p.commandAction)return;p.checkUnknownOptions(),p.checkOptionValue(),p.checkRequiredArgs();let A=[];p.args.forEach((Z,ee)=>{if(Z.variadic)A.push(N.slice(ee));else A.push(N[ee])}),A.push(t);let L={command:p,args:A,options:t};for(let Z of p.beforeHooks)await Z(L);let j,G=async()=>{let Z=p.commandAction.apply(this,A);if(Z instanceof Promise)j=await Z;else j=Z;return j};if(p.middleware.length>0){let Z=0,ee=async()=>{if(Z<p.middleware.length){let re=p.middleware[Z++];await re({...L,next:ee})}else await G()};await ee()}else await G();for(let Z of p.afterHooks)await Z(L);return j}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Vi.removeAllListeners("SIGINT"),Vi.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class dl{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(N){if(!this.enabled){this.misses++;return}let t=this.cache.get(N);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(N),this.misses++;return}return this.hits++,t.value}set(N,t,p=5000){if(!this.enabled)return;this.cache.set(N,{value:t,timestamp:Date.now(),ttl:p})}has(N){if(!this.enabled)return!1;let t=this.cache.get(N);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(N),!1;return!0}delete(N){this.cache.delete(N)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let N=Date.now();for(let[t,p]of this.cache.entries())if(N-p.timestamp>p.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Ag=new dl;function Xd(){if("FORCE_COLOR"in Wo.env)return Wo.env.FORCE_COLOR!=="0";if("NO_COLOR"in Wo.env||Wo.env.TERM==="dumb")return!1;if(Wo.platform==="win32")return!0;return sl.isatty(1)&&sl.isatty(2)}var ul=Xd();function sn(N,t){if(!ul)return(p)=>p;return(p)=>N+p+t}var eu=sn("\x1B[0m","\x1B[0m"),tu=sn("\x1B[31m","\x1B[39m"),nu=sn("\x1B[32m","\x1B[39m"),ru=sn("\x1B[33m","\x1B[39m"),iu=sn("\x1B[34m","\x1B[39m"),ou=sn("\x1B[35m","\x1B[39m"),su=sn("\x1B[36m","\x1B[39m"),au=sn("\x1B[37m","\x1B[39m"),cu=sn("\x1B[90m","\x1B[39m"),lu=sn("\x1B[1m","\x1B[22m"),du=sn("\x1B[3m","\x1B[23m"),uu=sn("\x1B[4m","\x1B[24m"),mu=sn("\x1B[2m","\x1B[22m"),pu=sn("\x1B[7m","\x1B[27m"),fu=sn("\x1B[8m","\x1B[28m"),gu=sn("\x1B[9m","\x1B[29m"),hu=sn("\x1B[41m","\x1B[49m"),yu=sn("\x1B[42m","\x1B[49m"),vu=sn("\x1B[43m","\x1B[49m"),bu=sn("\x1B[44m","\x1B[49m"),wu=sn("\x1B[45m","\x1B[49m"),Su=sn("\x1B[46m","\x1B[49m"),$u=sn("\x1B[47m","\x1B[49m"),Cu=ul,Au={reset:eu,red:tu,green:nu,yellow:ru,blue:iu,magenta:ou,cyan:su,white:au,gray:cu,bold:lu,italic:du,underline:uu,dim:mu,inverse:pu,hidden:fu,strikethrough:gu,bgRed:hu,bgGreen:yu,bgYellow:vu,bgBlue:bu,bgMagenta:wu,bgCyan:Su,bgWhite:$u,isColorSupported:Cu},ku=Au,Iu=["up","down","left","right","space","enter","cancel"],Dg={actions:new Set(Iu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var Eg=Ru.platform.startsWith("win"),Tg=Symbol("clapp:cancel");var Pu=qd();var on=(N,t)=>Pu?N:t,Ng=on("◆","*"),Og=on("■","x"),Lg=on("▲","x"),jg=on("◇","o"),Fg=on("┌","T"),xu=on("│","|"),Bg=on("└","—"),Mg=on("●",">"),_g=on("○"," "),zg=on("◻","[•]"),Ug=on("◼","[+]"),Vg=on("◻","[ ]"),Wg=on("▪","•"),qg=on("─","-"),Hg=on("╮","+"),Gg=on("├","+"),Kg=on("╯","+"),Jg=on("●","•"),Yg=on("◆","*"),Zg=on("▲","!"),Qg=on("■","x");var Xg={light:on("─","-"),heavy:on("━","="),block:on("█","#")};function Du(){return`${ku.gray(xu)}  `}var eh=Du();var ma="0.16.10";import{existsSync as pa}from"node:fs";import{mkdir as Tu,writeFile as ml}from"node:fs/promises";function fa(N){N.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),pa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let p=t?.name||await I("Project name","my-app"),A=t?.mode||await fo("Select deployment mode",["serverless","server"]),L=t?.region||await fo("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),j=new o("Creating configuration file...");j.start();let G=`import { defineConfig } from '@ts-cloud/core'
+`),Vi.exit(N.exitCode??2)}async runMatchedCommand(){let{args:N,options:t,matchedCommand:p}=this;if(!p||!p.commandAction)return;p.checkUnknownOptions(),p.checkOptionValue(),p.checkRequiredArgs();let A=[];p.args.forEach((Z,ee)=>{if(Z.variadic)A.push(N.slice(ee));else A.push(N[ee])}),A.push(t);let L={command:p,args:A,options:t};for(let Z of p.beforeHooks)await Z(L);let j,G=async()=>{let Z=p.commandAction.apply(this,A);if(Z instanceof Promise)j=await Z;else j=Z;return j};if(p.middleware.length>0){let Z=0,ee=async()=>{if(Z<p.middleware.length){let re=p.middleware[Z++];await re({...L,next:ee})}else await G()};await ee()}else await G();for(let Z of p.afterHooks)await Z(L);return j}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Vi.removeAllListeners("SIGINT"),Vi.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class dl{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(N){if(!this.enabled){this.misses++;return}let t=this.cache.get(N);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(N),this.misses++;return}return this.hits++,t.value}set(N,t,p=5000){if(!this.enabled)return;this.cache.set(N,{value:t,timestamp:Date.now(),ttl:p})}has(N){if(!this.enabled)return!1;let t=this.cache.get(N);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(N),!1;return!0}delete(N){this.cache.delete(N)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let N=Date.now();for(let[t,p]of this.cache.entries())if(N-p.timestamp>p.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Ag=new dl;function Xd(){if("FORCE_COLOR"in Wo.env)return Wo.env.FORCE_COLOR!=="0";if("NO_COLOR"in Wo.env||Wo.env.TERM==="dumb")return!1;if(Wo.platform==="win32")return!0;return sl.isatty(1)&&sl.isatty(2)}var ul=Xd();function sn(N,t){if(!ul)return(p)=>p;return(p)=>N+p+t}var eu=sn("\x1B[0m","\x1B[0m"),tu=sn("\x1B[31m","\x1B[39m"),nu=sn("\x1B[32m","\x1B[39m"),ru=sn("\x1B[33m","\x1B[39m"),iu=sn("\x1B[34m","\x1B[39m"),ou=sn("\x1B[35m","\x1B[39m"),su=sn("\x1B[36m","\x1B[39m"),au=sn("\x1B[37m","\x1B[39m"),cu=sn("\x1B[90m","\x1B[39m"),lu=sn("\x1B[1m","\x1B[22m"),du=sn("\x1B[3m","\x1B[23m"),uu=sn("\x1B[4m","\x1B[24m"),mu=sn("\x1B[2m","\x1B[22m"),pu=sn("\x1B[7m","\x1B[27m"),fu=sn("\x1B[8m","\x1B[28m"),gu=sn("\x1B[9m","\x1B[29m"),hu=sn("\x1B[41m","\x1B[49m"),yu=sn("\x1B[42m","\x1B[49m"),vu=sn("\x1B[43m","\x1B[49m"),bu=sn("\x1B[44m","\x1B[49m"),wu=sn("\x1B[45m","\x1B[49m"),Su=sn("\x1B[46m","\x1B[49m"),$u=sn("\x1B[47m","\x1B[49m"),Cu=ul,Au={reset:eu,red:tu,green:nu,yellow:ru,blue:iu,magenta:ou,cyan:su,white:au,gray:cu,bold:lu,italic:du,underline:uu,dim:mu,inverse:pu,hidden:fu,strikethrough:gu,bgRed:hu,bgGreen:yu,bgYellow:vu,bgBlue:bu,bgMagenta:wu,bgCyan:Su,bgWhite:$u,isColorSupported:Cu},ku=Au,Iu=["up","down","left","right","space","enter","cancel"],Dg={actions:new Set(Iu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var Eg=Ru.platform.startsWith("win"),Tg=Symbol("clapp:cancel");var Pu=qd();var on=(N,t)=>Pu?N:t,Ng=on("◆","*"),Og=on("■","x"),Lg=on("▲","x"),jg=on("◇","o"),Fg=on("┌","T"),xu=on("│","|"),Bg=on("└","—"),Mg=on("●",">"),_g=on("○"," "),zg=on("◻","[•]"),Ug=on("◼","[+]"),Vg=on("◻","[ ]"),Wg=on("▪","•"),qg=on("─","-"),Hg=on("╮","+"),Gg=on("├","+"),Kg=on("╯","+"),Jg=on("●","•"),Yg=on("◆","*"),Zg=on("▲","!"),Qg=on("■","x");var Xg={light:on("─","-"),heavy:on("━","="),block:on("█","#")};function Du(){return`${ku.gray(xu)}  `}var eh=Du();var ma="0.16.11";import{existsSync as pa}from"node:fs";import{mkdir as Tu,writeFile as ml}from"node:fs/promises";function fa(N){N.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),pa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let p=t?.name||await I("Project name","my-app"),A=t?.mode||await fo("Select deployment mode",["serverless","server"]),L=t?.region||await fo("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),j=new o("Creating configuration file...");j.start();let G=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -315,7 +315,7 @@ Resources to create: ${Ne}`);let Qe={};for(let Je of Object.values(re.Resources|
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
 `),Ee.length>0){n(`Resources to add (${Ee.length}):`);for(let Te of Ee){let Ne=Ce[Te].Type;e(`  + ${Te} (${Ne})`)}console.log()}if(We.length>0){r(`Resources to remove (${We.length}):`);for(let Te of We){let Ne=we[Te].Type;e(`  - ${Te} (${Ne})`)}console.log()}if(Ae.length>0){a(`Resources to modify (${Ae.length}):`);for(let Te of Ae){let Ne=Ce[Te].Type;e(`  ~ ${Te} (${Ne})`)}console.log()}e("Summary:"),e(`  - Add: ${Ee.length}`),e(`  - Remove: ${We.length}`),e(`  - Modify: ${Ae.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(p){r(`Diff failed: ${p.message}`)}})}function Hi(N,t=0){let p=Number(N);return Number.isFinite(p)?p:t}function Sa(N){return Hi(N)*1024}function dm(N){let t=N?.date?.trim(),p=N?.time?.trim();if(!t||!p)return null;let A=new Date(`${t}T${p}Z`);return Number.isFinite(A.getTime())?A.toISOString():null}function um(N,t,p){let A;try{A=JSON.parse(N)}catch{return[]}let L=(A?.sysstat?.hosts??[]).flatMap((G)=>G.statistics??[]),j=[];for(let G of L){let Z=dm(G.timestamp);if(!Z)continue;let ee=new Date(Z).getTime();if(ee<t.getTime()||ee>p.getTime())continue;let re=G["cpu-load"]?.find((be)=>be.cpu==="all")??G["cpu-load"]?.[0],oe=Hi(re?.idle,100);j.push({timestamp:Z,cpuUsedPercent:Math.max(0,Math.min(100,100-oe)),cpuUserPercent:Hi(re?.user),cpuSystemPercent:Hi(re?.system),cpuIowaitPercent:Hi(re?.iowait),memoryUsedPercent:Hi(G.memory?.["memused-percent"]),memoryUsedBytes:Sa(G.memory?.memused),memoryAvailableBytes:Sa(G.memory?.avail),swapUsedPercent:Hi(G.memory?.["swpused-percent"]),swapUsedBytes:Sa(G.memory?.swpused)})}return j.sort((G,Z)=>G.timestamp.localeCompare(Z.timestamp))}function mm(N){return Object.fromEntries(Object.entries(N.time_series??{}).map(([t,p])=>[t,(p.values??[]).map(([A,L])=>({timestamp:new Date(Number(A)*1000).toISOString(),value:Hi(L,Number.NaN)})).filter((A)=>Number.isFinite(A.value))]))}function Rl(N){return N.length?N.reduce((t,p)=>t+p,0)/N.length:null}function $a(N){return N.length?Math.max(...N):null}function pm(N){return N.length?Math.min(...N):null}async function Il(N){let[t,p]=await Promise.all([N.client.getServerMetrics(N.serverId,{types:["cpu","disk","network"],start:N.from,end:N.to,step:N.step}),Re(N.remote.host,"LC_ALL=C sadf -j -- -u -r -S",N.remote).catch(()=>"")]),A=um(p,N.from,N.to),L=mm(t),G=(L.cpu??[]).map((be)=>Math.max(0,Math.min(100,be.value/Math.max(1,N.cores)))),Z=A.map((be)=>be.cpuUsedPercent),ee=G.length?G:Z,re=A.map((be)=>be.memoryUsedPercent),oe=A.map((be)=>be.swapUsedPercent);return{from:N.from.toISOString(),to:N.to.toISOString(),cores:N.cores,host:A,provider:L,summary:{cpuAveragePercent:Rl(ee),cpuPeakPercent:$a(ee),memoryAveragePercent:Rl(re),memoryPeakPercent:$a(re),memoryMinimumAvailableBytes:pm(A.map((be)=>be.memoryAvailableBytes)),swapPeakPercent:$a(oe)}}}function fm(N){if(N.length===0)throw Error("A server name cannot be empty.");if(N.length>253)throw Error(`'${N}' is longer than the 253 characters a hostname allows.`);for(let t of N.split(".")){if(t.length===0)throw Error(`'${N}' has an empty label — a hostname cannot contain '..'.`);if(t.length>63)throw Error(`'${t}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(t))throw Error(`'${t}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function Pl(N,t,p){if(fm(t),N===t)throw Error(`'${N}' is already named that.`);if((await p.takenNames()).some((j)=>j===t&&j!==N))throw Error(`'${t}' is already taken. Server names have to be unique within a provider project.`);let L=[];if(p.providerName&&p.renameProvider){let{providerName:j,renameProvider:G}=p;L.push({id:"provider",title:"Rename the server at the provider",change:{from:N,to:t},satisfied:async()=>await j()===t,apply:()=>G(t)})}if(p.stateName&&p.writeStateName){let{stateName:j,writeStateName:G}=p;L.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:N,to:t},satisfied:async()=>{let Z=await j();return Z===void 0||Z===t},apply:()=>G(t)})}if(p.remoteHostname&&p.setRemoteHostname){let{remoteHostname:j,setRemoteHostname:G}=p;L.push({id:"hostname",title:"Set the hostname on the box",change:{from:N,to:t},satisfied:async()=>await j()===t,apply:()=>G(t)})}return L.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:N,to:t},satisfied:async()=>p.inventoryName()===t,apply:async()=>{await p.renameInventory(t)}}),{operation:"server:rename",target:N,steps:L}}function xl(N){let t=`'${N.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${t} 2>/dev/null || { echo ${t} > /etc/hostname && hostname ${t}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${N}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${t} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}async function gm(){let N=await _e(),t=y(process.cwd(),N),p=new Ie(t.store),A=new pn(p,[new tt("aws"),new tt("hetzner"),new tt("ssh")]);return{controlPlane:t,store:p,service:A}}async function yi(N){let t=await gm();try{return await N(t)}finally{t.controlPlane.store.close()}}var Gi=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error(`Server ${t} was not found.`);return p},ur=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};function Ca(N,t){let p=Number.parseInt(N??"",10);return Number.isFinite(p)&&p>=0?p:t}function hm(N="3h"){let t=N.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let p=Number(t[1])*(t[2]==="h"?3600000:60000);if(p<300000||p>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return p}function Zo(N,t="%"){return N==null?"unavailable":`${N.toFixed(1)}${t}`}async function ym(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",L=E(p,A),j=await de(L);if(!j?.serverId)throw Error(`No pinned Hetzner server was found for ${L}.`);if(![j.serverName,String(j.serverId),j.stackName].includes(N))throw Error(`Refusing to read ${N}: project state is pinned to ${j.serverName}.`);let G=tr(p),Z=new je({apiToken:rr(G.apiToken,p)}),ee=await Z.getServer(j.serverId),re=j.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=new Date,be=new Date(oe.getTime()-hm(t.range)),we=Math.min(3600,Math.max(60,Ca(t.step,60))),Ce=await Il({client:Z,serverId:ee.id,cores:Math.max(1,Number(ee.server_type.cores)||1),from:be,to:oe,step:we,remote:{host:re,user:j.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:ee.name,result:Ce},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[ee.name,`${Ce.from} to ${Ce.to}`,`${Zo(Ce.summary.cpuAveragePercent)} / ${Zo(Ce.summary.cpuPeakPercent)}`,`${Zo(Ce.summary.memoryAveragePercent)} / ${Zo(Ce.summary.memoryPeakPercent)}`,Ce.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(Ce.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,Zo(Ce.summary.swapPeakPercent)]])}function Dl(N){let t=N.targetType.prices?.find((p)=>p.location===N.location);return{serverId:N.serverId,serverName:N.serverName,location:N.location,from:N.currentType.name,to:N.targetType.name,capacityAvailable:N.capacityAvailable,alreadyComplete:N.alreadyComplete,upgradeDisk:N.upgradeDisk,target:{cores:N.targetType.cores,memoryGb:N.targetType.memory,diskGb:N.targetType.disk,architecture:N.targetType.architecture,cpuType:N.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function vm(N){let t=Dl(N);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function bm(N,t,p){let A=await _e();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let L=p.env??process.env.CLOUD_ENV??"production",j=E(A,L),G=await de(j),Z=tr(A),ee=new je({apiToken:rr(Z.apiToken,A)}),oe=G&&(N===G.serverName||N===String(G.serverId)||N===G.stackName)?await ee.getServer(G.serverId):(await ee.listServers()).find((Je)=>Je.name===N||String(Je.id)===N);if(!oe)throw Error(`Hetzner server ${N} was not found.`);if(G?.serverId&&G.serverId!==oe.id)throw Error(`Refusing to resize ${N}: project state is pinned to server ${G.serverId}.`);let be=at(t),we=p.upgradeDisk!==!1,Ce=await Vn(ee,oe.id,be,we);if(p.json)console.log(JSON.stringify({schemaVersion:1,plan:Dl(Ce)},null,2));else vm(Ce);if(!p.apply){if(!p.json)e(`Preview only. Re-run with --apply --confirm ${oe.name} to execute.`);return}if(p.confirm!==oe.name)throw Error(`Resize requires --confirm ${oe.name}.`);let De=G?.publicIp??oe.public_net.ipv4?.ip;if(!De)throw Error(`Server ${oe.name} has no public IPv4 address for verification.`);let Se={host:De,user:G?.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},Ee=await Fo(j),We=new Date().toISOString(),Ae={schemaVersion:1,operationId:Ee?.targetType===be&&Ee.serverId===oe.id?Ee.operationId:crypto.randomUUID(),stackName:j,serverId:oe.id,serverName:oe.name,sourceType:Ce.currentType.name,targetType:be,upgradeDisk:we,phase:"planning",status:"running",attempts:Ee?.targetType===be?Ee.attempts:0,startedAt:Ee?.targetType===be?Ee.startedAt:We,updatedAt:We,manifest:Ee?.targetType===be?Ee.manifest:void 0};await lt(Ae);let Te=Ca(p.pollSeconds,900)*1000,Ne=Ca(p.maxWaitMinutes,0)*60000,Qe=Date.now();for(;;){let Je=await Vn(ee,oe.id,be,we);if(!Je.capacityAvailable&&!Je.