@stacksjs/ts-cloud 0.16.19 → 0.16.20

package/dist/aws/index.js

@@ -1 +1 @@
-import{me,er,ss,os,Au,La,$a,as,cs,Ma,Ye,V,Ze,ne,C,he,gn,Fa,Be,Ua,mn,hn,fn,yh,Ih,vy,Ty,wy,Ry,Et,Dy,Py,Ny,ky,bt,Sh,Ch,Eh,vt,bh,vh,Th,An,By,_y,Oy,tr,xy,Ly,$y,Qa,Ha,yu,My,Fy,Uy,rr,wh,Rh,nr,et,yn,Ga,Iu,Qy,Su,Hy,Tt,Gy,qy,Vy,jy,ie,zy,Ky,Wy,Jy,ir,Xy,Yy,Zy,In,qa,Va,Cu,Eu,ja,sr}from"../chunk-2m262b2n.js";import{fe,tt,Sn,Dh}from"../chunk-r1wpwfff.js";import{A}from"../chunk-31tvc877.js";import{_e}from"../chunk-5far81q7.js";import{j}from"../chunk-k53agv2m.js";import{rt,se,Oe,Ae,wt,En,ls,us,or,ar,bn,cr,ps,gs,ms,hs,z,fs,As,ys,Is,oe,Ss,Cs,Es,T,Wa,vn,Ja,ae,dr}from"../chunk-e8e1h2h9.js";import{y}from"../chunk-9wmer0zx.js";import{Er,be}from"../chunk-qcaqc5b8.js";import{h}from"../chunk-ptq9v346.js";import{o}from"../chunk-9asn5fpt.js";import{br,n,l,Wh}from"../chunk-zx8ecz8b.js";export{ae as ACMClient,dr as ACMDnsValidator,n as AWSClient,Ga as ApplicationAutoScalingClient,er as AwsBackupClient,Ih as BedrockAgentClient,yh as BedrockAgentRuntimeClient,fn as BedrockClient,hn as BedrockRuntimeClient,h as CloudFormationClient,A as CloudFrontClient,he as CloudWatchLogsClient,Ae as CloudflareProvider,Et as ComprehendClient,gn as ConnectClient,cs as CostExplorerClient,vn as DnsProviderFactory,Be as DynamoDBClient,Er as EC2Client,_e as ECRClient,Ye as ECSClient,sr as EFSClient,Fa as ELBv2Client,et as ElastiCacheClient,Sn as EmailClient,nr as EventBridgeClient,Oe as GoDaddyProvider,fe as IAMClient,Iu as ImapServer,rr as KendraClient,C as LambdaClient,Ua as OpenSearchClient,rt as PROXIABLE_RECORD_TYPES,Qa as PersonalizeClient,yu as PersonalizeEventsClient,Ha as PersonalizeRuntimeClient,An as PollyClient,se as PorkbunProvider,j as RDSClient,bt as RekognitionClient,y as Route53Client,Ma as Route53DomainsClient,z as Route53Provider,o as S3Client,tt as SESClient,Ze as SNSClient,ne as SQSClient,be as SSMClient,me as STSClient,yn as SchedulerClient,V as SecretsManagerClient,Tt as SmsClient,ja as SmsVoiceClient,Su as SmtpServer,In as SupportClient,qa as SupportTemplates,vt as TextractClient,mn as TranscribeClient,tr as TranslateClient,oe as UnifiedDnsValidator,ir as VoiceClient,Dy as analyzeSentiment,ms as applyDeclaredZoneSettings,ys as applyZoneMigration,l as buildQueryParams,wy as completeWithClaude,ky as containsPii,Ch as countFacesInS3Image,jy as createDeliveryReceiptHandler,T as createDnsProvider,Cs as createGoDaddyValidator,as as createObjectStorageClient,Ss as createPorkbunValidator,Yy as createRecordingHandler,Es as createRoute53Validator,Oy as createSSML,qy as createScheduledSmsHandler,Vy as createSmsClient,Gy as createSmsInboxHandler,Eu as createSmsInfrastructure,Zy as createVoiceClient,Xy as createVoicemailHandler,cr as delegateZone,ps as delegateZoneFromConfig,gs as describeDelegation,hs as describeZoneSettings,Wh as detectCredentialSource,Wa as detectDnsProvider,Sh as detectLabelsFromS3,Ny as detectLanguage,Ja as dnsProviders,Dh as email,fs as exportRoute53Zone,Py as extractEntities,vh as extractFormsFromS3,Th as extractTablesFromS3,bh as extractTextFromS3,zy as formatPhoneNumber,Ry as generateEmbeddings,Wy as getCountryCode,My as getRecommendations,Fy as getSimilarItems,Cu as getSmsInfrastructureStatus,Eh as isContentSafe,or as isNameserverRegistrar,Jy as isSamePhoneNumber,Ky as isValidPhoneNumber,ar as isZoneHost,os as keyMatchesFilters,Ty as listClaudeModels,$y as listLanguages,_y as listVoices,Au as migrateObjectStorage,ie as normalizePhoneNumber,As as planZoneMigration,wt as policyTag,La as providerEndpoint,En as qualifyName,us as reconcileDeclaredRecords,ss as remapKey,vy as requestModelAccess,ls as resolveDeclaredRecords,$a as resolveObjectStorage,br as resolveS3Endpoint,Rh as retrieveForRag,bn as sameNameservers,wh as search,Va as setupSmsInfrastructure,Qy as startImapServer,Hy as startSmtpServer,By as textToSpeech,Uy as trackEvent,xy as translate,Ly as translateToMultiple,Is as verifyZoneParity};
+import{me,er,ss,os,Au,La,$a,as,cs,Ma,Ye,V,Ze,ne,C,he,gn,Fa,Be,Ua,mn,hn,fn,yh,Ih,vy,Ty,wy,Ry,Et,Dy,Py,Ny,ky,bt,Sh,Ch,Eh,vt,bh,vh,Th,An,By,_y,Oy,tr,xy,Ly,$y,Qa,Ha,yu,My,Fy,Uy,rr,wh,Rh,nr,et,yn,Ga,Iu,Qy,Su,Hy,Tt,Gy,qy,Vy,jy,ie,zy,Ky,Wy,Jy,ir,Xy,Yy,Zy,In,qa,Va,Cu,Eu,ja,sr}from"../chunk-wgf1ndgq.js";import{fe,tt,Sn,Dh}from"../chunk-d46p0h6t.js";import{A}from"../chunk-31tvc877.js";import{_e}from"../chunk-5far81q7.js";import{j}from"../chunk-k53agv2m.js";import{rt,se,Oe,Ae,wt,En,ls,us,or,ar,bn,cr,ps,gs,ms,hs,z,fs,As,ys,Is,oe,Ss,Cs,Es,T,Wa,vn,Ja,ae,dr}from"../chunk-e8e1h2h9.js";import{y}from"../chunk-9wmer0zx.js";import{Er,be}from"../chunk-qcaqc5b8.js";import{h}from"../chunk-ptq9v346.js";import{o}from"../chunk-9asn5fpt.js";import{br,n,l,Wh}from"../chunk-zx8ecz8b.js";export{ae as ACMClient,dr as ACMDnsValidator,n as AWSClient,Ga as ApplicationAutoScalingClient,er as AwsBackupClient,Ih as BedrockAgentClient,yh as BedrockAgentRuntimeClient,fn as BedrockClient,hn as BedrockRuntimeClient,h as CloudFormationClient,A as CloudFrontClient,he as CloudWatchLogsClient,Ae as CloudflareProvider,Et as ComprehendClient,gn as ConnectClient,cs as CostExplorerClient,vn as DnsProviderFactory,Be as DynamoDBClient,Er as EC2Client,_e as ECRClient,Ye as ECSClient,sr as EFSClient,Fa as ELBv2Client,et as ElastiCacheClient,Sn as EmailClient,nr as EventBridgeClient,Oe as GoDaddyProvider,fe as IAMClient,Iu as ImapServer,rr as KendraClient,C as LambdaClient,Ua as OpenSearchClient,rt as PROXIABLE_RECORD_TYPES,Qa as PersonalizeClient,yu as PersonalizeEventsClient,Ha as PersonalizeRuntimeClient,An as PollyClient,se as PorkbunProvider,j as RDSClient,bt as RekognitionClient,y as Route53Client,Ma as Route53DomainsClient,z as Route53Provider,o as S3Client,tt as SESClient,Ze as SNSClient,ne as SQSClient,be as SSMClient,me as STSClient,yn as SchedulerClient,V as SecretsManagerClient,Tt as SmsClient,ja as SmsVoiceClient,Su as SmtpServer,In as SupportClient,qa as SupportTemplates,vt as TextractClient,mn as TranscribeClient,tr as TranslateClient,oe as UnifiedDnsValidator,ir as VoiceClient,Dy as analyzeSentiment,ms as applyDeclaredZoneSettings,ys as applyZoneMigration,l as buildQueryParams,wy as completeWithClaude,ky as containsPii,Ch as countFacesInS3Image,jy as createDeliveryReceiptHandler,T as createDnsProvider,Cs as createGoDaddyValidator,as as createObjectStorageClient,Ss as createPorkbunValidator,Yy as createRecordingHandler,Es as createRoute53Validator,Oy as createSSML,qy as createScheduledSmsHandler,Vy as createSmsClient,Gy as createSmsInboxHandler,Eu as createSmsInfrastructure,Zy as createVoiceClient,Xy as createVoicemailHandler,cr as delegateZone,ps as delegateZoneFromConfig,gs as describeDelegation,hs as describeZoneSettings,Wh as detectCredentialSource,Wa as detectDnsProvider,Sh as detectLabelsFromS3,Ny as detectLanguage,Ja as dnsProviders,Dh as email,fs as exportRoute53Zone,Py as extractEntities,vh as extractFormsFromS3,Th as extractTablesFromS3,bh as extractTextFromS3,zy as formatPhoneNumber,Ry as generateEmbeddings,Wy as getCountryCode,My as getRecommendations,Fy as getSimilarItems,Cu as getSmsInfrastructureStatus,Eh as isContentSafe,or as isNameserverRegistrar,Jy as isSamePhoneNumber,Ky as isValidPhoneNumber,ar as isZoneHost,os as keyMatchesFilters,Ty as listClaudeModels,$y as listLanguages,_y as listVoices,Au as migrateObjectStorage,ie as normalizePhoneNumber,As as planZoneMigration,wt as policyTag,La as providerEndpoint,En as qualifyName,us as reconcileDeclaredRecords,ss as remapKey,vy as requestModelAccess,ls as resolveDeclaredRecords,$a as resolveObjectStorage,br as resolveS3Endpoint,Rh as retrieveForRag,bn as sameNameservers,wh as search,Va as setupSmsInfrastructure,Qy as startImapServer,Hy as startSmtpServer,By as textToSpeech,Uy as trackEvent,xy as translate,Ly as translateToMultiple,Is as verifyZoneParity};

package/dist/bin/{chunk-ehb9mpt8.js → chunk-7zfydgfz.js}

@@ -1,4 +1,4 @@
-import{js,Ye,A,V,C,U,Pe,zt}from"./chunk-mxvekmdx.js";import{ie,tn,Z,rn,h,wr,Bs}from"./chunk-0trtkv9g.js";import{xe,b,Qo,lr,Kn,Jn,dt,Hr,xa,Dt,qr,He,$e,qe,$a,pt,dr,Oe,We,Xn,Qn,Bi,Fi,Ge,Wr,mr,mt,m,Ki,us,ps}from"./chunk-e24bscb0.js";import{u}from"./chunk-mx9ppkmn.js";import{ue}from"./chunk-k7wh1wr5.js";import{g}from"./chunk-e55fdn0r.js";import{Sr,bt,br,vr,Tr,Er,en}from"./chunk-z1dtdw3j.js";import{je,ir,xi,_,Vr,Ra,Pa,Pt,qn,Wn}from"./chunk-4sa22raw.js";import{v}from"./chunk-vjkyj3xy.js";import{re,J,Vn}from"./chunk-48x0wc2g.js";import{w}from"./chunk-dyh0vndw.js";import{F}from"./chunk-egn33pr9.js";import{R}from"./chunk-6kx50dyc.js";import{W,P,L,hr,mo,yr,Qr}from"./chunk-t10e32an.js";import{io}from"./chunk-ys5n5c84.js";import{q,bs,vs,co,Ot,j,Ts}from"./chunk-ndddd2ft.js";import{Is,Rs}from"./chunk-rbtt23vx.js";import{Xo}from"./chunk-h1rb8qvt.js";import{zr}from"./chunk-3n733cgx.js";import{createHash as DT}from"node:crypto";import{existsSync as uo,mkdtempSync as ip,readdirSync as tb,rmSync as ms,statSync as pb}from"node:fs";import{readFile as ji,writeFile as ls}from"node:fs/promises";import{tmpdir as Cd}from"node:os";import{dirname as OT,extname as za,join as Et,normalize as _T,relative as NT,resolve as $T,sep as MT}from"node:path";import{fileURLToPath as LT}from"node:url";class Od extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class Ri{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new Od(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as bS}from"node:crypto";import{lstatSync as kb,readdirSync as Rb,readFileSync as Pb}from"node:fs";import{relative as xb,resolve as Ap,sep as Db}from"node:path";function Ob(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function Uo(e,t,r){return{path:e,reason:t,weight:r}}function kp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Cs(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function At(e){let t=Ob(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Cs("dockerfile","dockerfile",0.99,[Uo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=kp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(Cs("laravel","server",0.98,[Uo("artisan","Laravel Artisan entrypoint is present.",0.45),Uo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Cs("php","server",0.82,[Uo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=kp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",l=[Uo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)l.push(Uo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(Cs(c,f.kind,Math.min(0.94,l.reduce((E,x)=>E+x.weight,0)),l,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Cs("static","static",0.78,[Uo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Cs("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Dn(e,t={}){let r=Ap(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),l=(a)=>{for(let f of Rb(a).sort()){if(c.has(f))continue;let E=Ap(a,f),x=xb(r,E).split(Db).join("/");if(!x||x.startsWith("../"))throw Error("Detection path escaped the application root");let D=kb(E);if(D.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${x}`);if(D.isDirectory())l(E);else if(D.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let H={path:x,size:D.size};if(s.has(x)&&D.size<=i)H.content=Pb(E,"utf8");o.push(H)}}};return l(r),o}function Nd(e){if(Array.isArray(e))return`[${e.map(Nd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Nd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function ca(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function Hn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function _d(e){return JSON.parse(JSON.stringify(e))}function _b(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return _d({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return _d({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return _d({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function se(e,t=[]){let r=[],n=(H)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(H),i=Object.fromEntries(Object.entries(e.environment??{}).map(([H,K])=>{if(typeof K==="string"&&n(H))return r.push(Hn(`environment.${H}`,"write_only_secret_required",`${H} must be supplied through the write-only secrets boundary.`)),[H,{secretRef:H}];return[H,K]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let H=Object.fromEntries(Object.entries(e.build.buildArgs).map(([K,X])=>{if(n(K))return r.push(Hn(`build.buildArgs.${K}`,"write_only_build_secret_required",`${K} must be declared in secretNames instead of buildArgs.`)),[K,"[REDACTED]"];return[K,X]}));o={...e.build,buildArgs:H}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(Hn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!ca((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(Hn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((H)=>!ca(H)))r.push(Hn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!ca(e.build.context)||!ca(e.build.dockerfile)))r.push(Hn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!ca(e.build.publishDirectory))r.push(Hn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(Hn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(Hn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(Hn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(Hn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(Hn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(Hn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(Hn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((H)=>typeof H==="object"?[H.secretRef]:[]),l=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=l.filter((H)=>!a.has(H)),E={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},x=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),D=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:E,configPatch:_b({...e,build:o,environment:i}),capabilityRequirements:x,costDrivers:D,serializedManifest:`${Nd(E)}
+import{js,Ye,A,V,C,U,Pe,zt}from"./chunk-mxvekmdx.js";import{ie,tn,Z,rn,h,wr,Bs}from"./chunk-0trtkv9g.js";import{xe,b,Qo,lr,Kn,Jn,dt,Hr,xa,Dt,qr,He,$e,qe,$a,pt,dr,Oe,We,Xn,Qn,Bi,Fi,Ge,Wr,mr,mt,m,Ki,us,ps}from"./chunk-e24bscb0.js";import{u}from"./chunk-mx9ppkmn.js";import{ue}from"./chunk-k7wh1wr5.js";import{g}from"./chunk-e55fdn0r.js";import{Sr,bt,br,vr,Tr,Er,en}from"./chunk-z1dtdw3j.js";import{je,ir,xi,_,Vr,Ra,Pa,Pt,qn,Wn}from"./chunk-gfr2215x.js";import{v}from"./chunk-vjkyj3xy.js";import{re,J,Vn}from"./chunk-48x0wc2g.js";import{w}from"./chunk-dyh0vndw.js";import{F}from"./chunk-egn33pr9.js";import{R}from"./chunk-6kx50dyc.js";import{W,P,L,hr,mo,yr,Qr}from"./chunk-t10e32an.js";import{io}from"./chunk-ys5n5c84.js";import{q,bs,vs,co,Ot,j,Ts}from"./chunk-ndddd2ft.js";import{Is,Rs}from"./chunk-rbtt23vx.js";import{Xo}from"./chunk-h1rb8qvt.js";import{zr}from"./chunk-3n733cgx.js";import{createHash as DT}from"node:crypto";import{existsSync as uo,mkdtempSync as ip,readdirSync as tb,rmSync as ms,statSync as pb}from"node:fs";import{readFile as ji,writeFile as ls}from"node:fs/promises";import{tmpdir as Cd}from"node:os";import{dirname as OT,extname as za,join as Et,normalize as _T,relative as NT,resolve as $T,sep as MT}from"node:path";import{fileURLToPath as LT}from"node:url";class Od extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class Ri{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new Od(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as bS}from"node:crypto";import{lstatSync as kb,readdirSync as Rb,readFileSync as Pb}from"node:fs";import{relative as xb,resolve as Ap,sep as Db}from"node:path";function Ob(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function Uo(e,t,r){return{path:e,reason:t,weight:r}}function kp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Cs(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function At(e){let t=Ob(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Cs("dockerfile","dockerfile",0.99,[Uo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=kp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(Cs("laravel","server",0.98,[Uo("artisan","Laravel Artisan entrypoint is present.",0.45),Uo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Cs("php","server",0.82,[Uo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=kp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",l=[Uo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)l.push(Uo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(Cs(c,f.kind,Math.min(0.94,l.reduce((E,x)=>E+x.weight,0)),l,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Cs("static","static",0.78,[Uo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Cs("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Dn(e,t={}){let r=Ap(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),l=(a)=>{for(let f of Rb(a).sort()){if(c.has(f))continue;let E=Ap(a,f),x=xb(r,E).split(Db).join("/");if(!x||x.startsWith("../"))throw Error("Detection path escaped the application root");let D=kb(E);if(D.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${x}`);if(D.isDirectory())l(E);else if(D.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let H={path:x,size:D.size};if(s.has(x)&&D.size<=i)H.content=Pb(E,"utf8");o.push(H)}}};return l(r),o}function Nd(e){if(Array.isArray(e))return`[${e.map(Nd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Nd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function ca(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function Hn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function _d(e){return JSON.parse(JSON.stringify(e))}function _b(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return _d({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return _d({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return _d({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function se(e,t=[]){let r=[],n=(H)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(H),i=Object.fromEntries(Object.entries(e.environment??{}).map(([H,K])=>{if(typeof K==="string"&&n(H))return r.push(Hn(`environment.${H}`,"write_only_secret_required",`${H} must be supplied through the write-only secrets boundary.`)),[H,{secretRef:H}];return[H,K]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let H=Object.fromEntries(Object.entries(e.build.buildArgs).map(([K,X])=>{if(n(K))return r.push(Hn(`build.buildArgs.${K}`,"write_only_build_secret_required",`${K} must be declared in secretNames instead of buildArgs.`)),[K,"[REDACTED]"];return[K,X]}));o={...e.build,buildArgs:H}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(Hn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!ca((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(Hn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((H)=>!ca(H)))r.push(Hn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!ca(e.build.context)||!ca(e.build.dockerfile)))r.push(Hn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!ca(e.build.publishDirectory))r.push(Hn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(Hn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(Hn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(Hn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(Hn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(Hn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(Hn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(Hn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((H)=>typeof H==="object"?[H.secretRef]:[]),l=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=l.filter((H)=>!a.has(H)),E={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},x=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),D=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:E,configPatch:_b({...e,build:o,environment:i}),capabilityRequirements:x,costDrivers:D,serializedManifest:`${Nd(E)}