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await lt(Ae),!p.wait){if(!p.json)e(`${be} has no capacity in ${Je.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Ne>0&&Date.now()-Qe>=Ne)throw Error(`Timed out waiting for ${be} capacity in ${Je.location}.`);if(!p.json)e(`Waiting ${Math.round(Te/1000)} seconds for ${be} capacity...`);await Bun.sleep(Te);continue}let Ye=await jo(j);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await lt(Ae),await $o({client:ee,serverId:oe.id,targetType:be,upgradeDisk:we,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let Pt=await Oo(Se);return Ae={...Ae,manifest:Pt,updatedAt:new Date().toISOString()},await lt(Ae),Pt},afterBoot:async(Pt,wt,Ot,Ut)=>Lo(Se,wt,Ot,Ut),onPhase:async(Pt,wt)=>{if(Ae={...Ae,phase:Pt,status:Pt==="waiting-capacity"?"waiting-capacity":Pt==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await lt(Ae),!p.json)e(`${Pt}${wt?` ${JSON.stringify(wt)}`:""}`)}}})}finally{await Ye()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await lt(Ae),p.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${oe.name} is on ${be} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&p.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Te/1000)} seconds before retry.`),await Bun.sleep(Te);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await lt(Ae),et}}}async function wm(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",L=E(p,A),j=await de(L);if(!j?.serverId)throw Error(`No pinned Hetzner server was found for ${L}.`);if(![j.serverName,String(j.serverId),j.stackName].includes(N))throw Error(`Refusing to optimize ${N}: project state is pinned to ${j.serverName}.`);let G=tr(p),Z=new je({apiToken:rr(G.apiToken,p)}),ee=await Z.getServer(j.serverId),re=j.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=_i(p);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:ee.name,plan:oe},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[ee.name,oe.firewallPorts.join(","),oe.monitoring?"on":"off",oe.autoUpdates?"on":"off",`${oe.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${ee.name} to execute.`);return}if(t.confirm!==ee.name)throw Error(`Optimization requires --confirm ${ee.name}.`);let be={host:re,user:j.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15},we=await Fr(be),Ce=we.routeProbes.filter((Ot)=>!Ot.ok),De=p.infrastructure?.compute,Se=J(De)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,Ee=we.failedUnits.filter((Ot)=>!Se.has(Ot));if(Ee.length>0)throw Error(`Preflight found failed services: ${Ee.join(", ")}`);if(Ce.length>0)throw Error(`Preflight found unhealthy routes: ${Ce.map((Ot)=>Ot.domain).join(", ")}`);let We=J(De)?[]:Object.values(p.sites??{}).flatMap((Ot)=>typeof Ot?.port==="number"&&![80,443].includes(Ot.port)?[Ot.port]:[]),Ae=Ur({allowSsh:De?.allowSsh!==!1,sitePorts:We,allowedPorts:De?.firewall?.allowedPorts}),Te=(j.firewallId?(await Z.listFirewalls()).find((Ot)=>Ot.id===j.firewallId):void 0)??(await Z.listFirewalls()).find((Ot)=>Ot.name===`${p.project.slug}-${A}-app-fw`);if(!Te)throw Error(`Managed firewall for ${ee.name} was not found.`);let Ne=await Z.setFirewallRules(Te.id,Ae);await Promise.all(Ne.map((Ot)=>Z.waitForAction(Ot.id))),await Mo(p,be);let[Qe,Je]=await Promise.all([Fr(be),Uo(be)]),Ye=Bo(oe,Je),et=sa(we,Qe),Pt=Qe.routeProbes.filter((Ot)=>!Ot.ok);if(et.stoppedServices.length>0)Ye.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Ye.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Ye.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Ye.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Ye.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if(Pt.length>0)Ye.push(`unhealthy routes: ${Pt.map((Ot)=>Ot.domain).join(", ")}`);if(Ye.length>0)throw Error(`Host optimization verification failed: ${Ye.join("; ")}`);let wt={serverId:ee.id,serverName:ee.name,services:Qe.runningServices.length,routes:Qe.routeIds.length,healthyDomains:Qe.routeProbes.length,releaseLinks:Qe.releaseLinks.length,databasesAndVolumes:Qe.dataCatalog.length,report:Je};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:wt},null,2));else n(`${ee.name} passed full host, rpx route, service, release, and data verification.`)}async function Sm(N,t,p){let A=await _e(),L=p.env??"production",j=E(A,L);await yi(async(G)=>{let Z=Gi(G,N),ee=G.store.list(G.controlPlane.project.id,!0),re=Z.provider==="hetzner"&&Z.providerId?(()=>{try{let Te=tr(A);return new je({apiToken:rr(Te.apiToken,A)})}catch{return null}})():null,oe=Z.providerId?Number(Z.providerId):Number.NaN,be=await de(j),we=be!=null&&be.serverId===oe,Ce=new Ir,De=Z.trustState==="pinned",Se={takenNames:async()=>{let Te=ee.map((Ne)=>Ne.name);if(re)Te.push(...(await re.listServers()).map((Ne)=>Ne.name));return Te},inventoryName:()=>G.store.get(Z.id)?.name??Z.name,renameInventory:(Te)=>{G.store.update(Z.id,{name:Te})},...re&&Number.isFinite(oe)?{providerName:async()=>(await re.getServer(oe)).name,renameProvider:async(Te)=>{await re.renameServer(oe,Te)}}:{},...we?{stateName:async()=>(await de(j))?.serverName,writeStateName:async(Te)=>{let Ne=await de(j);if(Ne)await ct(j,{...Ne,serverName:Te})}}:{},...De?{remoteHostname:async()=>{let Te=await Ce.exec(Z,"hostname");return Te.code===0?Te.stdout.trim():void 0},setRemoteHostname:async(Te)=>{let Ne=await Ce.exec(Z,xl(Te));if(Ne.code!==0)throw Error(Ne.stderr.trim()||`hostname exited ${Ne.code}`)}}:{}},Ee=await Pl(Z.name,t,Se),We=await vs(Ee);if(!p.apply){let Te=[re?"":"provider record (no provider id or no API token)",we?"":"local state pin (none points at this server)",De?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(p.json){console.log(JSON.stringify({schemaVersion:1,operation:Ee.operation,target:Ee.target,rename:{from:Z.name,to:t},notCovered:Te,steps:We.map((Ne)=>({id:Ne.step.id,title:Ne.step.title,state:Ne.state,change:Ne.step.change,reason:Ne.reason}))},null,2));return}for(let Ne of bs(Ee,We))console.log(Ne);for(let Ne of Te)console.log(`  not covered: ${Ne}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await ws(Ee,We,{log:(Te)=>e(Te),audit:(Te)=>G.controlPlane.store.appendEvent({projectId:G.controlPlane.project.id,resourceId:Z.resourceId,type:`${Te.operation}.${Te.step}.${Te.state}`,level:Te.state==="failed"?"error":"info",payload:{target:Te.target,renameTo:t,...Te.error?{error:Te.error}:{}}})});if(p.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Te=Ae.steps.find((Ne)=>Ne.state==="failed");throw Error(`${Ee.operation} stopped at '${Te?.title}': ${Te?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!p.json)n(`Renamed ${Z.name} to ${t}.`)})}function Aa(N){N.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,p)=>{try{await yi(async(A)=>{let L=t?[Gi(A,t)]:A.store.list(A.controlPlane.project.id),j=L.flatMap((G)=>Object.entries(G.capabilities).map(([Z,ee])=>({server:G.name,provider:G.provider,action:Z,...ee})));if(p.json)console.log(JSON.stringify({schemaVersion:1,targets:j},null,2));else c(["Server","Provider","Action","Support","Explanation"],j.map((G)=>[G.server,G.provider,G.action,G.supported?"supported":"unsupported",G.reason??"—"]))})}catch(A){ur(A)}}),N.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,p,A)=>{try{await bm(t,p,A)}catch(L){ur(L)}}),N.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,p)=>{try{await wm(t,p)}catch(A){ur(A)}}),N.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,p)=>{try{await ym(t,p)}catch(A){ur(A)}}),N.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await yi(async(p)=>{let A=p.store.list(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((L)=>[L.name,L.providerId??"—",`${L.provider} / ${L.region??"external"}`,`${L.status} / ${L.trustState}`,L.roles.join(","),`${L.capacity.cpu??0} / ${L.capacity.memoryBytes??0}`,L.heartbeatAt??"never"]))})}catch(p){ur(p)}}),N.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,p)=>{try{await yi(async(A)=>{let L=p.provider;if(!["aws","hetzner","ssh"].includes(L)||!p.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let j=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:L,providerId:p.providerId,endpoint:p.endpoint,sshUser:p.user??"deploy",credentialRef:p.credentialRef??"secret://fleet/agent",region:p.region,roles:String(p.roles??"application").split(","),labels:Object.fromEntries(String(p.labels??"").split(",").map((G)=>G.split("=")).filter((G)=>G[0]&&G[1]))});n(`Enrolled ${j.name} as ${j.id}; no remote mutation was performed.`)})}catch(A){ur(A)}}),N.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,p)=>{try{await yi(async(A)=>{let L=Gi(A,t);if(L=await A.service.test(L.id),L.trustState==="rotation_pending"){if(!p.acceptHostKey)throw Error(`Host key changed to ${L.pendingHostKey}; review it first.`);L=A.service.reviewHostKey(L.id,p.acceptHostKey)}let j=await A.service.validate(L.id);if(p.json)console.log(JSON.stringify(j.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(j.validation?.findings??[]).map((G)=>[G.severity,G.code,G.message,G.remediation??"—"]));if(!j.validation?.valid)process.exitCode=1})}catch(A){ur(A)}}),N.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,p)=>{try{await yi(async(A)=>{let L=A.service.bootstrap(Gi(A,t).id,!!p.apply);if(L.preview)c(["Step"],L.steps.map((j)=>[j]));else n(`Bootstrap queued: ${L.operation?.id}`)})}catch(A){ur(A)}}),N.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,p,A)=>{try{await Sm(t,p,A)}catch(L){ur(L)}}),N.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,p)=>{try{await yi(async(A)=>n(A.service.drain(Gi(A,t).id,!!p.complete).status))}catch(A){ur(A)}}),N.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await yi(async(p)=>{p.service.uncordon(Gi(p,t).id),n(`Uncordoned ${t}.`)})}catch(p){ur(p)}}),N.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,p)=>{try{await yi(async(A)=>{A.service.archive(Gi(A,t).id,p.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){ur(A)}}),N.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await yi(async(p)=>{let A=Gi(p,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let L=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),j=await L.exited;if(j)process.exitCode=j})}catch(p){ur(p)}});for(let[t,p]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])N.command(t,p).action(async(...A)=>Ar(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as El,mkdirSync as $m,readFileSync as Cm,writeFileSync as Am}from"node:fs";import{join as Tl,resolve as km}from"node:path";var ka=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};async function Rm(){try{return await _e()}catch{return}}function Im(N){if(N===void 0)return;let t=Number(N);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${N}'.`);return t}function Nl(N,t,p){let A=N?.ssh?.hosts?.find((L)=>L.host===t);return new ar({hosts:t?[A??{host:t}]:N?.ssh?.hosts,user:p.user,port:Im(p.port),privateKeyPath:p.key,hostKey:N?.ssh?.hostKey,sudo:N?.ssh?.sudo,profile:p.profile??N?.ssh?.profile,publicIp:N?.ssh?.publicIp,lan:N?.ssh?.lan})}var Ol=1073741824;function Ra(N){N.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,p)=>{try{let A=await Rm(),L=Nl(A,t,p),j=t??L.targetHost(),G=await L.ensureHostKey(j),{facts:Z,findings:ee}=await L.preflight(j);if(p.json)console.log(JSON.stringify({schemaVersion:1,host:j,hostKeyFingerprint:G.fingerprint,facts:Z,findings:ee},null,2));else{if(i(`Preflight ${j}`),G.pinnedNow)e(`Pinned host key ${G.fingerprint}`);if(e(`${Z.os} on ${Z.arch}, ${Z.cpuCores} cores, ${(Z.memoryBytes/Ol).toFixed(1)} GiB memory, ${(Z.diskFreeBytes/Ol).toFixed(1)} GiB free`),Z.piModel)e(Z.piModel);if(Z.lanIp)e(`LAN address ${Z.lanIp}`);if(console.log(Br(ee)),sr(ee))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(sr(ee))process.exitCode=1}catch(A){ka(A)}}),N.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let p=await _e(),A=t.env??"production";if(t.dryRun){let G=or(p),[Z]=G.hosts;console.log(ir({config:p,environment:A,profile:G.profile,sudoUser:Z.user!=="root"?Z.user:void 0,lan:G.lan}));return}let L=Nl(p,void 0,{});i(`Adopt ${L.targetHost()}`);let j=await L.provisionComputeInfrastructure({config:p,environment:A});n(`${j.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(p){ka(p)}}),N.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let p=t.os??"raspberry-pi-os";if(!(p in ki))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${p}'.`);let A=await _e(),L=t.env??"production",j=or(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:p==="raspberry-pi-os"?"raspberry-pi":void 0}),G=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),Z=Mr(t.key??"~/.ssh/id_ed25519.pub");if(!El(Z))throw Error(`Public key not found at ${Z}; pass --key <path to a .pub file>.`);let ee=Cm(Z,"utf8").trim(),re;if(t.wifiSsid){let De=t.wifiPassphraseEnv??"WIFI_PASSWORD",Se=process.env[De];if(!Se)throw Error(`--wifi-ssid needs the passphrase in $${De} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");re={ssid:t.wifiSsid,passphrase:Se,country:t.wifiCountry}}let oe=ir({config:A,environment:L,profile:j.profile,sudoUser:G!=="root"?G:void 0,lan:j.lan}),be=xi({hostname:t.hostname,user:G,publicKey:ee,timezone:t.timezone,locale:t.locale,wifi:re},oe,{os:p}),we=km(t.out);$m(we,{recursive:!0});let Ce=Object.keys(be.files).filter((De)=>El(Tl(we,De)));if(Ce.length>0&&!t.force)throw Error(`${Ce.join(", ")} already exist in ${we}; pass --force to overwrite.`);for(let[De,Se]of Object.entries(be.files))Am(Tl(we,De),Se,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(be.files).join(", ")} to ${we}`),console.log(be.instructions)}catch(p){ka(p)}})}async function Pm(){let N=await _e(),t=y(process.cwd(),N),p=new mn(t.store),A=new gn(p,new Ie(t.store));return{controlPlane:t,store:p,service:A}}async function Qo(N){let t=await Pm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Ss=(N)=>Object.fromEntries(String(N??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Ll=(N)=>Object.fromEntries(Object.entries(Ss(N)).map(([t,p])=>[t,Number(p)]));function Ia(N){N.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>Qo((p)=>{let A=p.store.listPools(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((L)=>[L.name,L.purpose,L.backend,`${L.region??"any"} / ${L.architecture??"any"}`,L.status,JSON.stringify(L.capacity),String(L.concurrency)]))})),N.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,p)=>Qo((A)=>{let{purpose:L,backend:j}=p;if(!["application","build","worker","monitoring","backup"].includes(L)||!["server","ecs","asg"].includes(j))throw Error("Unsupported pool purpose or backend.");let G=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:L,backend:j,region:p.region,architecture:p.arch,labels:Ss(p.labels),requiredServerLabels:Ss(p.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Ll(p.capacity)},maxWorkloads:Number(p.max),costWeight:1,concurrency:Number(p.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${G.name} (${G.id}).`)})),N.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,p)=>Qo((A)=>{let L=A.store.listPools(A.controlPlane.project.id).find((G)=>G.id===t||G.name===t),j=new Ie(A.controlPlane.store).list(A.controlPlane.project.id).find((G)=>G.id===p||G.name===p);if(!L||!j)throw Error("Pool or server was not found.");A.store.addMember(L.id,j.id),n(`Attached ${j.name} to ${L.name}.`)})),N.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>Qo((p)=>{let A=p.service.explain(p.controlPlane.project.id,{purpose:t.purpose,resources:Ll(t.resources),region:t.region,architecture:t.arch,labels:Ss(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((L)=>[L.poolName,L.serverId??"provider-managed",L.eligible?"yes":"no",JSON.stringify(L.available),`${L.score.fit.toFixed(2)} / ${L.score.spread} / ${L.score.cost}`,L.reasons.join("; ")||"eligible"]))})),N.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>Qo((p)=>{let A=p.store.listPools(p.controlPlane.project.id).find((j)=>j.id===t||j.name===t);if(!A)throw Error("Pool was not found.");let L=p.service.drainPool(A.id);n(`Draining ${A.name}: moved ${L.moved.length}, blocked ${L.blocked.length} stateful placement(s).