 `}}function Rp(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function Pp(e,t,r={}){let n=r.maxBytes??104857600,i=r.maxEntries??1e4,o=r.maxExpandedBytes??524288000;if(e.byteLength>n)throw Error("Archive exceeds the compressed size limit");let s=new DataView(e.buffer,e.byteOffset,e.byteLength),c=[],l=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let f=0;while(f+30<=e.length){let E=s.getUint32(f,!0);if(E===33639248||E===101010256)break;if(E!==67324752)throw Error("Malformed ZIP local header");let x=s.getUint16(f+6,!0),D=s.getUint32(f+18,!0),H=s.getUint32(f+22,!0),K=s.getUint16(f+26,!0),X=s.getUint16(f+28,!0);if(x&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let ne=new TextDecoder().decode(e.subarray(f+30,f+30+K));if(!Rp(ne))throw Error(`Unsafe archive path: ${ne}`);if(c.push(ne),l+=H,c.length>i||l>o)throw Error("Archive expansion limit exceeded");f+=30+K+X+D}return{format:"zip",entries:c.length,expandedBytes:l,paths:c}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let a=0;while(a+512<=e.length){let f=e.subarray(a,a+512);if(f.every((K)=>K===0))break;let E=(K,X)=>new TextDecoder().decode(f.subarray(K,K+X)).replace(/\0.*$/,""),x=`${E(345,155)}${E(345,155)?"/":""}${E(0,100)}`,D=Number.parseInt(E(124,12).trim()||"0",8),H=String.fromCharCode(f[156]??0);if(!Rp(x))throw Error(`Unsafe archive path: ${x}`);if(H==="1"||H==="2")throw Error(`Archive links are not accepted: ${x}`);if(!Number.isFinite(D)||D<0)throw Error("Malformed TAR entry size");if(c.push(x),l+=D,c.length>i||l>o)throw Error("Archive expansion limit exceeded");a+=512+Math.ceil(D/512)*512}return{format:"tar",entries:c.length,expandedBytes:l,paths:c}}var xp=new Set(["source","build","runtime","environment","domain","review"]);function Dp(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Op(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function _p(e){for(let[r,n]of Object.entries(e.environment??{}))if(typeof n==="string"&&Op(r)&&n)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,n]of Object.entries(e.build.buildArgs??{}))if(Op(r)&&n)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function Np(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:Dp(e.input,{}),suppliedSecretNames:Dp(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class kn{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(_p(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),n=this.now(),i=e.step??"source";if(!xp.has(i))throw Error("Invalid draft step");let o=[...new Set(e.suppliedSecretNames??[])].sort(),s=se(e.draft,o).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),i,JSON.stringify(e.draft),JSON.stringify(o),s,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:i,status:s,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?Np(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Np)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!xp.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==n.projectId)throw Error("Draft project cannot be changed");_p(r.draft);let i=[...new Set(r.suppliedSecretNames??n.suppliedSecretNames)].sort(),o=se(r.draft,i).valid?"ready":"draft",s=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(i),o,s,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:o}}),this.get(e)}markApplied(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let i=se(n.input,n.suppliedSecretNames);if(!i.valid)throw Error(`Draft is not deployable: ${[...i.issues.map((s)=>s.message),...i.missingSecrets.map((s)=>`Missing secret ${s}`)].join("; ")}`);let o=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[o,e,t]),this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r,type:"application.draft.applied",payload:h({draftId:e,manifest:i.manifest})}),this.get(e)}}import{createCipheriv as Nb,createDecipheriv as $b,createHash as Lp,randomBytes as Mb}from"node:crypto";function da(e){return typeof e==="string"&&e?e:void 0}function $d(e){return Lp("sha256").update(e).digest("hex").slice(0,16)}function $p(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function Lb(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:da(e.credential_fingerprint),credentialExpiresAt:da(e.credential_expires_at),status:String(e.status),healthMessage:da(e.health_message),lastTestedAt:da(e.last_tested_at),version:Number(e.version),createdByActorId:da(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class _n{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=Lp("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Mb(12),r=Nb("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Registry credential envelope is invalid");let o=$b("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}current(e){let t=Lb(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),n=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),$p(e.host),t?this.encrypt(t):null,t?$d(t):null,e.credentialExpiresAt??null,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:$p(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let n=this.get(e);if(!n||n.status==="disconnected")throw Error("Registry connection was not found");let i=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(i),$d(i),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:$d(i),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let n=this.credential(e),i=t.fetch??fetch,o=new AbortController,s=setTimeout(()=>o.abort(),t.timeoutMs??15000),c=n?.token?`Bearer ${n.token}`:n?.username||n?.password?`Basic ${Buffer.from(`${n.username??""}:${n.password??""}`).toString("base64")}`:void 0;try{let l=await i(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:o.signal,headers:c?{Authorization:c}:void 0}),a=l.headers.get("www-authenticate")??"";if(l.status===401&&a.startsWith("Bearer ")&&n){let x=Object.fromEntries([...a.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((ne)=>[ne[1],ne[2]])),D=new URL(x.realm??"");if(D.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(x.service)D.searchParams.set("service",x.service);if(t.image)D.searchParams.set("scope",`repository:${Bp(t.image).repository}:pull`);let H=await i(D,{signal:o.signal,redirect:"error",headers:c?{Authorization:c}:void 0});if(!H.ok)throw Error(`Registry authentication failed (${H.status})`);let K=await H.json(),X=K.token??K.access_token;if(!X)throw Error("Registry did not return an access token");l=t.image?await Mp(i,r.host,t.image,X,o.signal):await i(`${r.host}/v2/`,{signal:o.signal,redirect:"error",headers:{Authorization:`Bearer ${X}`}})}else if(l.ok&&t.image)l=await Mp(i,r.host,t.image,n?.token,o.signal,c);let f=l.ok?"healthy":"degraded",E=l.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${l.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[f,E,this.now(),this.now(),e]),this.get(e)}catch(l){let a=o.signal.aborted?"Registry request timed out.":l instanceof Error?l.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[a.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(s)}}}function Bp(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let n=t.slice(r+1),i=n.lastIndexOf("@"),o=n.lastIndexOf(":"),s=i>=0?i:o>n.lastIndexOf("/")?o:-1,c=s>=0?n.slice(0,s):n,l=s>=0?n.slice(s+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(c)||!/^[A-Za-z0-9_.:+-]+$/.test(l))throw Error("Image reference is invalid");return{repository:c,reference:l}}async function Mp(e,t,r,n,i,o){let s=Bp(r);return e(`${t}/v2/${s.repository}/manifests/${encodeURIComponent(s.reference)}`,{method:"HEAD",redirect:"error",signal:i,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...n?{Authorization:`Bearer ${n}`}:o?{Authorization:o}:{}}})}import{createHash as Bb}from"node:crypto";import{chmodSync as jp,existsSync as Fp,mkdirSync as jb,renameSync as Fb,unlinkSync as Up,writeFileSync as Ub}from"node:fs";import{basename as zb,join as Vb}from"node:path";function Md(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class xn{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=A(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=zb(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let n=Pp(e.bytes,r),i=Bb("sha256").update(e.bytes).digest("hex"),o=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,i);if(o)return Md(o);let s=this.idFn();jb(this.root,{recursive:!0,mode:448}),jp(this.root,448);let c=Vb(this.root,`${s}.archive`),l=`${c}.partial`;try{Ub(l,e.bytes,{mode:384,flag:"wx"}),Fb(l,c),jp(c,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.organizationId,e.projectId,r,c,i,e.bytes.byteLength,n.format,n.entries,n.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(a){if(Fp(l))Up(l);if(Fp(c))Up(c);throw a}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:s,filename:r,sha256:i,size:e.bytes.byteLength,entries:n.entries}}),this.get(s)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?Md(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(Md)}}function Dr(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),n=r?e.controlPlane.listEnvironments(r.id).find((a)=>a.id===t.input.environmentId):void 0;if(!r||!n||n.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==n.slug)throw Error(`Type ${n.slug} to confirm this deployment target`);let i=se(t.input,t.suppliedSecretNames);if(!i.valid)throw Error(`Application plan is invalid: ${[...i.issues.map((a)=>a.message),...i.missingSecrets.map((a)=>`Missing secret ${a}`)].join("; ")}`);let o=e.controlPlane.listResources(r.id,n.id).find((a)=>a.kind==="application"&&a.slug===t.input.slug),s=JSON.parse(JSON.stringify({manifest:i.manifest,configPatch:i.configPatch})),c=o?e.controlPlane.updateResource(o.id,o.version,{name:t.input.name,desiredState:s}):e.controlPlane.createResource({projectId:r.id,environmentId:n.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:s,metadata:{source:"application-onboarding",draftId:t.id}}),l=new b(e.controlPlane).enqueue({projectId:r.id,environmentId:n.id,resourceId:c.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:s,lockKey:`resource:${c.id}`,providerKey:c.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:c.id,operationId:l.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:n.slug,strategy:t.input.build.kind,costDrivers:i.costDrivers}}),{plan:i,resource:c,operation:l}}function Zt(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,n=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",i=(o,s)=>s&&(o==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:i("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:i("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:i("blue_green",n),explanation:n?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:i("canary",n),explanation:n?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Qa(e,t){let r=Zt(e).find((n)=>n.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as qb}from"node:crypto";var Jb=/^sha256:[a-f0-9]{64}$/,Wb=/^[a-f0-9]{40,64}$/i;function Oi(e){return typeof e==="string"&&e?e:void 0}function zo(e,t){try{return JSON.parse(String(e))}catch{return t}}function zp(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:zo(e.provenance,{}),attestation:zo(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Vp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:Oi(e.source_sha),configHash:String(e.config_hash),manifest:zo(e.manifest,{}),provenance:zo(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:zo(e.health_gate,void 0),hooks:zo(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:Oi(e.previous_release_id),promotedFromReleaseId:Oi(e.promoted_from_release_id),actorId:Oi(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:Oi(e.pin_reason),activatedAt:Oi(e.activated_at),failedAt:Oi(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Hb(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:Oi(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:zo(e.health,{}),message:String(e.message),operationId:Oi(e.operation_id),createdAt:String(e.created_at)}}function Gb(e,t){let r=[],n=(i,o,s)=>{if(JSON.stringify(o)===JSON.stringify(s))return;if(o&&s&&typeof o==="object"&&typeof s==="object"&&!Array.isArray(o)&&!Array.isArray(s)){for(let c of[...new Set([...Object.keys(o),...Object.keys(s)])].sort())n(i?`${i}.${c}`:c,o[c],s[c]);return}r.push({path:i,...o!==void 0?{before:o}:{},...s!==void 0?{after:s}:{}})};return n("",e,t),r}class Ld{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Jb.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return zp(t);let r=this.id(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(h(e.provenance??{})),JSON.stringify(h(e.attestation??{})),n,n]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?zp(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),n=this.controlPlane.listEnvironments(e.projectId).find((E)=>E.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!n)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Wb.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Qa({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let i=h(e.config),o=qb("sha256").update(JSON.stringify(i)).digest("hex"),s=this.active(e.resourceId),c=this.id(),l=this.now().toISOString(),a=e.approvalRequired?"awaiting_approval":"built",f=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,o,JSON.stringify(h(e.manifest)),JSON.stringify(h(e.provenance??{})),e.strategy,a,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(f),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,s?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",l,l]),this.recordTransition(c,void 0,a,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(c)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Vp(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Vp).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(Hb)}recordTransition(e,t,r,n){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,n.trafficPercent??null,JSON.stringify(h(n.health??{})),n.message.slice(0,1000),n.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let n=this.get(e);if(!n)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[n.status].includes(t))throw Error(`Invalid release transition ${n.status} → ${t}`);let o=this.now().toISOString();if(t==="active"){let s=this.active(n.resourceId);if(s&&s.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[o,s.id]),this.recordTransition(s.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,o,t,o,o,e]),this.recordTransition(e,n.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let n=this.id(),i=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,i]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:Oi(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),n=this.get(t);if(!r||!n)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==n.artifactId,sourceChanged:r.sourceSha!==n.sourceSha,configChanged:r.configHash!==n.configHash,manifestChanges:Gb(r.manifest,n.manifest),dataCaveat:n.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${n.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let n of this.list()){let i=r.get(n.resourceId)??[];i.push(n),r.set(n.resourceId,i)}return[...r.values()].flatMap((n)=>n.slice(t)).filter((n)=>new Date(n.createdAt)<e.before&&!n.pinned&&!["active","activating","awaiting_approval"].includes(n.status)&&!this.list().some((i)=>i.previousReleaseId===n.id&&["active","activating"].includes(i.status)))}}class nt{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Ld(e),this.queue=new b(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let n=t.action??"activate",i=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${n}`,idempotencyKey:`release:${r.id}:${n}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${n} queued.`,operationId:i.id,trafficPercent:0}),i}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let n=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),i=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!i)return{release:n};let o=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:i.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:n,rollbackOperation:o}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let n=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!n||n.resourceId!==r.resourceId||!["superseded","active"].includes(n.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${n.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:n.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function Kb(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function qp(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Qa({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:Kb(t.release)})}async function Jp(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var Qb=["release.activate","release.rollback"];function Yb(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Wp(e){let t=new nt(e.store),r=async(n)=>{let i=Yb(n.operation.input),o=typeof i.releaseId==="string"?i.releaseId:"",s=t.releases.get(o);if(!s)throw Error(`Queued release ${o||"(missing)"} was not found`);if(s.projectId!==n.operation.projectId||s.environmentId!==n.operation.environmentId||s.resourceId!==n.operation.resourceId)throw Error("Queued release does not match the operation scope");let c=t.releases.getArtifact(s.artifactId);if(!c||c.digest!==t.releases.getArtifact(s.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let l=typeof i.targetReleaseId==="string"&&i.targetReleaseId?i.targetReleaseId:s.previousReleaseId,a=l?t.releases.get(l):void 0;if(a&&(a.resourceId!==s.resourceId||a.artifactId===s.artifactId&&a.id===s.id))throw Error("Rollback target does not match the release resource");let f=await e.resolveDriver(s);n.checkpoint("verify",`Verifying ${c.digest} and ${s.configHash} for ${f.name}.`),n.log(`Artifact ${c.digest}; source ${s.sourceSha??"not recorded"}; config ${s.configHash}.`,{stream:"system"}),n.throwIfCancellationRequested();let E;try{E=n.operation.kind==="release.rollback"?await Jp(f,{release:s,artifact:c,previous:a}):await qp(f,{release:s,artifact:c,previous:a})}catch(x){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:x instanceof Error?x.message:String(x)});throw x}for(let x of E.transitions)t.releases.progress(s.id,{message:`${n.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${x.trafficPercent}%.`,trafficPercent:x.trafficPercent,health:x.observed,operationId:n.operation.id}),n.log(`Traffic ${x.trafficPercent}%: ${x.healthy?"healthy":"unhealthy"}.`,{stream:x.healthy?"step":"stderr",step:"health"});if(n.checkpoint("health","Evaluating the provider health result."),!E.activated||!E.healthy){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:{resourceVersions:E.resourceVersions},message:E.error??"Provider health gate failed."});throw Error(E.error??`${f.name} reported an unhealthy release`)}if(n.operation.kind==="release.activate"&&s.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:`Named health gate ${s.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${s.healthGate.name} is unavailable`);n.checkpoint("named-health-gate",`Waiting on ${s.healthGate.name}.`);let x=await e.resolveHealthGate(s.healthGate.name,s);if(n.log(`${s.healthGate.name}: ${x.healthy?"healthy":"unhealthy"}${x.message?` — ${x.message}`:""}.`,{stream:x.healthy?"step":"stderr",step:"health"}),!x.healthy)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:x.evidence,message:x.message??`Named health gate ${s.healthGate.name} failed.`}),Error(x.message??`Named health gate ${s.healthGate.name} failed`)}if(n.operation.kind==="release.rollback"){let x=t.releases.get(s.id);if(x.status!=="rolled_back")t.releases.transition(x.id,"rolled_back",{message:`Traffic restored through ${f.name}.`,operationId:n.operation.id,trafficPercent:0,health:{resourceVersions:E.resourceVersions}});if(a&&a.status!=="active"){let D=a.status==="activating"?a:t.releases.transition(a.id,"activating",{message:"Rollback target restoring traffic.",operationId:n.operation.id,trafficPercent:0});t.releases.transition(D.id,"active",{message:"Previous immutable release restored.",operationId:n.operation.id,trafficPercent:100,health:{resourceVersions:E.resourceVersions}})}}else t.completeHealthGate(s.id,{healthy:!0,operationId:n.operation.id,health:{providerVersion:E.providerVersion??null,resourceVersions:E.resourceVersions},message:"Provider activation and health gates completed."