`)}))}async function xm(){let N=await _e(),t=y(process.cwd(),N),p=new fn(t.store),A=new hn(p);return{controlPlane:t,store:p,service:A}}async function ao(N){let t=await xm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Xo=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error("Regional topology was not found.");return p},Dm=(N)=>N.split(",").map((t,p)=>{let[A,L="aws"]=t.split(":");return{region:String(A),provider:L,role:p===0?"primary":"secondary"}}),Em=(N)=>{let t=new Set(["s3","dynamodb","secrets"]),p=N.split(",").map((L)=>L.trim()),A=p.find((L)=>!t.has(L));if(A)throw Error(`Unsupported replication kind: ${A}`);return p};function Pa(N){N.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>ao((p)=>{let A=p.store.list(p.controlPlane.project.id).map((L)=>({topology:L,targets:p.store.targets(L.id),channels:p.store.channels(L.id),route:p.store.route(L.id),executions:p.store.executions(L.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((L)=>[L.topology.name,L.topology.hostname,L.topology.activeRegion,L.topology.status,L.topology.revision??"—",`${L.channels.filter((j)=>j.status==="in_sync").length}/${L.channels.length} in sync`]))})),N.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,p)=>ao((A)=>{if(!p.hostname||!p.regions)throw Error("--hostname and --regions are required.");let L=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:p.hostname,regions:Dm(p.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Em(String(p.replicate)),maxLagSeconds:Number(p.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!p.cdn,wafEnabled:!!p.waf});n(`Created ${L.name} (${L.id}); run region:rollout with an immutable manifest.`)})),N.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,p,A)=>ao((L)=>c(["Step"],L.service.plan(Xo(L,t).id,p,A.target).map((j)=>[j])))),N.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,p,A)=>ao(async(L)=>{let j=A.manifest?await Bun.file(A.manifest).json():{},G=L.service.enqueue({topologyId:Xo(L,t).id,kind:"rollout",revision:p,manifest:j});n(`Regional rollout queued: ${G.operation.id}`)})),N.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,p)=>ao((A)=>{let L=A.service.enqueue({topologyId:Xo(A,t).id,kind:"failover",targetRegion:p});n(`Failover queued: ${L.operation.id}`)})),N.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,p)=>ao((A)=>{let L=A.service.enqueue({topologyId:Xo(A,t).id,kind:"failback",targetRegion:p});n(`Failback queued: ${L.operation.id}`)})),N.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,p)=>ao((A)=>{let L=A.service.enqueue({topologyId:Xo(A,t).id,kind:"destroy",confirmation:p.confirm});n(`Regional teardown queued: ${L.operation.id}; replicated data remains retained.`)}))}var es="0.16.10";async function Nm(){let N=await _e(),t=y(process.cwd(),N),p=new yn(t.store),A=new Sn(p),L=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((j)=>new bn(j,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:p,service:A,cleanup:L}}async function Li(N){let t=await Nm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}function xa(N){N.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Li((p)=>{let A={manifests:p.store.manifests(p.controlPlane.organization.id),windows:p.store.windows(p.controlPlane.project.id),campaigns:p.store.campaigns(p.controlPlane.project.id),cleanups:p.store.cleanups(p.controlPlane.project.id),drills:p.store.drills(p.controlPlane.project.id)},L=[...A.manifests.map((j)=>["update",j.version,j.compatibility.compatible?"compatible":"blocked",j.compatibility.reasons.join("; ")||j.channel]),...A.campaigns.map((j)=>["upgrade",j.id,j.status,j.currentStage??j.fromVersion]),...A.cleanups.map((j)=>["cleanup",j.kind,j.status,`${j.candidates.length} items / ${j.estimatedBytes} bytes`]),...A.drills.map((j)=>["DR drill",j.scenario,j.status,j.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],L)})),N.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,p)=>Li(async(A)=>{let L=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(p).text()});n(`Trusted ${L.name}: ${L.fingerprint}`)})),N.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,p,A)=>Li(async(L)=>{let j=await Bun.file(t).json(),G=(await Bun.file(p).text()).trim(),Z=L.store.importManifest({organizationId:L.controlPlane.organization.id,keyId:A,document:j,signature:G,current:{schemaVersion:L.controlPlane.store.health().schemaVersion,currentVersion:es,platform:process.platform,architecture:process.arch}});n(`Verified ${Z.version}; ${Z.compatibility.compatible?"compatible":"blocked: "+Z.compatibility.reasons.join("; ")}`)})),N.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,p,A)=>Li((L)=>{let j=L.store.createWindow({projectId:L.controlPlane.project.id,name:t,schedule:p,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${j.name} (${j.id}).`)})),N.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,p,A)=>Li((L)=>{let j=new Ie(L.controlPlane.store).list(L.controlPlane.project.id).filter((ee)=>ee.status==="ready").map((ee)=>({serverId:ee.id,target:ee.name,previousVersion:ee.bootstrapVersion??es}));if(!j.length)j.push({target:"control-plane",previousVersion:es});let G=L.store.createCampaign({projectId:L.controlPlane.project.id,manifestId:t,fromVersion:es,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:p,targets:j}),Z=L.service.enqueueCampaign(G.id);n(`Staged upgrade queued: ${Z.operation.id}`)})),N.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,p)=>Li(async(A)=>{let L=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(p.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],L.candidates.map((j)=>[j.id,j.label,String(j.bytes)])),e(`Apply with: cloud cleanup:apply ${L.id} --confirm "DELETE ${L.candidates.length} ${L.kind}"`)})),N.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,p)=>Li((A)=>{let L=A.service.enqueueCleanup(t,String(p.confirm??""));n(`Cleanup queued: ${L.operation.id}`)})),N.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,p,A)=>Li((L)=>{let j=L.store.createDrill({projectId:L.controlPlane.project.id,scenario:t,isolatedTarget:p,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${j.id}.`)})),N.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Li((p)=>{let A=p.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Da(){try{return(await _e()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Ea(N){N.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let p=t?.region||await Da(),A=new P(p);try{let{Functions:L=[]}=await A.listFunctions({MaxItems:50});if(!L.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],L.map((j)=>[j.FunctionName??"-",j.Runtime??"-",j.MemorySize?`${j.MemorySize} MB`:"-",j.Timeout?`${j.Timeout}s`:"-",j.LastModified??"-"]))}catch(L){r(`Failed to list functions: ${L.message}`),process.exitCode=1}}),N.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,p)=>{i(`Invoking ${t}`);let A=p?.region||await Da(),L=new P(A),j=new o("Invoking function...");j.start();try{let G=await L.invoke({FunctionName:t,InvocationType:p?.async?"Event":"RequestResponse",Payload:p?.payload||"{}",LogType:p?.async?"None":"Tail"});if(G.FunctionError){if(j.fail(`Function returned an error (${G.FunctionError})`),G.Payload)e(G.Payload);process.exitCode=1;return}if(j.succeed(`Invoked (status ${G.StatusCode})`),G.Payload)e(`
+`)}async function gm(){let N=await _e(),t=y(process.cwd(),N),p=new Ie(t.store),A=new pn(p,[new tt("aws"),new tt("hetzner"),new tt("ssh")]);return{controlPlane:t,store:p,service:A}}async function yi(N){let t=await gm();try{return await N(t)}finally{t.controlPlane.store.close()}}var Gi=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error(`Server ${t} was not found.`);return p},ur=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};function Ca(N,t){let p=Number.parseInt(N??"",10);return Number.isFinite(p)&&p>=0?p:t}function hm(N="3h"){let t=N.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let p=Number(t[1])*(t[2]==="h"?3600000:60000);if(p<300000||p>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return p}function Zo(N,t="%"){return N==null?"unavailable":`${N.toFixed(1)}${t}`}async function ym(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",L=E(p,A),j=await de(L);if(!j?.serverId)throw Error(`No pinned Hetzner server was found for ${L}.`);if(![j.serverName,String(j.serverId),j.stackName].includes(N))throw Error(`Refusing to read ${N}: project state is pinned to ${j.serverName}.`);let G=tr(p),Z=new je({apiToken:rr(G.apiToken,p)}),ee=await Z.getServer(j.serverId),re=j.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=new Date,be=new Date(oe.getTime()-hm(t.range)),we=Math.min(3600,Math.max(60,Ca(t.step,60))),Ce=await Il({client:Z,serverId:ee.id,cores:Math.max(1,Number(ee.server_type.cores)||1),from:be,to:oe,step:we,remote:{host:re,user:j.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:ee.name,result:Ce},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[ee.name,`${Ce.from} to ${Ce.to}`,`${Zo(Ce.summary.cpuAveragePercent)} / ${Zo(Ce.summary.cpuPeakPercent)}`,`${Zo(Ce.summary.memoryAveragePercent)} / ${Zo(Ce.summary.memoryPeakPercent)}`,Ce.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(Ce.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,Zo(Ce.summary.swapPeakPercent)]])}function Dl(N){let t=N.targetType.prices?.find((p)=>p.location===N.location);return{serverId:N.serverId,serverName:N.serverName,location:N.location,from:N.currentType.name,to:N.targetType.name,capacityAvailable:N.capacityAvailable,alreadyComplete:N.alreadyComplete,upgradeDisk:N.upgradeDisk,target:{cores:N.targetType.cores,memoryGb:N.targetType.memory,diskGb:N.targetType.disk,architecture:N.targetType.architecture,cpuType:N.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function vm(N){let t=Dl(N);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function bm(N,t,p){let A=await _e();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let L=p.env??process.env.CLOUD_ENV??"production",j=E(A,L),G=await de(j),Z=tr(A),ee=new je({apiToken:rr(Z.apiToken,A)}),oe=G&&(N===G.serverName||N===String(G.serverId)||N===G.stackName)?await ee.getServer(G.serverId):(await ee.listServers()).find((Je)=>Je.name===N||String(Je.id)===N);if(!oe)throw Error(`Hetzner server ${N} was not found.`);if(G?.serverId&&G.serverId!==oe.id)throw Error(`Refusing to resize ${N}: project state is pinned to server ${G.serverId}.`);let be=at(t),we=p.upgradeDisk!==!1,Ce=await Vn(ee,oe.id,be,we);if(p.json)console.log(JSON.stringify({schemaVersion:1,plan:Dl(Ce)},null,2));else vm(Ce);if(!p.apply){if(!p.json)e(`Preview only. Re-run with --apply --confirm ${oe.name} to execute.`);return}if(p.confirm!==oe.name)throw Error(`Resize requires --confirm ${oe.name}.`);let De=G?.publicIp??oe.public_net.ipv4?.ip;if(!De)throw Error(`Server ${oe.name} has no public IPv4 address for verification.`);let Se={host:De,user:G?.sshUser??Z.sshUser,identityFile:Z.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},Ee=await Fo(j),We=new Date().toISOString(),Ae={schemaVersion:1,operationId:Ee?.targetType===be&&Ee.serverId===oe.id?Ee.operationId:crypto.randomUUID(),stackName:j,serverId:oe.id,serverName:oe.name,sourceType:Ce.currentType.name,targetType:be,upgradeDisk:we,phase:"planning",status:"running",attempts:Ee?.targetType===be?Ee.attempts:0,startedAt:Ee?.targetType===be?Ee.startedAt:We,updatedAt:We,manifest:Ee?.targetType===be?Ee.manifest:void 0};await lt(Ae);let Te=Ca(p.pollSeconds,900)*1000,Ne=Ca(p.maxWaitMinutes,0)*60000,Qe=Date.now();for(;;){let Je=await Vn(ee,oe.id,be,we);if(!Je.capacityAvailable&&!Je.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await lt(Ae),!p.wait){if(!p.json)e(`${be} has no capacity in ${Je.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Ne>0&&Date.now()-Qe>=Ne)throw Error(`Timed out waiting for ${be} capacity in ${Je.location}.`);if(!p.json)e(`Waiting ${Math.round(Te/1000)} seconds for ${be} capacity...`);await Bun.sleep(Te);continue}let Ye=await jo(j);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await lt(Ae),await $o({client:ee,serverId:oe.id,targetType:be,upgradeDisk:we,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let Pt=await Oo(Se);return Ae={...Ae,manifest:Pt,updatedAt:new Date().toISOString()},await lt(Ae),Pt},afterBoot:async(Pt,wt,Ot,Ut)=>Lo(Se,wt,Ot,Ut),onPhase:async(Pt,wt)=>{if(Ae={...Ae,phase:Pt,status:Pt==="waiting-capacity"?"waiting-capacity":Pt==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await lt(Ae),!p.json)e(`${Pt}${wt?` ${JSON.stringify(wt)}`:""}`)}}})}finally{await Ye()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await lt(Ae),p.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${oe.name} is on ${be} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&p.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Te/1000)} seconds before retry.`),await Bun.sleep(Te);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await lt(Ae),et}}}async function wm(N,t){let p=await _e();if(p.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",L=E(p,A),j=await de(L);if(!j?.serverId)throw Error(`No pinned Hetzner server was found for ${L}.`);if(![j.serverName,String(j.serverId),j.stackName].includes(N))throw Error(`Refusing to optimize ${N}: project state is pinned to ${j.serverName}.`);let G=tr(p),Z=new je({apiToken:rr(G.apiToken,p)}),ee=await Z.getServer(j.serverId),re=j.publicIp??ee.public_net.ipv4?.ip;if(!re)throw Error(`Server ${ee.name} has no public IPv4 address.`);let oe=_i(p);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:ee.name,plan:oe},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[ee.name,oe.firewallPorts.join(","),oe.monitoring?"on":"off",oe.autoUpdates?"on":"off",`${oe.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${ee.name} to execute.`);return}if(t.confirm!==ee.name)throw Error(`Optimization requires --confirm ${ee.name}.`);let be={host:re,user:j.sshUser??G.sshUser,identityFile:G.sshPrivateKeyPath,connectTimeoutSec:15},we=await Fr(be),Ce=we.routeProbes.filter((Ot)=>!Ot.ok),De=p.infrastructure?.compute,Se=J(De)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,Ee=we.failedUnits.filter((Ot)=>!Se.has(Ot));if(Ee.length>0)throw Error(`Preflight found failed services: ${Ee.join(", ")}`);if(Ce.length>0)throw Error(`Preflight found unhealthy routes: ${Ce.map((Ot)=>Ot.domain).join(", ")}`);let We=J(De)?[]:Object.values(p.sites??{}).flatMap((Ot)=>typeof Ot?.port==="number"&&![80,443].includes(Ot.port)?[Ot.port]:[]),Ae=Ur({allowSsh:De?.allowSsh!==!1,sitePorts:We,allowedPorts:De?.firewall?.allowedPorts}),Te=(j.firewallId?(await Z.listFirewalls()).find((Ot)=>Ot.id===j.firewallId):void 0)??(await Z.listFirewalls()).find((Ot)=>Ot.name===`${p.project.slug}-${A}-app-fw`);if(!Te)throw Error(`Managed firewall for ${ee.name} was not found.`);let Ne=await Z.setFirewallRules(Te.id,Ae);await Promise.all(Ne.map((Ot)=>Z.waitForAction(Ot.id))),await Mo(p,be);let[Qe,Je]=await Promise.all([Fr(be),Uo(be)]),Ye=Bo(oe,Je),et=sa(we,Qe),Pt=Qe.routeProbes.filter((Ot)=>!Ot.ok);if(et.stoppedServices.length>0)Ye.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Ye.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Ye.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Ye.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Ye.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if(Pt.length>0)Ye.push(`unhealthy routes: ${Pt.map((Ot)=>Ot.domain).join(", ")}`);if(Ye.length>0)throw Error(`Host optimization verification failed: ${Ye.join("; ")}`);let wt={serverId:ee.id,serverName:ee.name,services:Qe.runningServices.length,routes:Qe.routeIds.length,healthyDomains:Qe.routeProbes.length,releaseLinks:Qe.releaseLinks.length,databasesAndVolumes:Qe.dataCatalog.length,report:Je};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:wt},null,2));else n(`${ee.name} passed full host, rpx route, service, release, and data verification.`)}async function Sm(N,t,p){let A=await _e(),L=p.env??"production",j=E(A,L);await yi(async(G)=>{let Z=Gi(G,N),ee=G.store.list(G.controlPlane.project.id,!0),re=Z.provider==="hetzner"&&Z.providerId?(()=>{try{let Te=tr(A);return new je({apiToken:rr(Te.apiToken,A)})}catch{return null}})():null,oe=Z.providerId?Number(Z.providerId):Number.NaN,be=await de(j),we=be!=null&&be.serverId===oe,Ce=new Ir,De=Z.trustState==="pinned",Se={takenNames:async()=>{let Te=ee.map((Ne)=>Ne.name);if(re)Te.push(...(await re.listServers()).map((Ne)=>Ne.name));return Te},inventoryName:()=>G.store.get(Z.id)?.name??Z.name,renameInventory:(Te)=>{G.store.update(Z.id,{name:Te})},...re&&Number.isFinite(oe)?{providerName:async()=>(await re.getServer(oe)).name,renameProvider:async(Te)=>{await re.renameServer(oe,Te)}}:{},...we?{stateName:async()=>(await de(j))?.serverName,writeStateName:async(Te)=>{let Ne=await de(j);if(Ne)await ct(j,{...Ne,serverName:Te})}}:{},...De?{remoteHostname:async()=>{let Te=await Ce.exec(Z,"hostname");return Te.code===0?Te.stdout.trim():void 0},setRemoteHostname:async(Te)=>{let Ne=await Ce.exec(Z,xl(Te));if(Ne.code!==0)throw Error(Ne.stderr.trim()||`hostname exited ${Ne.code}`)}}:{}},Ee=await Pl(Z.name,t,Se),We=await vs(Ee);if(!p.apply){let Te=[re?"":"provider record (no provider id or no API token)",we?"":"local state pin (none points at this server)",De?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(p.json){console.log(JSON.stringify({schemaVersion:1,operation:Ee.operation,target:Ee.target,rename:{from:Z.name,to:t},notCovered:Te,steps:We.map((Ne)=>({id:Ne.step.id,title:Ne.step.title,state:Ne.state,change:Ne.step.change,reason:Ne.reason}))},null,2));return}for(let Ne of bs(Ee,We))console.log(Ne);for(let Ne of Te)console.log(`  not covered: ${Ne}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await ws(Ee,We,{log:(Te)=>e(Te),audit:(Te)=>G.controlPlane.store.appendEvent({projectId:G.controlPlane.project.id,resourceId:Z.resourceId,type:`${Te.operation}.${Te.step}.${Te.state}`,level:Te.state==="failed"?"error":"info",payload:{target:Te.target,renameTo:t,...Te.error?{error:Te.error}:{}}})});if(p.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Te=Ae.steps.find((Ne)=>Ne.state==="failed");throw Error(`${Ee.operation} stopped at '${Te?.title}': ${Te?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!p.json)n(`Renamed ${Z.name} to ${t}.`)})}function Aa(N){N.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,p)=>{try{await yi(async(A)=>{let L=t?[Gi(A,t)]:A.store.list(A.controlPlane.project.id),j=L.flatMap((G)=>Object.entries(G.capabilities).map(([Z,ee])=>({server:G.name,provider:G.provider,action:Z,...ee})));if(p.json)console.log(JSON.stringify({schemaVersion:1,targets:j},null,2));else c(["Server","Provider","Action","Support","Explanation"],j.map((G)=>[G.server,G.provider,G.action,G.supported?"supported":"unsupported",G.reason??"—"]))})}catch(A){ur(A)}}),N.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,p,A)=>{try{await bm(t,p,A)}catch(L){ur(L)}}),N.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,p)=>{try{await wm(t,p)}catch(A){ur(A)}}),N.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,p)=>{try{await ym(t,p)}catch(A){ur(A)}}),N.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await yi(async(p)=>{let A=p.store.list(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((L)=>[L.name,L.providerId??"—",`${L.provider} / ${L.region??"external"}`,`${L.status} / ${L.trustState}`,L.roles.join(","),`${L.capacity.cpu??0} / ${L.capacity.memoryBytes??0}`,L.heartbeatAt??"never"]))})}catch(p){ur(p)}}),N.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,p)=>{try{await yi(async(A)=>{let L=p.provider;if(!["aws","hetzner","ssh"].includes(L)||!p.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let j=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:L,providerId:p.providerId,endpoint:p.endpoint,sshUser:p.user??"deploy",credentialRef:p.credentialRef??"secret://fleet/agent",region:p.region,roles:String(p.roles??"application").split(","),labels:Object.fromEntries(String(p.labels??"").split(",").map((G)=>G.split("=")).filter((G)=>G[0]&&G[1]))});n(`Enrolled ${j.name} as ${j.id}; no remote mutation was performed.`)})}catch(A){ur(A)}}),N.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,p)=>{try{await yi(async(A)=>{let L=Gi(A,t);if(L=await A.service.test(L.id),L.trustState==="rotation_pending"){if(!p.acceptHostKey)throw Error(`Host key changed to ${L.pendingHostKey}; review it first.`);L=A.service.reviewHostKey(L.id,p.acceptHostKey)}let j=await A.service.validate(L.id);if(p.json)console.log(JSON.stringify(j.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(j.validation?.findings??[]).map((G)=>[G.severity,G.code,G.message,G.remediation??"—"]));if(!j.validation?.valid)process.exitCode=1})}catch(A){ur(A)}}),N.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,p)=>{try{await yi(async(A)=>{let L=A.service.bootstrap(Gi(A,t).id,!!p.apply);if(L.preview)c(["Step"],L.steps.map((j)=>[j]));else n(`Bootstrap queued: ${L.operation?.id}`)})}catch(A){ur(A)}}),N.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,p,A)=>{try{await Sm(t,p,A)}catch(L){ur(L)}}),N.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,p)=>{try{await yi(async(A)=>n(A.service.drain(Gi(A,t).id,!!p.complete).status))}catch(A){ur(A)}}),N.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await yi(async(p)=>{p.service.uncordon(Gi(p,t).id),n(`Uncordoned ${t}.`)})}catch(p){ur(p)}}),N.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,p)=>{try{await yi(async(A)=>{A.service.archive(Gi(A,t).id,p.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){ur(A)}}),N.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await yi(async(p)=>{let A=Gi(p,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let L=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),j=await L.exited;if(j)process.exitCode=j})}catch(p){ur(p)}});for(let[t,p]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])N.command(t,p).action(async(...A)=>Ar(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as El,mkdirSync as $m,readFileSync as Cm,writeFileSync as Am}from"node:fs";import{join as Tl,resolve as km}from"node:path";var ka=(N)=>{r(N instanceof Error?N.message:String(N)),process.exitCode=1};async function Rm(){try{return await _e()}catch{return}}function Im(N){if(N===void 0)return;let t=Number(N);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${N}'.`);return t}function Nl(N,t,p){let A=N?.ssh?.hosts?.find((L)=>L.host===t);return new ar({hosts:t?[A??{host:t}]:N?.ssh?.hosts,user:p.user,port:Im(p.port),privateKeyPath:p.key,hostKey:N?.ssh?.hostKey,sudo:N?.ssh?.sudo,profile:p.profile??N?.ssh?.profile,publicIp:N?.ssh?.publicIp,lan:N?.ssh?.lan})}var Ol=1073741824;function Ra(N){N.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,p)=>{try{let A=await Rm(),L=Nl(A,t,p),j=t??L.targetHost(),G=await L.ensureHostKey(j),{facts:Z,findings:ee}=await L.preflight(j);if(p.json)console.log(JSON.stringify({schemaVersion:1,host:j,hostKeyFingerprint:G.fingerprint,facts:Z,findings:ee},null,2));else{if(i(`Preflight ${j}`),G.pinnedNow)e(`Pinned host key ${G.fingerprint}`);if(e(`${Z.os} on ${Z.arch}, ${Z.cpuCores} cores, ${(Z.memoryBytes/Ol).toFixed(1)} GiB memory, ${(Z.diskFreeBytes/Ol).toFixed(1)} GiB free`),Z.piModel)e(Z.piModel);if(Z.lanIp)e(`LAN address ${Z.lanIp}`);if(console.log(Br(ee)),sr(ee))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(sr(ee))process.exitCode=1}catch(A){ka(A)}}),N.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let p=await _e(),A=t.env??"production";if(t.dryRun){let G=or(p),[Z]=G.hosts;console.log(ir({config:p,environment:A,profile:G.profile,sudoUser:Z.user!=="root"?Z.user:void 0,lan:G.lan}));return}let L=Nl(p,void 0,{});i(`Adopt ${L.targetHost()}`);let j=await L.provisionComputeInfrastructure({config:p,environment:A});n(`${j.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(p){ka(p)}}),N.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let p=t.os??"raspberry-pi-os";if(!(p in ki))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${p}'.`);let A=await _e(),L=t.env??"production",j=or(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:p==="raspberry-pi-os"?"raspberry-pi":void 0}),G=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),Z=Mr(t.key??"~/.ssh/id_ed25519.pub");if(!El(Z))throw Error(`Public key not found at ${Z}; pass --key <path to a .pub file>.`);let ee=Cm(Z,"utf8").trim(),re;if(t.wifiSsid){let De=t.wifiPassphraseEnv??"WIFI_PASSWORD",Se=process.env[De];if(!Se)throw Error(`--wifi-ssid needs the passphrase in $${De} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");re={ssid:t.wifiSsid,passphrase:Se,country:t.wifiCountry}}let oe=ir({config:A,environment:L,profile:j.profile,sudoUser:G!=="root"?G:void 0,lan:j.lan}),be=xi({hostname:t.hostname,user:G,publicKey:ee,timezone:t.timezone,locale:t.locale,wifi:re},oe,{os:p}),we=km(t.out);$m(we,{recursive:!0});let Ce=Object.keys(be.files).filter((De)=>El(Tl(we,De)));if(Ce.length>0&&!t.force)throw Error(`${Ce.join(", ")} already exist in ${we}; pass --force to overwrite.`);for(let[De,Se]of Object.entries(be.files))Am(Tl(we,De),Se,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(be.files).join(", ")} to ${we}`),console.log(be.instructions)}catch(p){ka(p)}})}async function Pm(){let N=await _e(),t=y(process.cwd(),N),p=new mn(t.store),A=new gn(p,new Ie(t.store));return{controlPlane:t,store:p,service:A}}async function Qo(N){let t=await Pm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Ss=(N)=>Object.fromEntries(String(N??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Ll=(N)=>Object.fromEntries(Object.entries(Ss(N)).map(([t,p])=>[t,Number(p)]));function Ia(N){N.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>Qo((p)=>{let A=p.store.listPools(p.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((L)=>[L.name,L.purpose,L.backend,`${L.region??"any"} / ${L.architecture??"any"}`,L.status,JSON.stringify(L.capacity),String(L.concurrency)]))})),N.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,p)=>Qo((A)=>{let{purpose:L,backend:j}=p;if(!["application","build","worker","monitoring","backup"].includes(L)||!["server","ecs","asg"].includes(j))throw Error("Unsupported pool purpose or backend.");let G=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:L,backend:j,region:p.region,architecture:p.arch,labels:Ss(p.labels),requiredServerLabels:Ss(p.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Ll(p.capacity)},maxWorkloads:Number(p.max),costWeight:1,concurrency:Number(p.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${G.name} (${G.id}).`)})),N.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,p)=>Qo((A)=>{let L=A.store.listPools(A.controlPlane.project.id).find((G)=>G.id===t||G.name===t),j=new Ie(A.controlPlane.store).list(A.controlPlane.project.id).find((G)=>G.id===p||G.name===p);if(!L||!j)throw Error("Pool or server was not found.");A.store.addMember(L.id,j.id),n(`Attached ${j.name} to ${L.name}.`)})),N.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>Qo((p)=>{let A=p.service.explain(p.controlPlane.project.id,{purpose:t.purpose,resources:Ll(t.resources),region:t.region,architecture:t.arch,labels:Ss(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((L)=>[L.poolName,L.serverId??"provider-managed",L.eligible?"yes":"no",JSON.stringify(L.available),`${L.score.fit.toFixed(2)} / ${L.score.spread} / ${L.score.cost}`,L.reasons.join("; ")||"eligible"]))})),N.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>Qo((p)=>{let A=p.store.listPools(p.controlPlane.project.id).find((j)=>j.id===t||j.name===t);if(!A)throw Error("Pool was not found.");let L=p.service.drainPool(A.id);n(`Draining ${A.name}: moved ${L.moved.length}, blocked ${L.blocked.length} stateful placement(s).`)}))}async function xm(){let N=await _e(),t=y(process.cwd(),N),p=new fn(t.store),A=new hn(p);return{controlPlane:t,store:p,service:A}}async function ao(N){let t=await xm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Xo=(N,t)=>{let p=N.store.list(N.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!p)throw Error("Regional topology was not found.");return p},Dm=(N)=>N.split(",").map((t,p)=>{let[A,L="aws"]=t.split(":");return{region:String(A),provider:L,role:p===0?"primary":"secondary"}}),Em=(N)=>{let t=new Set(["s3","dynamodb","secrets"]),p=N.split(",").map((L)=>L.trim()),A=p.find((L)=>!t.has(L));if(A)throw Error(`Unsupported replication kind: ${A}`);return p};function Pa(N){N.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>ao((p)=>{let A=p.store.list(p.controlPlane.project.id).map((L)=>({topology:L,targets:p.store.targets(L.id),channels:p.store.channels(L.id),route:p.store.route(L.id),executions:p.store.executions(L.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((L)=>[L.topology.name,L.topology.hostname,L.topology.activeRegion,L.topology.status,L.topology.revision??"—",`${L.channels.filter((j)=>j.status==="in_sync").length}/${L.channels.length} in sync`]))})),N.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,p)=>ao((A)=>{if(!p.hostname||!p.regions)throw Error("--hostname and --regions are required.");let L=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:p.hostname,regions:Dm(p.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Em(String(p.replicate)),maxLagSeconds:Number(p.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!p.cdn,wafEnabled:!!p.waf});n(`Created ${L.name} (${L.id}); run region:rollout with an immutable manifest.`)})),N.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,p,A)=>ao((L)=>c(["Step"],L.service.plan(Xo(L,t).id,p,A.target).map((j)=>[j])))),N.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,p,A)=>ao(async(L)=>{let j=A.manifest?await Bun.file(A.manifest).json():{},G=L.service.enqueue({topologyId:Xo(L,t).id,kind:"rollout",revision:p,manifest:j});n(`Regional rollout queued: ${G.operation.id}`)})),N.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,p)=>ao((A)=>{let L=A.service.enqueue({topologyId:Xo(A,t).id,kind:"failover",targetRegion:p});n(`Failover queued: ${L.operation.id}`)})),N.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,p)=>ao((A)=>{let L=A.service.enqueue({topologyId:Xo(A,t).id,kind:"failback",targetRegion:p});n(`Failback queued: ${L.operation.id}`)})),N.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,p)=>ao((A)=>{let L=A.service.enqueue({topologyId:Xo(A,t).id,kind:"destroy",confirmation:p.confirm});n(`Regional teardown queued: ${L.operation.id}; replicated data remains retained.`)}))}var es="0.16.11";async function Nm(){let N=await _e(),t=y(process.cwd(),N),p=new yn(t.store),A=new Sn(p),L=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((j)=>new bn(j,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:p,service:A,cleanup:L}}async function Li(N){let t=await Nm();try{await N(t)}catch(p){r(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{t.controlPlane.store.close()}}function xa(N){N.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Li((p)=>{let A={manifests:p.store.manifests(p.controlPlane.organization.id),windows:p.store.windows(p.controlPlane.project.id),campaigns:p.store.campaigns(p.controlPlane.project.id),cleanups:p.store.cleanups(p.controlPlane.project.id),drills:p.store.drills(p.controlPlane.project.id)},L=[...A.manifests.map((j)=>["update",j.version,j.compatibility.compatible?"compatible":"blocked",j.compatibility.reasons.join("; ")||j.channel]),...A.campaigns.map((j)=>["upgrade",j.id,j.status,j.currentStage??j.fromVersion]),...A.cleanups.map((j)=>["cleanup",j.kind,j.status,`${j.candidates.length} items / ${j.estimatedBytes} bytes`]),...A.drills.map((j)=>["DR drill",j.scenario,j.status,j.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],L)})),N.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,p)=>Li(async(A)=>{let L=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(p).text()});n(`Trusted ${L.name}: ${L.fingerprint}`)})),N.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,p,A)=>Li(async(L)=>{let j=await Bun.file(t).json(),G=(await Bun.file(p).text()).trim(),Z=L.store.importManifest({organizationId:L.controlPlane.organization.id,keyId:A,document:j,signature:G,current:{schemaVersion:L.controlPlane.store.health().schemaVersion,currentVersion:es,platform:process.platform,architecture:process.arch}});n(`Verified ${Z.version}; ${Z.compatibility.compatible?"compatible":"blocked: "+Z.compatibility.reasons.join("; ")}`)})),N.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,p,A)=>Li((L)=>{let j=L.store.createWindow({projectId:L.controlPlane.project.id,name:t,schedule:p,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${j.name} (${j.id}).`)})),N.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,p,A)=>Li((L)=>{let j=new Ie(L.controlPlane.store).list(L.controlPlane.project.id).filter((ee)=>ee.status==="ready").map((ee)=>({serverId:ee.id,target:ee.name,previousVersion:ee.bootstrapVersion??es}));if(!j.length)j.push({target:"control-plane",previousVersion:es});let G=L.store.createCampaign({projectId:L.controlPlane.project.id,manifestId:t,fromVersion:es,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:p,targets:j}),Z=L.service.enqueueCampaign(G.id);n(`Staged upgrade queued: ${Z.operation.id}`)})),N.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,p)=>Li(async(A)=>{let L=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(p.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],L.candidates.map((j)=>[j.id,j.label,String(j.bytes)])),e(`Apply with: cloud cleanup:apply ${L.id} --confirm "DELETE ${L.candidates.length} ${L.kind}"`)})),N.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,p)=>Li((A)=>{let L=A.service.enqueueCleanup(t,String(p.confirm??""));n(`Cleanup queued: ${L.operation.id}`)})),N.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,p,A)=>Li((L)=>{let j=L.store.createDrill({projectId:L.controlPlane.project.id,scenario:t,isolatedTarget:p,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${j.id}.`)})),N.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Li((p)=>{let A=p.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Da(){try{return(await _e()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Ea(N){N.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let p=t?.region||await Da(),A=new P(p);try{let{Functions:L=[]}=await A.listFunctions({MaxItems:50});if(!L.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],L.map((j)=>[j.FunctionName??"-",j.Runtime??"-",j.MemorySize?`${j.MemorySize} MB`:"-",j.Timeout?`${j.Timeout}s`:"-",j.LastModified??"-"]))}catch(L){r(`Failed to list functions: ${L.message}`),process.exitCode=1}}),N.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,p)=>{i(`Invoking ${t}`);let A=p?.region||await Da(),L=new P(A),j=new o("Invoking function...");j.start();try{let G=await L.invoke({FunctionName:t,InvocationType:p?.async?"Event":"RequestResponse",Payload:p?.payload||"{}",LogType:p?.async?"None":"Tail"});if(G.FunctionError){if(j.fail(`Function returned an error (${G.FunctionError})`),G.Payload)e(G.Payload);process.exitCode=1;return}if(j.succeed(`Invoked (status ${G.StatusCode})`),G.Payload)e(`