});return n.checkpoint("finalize","Persisted the terminal release state."),{releaseId:s.id,artifactDigest:c.digest,provider:f.name,providerVersion:E.providerVersion??null,resourceVersions:E.resourceVersions,status:t.releases.get(s.id).status}};return Object.fromEntries(Qb.map((n)=>[n,r]))}import{createCipheriv as Xb,createDecipheriv as Zb,createHash as Yp,randomBytes as Bd}from"node:crypto";var Xp={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function xt(e){return typeof e==="string"&&e?e:void 0}function qo(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function _i(e){return JSON.stringify(h(e))}function Vo(e){return Yp("sha256").update(e).digest("hex")}function Hp(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Gp(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function jd(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function Kp(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Ya(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function eS(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function tS(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:xt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:xt(e.credential_fingerprint),grantedScopes:qo(e.granted_scopes,[]),capabilities:qo(e.capabilities,Xp[String(e.provider)]),status:String(e.status),healthMessage:xt(e.health_message),lastTestedAt:xt(e.last_tested_at),lastSyncedAt:xt(e.last_synced_at),credentialExpiresAt:xt(e.credential_expires_at),version:Number(e.version),createdByActorId:xt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Fd(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:qo(e.metadata,{}),syncedAt:String(e.synced_at)}}function Qp(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:xt(e.environment_id),resourceId:xt(e.resource_id),connectionId:String(e.connection_id),repositoryId:xt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:xt(e.branch_rule),tagRule:xt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:qo(e.include_paths,[]),excludePaths:qo(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:xt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:xt(e.disabled_reason),version:Number(e.version),createdByActorId:xt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Ud(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:xt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function zd(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:xt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:xt(e.provider_webhook_id),events:qo(e.events,[]),status:String(e.status),healthMessage:xt(e.health_message),lastDeliveryAt:xt(e.last_delivery_at),lastReconciledAt:xt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Vd(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:xt(e.action),commitSha:xt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:qo(e.payload_summary,{}),operationId:xt(e.operation_id),error:xt(e.error),receivedAt:String(e.received_at),processedAt:xt(e.processed_at)}}class Jt{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?Yp("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=Bd(12),r=Xb("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted source credential is unavailable");let o=Zb("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),n=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Gp(e.name),Hp(e.host),e.owner?.trim()||null,e.authKind??(n?"access_token":"none"),n?this.encrypt(n):null,n?Vo(n).slice(0,16):null,_i([...new Set(e.grantedScopes??[])].sort()),_i(Xp[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:Hp(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=tS(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let n=this.getConnection(e);if(!n||n.status==="disconnected")throw Error("Active source connection was not found");let i=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(i),Vo(i).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:Vo(i).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let n=this.now(),i=t.grantedScopes?[...new Set(t.grantedScopes.map((o)=>o.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,i?_i(i):null,t.tested?n:null,t.synced?n:null,n,e]),i&&JSON.stringify(i)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:i}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),n=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),i=n?String(n.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[i,e.connectionId,e.providerRepositoryId,jd(e.fullName),eS(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,_i(e.metadata),r]),Fd(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(i))}listRepositories(e,t,r=100){let n=t?.trim().toLowerCase();return(n?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${n}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(Fd)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?Fd(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),n=this.now(),i=`sha256:${Vo(e.publicKey.trim())}`,o=`sha256:${Vo(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Gp(e.name),e.publicKey.trim(),i,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),o,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:i,hostFingerprint:o}}),Ud(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?Ud(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(Ud)}revokeDeployKey(e,t){let r=this.getDeployKey(e),n=r?this.getConnection(r.connectionId):void 0;if(!r||!n)throw Error("Deploy key was not found");let i=this.listBindings({connectionId:n.id}).filter((s)=>s.deployKeyId===e),o=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[o,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:n.id,deployKeyId:e,affectedBindingIds:i.map((s)=>s.id)}}),{affectedBindings:i}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),n=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
@@ -30,7 +30,7 @@ data: ${JSON.stringify(et)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,n,i,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(o),JSON.stringify(s),e.defaultRole??c.defaultRole,e.enabled??c.enabled?1:0,e.enforceSso??c.enforceSso?1:0,l,c.id]),this.getOidcProvider(c.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let a=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.organizationId,t,r,n,i,this.encrypt(e.clientSecret),JSON.stringify(o),JSON.stringify(s),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,l,l]),this.getOidcProvider(a)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?rc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?rc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(rc).filter((n)=>t.includeDisabled||n.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:rc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let i=this.idFn(),o=qi(32).toString("base64url"),s=qi(32).toString("base64url"),c=qi(64).toString("base64url"),l=this.now(),a=new Date(this.nowFn().getTime()+Ig).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e,mi(o),this.encrypt(s),this.encrypt(c),t,r,a,l]),{transaction:this.getOidcTransaction(i),state:o,nonce:s,verifier:c}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?yg(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,mi(t));if(!r)throw Error("OIDC transaction is invalid");let n=yg(r,this.now());if(n.state!=="pending")throw Error(`OIDC transaction is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(n.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?xS(r):void 0}linkOidcSubject(e,t,r,n){let i=this.getOidcProvider(e),o=this.getIdentity(t);if(!i||!o)throw Error("OIDC provider or identity was not found");let s=Xd(n);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let c=this.getOidcSubject(e,r);if(c&&c.identityId!==t)throw Error("OIDC subject is already linked to another identity");let l=this.now();if(c)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[s,l,c.id]),this.getOidcSubject(e,r);let a=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,t,r,s,l,l]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function ma(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:n}=await import("./chunk-3ay4kfaw.js");return await new n({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as DS}from"node:crypto";import{chmodSync as OS,existsSync as _S,mkdirSync as NS,readFileSync as $S,writeFileSync as MS}from"node:fs";import{dirname as LS}from"node:path";function k(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=A(e,"auth-encryption-key");try{if(_S(r)){let i=$S(r,"utf8").trim();if(i)return i}}catch{}let n=DS(32).toString("base64url");try{NS(LS(r),{recursive:!0,mode:448}),MS(r,`${n}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e,mi(o),this.encrypt(s),this.encrypt(c),t,r,a,l]),{transaction:this.getOidcTransaction(i),state:o,nonce:s,verifier:c}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?yg(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,mi(t));if(!r)throw Error("OIDC transaction is invalid");let n=yg(r,this.now());if(n.state!=="pending")throw Error(`OIDC transaction is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(n.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?xS(r):void 0}linkOidcSubject(e,t,r,n){let i=this.getOidcProvider(e),o=this.getIdentity(t);if(!i||!o)throw Error("OIDC provider or identity was not found");let s=Xd(n);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let c=this.getOidcSubject(e,r);if(c&&c.identityId!==t)throw Error("OIDC subject is already linked to another identity");let l=this.now();if(c)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[s,l,c.id]),this.getOidcSubject(e,r);let a=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,t,r,s,l,l]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function ma(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:n}=await import("./chunk-ysv52qcc.js");return await new n({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as DS}from"node:crypto";import{chmodSync as OS,existsSync as _S,mkdirSync as NS,readFileSync as $S,writeFileSync as MS}from"node:fs";import{dirname as LS}from"node:path";function k(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=A(e,"auth-encryption-key");try{if(_S(r)){let i=$S(r,"utf8").trim();if(i)return i}}catch{}let n=DS(32).toString("base64url");try{NS(LS(r),{recursive:!0,mode:448}),MS(r,`${n}