 Response:`),e(G.Payload);if(G.LogResult)e(`
 Logs:`),e(Buffer.from(G.LogResult,"base64").toString("utf-8"))}catch(G){j.fail(`Invocation failed: ${G.message}`),process.exitCode=1}}),N.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(t,p)=>{i(`Logs for ${t}`);let A=p?.region||await Da(),L=new ne(A),j=t.startsWith("/aws/lambda/")?t:`/aws/lambda/${t}`,G=Number(p?.since??15),Z=(ee)=>{for(let re of ee){let oe=re.timestamp?new Date(re.timestamp).toISOString():"";e(`${oe}  ${(re.message??"").trimEnd()}`)}};try{let ee=Date.now()-G*60000,{events:re=[]}=await L.filterLogEvents({logGroupName:j,startTime:ee,filterPattern:p?.filter,limit:200});if(Z(re),re.length)ee=(re[re.length-1].timestamp??ee)+1;if(p?.tail){e(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((be)=>setTimeout(be,3000));let{events:oe=[]}=await L.filterLogEvents({logGroupName:j,startTime:ee,filterPattern:p?.filter,limit:200});if(oe.length)Z(oe),ee=(oe[oe.length-1].timestamp??ee)+1}}}catch(ee){r(`Failed to read logs: ${ee.message}`),process.exitCode=1}})}async function jl(N){let t=Bun.spawn(["docker",...N],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[p,A]=await Promise.all([t.exited,new Response(t.stderr).text()]);return{ok:p===0,exitCode:p,command:["docker",...N].join(" "),stderr:A.trim()}}function Ta(N){N.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(t)=>{let p=["build","--file",t.file??"Dockerfile","--tag",t.tag??"latest","."];if(t.dryRun){console.log(`docker ${p.join(" ")}`);return}let A=await jl(p);if(t.json)console.log(JSON.stringify(A));if(!A.ok)r(A.stderr||`docker exited ${A.exitCode}`),process.exitCode=A.exitCode;else n(`Built ${t.tag??"latest"}.`)}),N.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(t)=>{if(!t.image){r("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(t.dryRun){console.log(`docker push ${t.image}`);return}let p=await jl(["push",t.image]);if(t.json)console.log(JSON.stringify(p));if(!p.ok)r(p.stderr),process.exitCode=p.exitCode;else n(`Pushed ${t.image}.`)}),N.command("container:deploy","Deploy a container image").action(async()=>Ar("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function Na(N){N.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t)=>{i("Domains");try{let p=pi(t?.provider),A=Xn(t?.provider)?.provider||"unknown",L=new o(`Fetching domains from ${A}...`);L.start();let j=await p.listDomains();if(L.succeed(`Found ${j.length} domain(s)`),j.length===0){e("No domains found in this provider");return}let G=j.map((Z)=>[Z,"Active","-",A.charAt(0).toUpperCase()+A.slice(1)]);c(["Domain","Status","SSL","Provider"],G)}catch(p){r(`Failed to list domains: ${p instanceof Error?p.message:String(p)}`)}}),N.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,p)=>{i(`Adding Domain: ${t}`);try{let A=pi(p?.provider),L=Xn(p?.provider)?.provider||"unknown",j=new o(`Checking if ${L} can manage ${t}...`);if(j.start(),await A.canManageDomain(t))j.succeed(`Domain ${t} is already available in ${L}`),e(`
@@ -372,7 +372,7 @@ Deployment complete!`),e(`Total size: ${Ce} MB`),e(`
 Assets URL: https://${j}.s3.${A}.amazonaws.com${G?`/${G}`:""}`)}catch(p){r(`Deployment failed: ${p.message}`)}}),N.command("assets:invalidate","Invalidate CloudFront cache").option("--distribution <id>","CloudFront distribution ID").option("--paths <paths>","Paths to invalidate (comma-separated)",{default:"/*"}).option("--wait","Wait for invalidation to complete").action(async(t)=>{i("Invalidating CloudFront Cache");try{let p=t?.distribution;if(!p){r("--distribution is required");return}let L=(t?.paths||"/*").split(",").map((oe)=>oe.trim()),j=t?.wait||!1;if(e(`Distribution: ${p}`),e(`Paths: ${L.join(", ")}`),!await d(`
 Invalidate cache now?`,!0)){e("Invalidation cancelled");return}let Z=new w,ee=new o("Creating invalidation...");ee.start();let re=await Z.invalidatePaths(p,L);if(ee.succeed("Invalidation created"),n(`
 Invalidation ID: ${re.Id}`),e(`Status: ${re.Status}`),e(`Created: ${new Date(re.CreateTime).toLocaleString()}`),j){let oe=new o("Waiting for invalidation to complete...");oe.start(),await Z.waitForInvalidation(p,re.Id),oe.succeed("Invalidation completed!")}else e(`
-Invalidation is in progress. Use --wait to wait for completion.`)}catch(p){r(`Invalidation failed: ${p.message}`)}})}function lc(N){for(let[t,p]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])N.command(t,p).action(async(...A)=>Ar(t.split(" ")[0],{target:String(A[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}import{execFileSync as wp,execSync as $c}from"node:child_process";import{copyFileSync as ls,existsSync as fr,mkdirSync as ad,readFileSync as Sc,writeFileSync as Sp}from"node:fs";import{tmpdir as cd}from"node:os";import{dirname as $p,join as ld,resolve as Cp}from"node:path";import{existsSync as dc,readdirSync as ed,statSync as uc}from"node:fs";import{join as Os}from"node:path";var dp=new Set([".DS_Store","Thumbs.db",".gitkeep",".keep"]);function td(N){return dp.has(N)}function nd(N,t=0){if(t>8)return!0;let p;try{p=ed(N)}catch{return!1}for(let A of p){if(td(A))continue;let L=Os(N,A),j;try{j=uc(L)}catch{continue}if(j.isFile())return!0;if(j.isDirectory()&&nd(L,t+1))return!0}return!1}function up(N){let t;try{t=ed(N)}catch{return[]}let p=[];for(let A of t){if(td(A))continue;let L=Os(N,A);try{if(uc(L).isDirectory()&&dc(Os(L,"index.html")))p.push(A)}catch{}}return p.sort((A,L)=>A.localeCompare(L))}function rd(N){let{root:t,siteName:p,expectIndex:A}=N,L=[];if(!dc(t))return L.push({level:"error",message:`Build output not found at ${t} for site '${p}'`}),L;if(!uc(t).isDirectory())return L.push({level:"error",message:`Site '${p}' has root ${t}, which is a file, not a directory`}),L;if(!nd(t))return L.push({level:"error",message:`Site '${p}' would ship an empty release: ${t} contains no files. Check that the build ran and wrote where 'root' points.`}),L;if(!A)return L;if(dc(Os(t,"index.html")))return L;let j=up(t);if(j.length===1){let G=`${t.replace(/\/+$/,"")}/${j[0]}`;return L.push({level:"error",message:`Site '${p}' has no index.html at the top of ${t}, but ${G} has one. The generator wrote one level down, so this release would serve 404s at the domain root. Set root: '${G}'.`}),L}if(j.length>1)return L.push({level:"warning",message:`Site '${p}' has no index.html at the top of ${t}. These subdirectories have one: ${j.join(", ")}. The domain root will 404.`}),L;return L.push({level:"warning",message:`Site '${p}' has no index.html anywhere under ${t}. The domain root will 404.`}),L}function mp(N){if(!N)return[];if(Array.isArray(N))return N.map(String);let t=N,p=t.Items??t.Item;if(!p)return[];if(Array.isArray(p))return p.map(String);if(typeof p==="object"&&p!==null){let A=p;if("Item"in A){let L=A.Item;if(!L)return[];return Array.isArray(L)?L.map(String):[String(L)]}if("CNAME"in A){let L=A.CNAME;if(!L)return[];return Array.isArray(L)?L.map(String):[String(L)]}return Object.values(A).flatMap((L)=>{if(Array.isArray(L))return L.map(String);return typeof L==="string"?[L]:[]})}return[String(p)]}async function Bs(N){if(N.length===0)return;let t=new w,p=await t.listDistributions(),A=[...new Set(N.map((L)=>L.toLowerCase()))];for(let L of A){let j=p.find((Z)=>mp(Z.Aliases).some((re)=>re.toLowerCase()===L));if(!j?.Id){a(`No CloudFront distribution found for ${L} — skipping dynamic HTTP method sync`);continue}if(await t.ensureDynamicHttpMethods(j.Id))n(`CloudFront ${j.Id} (${L}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else e(`CloudFront ${j.Id} (${L}): already allows dynamic HTTP methods`)}}import{execSync as pp}from"node:child_process";async function fp(N,t,p,A={},L=process.cwd()){if(!N)return;if(A.step?.(`Running ${p} hook`),typeof N==="string"){pp(N,{stdio:"inherit",cwd:L});return}await N(t)}async function ss(N,t,p={},A){try{return await fp(N.hooks?.[t],N,t,p,A),!0}catch(L){return p.error?.(`${t} hook failed: ${L?.message||L}`),!1}}var id=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"],gp=[{name:"x-stx-router",value:"true"}];function as(N){return`"${N.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function od(N){return`{${N.map(as).join(" ")}}`}function hp(N){let t=`http.request.headers[${as(N.name.toLowerCase())}]`;return N.value===void 0?`len(${t}) > 0`:`any(${t}[*] == ${as(N.value)})`}function mc(N){if(N.length===1)return`http.host eq ${as(N[0])}`;return`http.host in ${od(N)}`}function pc(N,t={}){if(t.enabled===!1||N.length===0)return[];let p=mc(N),A=[],j=(t.bypassPaths??[]).map((Ce)=>`starts_with(http.request.uri.path, ${as(Ce)})`),Z=(t.negotiatedRequestHeaders??gp).map(hp),ee=[...j,...Z],re=ee.length>0?`(${ee.join(" or ")})`:void 0;if(re)A.push({action:"set_cache_settings",description:"bypass cache",expression:`(${p} and ${re})`,enabled:!0,action_parameters:{cache:!1}});let oe=re?`${p} and not ${re}`:p,be=t.assetExtensions??id,we=be.length>0?`lower(http.request.uri.path.extension) in ${od([...be])}`:void 0;if(we)A.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${oe} and ${we})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:t.assetBrowserTtl??31536000}}});return A.push({action:"set_cache_settings",description:"cache documents",expression:we?`(${oe} and not ${we})`:`(${oe})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:t.documentBrowserTtl??0}}}),A}function fc(N,t,p){if(N.length===0||!t||!p)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${mc(N)})`,enabled:!0,action_parameters:{headers:{[t]:{operation:"set",value:p}}}}]}var bi=(N)=>N===void 0?void 0:N?"on":"off";function gc(N){let t={ssl:N.ssl,always_use_https:bi(N.alwaysUseHttps),automatic_https_rewrites:bi(N.automaticHttpsRewrites),min_tls_version:N.minTlsVersion,tls_1_3:bi(N.tls13),brotli:bi(N.brotli),http3:bi(N.http3),"0rtt":bi(N.zeroRtt),early_hints:bi(N.earlyHints),browser_cache_ttl:N.browserCacheTtl,always_online:bi(N.alwaysOnline),websockets:bi(N.websockets),email_obfuscation:bi(N.emailObfuscation)};if(N.hsts)t.security_header={strict_transport_security:{enabled:N.hsts.enabled,max_age:N.hsts.maxAge??31536000,include_subdomains:N.hsts.includeSubdomains??!1,preload:N.hsts.preload??!1,nosniff:N.hsts.noSniff??!0}};for(let p of Object.keys(t))if(t[p]===void 0)delete t[p];return{...t,...N.raw??{}}}var cs={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as yp}from"node:tls";async function hc(N){let{address:t,serverName:p,port:A=443,timeoutMs:L=5000}=N;return new Promise((j)=>{let G=!1,Z=(re)=>{if(G)return;G=!0;try{ee.destroy()}catch{}j(re)},ee=yp({host:t,port:A,servername:p,rejectUnauthorized:!1,timeout:L});ee.once("secureConnect",()=>{if(ee.authorized){Z({reachable:!0,trusted:!0});return}Z({reachable:!0,trusted:!1,reason:ee.authorizationError?String(ee.authorizationError):"origin certificate is not trusted for this hostname"})}),ee.once("timeout",()=>{Z({reachable:!1,trusted:!1,reason:`no TLS handshake within ${L}ms`})}),ee.once("error",(re)=>{Z({reachable:!1,trusted:!1,reason:re.message})})})}function vp(N,t){let p=t.replace(/\.$/,"").toLowerCase();return N.some((A)=>{let L=A.replace(/\.$/,"").toLowerCase();if(L===p)return!0;if(!L.startsWith("*."))return!1;let j=L.slice(2);if(!p.endsWith(`.${j}`))return!1;return!p.slice(0,p.length-j.length-1).includes(".")})}async function yc(N){let{provider:t,zone:p,hosts:A,ipv4:L,ipv6:j,proxied:G=!0,settings:Z=cs,cache:ee,originGuard:re,purge:oe=!0,ttl:be=300,skipOriginProbe:we=!1,skipEdgeCertificateCheck:Ce=!1}=N,De={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(A.length===0)return De;let Se=[],Ee=G&&!Ce?await t.listEdgeCertificateHosts(p):null;for(let Ae of A){let Te=G;if(Te&&Ee&&!vp(Ee,Ae)){Te=!1;let Qe=Ee.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Ee.join(", ")})`;De.deferredProxy.push({host:Ae,reason:Qe}),De.warnings.push(`${Ae}: publishing DNS-only — ${Qe}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Te&&!we){let Qe=await hc({address:L,serverName:Ae});if(!Qe.trusted){Te=!1;let Je=Qe.reason||"origin is not serving a trusted certificate";De.deferredProxy.push({host:Ae,reason:Je}),De.warnings.push(`${Ae}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Je}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Te)Se.push(Ae);let Ne=[{type:"A",content:L}];if(j&&Ai(Ae))Ne.push({type:"AAAA",content:j});for(let{type:Qe,content:Je}of Ne){let Ye=await t.upsertRecord(p,{name:Ae,type:Qe,content:Je,ttl:be,proxied:Te});if(Ye.success)De.records.push({host:Ae,type:Qe,content:Je,proxied:Te});else De.warnings.push(`${Ae} ${Qe} → ${Je} failed: ${Ye.message||"unknown provider error"}`)}}if(Se.length===0){if(G)De.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return De}try{let Ae=gc(Z),Te=await t.applyZoneSettings(p,Ae);De.settingsChanged=Te.changed;for(let Ne of Te.failed)De.warnings.push(`zone setting '${Ne.id}' could not be applied: ${Ne.error}`)}catch(Ae){De.warnings.push(`zone settings could not be read: ${Ae instanceof Error?Ae.message:String(Ae)}`)}let We=pc(Se,ee);if(We.length>0){let Ae=await t.putManagedPhaseRules(p,"http_request_cache_settings",We);if(Ae.success)De.cacheRules=We.length;else De.warnings.push(`cache rules could not be written: ${Ae.message}`)}if(re){let Ae=fc(Se,re.header,re.value);if(Ae.length>0){let Te=await t.putManagedPhaseRules(p,"http_request_late_transform",Ae);if(Te.success)De.originGuard=!0;else De.warnings.push(`origin guard header could not be written: ${Te.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(oe){if(De.purged=await t.purgeCache(p,{hosts:Se}),!De.purged)De.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return De}var bp=(N)=>process.env[N];function sd(N,t){let p=N.replace(/\.$/,"").toLowerCase();if(t){let A=t.replace(/\.$/,"").toLowerCase();if(p===A||p.endsWith(`.${A}`))return A}return p.split(".").slice(-2).join(".")}function vc(N,t={}){let p=t.env??bp,A=N.infrastructure?.compute?.proxy?.cdn,L=[];if(!A||A.provider!=="cloudflare")return{plan:null,errors:L};if(A.originDomain)L.push(`compute.proxy.cdn.originDomain (${A.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let j=p("CLOUDFLARE_API_TOKEN");if(!j)return L.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:L};let G=N.sites??{},Z=A.frontedHosts?.length?[...new Set(A.frontedHosts.map((we)=>we.toLowerCase()))]:Pi(G,{autoWww:N.infrastructure?.compute?.proxy?.autoWww!==!1});if(Z.length===0)return L.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:L};let ee=N.infrastructure?.dns?.domain,re=new Set(Z.map((we)=>sd(we,ee)));if(re.size>1)return L.push(`Fronted hosts span more than one zone (${[...re].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:L};let oe=A.cloudflare??{},be=A.secret?{header:A.secretHeader??"X-Origin-Verify",value:A.secret}:void 0;return{plan:{zone:[...re][0],hosts:Z,apiToken:j,zoneId:oe.zoneId??p("CLOUDFLARE_ZONE_ID"),accountId:oe.accountId??p("CLOUDFLARE_ACCOUNT_ID"),proxied:oe.proxied!==!1,settings:oe.settings??cs,cache:oe.cache,originGuard:be,purge:oe.purgeOnDeploy!==!1,skipOriginProbe:oe.skipOriginProbe===!0},errors:L}}async function Ap(N){let t=Ps();if(t.emptyEnvKey||t.emptyEnvSecret)a("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");e(`AWS credentials: ${t.description}`);try{let A=await new st(N).getCallerIdentity();if(A.Arn)e(`AWS identity: ${A.Arn}`)}catch(p){a(`Could not verify AWS identity: ${p.message}`)}}function kp(){try{return $c("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function bc(N,t,p,A){let{ensureManagementDashboard:L}=await import("./chunk-czrdw88c.js");L(N,{logger:{info:e,warn:a}});let j=N.sites||{},G=Object.entries(j);if(G.length===0)return a("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(A&&!j[A])return r(`Site '${A}' was not found. Configured sites: ${G.map(([We])=>We).join(", ")}`),!1;let Z=G.filter(([We,Ae])=>{if(!Ae)return!1;if(A&&We!==A)return!1;if(R(Ae)==="bucket")return a(`Site '${We}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return ps(Ae)});if(A)e(`Deploying only '${A}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let ee=N.project.slug,oe=(N.infrastructure?.compute||{}).runtime||"bun",be=x({config:N}),we=kp(),Ce=new Map,De=new Map,Se={step:(We)=>m(We),error:(We)=>r(We)};if(!await ss(N,"beforeDeploy",Se))return!1;if(!await ss(N,"beforeBuild",Se))return!1;for(let[We,Ae]of Z){let Te=R(Ae);if(i(`Preparing site: ${We}`),e(`Domain: ${Ae.domain||"(none)"}`),e(`Source: ${Ae.root}`),e(`Kind: ${Te==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),Te==="server-app")e(`Start: ${Ae.start}`),e(`Port: ${Ae.port??"(unset)"}`);if(Ae.build){m(`Running build: ${Ae.build}`);try{$c(Ae.build,{stdio:"inherit",cwd:process.cwd()})}catch(et){return r(`Build failed for site '${We}': ${et.message}`),!1}}let Ne=rd({root:Ae.root,siteName:We,expectIndex:Te==="server-static"});for(let et of Ne)if(et.level==="error")r(et.message);else a(et.message);if(Ne.some((et)=>et.level==="error"))return!1;let Qe=Ae.build?void 0:JSON.stringify([Cp(Ae.root),[...Ae.exclude||[]].sort()]),Je=Qe?De.get(Qe):void 0;if(Je){m(`Reusing package for ${Ae.root} → ${Je}`),Ce.set(We,Je);continue}let Ye=ld(cd(),`${ee}-${We}-${we}.tar.gz`);m(`Packaging ${Ae.root} → ${Ye}`);try{let et=(Ae.exclude||[]).map((Pt)=>`--exclude=${Pt}`);wp("tar",["czf",Ye,"-C",Ae.root,...et,"."],{stdio:"inherit",env:{...process.env,COPYFILE_DISABLE:"1"}})}catch(et){return r(`Failed to package '${We}': ${et.message}`),!1}if(Ce.set(We,Ye),Qe)De.set(Qe,Ye)}if(!await ss(N,"afterBuild",Se))return!1;let Ee=await $i({config:A?{...N,sites:Object.fromEntries(Z)}:N,rpxConfig:A?N:void 0,environment:t,driver:be,sha:we,runtime:oe,tarballForSite:(We)=>{let Ae=Ce.get(We);if(!Ae)throw Error(`Missing tarball for site '${We}'`);return Ae},logger:{info:(We)=>e(We),warn:(We)=>a(We),error:(We)=>r(We),step:(We)=>m(We),success:(We)=>n(We)}});if(Ee&&!await ss(N,"afterDeploy",Se))return!1;return Ee}async function zs(N){let t=new xr;if(m("Running pre-deployment security scan..."),N.exclude?.length)e(`Excluding from the scan: ${N.exclude.join(", ")}`);let p=await t.scan({directory:N.sourceDir,failOnSeverity:N.failOnSeverity||"critical",skipPatterns:N.skipPatterns,exclude:N.exclude});return{passed:p.passed,result:p}}function Rp(){let N=ld(cd(),`ts-cloud-empty-scan-${process.pid}`);return ad(N,{recursive:!0}),N}function Vs(N){let{summary:t,findings:p,scannedFiles:A,duration:L}=N;if(e(`
+Invalidation is in progress. Use --wait to wait for completion.`)}catch(p){r(`Invalidation failed: ${p.message}`)}})}function lc(N){for(let[t,p]of[["team:add <email> <role>","Invite an organization member"],["team:list","List organization members"],["team:remove <email>","Revoke organization membership"]])N.command(t,p).action(async(...A)=>Ar(t.split(" ")[0],{target:String(A[0]??""),message:"Legacy IAM-backed team commands are deprecated and cannot safely represent organization-scoped access.",nextAction:"Use the Team dashboard or organization invitation API; this command exits without changing IAM."}))}import{execFileSync as wp,execSync as $c}from"node:child_process";import{copyFileSync as ls,existsSync as fr,mkdirSync as ad,readFileSync as Sc,writeFileSync as Sp}from"node:fs";import{tmpdir as cd}from"node:os";import{dirname as $p,join as ld,resolve as Cp}from"node:path";import{existsSync as dc,readdirSync as ed,statSync as uc}from"node:fs";import{join as Os}from"node:path";var dp=new Set([".DS_Store","Thumbs.db",".gitkeep",".keep"]);function td(N){return dp.has(N)}function nd(N,t=0){if(t>8)return!0;let p;try{p=ed(N)}catch{return!1}for(let A of p){if(td(A))continue;let L=Os(N,A),j;try{j=uc(L)}catch{continue}if(j.isFile())return!0;if(j.isDirectory()&&nd(L,t+1))return!0}return!1}function up(N){let t;try{t=ed(N)}catch{return[]}let p=[];for(let A of t){if(td(A))continue;let L=Os(N,A);try{if(uc(L).isDirectory()&&dc(Os(L,"index.html")))p.push(A)}catch{}}return p.sort((A,L)=>A.localeCompare(L))}function rd(N){let{root:t,siteName:p,expectIndex:A}=N,L=[];if(!dc(t))return L.push({level:"error",message:`Build output not found at ${t} for site '${p}'`}),L;if(!uc(t).isDirectory())return L.push({level:"error",message:`Site '${p}' has root ${t}, which is a file, not a directory`}),L;if(!nd(t))return L.push({level:"error",message:`Site '${p}' would ship an empty release: ${t} contains no files. Check that the build ran and wrote where 'root' points.`}),L;if(!A)return L;if(dc(Os(t,"index.html")))return L;let j=up(t);if(j.length===1){let G=`${t.replace(/\/+$/,"")}/${j[0]}`;return L.push({level:"error",message:`Site '${p}' has no index.html at the top of ${t}, but ${G} has one. The generator wrote one level down, so this release would serve 404s at the domain root. Set root: '${G}'.`}),L}if(j.length>1)return L.push({level:"warning",message:`Site '${p}' has no index.html at the top of ${t}. These subdirectories have one: ${j.join(", ")}. The domain root will 404.`}),L;return L.push({level:"warning",message:`Site '${p}' has no index.html anywhere under ${t}. The domain root will 404.`}),L}function mp(N){if(!N)return[];if(Array.isArray(N))return N.map(String);let t=N,p=t.Items??t.Item;if(!p)return[];if(Array.isArray(p))return p.map(String);if(typeof p==="object"&&p!==null){let A=p;if("Item"in A){let L=A.Item;if(!L)return[];return Array.isArray(L)?L.map(String):[String(L)]}if("CNAME"in A){let L=A.CNAME;if(!L)return[];return Array.isArray(L)?L.map(String):[String(L)]}return Object.values(A).flatMap((L)=>{if(Array.isArray(L))return L.map(String);return typeof L==="string"?[L]:[]})}return[String(p)]}async function Bs(N){if(N.length===0)return;let t=new w,p=await t.listDistributions(),A=[...new Set(N.map((L)=>L.toLowerCase()))];for(let L of A){let j=p.find((Z)=>mp(Z.Aliases).some((re)=>re.toLowerCase()===L));if(!j?.Id){a(`No CloudFront distribution found for ${L} — skipping dynamic HTTP method sync`);continue}if(await t.ensureDynamicHttpMethods(j.Id))n(`CloudFront ${j.Id} (${L}): enabled POST/PUT/PATCH/DELETE on dynamic paths`);else e(`CloudFront ${j.Id} (${L}): already allows dynamic HTTP methods`)}}import{execSync as pp}from"node:child_process";async function fp(N,t,p,A={},L=process.cwd()){if(!N)return;if(A.step?.(`Running ${p} hook`),typeof N==="string"){pp(N,{stdio:"inherit",cwd:L});return}await N(t)}async function ss(N,t,p={},A){try{return await fp(N.hooks?.[t],N,t,p,A),!0}catch(L){return p.error?.(`${t} hook failed: ${L?.message||L}`),!1}}var id=["js","mjs","cjs","css","map","woff","woff2","ttf","otf","eot","png","jpg","jpeg","gif","webp","avif","svg","ico","mp4","webm","ogg","mp3","wav","pdf","wasm"],gp=[{name:"x-stx-router",value:"true"}];function as(N){return`"${N.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function od(N){return`{${N.map(as).join(" ")}}`}function hp(N){let t=`http.request.headers[${as(N.name.toLowerCase())}]`;return N.value===void 0?`len(${t}) > 0`:`any(${t}[*] == ${as(N.value)})`}function mc(N){if(N.length===1)return`http.host eq ${as(N[0])}`;return`http.host in ${od(N)}`}function pc(N,t={}){if(t.enabled===!1||N.length===0)return[];let p=mc(N),A=[],j=(t.bypassPaths??[]).map((De)=>`starts_with(http.request.uri.path, ${as(De)})`),Z=(t.negotiatedRequestHeaders??gp).map(hp),ee=[...j,...Z],re=ee.length>0?`(${ee.join(" or ")})`:void 0;if(re)A.push({action:"set_cache_settings",description:"bypass cache",expression:`(${p} and ${re})`,enabled:!0,action_parameters:{cache:!1}});let oe=re?`${p} and not ${re}`:p,be=t.assetExtensions??id,we=be.length>0?`lower(http.request.uri.path.extension) in ${od([...be])}`:void 0;if(we)A.push({action:"set_cache_settings",description:"cache fingerprinted assets",expression:`(${oe} and ${we})`,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.assetEdgeTtl??2592000},browser_ttl:{mode:"override_origin",default:t.assetBrowserTtl??31536000}}});let Ce=we?`(${oe} and not ${we})`:`(${oe})`;if(t.documentEdgeTtl===0)return A.push({action:"set_cache_settings",description:"bypass documents",expression:Ce,enabled:!0,action_parameters:{cache:!1}}),A;return A.push({action:"set_cache_settings",description:"cache documents",expression:Ce,enabled:!0,action_parameters:{cache:!0,edge_ttl:{mode:"override_origin",default:t.documentEdgeTtl??3600},browser_ttl:{mode:"override_origin",default:t.documentBrowserTtl??0}}}),A}function fc(N,t,p){if(N.length===0||!t||!p)return[];return[{action:"rewrite",description:"origin guard header",expression:`(${mc(N)})`,enabled:!0,action_parameters:{headers:{[t]:{operation:"set",value:p}}}}]}var bi=(N)=>N===void 0?void 0:N?"on":"off";function gc(N){let t={ssl:N.ssl,always_use_https:bi(N.alwaysUseHttps),automatic_https_rewrites:bi(N.automaticHttpsRewrites),min_tls_version:N.minTlsVersion,tls_1_3:bi(N.tls13),brotli:bi(N.brotli),http3:bi(N.http3),"0rtt":bi(N.zeroRtt),early_hints:bi(N.earlyHints),browser_cache_ttl:N.browserCacheTtl,always_online:bi(N.alwaysOnline),websockets:bi(N.websockets),email_obfuscation:bi(N.emailObfuscation)};if(N.hsts)t.security_header={strict_transport_security:{enabled:N.hsts.enabled,max_age:N.hsts.maxAge??31536000,include_subdomains:N.hsts.includeSubdomains??!1,preload:N.hsts.preload??!1,nosniff:N.hsts.noSniff??!0}};for(let p of Object.keys(t))if(t[p]===void 0)delete t[p];return{...t,...N.raw??{}}}var cs={ssl:"strict",alwaysUseHttps:!0,automaticHttpsRewrites:!0,minTlsVersion:"1.2",tls13:!0,brotli:!0,http3:!0,earlyHints:!0,alwaysOnline:!0,emailObfuscation:!1,browserCacheTtl:0};import{connect as yp}from"node:tls";async function hc(N){let{address:t,serverName:p,port:A=443,timeoutMs:L=5000}=N;return new Promise((j)=>{let G=!1,Z=(re)=>{if(G)return;G=!0;try{ee.destroy()}catch{}j(re)},ee=yp({host:t,port:A,servername:p,rejectUnauthorized:!1,timeout:L});ee.once("secureConnect",()=>{if(ee.authorized){Z({reachable:!0,trusted:!0});return}Z({reachable:!0,trusted:!1,reason:ee.authorizationError?String(ee.authorizationError):"origin certificate is not trusted for this hostname"})}),ee.once("timeout",()=>{Z({reachable:!1,trusted:!1,reason:`no TLS handshake within ${L}ms`})}),ee.once("error",(re)=>{Z({reachable:!1,trusted:!1,reason:re.message})})})}function vp(N,t){let p=t.replace(/\.$/,"").toLowerCase();return N.some((A)=>{let L=A.replace(/\.$/,"").toLowerCase();if(L===p)return!0;if(!L.startsWith("*."))return!1;let j=L.slice(2);if(!p.endsWith(`.${j}`))return!1;return!p.slice(0,p.length-j.length-1).includes(".")})}async function yc(N){let{provider:t,zone:p,hosts:A,ipv4:L,ipv6:j,proxied:G=!0,settings:Z=cs,cache:ee,originGuard:re,purge:oe=!0,ttl:be=300,skipOriginProbe:we=!1,skipEdgeCertificateCheck:Ce=!1}=N,De={records:[],settingsChanged:[],cacheRules:0,originGuard:!1,purged:!1,deferredProxy:[],warnings:[]};if(A.length===0)return De;let Se=[],Ee=G&&!Ce?await t.listEdgeCertificateHosts(p):null;for(let Ae of A){let Te=G;if(Te&&Ee&&!vp(Ee,Ae)){Te=!1;let Qe=Ee.length===0?"the zone has no active edge certificate yet":`no active edge certificate covers it (${Ee.join(", ")})`;De.deferredProxy.push({host:Ae,reason:Qe}),De.warnings.push(`${Ae}: publishing DNS-only — ${Qe}. Proxying it would make Cloudflare terminate TLS with no certificate for the name, which fails the handshake outright rather than degrading. Universal SSL covers the apex and ONE level of subdomain, so a deeper name needs its own certificate; otherwise re-run the deploy once the certificate is active.`)}if(Te&&!we){let Qe=await hc({address:L,serverName:Ae});if(!Qe.trusted){Te=!1;let Je=Qe.reason||"origin is not serving a trusted certificate";De.deferredProxy.push({host:Ae,reason:Je}),De.warnings.push(`${Ae}: publishing DNS-only for now — the origin does not yet serve a certificate this proxy can verify (${Je}). The origin issues certificates over HTTP-01, which needs the name to reach it directly; re-run the deploy once it has one and the record will be proxied.`)}}if(Te)Se.push(Ae);let Ne=[{type:"A",content:L}];if(j&&Ai(Ae))Ne.push({type:"AAAA",content:j});for(let{type:Qe,content:Je}of Ne){let Ye=await t.upsertRecord(p,{name:Ae,type:Qe,content:Je,ttl:be,proxied:Te});if(Ye.success)De.records.push({host:Ae,type:Qe,content:Je,proxied:Te});else De.warnings.push(`${Ae} ${Qe} → ${Je} failed: ${Ye.message||"unknown provider error"}`)}}if(Se.length===0){if(G)De.warnings.push("No host is proxied yet, so zone settings, cache rules and purge were skipped — they only take effect through the proxy.");return De}try{let Ae=gc(Z),Te=await t.applyZoneSettings(p,Ae);De.settingsChanged=Te.changed;for(let Ne of Te.failed)De.warnings.push(`zone setting '${Ne.id}' could not be applied: ${Ne.error}`)}catch(Ae){De.warnings.push(`zone settings could not be read: ${Ae instanceof Error?Ae.message:String(Ae)}`)}let We=pc(Se,ee);if(We.length>0){let Ae=await t.putManagedPhaseRules(p,"http_request_cache_settings",We);if(Ae.success)De.cacheRules=We.length;else De.warnings.push(`cache rules could not be written: ${Ae.message}`)}if(re){let Ae=fc(Se,re.header,re.value);if(Ae.length>0){let Te=await t.putManagedPhaseRules(p,"http_request_late_transform",Ae);if(Te.success)De.originGuard=!0;else De.warnings.push(`origin guard header could not be written: ${Te.message}. `+"The gateway will reject requests that lack it — disable the guard or grant the token Transform Rules: Edit.")}}if(oe){if(De.purged=await t.purgeCache(p,{hosts:Se}),!De.purged)De.warnings.push("edge cache purge failed — new content may take until TTL expiry to appear.")}return De}var bp=(N)=>process.env[N];function sd(N,t){let p=N.replace(/\.$/,"").toLowerCase();if(t){let A=t.replace(/\.$/,"").toLowerCase();if(p===A||p.endsWith(`.${A}`))return A}return p.split(".").slice(-2).join(".")}function vc(N,t={}){let p=t.env??bp,A=N.infrastructure?.compute?.proxy?.cdn,L=[];if(!A||A.provider!=="cloudflare")return{plan:null,errors:L};if(A.originDomain)L.push(`compute.proxy.cdn.originDomain (${A.originDomain}) is ignored for Cloudflare: the proxy forwards to the address in the record it fronts, `+"so no separate origin hostname is needed — and publishing one gives clients a documented way around the edge.");let j=p("CLOUDFLARE_API_TOKEN");if(!j)return L.push("CLOUDFLARE_API_TOKEN is not set — the Cloudflare CDN cannot be reconciled."),{plan:null,errors:L};let G=N.sites??{},Z=A.frontedHosts?.length?[...new Set(A.frontedHosts.map((we)=>we.toLowerCase()))]:Pi(G,{autoWww:N.infrastructure?.compute?.proxy?.autoWww!==!1});if(Z.length===0)return L.push("No hostnames to front — set compute.proxy.cdn.frontedHosts, or give a site a domain."),{plan:null,errors:L};let ee=N.infrastructure?.dns?.domain,re=new Set(Z.map((we)=>sd(we,ee)));if(re.size>1)return L.push(`Fronted hosts span more than one zone (${[...re].join(", ")}). A Cloudflare zone is configured as a unit, so run one CDN config per zone.`),{plan:null,errors:L};let oe=A.cloudflare??{},be=A.secret?{header:A.secretHeader??"X-Origin-Verify",value:A.secret}:void 0;return{plan:{zone:[...re][0],hosts:Z,apiToken:j,zoneId:oe.zoneId??p("CLOUDFLARE_ZONE_ID"),accountId:oe.accountId??p("CLOUDFLARE_ACCOUNT_ID"),proxied:oe.proxied!