 `,{mode:384}),OS(r,384)}catch{}return n}import{constants as BS,createHash as tu,createPublicKey as jS,createVerify as FS,timingSafeEqual as US}from"node:crypto";var Tg=new Set(["RS256","PS256","ES256"]),Eg=60;function nc(e,t){let r=new URL(e),n=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function ru(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function nu(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let i=await e.text();if(i.length>1048576)throw Error(`${t} response is too large`);try{return ru(JSON.parse(i),t)}catch(o){if(o instanceof Error&&o.message===`${t} is invalid`)throw o;throw Error(`${t} returned invalid JSON`)}}function zS(e,t){let r=tu("sha256").update(e).digest(),n=tu("sha256").update(t).digest();return US(r,n)}function Ag(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function dn(e,t=fetch){let r=nc(e.issuer,"OIDC issuer"),n=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),i=await nu(await t(n,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(i.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let s of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof i[s]!=="string")throw Error(`OIDC discovery is missing ${s}`);nc(i[s],`OIDC ${s}`)}if(Array.isArray(i.response_types_supported)&&!i.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(i.code_challenge_methods_supported)&&!i.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let o=Array.isArray(i.id_token_signing_alg_values_supported)?i.id_token_signing_alg_values_supported.filter((s)=>typeof s==="string"):[];if(o.length>0&&!o.some((s)=>Tg.has(s)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return i}async function iu(e,t,r,n,i=fetch){let o=e.getOidcProviderBySlug(t);if(!o?.enabled)throw Error("OIDC provider is unavailable");let s=nc(r,"Application origin").origin,c=await dn(o,i),l=`${s}/auth/oidc/${encodeURIComponent(o.slug)}/callback`,a=e.beginOidcTransaction(o.id,l,Ag(n)),f=new URL(c.authorization_endpoint);return f.searchParams.set("response_type","code"),f.searchParams.set("client_id",o.clientId),f.searchParams.set("redirect_uri",l),f.searchParams.set("scope",o.scopes.join(" ")),f.searchParams.set("state",a.state),f.searchParams.set("nonce",a.nonce),f.searchParams.set("code_challenge",tu("sha256").update(a.verifier).digest("base64url")),f.searchParams.set("code_challenge_method","S256"),{authorizationUrl:f.href,expiresAt:a.transaction.expiresAt}}function VS(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:ru(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:ru(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function qS(e,t,r){let n=VS(e),i=typeof n.header.alg==="string"?n.header.alg:"",o=typeof n.header.kid==="string"?n.header.kid:"";if(!Tg.has(i)||!o)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(i))throw Error("OIDC ID-token algorithm was not advertised by the provider");let s=await nu(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(s.keys))throw Error("OIDC signing-key response is invalid");let c=s.keys.find((E)=>{if(!E||typeof E!=="object"||Array.isArray(E))return!1;let x=E;return x.kid===o&&(!x.alg||x.alg===i)&&(!x.use||x.use==="sig")});if(!c)throw Error("OIDC ID-token signing key was not found");let l=jS({key:c,format:"jwk"}),a=FS("SHA256").update(n.signingInput).end();if(!(i==="PS256"?a.verify({key:l,padding:BS.RSA_PKCS1_PSS_PADDING,saltLength:32},n.signature):i==="ES256"?a.verify({key:l,dsaEncoding:"ieee-p1363"},n.signature):a.verify(l,n.signature)))throw Error("OIDC ID-token signature is invalid");return n.claims}function JS(e,t,r,n){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let i=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((l)=>typeof l==="string"):[];if(!i.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((i.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let o=Math.floor(n.getTime()/1000);if(typeof e.exp!=="number"||e.exp<o-Eg)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>o+Eg)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!zS(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let s=e.email.trim().toLowerCase();if(s.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s))throw Error("OIDC provider returned an invalid email address");let c=s.split("@")[1];if(!c||!t.allowedDomains.includes(c))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:s,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function ou(e,t,r=fetch){let n=e.getOidcProviderBySlug(t.providerSlug);if(!n?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let i=nc(t.origin,"Application origin").origin,o=e.consumeOidcTransaction(n.id,t.state),s=`${i}/auth/oidc/${encodeURIComponent(n.slug)}/callback`;if(o.transaction.redirectUri!==s)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:c}=e.getOidcProviderCredentials(n.id),l=await dn(n,r),a=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:o.transaction.redirectUri,code_verifier:o.verifier}),f={accept:"application/json","content-type":"application/x-www-form-urlencoded"},E=l.token_endpoint_auth_methods_supported??["client_secret_basic"];if(E.includes("client_secret_basic")){let H=(X)=>new URLSearchParams({value:X}).toString().slice(6),K=`${H(n.clientId)}:${H(c)}`;f.authorization=`Basic ${Buffer.from(K).toString("base64")}`}else if(E.includes("client_secret_post"))a.set("client_id",n.clientId),a.set("client_secret",c);else throw Error("OIDC provider does not support a configured client authentication method");let x=await nu(await r(l.token_endpoint,{method:"POST",headers:f,body:a,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof x.id_token!=="string")throw Error("OIDC token response did not include an ID token");let D=await qS(x.id_token,l,r);return{identity:JS(D,n,o.nonce,t.now??new Date),returnPath:o.transaction.returnPath}}import{createHash as WS,randomBytes as HS}from"node:crypto";var Rg=new Set(ie),Pg=7776000000,xg=31536000000,Dg=86400000;function Ji(e){return typeof e==="string"?e:void 0}function kg(e){return WS("sha256").update(e).digest("hex")}function GS(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&Rg.has(r)):[]}catch{return[]}}function KS(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function su(e){let t=Ji(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:Ji(e.description),createdByActorId:Ji(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function au(e,t){let r=Ji(e.revoked_at),n=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:GS(e.capabilities),scope:KS(e),expiresAt:n,lastUsedAt:Ji(e.last_used_at),lastNetworkHint:Ji(e.last_network_hint),revokedAt:r,rotatedFromTokenId:Ji(e.rotated_from_token_id),createdByActorId:Ji(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":n<=t?"expired":"active"}}function QS(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:Ji(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class Be{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let n=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),i=this.idFn(),o=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e.organizationId,n.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,o,o]);let s=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:n.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),c=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:i,roleTemplate:e.roleTemplate,scope:{type:c.type,id:c.id??null}}}),{serviceAccount:this.getServiceAccount(i),membership:s}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?su(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?su(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(su).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let n=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[n,n,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[n,n,e]);let i=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(i?.status==="active")this.controlPlane.revokeMembership(i.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let n=[...new Set(e.capabilities)];if(n.length===0||n.some((x)=>!Rg.has(x)))throw Error("API token requires valid explicit capabilities");let i=e.scope??r.scope,o=this.controlPlane.resolveAuthorizationTarget(t.organizationId,i);if(!o)throw Error("API token scope was not found in this organization");for(let x of n)if(!Z({membership:r,grants:this.controlPlane.listGrants(r.id),capability:x,target:o}).allowed)throw Error(`Service-account membership does not grant ${x} at the token scope`);let s=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+Pg);if(!Number.isFinite(s.getTime())||s.getTime()<=this.nowFn().getTime()+60000||s.getTime()>this.nowFn().getTime()+xg)throw Error("API token expiry must be between one minute and one year from now");let c=this.idFn(),l=HS(32).toString("base64url"),a=`tsc_v1.${c}.${l}`,f=`tsc_v1.${c.slice(0,8)}`,E=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[c,t.id,e.name.trim().slice(0,100)||"API token",kg(a),f,JSON.stringify(n.sort()),i.type,i.type==="organization"?null:i.id??null,s.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,E,E]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:c,prefix:f,capabilities:n,scope:{type:i.type,id:i.id??null},expiresAt:s.