==!1,settings:oe.settings??cs,cache:oe.cache,originGuard:be,purge:oe.purgeOnDeploy!==!1,skipOriginProbe:oe.skipOriginProbe===!0},errors:L}}async function Ap(N){let t=Ps();if(t.emptyEnvKey||t.emptyEnvSecret)a("Empty AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY env var detected — likely a misconfigured .env file. Remove the empty lines or fill them in.");e(`AWS credentials: ${t.description}`);try{let A=await new st(N).getCallerIdentity();if(A.Arn)e(`AWS identity: ${A.Arn}`)}catch(p){a(`Could not verify AWS identity: ${p.message}`)}}function kp(){try{return $c("git rev-parse --short HEAD",{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{return Date.now().toString(36)}}async function bc(N,t,p,A){let{ensureManagementDashboard:L}=await import("./chunk-czrdw88c.js");L(N,{logger:{info:e,warn:a}});let j=N.sites||{},G=Object.entries(j);if(G.length===0)return a("infrastructure.compute is set but no sites are configured — nothing to deploy. Add sites to `cloud.config.ts`."),!0;if(A&&!j[A])return r(`Site '${A}' was not found. Configured sites: ${G.map(([We])=>We).join(", ")}`),!1;let Z=G.filter(([We,Ae])=>{if(!Ae)return!1;if(A&&We!==A)return!1;if(R(Ae)==="bucket")return a(`Site '${We}' targets a bucket — skipping compute deploy (handled by the static-site path).`),!1;return ps(Ae)});if(A)e(`Deploying only '${A}'. Other sites keep their current release; proxy routes are still regenerated in full.`);let ee=N.project.slug,oe=(N.infrastructure?.compute||{}).runtime||"bun",be=x({config:N}),we=kp(),Ce=new Map,De=new Map,Se={step:(We)=>m(We),error:(We)=>r(We)};if(!await ss(N,"beforeDeploy",Se))return!1;if(!await ss(N,"beforeBuild",Se))return!1;for(let[We,Ae]of Z){let Te=R(Ae);if(i(`Preparing site: ${We}`),e(`Domain: ${Ae.domain||"(none)"}`),e(`Source: ${Ae.root}`),e(`Kind: ${Te==="server-static"?"static (shipped to /var/www)":"app (systemd service)"}`),Te==="server-app")e(`Start: ${Ae.start}`),e(`Port: ${Ae.port??"(unset)"}`);if(Ae.build){m(`Running build: ${Ae.build}`);try{$c(Ae.build,{stdio:"inherit",cwd:process.cwd()})}catch(et){return r(`Build failed for site '${We}': ${et.message}`),!1}}let Ne=rd({root:Ae.root,siteName:We,expectIndex:Te==="server-static"});for(let et of Ne)if(et.level==="error")r(et.message);else a(et.message);if(Ne.some((et)=>et.level==="error"))return!1;let Qe=Ae.build?void 0:JSON.stringify([Cp(Ae.root),[...Ae.exclude||[]].sort()]),Je=Qe?De.get(Qe):void 0;if(Je){m(`Reusing package for ${Ae.root} → ${Je}`),Ce.set(We,Je);continue}let Ye=ld(cd(),`${ee}-${We}-${we}.tar.gz`);m(`Packaging ${Ae.root} → ${Ye}`);try{let et=(Ae.exclude||[]).map((Pt)=>`--exclude=${Pt}`);wp("tar",["czf",Ye,"-C",Ae.root,...et,"."],{stdio:"inherit",env:{...process.env,COPYFILE_DISABLE:"1"}})}catch(et){return r(`Failed to package '${We}': ${et.message}`),!1}if(Ce.set(We,Ye),Qe)De.set(Qe,Ye)}if(!await ss(N,"afterBuild",Se))return!1;let Ee=await $i({config:A?{...N,sites:Object.fromEntries(Z)}:N,rpxConfig:A?N:void 0,environment:t,driver:be,sha:we,runtime:oe,tarballForSite:(We)=>{let Ae=Ce.get(We);if(!Ae)throw Error(`Missing tarball for site '${We}'`);return Ae},logger:{info:(We)=>e(We),warn:(We)=>a(We),error:(We)=>r(We),step:(We)=>m(We),success:(We)=>n(We)}});if(Ee&&!await ss(N,"afterDeploy",Se))return!1;return Ee}async function zs(N){let t=new xr;if(m("Running pre-deployment security scan..."),N.exclude?.length)e(`Excluding from the scan: ${N.exclude.join(", ")}`);let p=await t.scan({directory:N.sourceDir,failOnSeverity:N.failOnSeverity||"critical",skipPatterns:N.skipPatterns,exclude:N.exclude});return{passed:p.passed,result:p}}function Rp(){let N=ld(cd(),`ts-cloud-empty-scan-${process.pid}`);return ad(N,{recursive:!0}),N}function Vs(N){let{summary:t,findings:p,scannedFiles:A,duration:L}=N;if(e(`
 Scanned ${A} files in ${L}ms`),t.critical>0)r(`  Critical: ${t.critical}`);else e(`  Critical: ${t.critical}`);if(t.high>0)a(`  High: ${t.high}`);else e(`  High: ${t.high}`);if(e(`  Medium: ${t.medium}`),e(`  Low: ${t.low}`),p.length>0){e(`
 Findings:`);let j=p.filter((oe)=>oe.pattern.severity==="critical"),G=p.filter((oe)=>oe.pattern.severity==="high"),Z=p.filter((oe)=>oe.pattern.severity==="medium"),ee=p.filter((oe)=>oe.pattern.severity==="low"),re=(oe,be,we)=>{if(oe.length>0){console.log(`
 ${Mt(`[${be}]`,we)}`);for(let Ce of oe.slice(0,10))e(`  ${Ce.pattern.name}`),e(`    File: ${Ce.file}:${Ce.line}`),e(`    Match: ${Ce.match}`);if(oe.length>10)e(`  ... and ${oe.length-10} more ${be.toLowerCase()} findings`)}};re(j,"CRITICAL","red"),re(G,"HIGH","yellow"),re(Z,"MEDIUM","blue"),re(ee,"LOW","gray")}}function dd(N,t){let p=Object.keys(N.environments??{});if(t&&p.includes(t))return t;if(p.includes("production"))return"production";if(p[0])return p[0];throw Error("A configured environment is required for security policy evaluation")}function wc(N,t,p){let A=dd(N,t),L=y(process.cwd(),N);try{let j=new Rt(L.store);$n(L);let G=ae(L,A);if(p)na(j,G,p);else ia(j,G);let Z=Zt(j,{scope:G,desiredConfigHash:L.project.desiredConfigHash});return e(`Security policy: ${Z.decision.policyId} v${Z.decision.policyVersion} — ${Z.decision.outcome.toUpperCase()}`),e(`Security decision: ${Z.decision.explanation}`),{allowed:Z.decision.outcome!=="block",explanation:Z.decision.explanation}}finally{L.store.close()}}async function Ip(N,t){let p=dd(N),A=y(process.cwd(),N);try{let L=new Rt(A.store);$n(A);let j=ae(A,p),G=t.imageSha256?`${t.imageRef}@sha256:${t.imageSha256.replace(/^sha256:/,"")}`:t.imageRef;m("Scanning the built image and producing release security artifacts...");let Z=await oa(L,{scope:j,releaseId:G,imageRef:t.imageRef,imageSha256:t.imageSha256,artifactRoot:t.artifactRoot,invocationId:t.invocationId,startedAt:t.startedAt,externalParameters:{imageRef:t.imageRef,artifactRoot:t.artifactRoot}});e(`Image scanner: ${Z.scan.run.status} (${Z.scan.findings.length} findings)`),e(`Release SBOM: ${Z.sbomSource==="image"?"full image inventory":Z.sbomSource==="manifest"?"package-manifest fallback":"unavailable"}`);let ee=Zt(L,{scope:j,operationId:t.invocationId,desiredConfigHash:A.project.desiredConfigHash});return e(`Release policy: ${ee.decision.policyId} v${ee.decision.policyVersion} — ${ee.decision.outcome.toUpperCase()}`),e(`Release decision: ${ee.decision.explanation}`),{allowed:ee.decision.outcome!=="block",explanation:ee.decision.explanation}}finally{A.store.close()}}function Pp(N){try{let t=y(process.cwd(),N),p=new qt(t.store).current();if(!p.attackMode&&!p.mitigationPause&&p.ipRules.allow.length===0&&p.ipRules.block.length===0)return N;let A=Do(N,p);return e(`Applying protection controls: ${p.ipRules.allow.length} allow, ${p.ipRules.block.length} block${p.attackMode?", attack mode ON":""}${p.mitigationPause?", mitigation PAUSED":""}`),A}catch{return N}}function Cc(N){N.command("deploy:security-scan","Run pre-deployment security scan").option("--source <path>","Source directory to scan",{default:"."}).option("--fail-on <severity>","Fail on severity level (critical, high, medium, low)",{default:"critical"}).option("--skip-patterns <patterns>","Comma-separated list of pattern names to skip").action(async(t)=>{i("Pre-Deployment Security Scan");try{let p=t?.source||".",A=t?.failOn||"critical",L=t?.skipPatterns?.split(",").map((Z)=>Z.trim())||[];if(!fr(p)){r(`Source directory not found: ${p}`);return}e(`Source: ${p}`),e(`Fail on: ${A} or higher severity`);let{passed:j,result:G}=await zs({sourceDir:p,failOnSeverity:A,skipPatterns:L});if(Vs(G),j)n(`
@@ -393,7 +393,7 @@ Resources: ${Ot}
 
 View in console:
 https://console.aws.amazon.com/cloudformation/home?region=${we}#/stacks/stackinfo?stackId=${encodeURIComponent(be)}`,"green"),Object.keys(Vt).length>0){e(`
-Stack Outputs:`);for(let[vt,Lt]of Object.entries(Vt))e(`  - ${vt}: ${Lt}`)}if(G.infrastructure?.storage)for(let[vt,Lt]of Object.entries(G.infrastructure.storage)){if(!Lt.website||!Lt.root)continue;let nr=Vt[`${vt}BucketName`]||Vt.FrontendBucketName,Qn=Vt[`${vt}CloudFrontDistributionId`];if(!nr){a(`Could not find bucket name for storage '${vt}' — skipping file upload`);continue}if(!fr(Lt.root)){a(`Source directory not found: ${Lt.root} — skipping file upload for '${vt}'`);continue}m(`Uploading files from ${Lt.root} to s3://${nr}...`);let{uploadStaticFiles:di,invalidateCache:ho}=await import("./chunk-7w5mds2p.js"),gr=await di({sourceDir:Lt.root,bucket:nr,region:we,onProgress:(tn,rn,Jr)=>{if(tn%10===0||tn===rn)e(`  ${tn}/${rn}: ${Jr}`)}});if(gr.errors.length>0)a(`Upload completed with errors: ${gr.errors.join(", ")}`);else{let tn=gr.skipped>0?`Uploaded ${gr.uploaded} files (${gr.skipped} unchanged)`:`Uploaded ${gr.uploaded} files`;n(tn)}if(Qn&&gr.uploaded>0){m("Invalidating CloudFront cache...");let{invalidationId:tn}=await ho(Qn);n(`Cache invalidation created: ${tn}`)}}if(G.infrastructure?.compute)await bc(G,A,we,t?.site);if(G.infrastructure?.compute&&G.sites){let vt=Object.values(G.sites).map((Lt)=>Lt.domain).filter((Lt)=>!!Lt);if(vt.length>0)m("Syncing CloudFront dynamic HTTP methods for app domains..."),await Bs(vt)}}catch(j){if(r(`Deployment failed: ${j.message}`),process.exitCode=1,j.stack)e(`
+Stack Outputs:`);for(let[vt,Lt]of Object.entries(Vt))e(`  - ${vt}: ${Lt}`)}if(G.infrastructure?.storage)for(let[vt,Lt]of Object.entries(G.infrastructure.storage)){if(!Lt.website||!Lt.root)continue;let nr=Vt[`${vt}BucketName`]||Vt.FrontendBucketName,Qn=Vt[`${vt}CloudFrontDistributionId`];if(!nr){a(`Could not find bucket name for storage '${vt}' — skipping file upload`);continue}if(!fr(Lt.root)){a(`Source directory not found: ${Lt.root} — skipping file upload for '${vt}'`);continue}m(`Uploading files from ${Lt.root} to s3://${nr}...`);let{uploadStaticFiles:di,invalidateCache:ho}=await import("./chunk-3der0n40.js"),gr=await di({sourceDir:Lt.root,bucket:nr,region:we,onProgress:(tn,rn,Jr)=>{if(tn%10===0||tn===rn)e(`  ${tn}/${rn}: ${Jr}`)}});if(gr.errors.length>0)a(`Upload completed with errors: ${gr.errors.join(", ")}`);else{let tn=gr.skipped>0?`Uploaded ${gr.uploaded} files (${gr.skipped} unchanged)`:`Uploaded ${gr.uploaded} files`;n(tn)}if(Qn&&gr.uploaded>0){m("Invalidating CloudFront cache...");let{invalidationId:tn}=await ho(Qn);n(`Cache invalidation created: ${tn}`)}}if(G.infrastructure?.compute)await bc(G,A,we,t?.site);if(G.infrastructure?.compute&&G.sites){let vt=Object.values(G.sites).map((Lt)=>Lt.domain).filter((Lt)=>!!Lt);if(vt.length>0)m("Syncing CloudFront dynamic HTTP methods for app domains..."),await Bs(vt)}}catch(j){if(r(`Deployment failed: ${j.message}`),process.exitCode=1,j.stack)e(`
 Stack trace:`),console.error(j.stack)}finally{if(L)await L()}}),N.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async(t)=>{i("Deploying Server Infrastructure");try{let p=await _e(),A=t?.env||"production",L=p.project.region||"us-east-1",j=wr(p);if(j){r(j),process.exitCode=1;return}if(!io(p)){r("No `infrastructure.compute` configured — nothing to deploy as a server."),e("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(e(`Region: ${L}`),e(`Environment: ${A}`),!await bc(p,A,L,t?.site)){process.exitCode=1;return}if(p.sites){let Z=Object.values(p.sites).map((ee)=>ee.domain).filter((ee)=>!!ee);if(Z.length>0)m("Syncing CloudFront dynamic HTTP methods for app domains..."),await Bs(Z)}n(`
 Server deployment complete!`)}catch(p){r(`Deployment failed: ${p.message}`),process.exitCode=1}}),N.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let p=await _e(),A=t?.env||"production",L=wr(p);if(L){r(L),process.exitCode=1;return}let{deployServerlessApp:j,redeployServerlessApp:G}=await import("./chunk-a6re7g7w.js");if(t?.redeploy){await G(p,A);return}await j(p,A,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(p){r(`Deployment failed: ${p.message}`),process.exitCode=1}}),N.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let p=await _e(),A=t?.env||"production",{rollbackServerlessApp:L}=await import("./chunk-a6re7g7w.js");await L(p,A)}catch(p){r(`Rollback failed: ${p.message}`),process.exitCode=1}}),N.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").action(async(t,p)=>{i("Rolling Back Release");try{let A=await _e(),L=p?.env||"production",j=t||Object.keys(A.sites||{})[0];if(!j){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:G}=await import("./chunk-3z4ejwvw.js"),Z=await G({driver:x({config:A}),slug:A.project.slug,environment:L,logger:g},{siteName:j,to:p?.to});if(!Z.success){r(`Rollback failed: ${Z.error||"unknown error"}`),process.exitCode=1;return}for(let ee of Z.perInstance||[])e(`  ${ee.instanceId}: ${ee.output?.trim()||ee.status}`)}catch(A){r(`Rollback failed: ${A.message}`),process.exitCode=1}}),N.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,p)=>{i("Deployment History");try{let A=await _e(),L=p?.env||"production",j=t||Object.keys(A.sites||{})[0];if(!j){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:G}=await import("./chunk-3z4ejwvw.js"),Z=await G({driver:x({config:A}),slug:A.project.slug,environment:L,logger:g},{siteName:j,limit:Number.parseInt(p?.limit||"20",10)||20});if(!Z.success){r(`Could not read history: ${Z.error||"unknown error"}`),process.exitCode=1;return}for(let ee of Z.perInstance||[])e(`
 ${ee.instanceId}:`),e(ee.output?.trimEnd()||"(no output)")}catch(A){r(`History lookup failed: ${A.message}`),process.exitCode=1}}),N.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(t,p,A)=>{i(`Running Recipe: ${t}`);try{if(!fr(p)){r(`Recipe script not found: ${p}`),process.exitCode=1;return}let L=await _e(),j=A?.env||"production",G=Sc(p,"utf8").split(`
@@ -629,7 +629,7 @@ Full Event Record:`);let re=JSON.parse(ee.CloudTrailEvent);console.log(JSON.stri
 Create this trail?`,!0)){e("Operation cancelled");return}let j=new o("Creating trail...");j.start();let G=await A.createTrail({Name:t,S3BucketName:p.bucket,S3KeyPrefix:p.prefix,IsMultiRegionTrail:p.multiRegion,EnableLogFileValidation:p.validation,IncludeGlobalServiceEvents:p.globalEvents??!0});j.text="Starting logging...",await A.startLogging(t),j.succeed("Trail created and logging started"),n(`
 Trail ARN: ${G.TrailARN}`),e(`S3 Bucket: ${G.S3BucketName}`)}catch(A){r(`Failed to create trail: ${A.message}`),process.exit(1)}}),N.command("audit:start <trailName>","Start CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,p)=>{i("Start CloudTrail Logging");try{let A=await to(p.region),L=new o("Starting logging...");L.start(),await A.startLogging(t),L.succeed("Logging started")}catch(A){r(`Failed to start logging: ${A.message}`),process.exit(1)}}),N.command("audit:stop <trailName>","Stop CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,p)=>{i("Stop CloudTrail Logging");try{let A=await to(p.region);if(a(`This will stop logging for trail: ${t}`),!await d(`
 Stop logging?`,!1)){e("Operation cancelled");return}let j=new o("Stopping logging...");j.start(),await A.stopLogging(t),j.succeed("Logging stopped")}catch(A){r(`Failed to stop logging: ${A.message}`),process.exit(1)}}),N.command("audit:delete <trailName>","Delete a CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,p)=>{i("Delete CloudTrail Trail");try{let A=await to(p.region);if(a(`This will permanently delete trail: ${t}`),!await d(`