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(c),secret:a}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?au(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>au(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let n=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],kg(e));if(!n)return;let i=au(n,this.now()),o=this.getServiceAccount(i.serviceAccountId);if(!o||o.state!=="active"||i.state!=="active")return;let s=this.controlPlane.getActor(o.actorId),c=this.controlPlane.getMembershipForActor(o.organizationId,o.actorId);if(!s||s.disabledAt||!c||c.status!=="active")return;let l=this.now(),a=!i.lastUsedAt||this.nowFn().getTime()-new Date(i.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[l,t?.slice(0,128)??null,l,i.id]),a)this.controlPlane.appendEvent({organizationId:o.organizationId,actorId:s.id,type:"api.token.used",payload:{serviceAccountId:o.id,tokenId:i.id,prefix:i.prefix}});return{serviceAccount:o,token:this.getToken(i.id),actor:s,membership:c}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let n=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),i=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:i?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:n.token.id}}),n}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let n=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[n,n,e]);let i=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:i?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?QS(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),n=this.now(),i=new Date(this.nowFn().getTime()+Dg).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -474,7 +474,7 @@ data: ${JSON.stringify({cursor:o,at:new Date().toISOString()})}
 ${c}
 ${l}`);return null}return n}catch(i){if(n)ms(n,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${i.message}`);return null}}function sA(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:Pt(oa(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,n])=>[r,{domain:n.domain,path:n.path,type:n.type,deploy:n.deploy,root:n.root,port:n.port,ssl:n.ssl}]))}}function mb(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function aA(e,t){return mb(t).find((r)=>r.id===e)}function sb(e){if(e.length<=rb)return e;return`${e.slice(0,rb)}
 
-[output truncated]`}async function ab(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:l}=await n.read();if(c)break;let a=i.decode(l,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function np(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([ab(r.stdout,"stdout",t.onOutput),ab(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:sb(i),stderr:sb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function cA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function uA(e){let t=za(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dA.has(r)}var lA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function cb(e,t){if(t.role==="admin")return!0;let r=za(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!uA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=lA[n];return!!i&&!!t.capabilities?.includes(i)}function pA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=_T(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Et(e,i);if(uo(o)&&!pb(o).isDirectory())return o;if(!za(o)&&uo(`${o}.html`))return`${o}.html`;if(!za(o)&&uo(Et(o,"index.html")))return Et(o,"index.html");return null}async function db(e,t){let r=pA(e,t);if(!r){let o=Et(e,"404.html");if(uo(o))return new Response(await ji(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ed("Not found",404)}if(pb(r).isDirectory())return Ed("Not found",404);let n=await ji(r),i=zT[za(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Id=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],ub=new WeakMap;async function lb(e){let t=ub.get(e);if(t)return t;let r=await import("./chunk-xdxk6baf.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return ub.set(e,i),i}async function tr(e={}){UT();let t=e.cwd??process.cwd(),r=e.host??BT,n=e.port??jT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await QT(t);let o=e.config??await Ai(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=C(o);if(s&&c&&!c.password)c.password=s;let l=o.infrastructure?.compute?.managedServices?.vitess;if(s&&l&&typeof l==="object"&&!l.password)l.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),E=GT(o,e.environment),x=YT(t),D=await gs(o,E),H=new Map([[E,D]]),K=new Map([[E,Date.now()]]),X=new Map([[E,Date.now()]]),ne=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),De=V(o)!=="serverless",Ze=(I)=>{let Ee=H.get(I);if(Ee&&!nb(K.get(I),Date.now(),he))return Promise.resolve(Ee);let Ne=ne.get(I);if(Ne)return Ne;let we=!De||nb(X.get(I),Date.now(),ee),ze=gs(o,I,{includeSiteHealth:we}).then((gt)=>{let N=H.get(I),Gr=we?gt:nA(N,gt);if(H.set(I,Gr),K.set(I,Date.now()),we)X.set(I,Date.now());if(N?._serverReachable!==Gr._serverReachable||N?._metricsStatus!==Gr._metricsStatus||(N?.sitesDetail?.length??0)!==(Gr.sitesDetail?.length??0))gi();return Gr}).finally(()=>ne.delete(I));return ne.set(I,ze),ze},Fe=io(t),Vt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Vt!=="0"&&(Vt==="1"||!o.cloud?.attachTo)){let I=!1,Ee=Date.now()+300000,Ne=async()=>{if(I)return;I=!0;try{let ze=Date.now(),gt=ze>=Ee;if(gt)Ee=ze+300000;let N=a.environments.get(E);await jn({controlPlane:a.store,projectId:a.project.id,environmentId:N?.id,config:o,environment:E,force:!0,lightweight:!0,includeSiteHealth:gt})}catch(ze){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${ze instanceof Error?ze.message:String(ze)}`)}finally{I=!1}};Ne(),setInterval(()=>void Ne(),60000).unref?.()}let Ae=new Map,Ke=new Map,Tt=new Set,Ci=0;function lo(I,Ee){if(I.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${I.username.toLowerCase()}`))return I;let Ne=a.store.getActorByExternalId("user",`dashboard:${I.username.toLowerCase()}`),we=Ne?a.store.getMembershipForActor(a.organization.id,Ne.id):void 0;if(!we||we.status!=="active")return{...I,role:"member",sites:{},capabilities:[]};let ze=a.store.listGrants(we.id),gt=a.store.resolveAuthorizationTarget(a.organization.id,we.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),N=rn({membership:we,grants:ze,target:gt});if(we.roleTemplate==="owner"||we.roleTemplate==="admin")return{...I,role:"admin",sites:{},organizationRole:we.roleTemplate,organizationSource:we.source,capabilities:N};let Gr=a.environments.get(Ee),rr={};for(let Qe of a.store.listResources(a.project.id,Gr?.id).filter((st)=>st.kind==="application")){let st=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Qe.id});if(!st||!Z({membership:we,grants:ze,capability:"project:read",target:st}).allowed)continue;rr[Qe.slug]=Z({membership:we,grants:ze,capability:"config:write",target:st}).allowed?"owner":"collaborator"}return{...I,role:"member",sites:rr,organizationRole:we.roleTemplate,organizationSource:we.source,capabilities:N}}function gi(){Ci+=1,Ae.clear();for(let I of Tt)ms(I,{recursive:!0,force:!0});Tt.clear()}let Ei=(I,Ee)=>`${Ee}:${I.role==="admin"?"admin":`member:${Object.entries(I.sites).sort(([Ne],[we])=>Ne.localeCompare(we)).map(([Ne,we])=>`${Ne}=${we}`).join(",")}`}:${[...I.capabilities??[]].sort().join(",")}`;async function Ti(I,Ee){let Ne=lo(I,Ee),we=Ei(Ne,Ee),ze=Ae.get(we);if(ze)return ze;let gt=Ke.get(we);if(gt)return gt;let N=Ci,Gr=(async()=>{let rr=H.get(Ee)??await gs(o,Ee);H.set(Ee,rr);let Qe={...ql(rr,{user:Ne,slug:o.project.slug}),viewer:{role:Ne.role,organizationRole:Ne.organizationRole,organizationSource:Ne.organizationSource,capabilities:Ne.capabilities??[]}},st=await oA(t,Qe);if(st&&N!==Ci)return ms(st,{recursive:!0,force:!0}),Fe?.uiRoot;if(st)Tt.add(st);let Ar=st??Fe?.uiRoot;if(Ar)Ae.set(we,Ar);return Ar})();Ke.set(we,Gr);try{return await Gr}finally{Ke.delete(we)}}let ki=await Ti({username:"",passwordHash:"",role:"admin",sites:{}},E);if(!ki)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let G=new WeakMap,pe=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ce=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ce&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Re=!Ce,Nt=Qh(t),qt=Re?ey(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,ve=new ke(a.store,{encryptionKey:k(t)}),ut=new Be(a.store),et=new Rt(a.store),Ue=new Jt(a.store,{encryptionKey:k(t)}),Jr=new kn(a.store),fs=new xn(a.store,{cwd:t}),Pi=new _n(a.store,{encryptionKey:k(t)}),kt=new b(a.store,{workerId:`dashboard:${process.pid}`}),$t=new Gt(a.store),Ui=new Kt(a.store,k(t)),po=new Sr(a.store),Va=new Pr($t,kt,Ui),go=o.project?.region??"us-east-1",op=k(t),zn=new Er(po,{encryptionKey:op,backends:[new bt(a.store,op),new br(new q(go),go),new vr(new je(go),go),new Tr]});await en(zn,a,o);let Td=new ue(go),fb={aws_rds:new En(new Rn(Td)),aws_aurora:new wn(new Pn(Td)),aws_elasticache:new Cn(new Nn(new te(go))),server:new An(new rt),container:new In(new rt)},sp=(I)=>fb[I.provider],nr=new Un(a.store),$o=new Lr(nr,kt),ap=new Bn(Ui),hb={managed_database:new gu($t,Td),logical_database:new bu($t,Ui),volume:new vu,files:new yu(t),control_plane:new Iu(a.store,t),infrastructure:new Eu(new fa(go))},yb=(I)=>hb[I.resourceKind],bb=(I)=>I.provider==="aws_backup"?void 0:ap,Ad=new dt(a.store),kd=[new Dt,new qr(A(t,"volumes"))],zi=new Hr(Ad,kd,kt),sa=new Ie(a.store),Di=new mn(sa,[new tt("aws"),new tt("hetzner"),new tt("ssh")],kt),fo=new gn(a.store),cp=new fn(fo,sa),Mo=new hn(a.store),dp=new yn(Mo,kt),Vi=new Sn(a.store),Rd=new bn(Vi,kt),up=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((I)=>new vn(I,a.store,a.project.id,a.organization.id)),Ir=new $r(a.store),lp=new Mn(Ir,{queue:kt}),Ht=new qe(a.store),ho=new He(a.store),ii=new nt(a.store),Je=new pt(a.store,{encryptionKey:k(t)}),Sb=()=>lb(a.store);for(let I of a.environments.values())Or(Ir,o,{organization:a.organization,project:a.project,environment:I,resources:a.store.listResources(a.project.id,I.id)});let oi=new dr(Je,{emailImpl:async(I)=>{let{email:Ee}=await import("./chunk-3ay4kfaw.js");return Ee.send(I)}}),pp=async(I)=>{let Ee=Wr(Je,a.project.id,I),Ne=[];for(let we of Ee.filter((ze)=>ze.notify&&ze.alert))Ne.push(...await oi.deliverAll(oi.enqueue(a.organization.id,we.alert,we.transition)));return Ne.push(...await oi.deliverAll(oi.enqueueRemindersAndEscalations(a.organization.id,Je.listAlerts(a.project.id,{environmentId:I,states:["firing"]})))),Ne.push(...await oi.retryDue()),{evaluations:Ee,deliveries:Ne}},Pd=!1,vb=async()=>{if(Pd)return;Pd=!0;try{for(let I of a.environments.values())for(let Ee of Je.listHealthChecks(a.project.id,I.id).filter((Ne)=>Ne.enabled)){let Ne=Je.listHealthResults(Ee.id,1)[0];if(Ne&&Date.now()-new Date(Ne.checkedAt).getTime()<Ee.intervalSeconds*1000)continue;let we=await new Oe(Je).runAndEvaluate(Ee);for(let ze of we.evaluations.filter((gt)=>gt.notify&&gt.alert))await oi.deliverAll(oi.enqueue(a.organization.id,ze.alert,ze.transition))}}finally{Pd=!1}},gp=setInterval(()=>{for(let I of a.environments.values())pp(I.id).catch((Ee)=>console.error("ts-cloud alert evaluation failed:",Ee))},60000);gp.unref?.