-Delete this trail?`,!1)){e("Operation cancelled");return}let j=new o("Deleting trail...");j.start(),await A.deleteTrail(t),j.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function qc(N){N.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let p=await _e(),A=t.region||p.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${p.project.name||"Unknown"}`),e("");let L=[],j=new o("Checking EC2 instances...");j.start();try{let{EC2Client:Se}=await import("./chunk-decxbs79.js"),We=await new Se(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Te=0,Ne=0;for(let Qe of We.Reservations||[])for(let Je of Qe.Instances||[])if(Ne++,Je.State?.Name==="running")Ae++;else if(Je.State?.Name==="stopped")Te++;j.succeed("EC2 instances checked"),L.push({name:"EC2 Instances",status:Ae>0?"OK":Ne>0?"WARN":"INFO",details:`${Ae} running, ${Te} stopped, ${Ne} total`})}catch(Se){j.fail("EC2 check failed"),L.push({name:"EC2 Instances",status:"ERROR",details:Se.message})}let G=new o("Checking RDS instances...");G.start();try{let{RDSClient:Se}=await import("./chunk-spf69ff0.js"),Ae=(await new Se(A).describeDBInstances()).DBInstances||[],Te=Ae.filter((Ne)=>Ne.DBInstanceStatus==="available").length;G.succeed("RDS instances checked"),L.push({name:"RDS Databases",status:Ae.length>0&&Te===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Te} available, ${Ae.length} total`})}catch(Se){G.fail("RDS check failed"),L.push({name:"RDS Databases",status:"ERROR",details:Se.message})}let Z=new o("Checking Lambda functions...");Z.start();try{let{LambdaClient:Se}=await import("./chunk-7yrga9sc.js"),Ae=(await new Se(A).listFunctions()).Functions||[];Z.succeed("Lambda functions checked"),L.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(Se){Z.fail("Lambda check failed"),L.push({name:"Lambda Functions",status:"ERROR",details:Se.message})}let ee=new o("Checking S3 buckets...");ee.start();try{let{S3Client:Se}=await import("./chunk-8vqmhtds.js"),Ae=(await new Se(A).listBuckets()).Buckets||[];ee.succeed("S3 buckets checked"),L.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(Se){ee.fail("S3 check failed"),L.push({name:"S3 Buckets",status:"ERROR",details:Se.message})}let re=new o("Checking CloudFront distributions...");re.start();try{let{CloudFrontClient:Se}=await import("./chunk-hkgyfaen.js"),We=await new Se().listDistributions(),Ae=We.filter((Te)=>Te.Status==="Deployed").length;re.succeed("CloudFront checked"),L.push({name:"CloudFront",status:We.length>0&&Ae===We.length?"OK":We.length>0?"WARN":"INFO",details:`${Ae} deployed, ${We.length} total`})}catch(Se){re.fail("CloudFront check failed"),L.push({name:"CloudFront",status:"ERROR",details:Se.message})}let oe=new o("Checking SQS queues...");oe.start();try{let{SQSClient:Se}=await import("./chunk-7ghk8tpp.js"),Ae=(await new Se(A).listQueues()).QueueUrls||[];oe.succeed("SQS queues checked"),L.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(Se){oe.fail("SQS check failed"),L.push({name:"SQS Queues",status:"ERROR",details:Se.message})}let be=new o("Checking CloudFormation stacks...");be.start();try{let{CloudFormationClient:Se}=await import("./chunk-e4cqjxd1.js"),Ae=(await new Se(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Te=Ae.filter((Je)=>Je.StackStatus==="CREATE_COMPLETE"||Je.StackStatus==="UPDATE_COMPLETE").length,Ne=Ae.filter((Je)=>Je.StackStatus?.includes("IN_PROGRESS")).length,Qe=Ae.filter((Je)=>Je.StackStatus?.includes("ROLLBACK")).length;be.succeed("CloudFormation checked"),L.push({name:"CloudFormation",status:Qe>0?"WARN":Ne>0?"INFO":"OK",details:`${Te} healthy, ${Ne} in progress, ${Qe} rolled back`})}catch(Se){be.fail("CloudFormation check failed"),L.push({name:"CloudFormation",status:"ERROR",details:Se.message})}let we=new o("Checking SSL certificates...");we.start();try{let{ACMClient:Se}=await import("./chunk-hzgws932.js"),Ee=new Se("us-east-1"),Ae=(await Ee.listCertificates()).CertificateSummaryList||[],Te=await Promise.all(Ae.map((Ye)=>Ee.describeCertificate({CertificateArn:Ye.CertificateArn}))),Ne=Te.filter((Ye)=>Ye.Status==="ISSUED").length,Qe=Te.filter((Ye)=>Ye.Status==="PENDING_VALIDATION").length,Je=Te.filter((Ye)=>{if(Ye.NotAfter)return(new Date(Ye.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;we.succeed("SSL certificates checked"),L.push({name:"SSL Certificates",status:Je>0?"WARN":Qe>0?"INFO":"OK",details:`${Ne} issued, ${Qe} pending${Je>0?`, ${Je} expiring soon`:""}`})}catch(Se){we.fail("ACM check failed"),L.push({name:"SSL Certificates",status:"ERROR",details:Se.message})}e(`
+Delete this trail?`,!1)){e("Operation cancelled");return}let j=new o("Deleting trail...");j.start(),await A.deleteTrail(t),j.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function qc(N){N.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let p=await _e(),A=t.region||p.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${p.project.name||"Unknown"}`),e("");let L=[],j=new o("Checking EC2 instances...");j.start();try{let{EC2Client:Se}=await import("./chunk-decxbs79.js"),We=await new Se(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Te=0,Ne=0;for(let Qe of We.Reservations||[])for(let Je of Qe.Instances||[])if(Ne++,Je.State?.Name==="running")Ae++;else if(Je.State?.Name==="stopped")Te++;j.succeed("EC2 instances checked"),L.push({name:"EC2 Instances",status:Ae>0?"OK":Ne>0?"WARN":"INFO",details:`${Ae} running, ${Te} stopped, ${Ne} total`})}catch(Se){j.fail("EC2 check failed"),L.push({name:"EC2 Instances",status:"ERROR",details:Se.message})}let G=new o("Checking RDS instances...");G.start();try{let{RDSClient:Se}=await import("./chunk-spf69ff0.js"),Ae=(await new Se(A).describeDBInstances()).DBInstances||[],Te=Ae.filter((Ne)=>Ne.DBInstanceStatus==="available").length;G.succeed("RDS instances checked"),L.push({name:"RDS Databases",status:Ae.length>0&&Te===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Te} available, ${Ae.length} total`})}catch(Se){G.fail("RDS check failed"),L.push({name:"RDS Databases",status:"ERROR",details:Se.message})}let Z=new o("Checking Lambda functions...");Z.start();try{let{LambdaClient:Se}=await import("./chunk-7yrga9sc.js"),Ae=(await new Se(A).listFunctions()).Functions||[];Z.succeed("Lambda functions checked"),L.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(Se){Z.fail("Lambda check failed"),L.push({name:"Lambda Functions",status:"ERROR",details:Se.message})}let ee=new o("Checking S3 buckets...");ee.start();try{let{S3Client:Se}=await import("./chunk-8vqmhtds.js"),Ae=(await new Se(A).listBuckets()).Buckets||[];ee.succeed("S3 buckets checked"),L.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(Se){ee.fail("S3 check failed"),L.push({name:"S3 Buckets",status:"ERROR",details:Se.message})}let re=new o("Checking CloudFront distributions...");re.start();try{let{CloudFrontClient:Se}=await import("./chunk-hkgyfaen.js"),We=await new Se().listDistributions(),Ae=We.filter((Te)=>Te.Status==="Deployed").length;re.succeed("CloudFront checked"),L.push({name:"CloudFront",status:We.length>0&&Ae===We.length?"OK":We.length>0?"WARN":"INFO",details:`${Ae} deployed, ${We.length} total`})}catch(Se){re.fail("CloudFront check failed"),L.push({name:"CloudFront",status:"ERROR",details:Se.message})}let oe=new o("Checking SQS queues...");oe.start();try{let{SQSClient:Se}=await import("./chunk-7ghk8tpp.js"),Ae=(await new Se(A).listQueues()).QueueUrls||[];oe.succeed("SQS queues checked"),L.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(Se){oe.fail("SQS check failed"),L.push({name:"SQS Queues",status:"ERROR",details:Se.message})}let be=new o("Checking CloudFormation stacks...");be.start();try{let{CloudFormationClient:Se}=await import("./chunk-e4cqjxd1.js"),Ae=(await new Se(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Te=Ae.filter((Je)=>Je.StackStatus==="CREATE_COMPLETE"||Je.StackStatus==="UPDATE_COMPLETE").length,Ne=Ae.filter((Je)=>Je.StackStatus?.includes("IN_PROGRESS")).length,Qe=Ae.filter((Je)=>Je.StackStatus?.includes("ROLLBACK")).length;be.succeed("CloudFormation checked"),L.push({name:"CloudFormation",status:Qe>0?"WARN":Ne>0?"INFO":"OK",details:`${Te} healthy, ${Ne} in progress, ${Qe} rolled back`})}catch(Se){be.fail("CloudFormation check failed"),L.push({name:"CloudFormation",status:"ERROR",details:Se.message})}let we=new o("Checking SSL certificates...");we.start();try{let{ACMClient:Se}=await import("./chunk-679ys4zt.js"),Ee=new Se("us-east-1"),Ae=(await Ee.listCertificates()).CertificateSummaryList||[],Te=await Promise.all(Ae.map((Ye)=>Ee.describeCertificate({CertificateArn:Ye.CertificateArn}))),Ne=Te.filter((Ye)=>Ye.Status==="ISSUED").length,Qe=Te.filter((Ye)=>Ye.Status==="PENDING_VALIDATION").length,Je=Te.filter((Ye)=>{if(Ye.NotAfter)return(new Date(Ye.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;we.succeed("SSL certificates checked"),L.push({name:"SSL Certificates",status:Je>0?"WARN":Qe>0?"INFO":"OK",details:`${Ne} issued, ${Qe} pending${Je>0?`, ${Je} expiring soon`:""}`})}catch(Se){we.fail("ACM check failed"),L.push({name:"SSL Certificates",status:"ERROR",details:Se.message})}e(`
 `+"=".repeat(60)),e("HEALTH SUMMARY"),e("=".repeat(60)+`
 `);for(let Se of L){let Ee="";if(Se.status==="OK")Ee=`${T.green}[OK]${T.reset}`;else if(Se.status==="WARN")Ee=`${T.yellow}[WARN]${T.reset}`;else if(Se.status==="ERROR")Ee=`${T.red}[ERROR]${T.reset}`;else Ee=`${T.blue}[INFO]${T.reset}`;console.log(`${Ee} ${Se.name.padEnd(20)} ${Se.details}`)}let Ce=L.some((Se)=>Se.status==="ERROR"),De=L.some((Se)=>Se.status==="WARN");if(e(""),Ce)r("Some services have errors. Check the details above.");else if(De)a("Some services need attention. Check the warnings above.");else n("All services are healthy!")}catch(p){r(`Failed to get status: ${p.message}`),process.exit(1)}}),N.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(t)=>{i("Cost Summary");try{e("Fetching cost data from AWS Cost Explorer..."),e("");let p=new Date,A=new Date(p.getFullYear(),p.getMonth(),1),L=new Date(p.getFullYear(),p.getMonth()+1,0);e(`Period: ${A.toISOString().split("T")[0]} to ${L.toISOString().split("T")[0]}`),e(""),e("Note: Cost data requires AWS Cost Explorer API access."),e("Run `cloud cost` for detailed cost analysis.")}catch(p){r(`Failed to get cost summary: ${p.message}`),process.exit(1)}}),N.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");try{let p=await _e(),A=t.region||p.project.region||"us-east-1",{AWSClient:L}=await import("./chunk-1ar2yycj.js");class j{client;region;constructor(Ce){this.region=Ce,this.client=new L}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let G=new j(A),Z=new o("Fetching alarms...");Z.start();let re=(await G.describeAlarms()).MetricAlarms||[];if(Z.succeed(`Found ${re.length} alarm(s)`),re.length===0){e("No CloudWatch alarms configured");return}let oe=re.filter((Ce)=>Ce.StateValue==="ALARM"),be=re.filter((Ce)=>Ce.StateValue==="OK"),we=re.filter((Ce)=>Ce.StateValue==="INSUFFICIENT_DATA");if(e(""),e(`Alarming: ${oe.length}`),e(`OK: ${be.length}`),e(`Insufficient Data: ${we.length}`),oe.length>0){e(`
 Alarms in ALARM state:`);for(let Ce of oe)r(`  - ${Ce.AlarmName}: ${Ce.AlarmDescription||"No description"}`)}}catch(p){r(`Failed to get alarms: ${p.message}`),process.exit(1)}})}async function ci(N){let{AWSClient:t}=await import("./chunk-1ar2yycj.js");class p{client;region;constructor(A){this.region=A,this.client=new t}async jsonRpcRequest(A,L){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${A}`},body:JSON.stringify(L)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(A,L){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:A,...L})}async describeBackupVault(A){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:A})}async getBackupPlan(A){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:A})}async createBackupVault(A,L){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:A,...L})}async deleteBackupVault(A){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:A})}async createBackupPlan(A){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:A})}async deleteBackupPlan(A){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:A})}async startBackupJob(A){return this.jsonRpcRequest("StartBackupJob",A)}async startRestoreJob(A){return this.jsonRpcRequest("StartRestoreJob",A)}async describeBackupJob(A){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:A})}async describeRestoreJob(A){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:A})}async listBackupJobs(A){return this.jsonRpcRequest("ListBackupJobs",A||{})}async listRestoreJobs(A){return this.jsonRpcRequest("ListRestoreJobs",A||{})}async createBackupSelection(A,L){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:A,BackupSelection:L})}async listBackupSelections(A){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:A})}}return new p(N)}function Hc(N){N.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(t)=>{i("Backup Vaults");try{let p=await _e(),A=t.region||p.project.region||"us-east-1",L=await ci(A),j=new o("Fetching vaults...");j.start();let Z=(await L.listBackupVaults()).BackupVaultList||[];if(j.succeed(`Found ${Z.length} vault(s)`),Z.length===0){e("No backup vaults found"),e("Use `cloud backup:create-vault` to create a new vault");return}c(["Vault Name","Recovery Points","Created","Encrypted"],Z.map((ee)=>[ee.BackupVaultName||"N/A",(ee.NumberOfRecoveryPoints||0).toString(),ee.CreationDate?new Date(ee.CreationDate).toLocaleDateString():"N/A",ee.EncryptionKeyArn?"Yes":"Default"]))}catch(p){r(`Failed to list vaults: ${p.message}`),process.exit(1)}}),N.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(t)=>{i("Backup Plans");try{let p=await _e(),A=t.region||p.project.region||"us-east-1",L=await ci(A),j=new o("Fetching backup plans...");j.start();let Z=(await L.listBackupPlans()).BackupPlansList||[];if(j.succeed(`Found ${Z.length} backup plan(s)`),Z.length===0){e("No backup plans found"),e("Use `cloud backup:create` to create a backup plan");return}c(["Plan Name","Plan ID","Version","Created"],Z.map((ee)=>[ee.BackupPlanName||"N/A",ee.BackupPlanId||"N/A",ee.VersionId?.substring(0,8)||"N/A",ee.CreationDate?new Date(ee.CreationDate).toLocaleDateString():"N/A"]))}catch(p){r(`Failed to list backup plans: ${p.message}`),process.exit(1)}}),N.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(t,p)=>{i(`Recovery Points: ${t}`);try{let A=await _e(),L=p.region||A.project.region||"us-east-1",j=await ci(L),G=new o("Fetching recovery points...");G.start();let ee=(await j.listRecoveryPointsByBackupVault(t,{MaxResults:Number.parseInt(p.limit)})).RecoveryPoints||[];if(G.succeed(`Found ${ee.length} recovery point(s)`),ee.length===0){e("No recovery points found");return}c(["Resource","Status","Created","Size","Lifecycle"],ee.map((re)=>[re.ResourceArn?.split(":").pop()||"N/A",re.Status||"N/A",re.CreationDate?new Date(re.CreationDate).toLocaleString():"N/A",re.BackupSizeInBytes?Td(re.BackupSizeInBytes):"N/A",re.Lifecycle?.DeleteAfterDays?`${re.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(A){r(`Failed to list recovery points: ${A.message}`),process.exit(1)}}),N.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(t,p)=>{i("Create Backup Vault");try{let A=await ci(p.region);if(e(`Vault Name: ${t}`),e(`Region: ${p.region}`),e(`Encryption: ${p.kmsKey?"Custom KMS":"AWS Managed"}`),!await d(`

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-gxwsq3k0.js";import"./chunk-rm6fm3r9.js";import"./chunk-4r3thj0q.js";import{er}from"./chunk-917m9nzt.js";import"./chunk-bhw14ry9.js";import"./chunk-jxcgrzh4.js";import"./chunk-mpz3spf2.js";import"./chunk-8qhjwthr.js";import"./chunk-p875a551.js";import"./chunk-46gwe1s8.js";import"./chunk-hckq0sty.js";import"./chunk-anpefq1s.js";import"./chunk-xkc1w47e.js";import"./chunk-92nf1z52.js";import"./chunk-1s44qfb8.js";import"./chunk-6ecg74kd.js";import"./chunk-5s9qckt2.js";import"./chunk-6zbq64ed.js";import"./chunk-hyz0w30r.js";import"./chunk-f15wfrvq.js";import"./chunk-23a7gckt.js";import"./chunk-ass0atp3.js";import"./chunk-jc63ybbb.js";import"./chunk-3x4mrxpv.js";import"./chunk-cvykzja8.js";import"./chunk-r4teb3g4.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await er({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-gxwsq3k0.js";import"./chunk-rm6fm3r9.js";import"./chunk-4r3thj0q.js";import{er}from"./chunk-917m9nzt.js";import"./chunk-bhw14ry9.js";import"./chunk-jxcgrzh4.js";import"./chunk-mpz3spf2.js";import"./chunk-8qhjwthr.js";import"./chunk-p875a551.js";import"./chunk-46gwe1s8.js";import"./chunk-hckq0sty.js";import"./chunk-anpefq1s.js";import"./chunk-xkc1w47e.js";import"./chunk-rrts8hnz.js";import"./chunk-1s44qfb8.js";import"./chunk-6ecg74kd.js";import"./chunk-5s9qckt2.js";import"./chunk-6zbq64ed.js";import"./chunk-hyz0w30r.js";import"./chunk-f15wfrvq.js";import"./chunk-23a7gckt.js";import"./chunk-ass0atp3.js";import"./chunk-jc63ybbb.js";import"./chunk-3x4mrxpv.js";import"./chunk-cvykzja8.js";import"./chunk-r4teb3g4.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await er({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();

package/dist/cdn/cloudflare-rules.d.ts

@@ -50,7 +50,7 @@ export interface CloudflareCacheRuleSettings {
     assetEdgeTtl?: number;
     /** Browser TTL for those assets, in seconds. @default 31536000 (1 year) */
     assetBrowserTtl?: number;
-    /** Edge TTL for HTML documents, in seconds. @default 3600 (1 hour) */
+    /** Edge TTL for HTML documents, in seconds. `0` bypasses the edge for them entirely. @default 3600 (1 hour) */
     documentEdgeTtl?: number;
     /**
      * Browser TTL for HTML documents, in seconds. @default 0