();let mp=setInterval(()=>{vb().catch((I)=>console.error("ts-cloud health check evaluation failed:",I))},30000);mp.unref?.();let fp=setInterval(()=>{try{lp.tick()}catch(I){console.error("ts-cloud scheduled job evaluation failed:",I)}},30000);fp.unref?.();let hp=setInterval(()=>{try{$o.enqueueDue(),$o.enqueueRetention()}catch(I){console.error("ts-cloud backup policy evaluation failed:",I)}},30000);hp.unref?.(),Ht.cleanup();let yp=setInterval(()=>{try{Ht.cleanup()}catch(I){console.error("ts-cloud preview cleanup failed:",I)}},3600000);yp.unref?.();let wb=e.queueWorker??!0,Ib=cA(),Cb=async(I,Ee)=>{let we=(I.environmentId?a.store.listEnvironments(I.projectId).find((ze)=>ze.id===I.environmentId):void 0)?.slug??String(E);if(Ee.kind==="dashboard_operation"&&Ee.operationId){let ze=H.get(we)??D,gt=$n(Ee.operationId,o,ze);if(!gt||gt.danger||!["scheduler","backup","worker"].includes(gt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let N=await _r(o,we,gt);return{ok:N.ok,stdout:N.stdout,stderr:N.stderr??N.error,retryable:/temporar|unavailable|timeout|network/i.test(N.stderr??N.error??""),output:{command:N.command??null,operation:N.operation}}}if(Ee.kind==="serverless_scheduler"){let ze=await Xl(o,we,"run");return{ok:ze.ok,stdout:ze.stdout,stderr:ze.error,retryable:/temporar|unavailable|timeout|network/i.test(ze.error??""),output:{command:ze.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ee.kind}.`}},qa=wb?new Qo(kt,{...$a({store:a.store,execute:async(I,Ee)=>{let Ne=Ee.operation.input&&typeof Ee.operation.input==="object"&&!Array.isArray(Ee.operation.input)?Ee.operation.input:{},we=Ne.source&&typeof Ne.source==="object"?Ne.source:void 0,ze=t,gt,N,Gr;try{if(we?.bindingId&&we?.connectionId&&we?.commitSha){let Qe=Ue.getBinding(String(we.bindingId)),st=Ue.getConnection(String(we.connectionId));if(!Qe||!st||Qe.connectionId!==st.id)throw Error("Queued source binding is no longer available");let gr=(Qe.repositoryId?Ue.getRepository(Qe.repositoryId):Ue.listRepositories(st.id).find((Ss)=>Ss.fullName.toLowerCase()===Qe.repositoryFullName.toLowerCase()))?.cloneUrl;if(!gr&&st.provider==="generic_ssh")gr=`git@${new URL(st.host).hostname}:${Qe.repositoryFullName}.git`;if(!gr)gr=new URL(`/${Qe.repositoryFullName}.git`,st.host.endsWith("/")?st.host:`${st.host}/`).href;let ye=Qe.deployKeyId?Ue.getDeployKey(Qe.deployKeyId):void 0,Mt=ye&&Qe.deployKeyId?{...ye,privateKey:Ue.getDeployPrivateKey(Qe.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(st.provider)&&I.target.previewId){let Ss=wo(st,Ue.getCredential(st.id)),de=Ht.previews.getInstance(I.target.previewId);Gr=async(si,Ka)=>{try{await Ss.setCommitStatus(Qe.repositoryFullName,String(we.commitSha),{state:si,url:de?.url,description:Ka})}catch(ws){Ee.log(`Could not publish source status: ${ws instanceof Error?ws.message:String(ws)}`,{stream:"stderr"})}},await Gr("pending",`Preview deployment started for ${String(we.commitSha).slice(0,12)}`)}gt=ip(Et(Cd(),"ts-cloud-queued-source-")),Ee.log(`Checking out immutable source commit ${we.commitSha}.`,{stream:"system"}),ze=(await Wd({remote:gr,binding:Qe,destination:Et(gt,"checkout"),ref:String(we.branch??Qe.defaultBranch),commitSha:String(we.commitSha)},{credential:Ue.getCredential(st.id),deployKey:Mt})).directory}if(Ee.operation.kind!=="preview.destroy"){let Qe=I.target.previewId?Ht.previews.getInstance(I.target.previewId):void 0,st=Qe?Ht.previews.getDefinition(Qe.definitionId):void 0,Ar=Ee.operation.resourceId?a.store.getResource(Ee.operation.resourceId):void 0;if(N=await zn.resolve({projectId:a.project.id,environmentId:Ee.operation.environmentId,resourceId:Ee.operation.resourceId,functionId:Ar?.kind==="function"?Ar.id:void 0,previewId:Qe?.id,trustedPreview:!!Qe&&!Qe.fork,allowedPreviewSecrets:st?.inheritedSecrets}),N.warnings.some((gr)=>gr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${N.warnings.filter((gr)=>gr.code==="missing_required").map((gr)=>gr.key).join(", ")}`);if(Ee.operation.resourceId)for(let gr of Object.values(N.entries))po.setDependency({entryId:gr.id,resourceId:Ee.operation.resourceId,injectionTarget:"environment",required:gr.required,requiresRedeploy:!0});Ee.log(`Resolved configuration ${N.configurationHash.slice(0,18)} for ${Object.keys(N.values).length} keys.`,{stream:"system"})}let rr=await np(I,{cwd:ze,cliEntry:i,signal:Ee.signal,env:N?.values,onOutput:(Qe,st)=>Ee.log(st,{stream:Qe,step:"execute",secrets:[...Ib,...Object.entries(N?.entries??{}).filter(([,Ar])=>Ar.kind==="secret").map(([Ar])=>N.values[Ar]).filter(Boolean)]})});if(rr.ok&&Ee.operation.resourceId&&N)for(let Qe of Object.values(N.entries))po.setDependency({entryId:Qe.id,resourceId:Ee.operation.resourceId,injectionTarget:"environment",required:Qe.required,requiresRedeploy:!1,lastDeployedVersion:Qe.version});return await Gr?.(rr.ok?"success":"failure",rr.ok?`Preview is ready at ${String(we?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(we?.commitSha).slice(0,12)}`),rr}catch(rr){throw await Gr?.("error",`Preview deployment could not complete at ${String(we?.commitSha).slice(0,12)}`),rr}finally{if(gt)ms(gt,{recursive:!0,force:!0})}}}),...Mg({store:Ir,executor:Cb}),...Hg({store:$t,secrets:Ui,resolveAdapter:sp}),...Nf(sa,Di.drivers),...th(Mo,[new Sl("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Hf({store:Vi,cleanup:up}),...xa(Ad,kd),...qg({store:nr,queue:kt,resolveSource:yb,resolveDestination:bb,validateHealth:async(I,Ee)=>{if(!I.healthCheckId)return{healthy:!0,mode:"adapter"};let Ne=Je.getHealthCheck(I.healthCheckId);if(!Ne||Ne.projectId!==I.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let we=await new Oe(Je).runAndEvaluate(Ne);return{healthy:we.result.status==="healthy",healthCheckId:Ne.id,healthResultId:we.result.id,target:Ee}}}),...Wp({store:a.store,resolveDriver:e.releaseDriver??((I)=>({name:`${a.store.getResource(I.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:I.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(I,Ee)=>{let Ne=Je.listHealthChecks(Ee.projectId,Ee.environmentId).find((ze)=>ze.enabled&&ze.name===I&&(!ze.resourceId||ze.resourceId===Ee.resourceId));if(!Ne)return{healthy:!1,message:`Named health gate ${I} was not found for this release.`};let we=await new Oe(Je).runAndEvaluate(Ne);return{healthy:we.result.status==="healthy",evidence:{healthCheckId:Ne.id,healthResultId:we.result.id,status:we.result.status,timings:we.result.timings},message:we.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(I)=>console.error("ts-cloud deployment queue worker failed:",I)}):void 0;if(On(a),od(et,ae(a,String(E)),D),qt)sd(a,qt.users),ny(ve,a,qt.users);let Bt=ty({cwd:t,enabled:Re,secret:Nt,authentication:ve,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(E)}}),or=new Il,bp=setInterval(()=>or.sweep(),60000);bp.unref?.();let Ja=new Ba,xd=new Ba(3,900000,900000),Wa=new Ba(8,900000,900000),Sp=setInterval(()=>Ja.prune(),300000),vp=setInterval(()=>xd.prune(),300000),wp=setInterval(()=>Wa.prune(),300000);if(Sp.unref?.(),vp.unref?.(),wp.unref?.(),Re){if(qt?.generated)console.warn(`
+[output truncated]`}async function ab(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:l}=await n.read();if(c)break;let a=i.decode(l,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function np(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([ab(r.stdout,"stdout",t.onOutput),ab(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:sb(i),stderr:sb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function cA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function uA(e){let t=za(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dA.has(r)}var lA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function cb(e,t){if(t.role==="admin")return!0;let r=za(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!uA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=lA[n];return!!i&&!!t.capabilities?.includes(i)}function pA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=_T(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Et(e,i);if(uo(o)&&!pb(o).isDirectory())return o;if(!za(o)&&uo(`${o}.html`))return`${o}.html`;if(!za(o)&&uo(Et(o,"index.html")))return Et(o,"index.html");return null}async function db(e,t){let r=pA(e,t);if(!r){let o=Et(e,"404.html");if(uo(o))return new Response(await ji(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ed("Not found",404)}if(pb(r).isDirectory())return Ed("Not found",404);let n=await ji(r),i=zT[za(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Id=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],ub=new WeakMap;async function lb(e){let t=ub.get(e);if(t)return t;let r=await import("./chunk-xdxk6baf.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return ub.set(e,i),i}async function tr(e={}){UT();let t=e.cwd??process.cwd(),r=e.host??BT,n=e.port??jT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await QT(t);let o=e.config??await Ai(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=C(o);if(s&&c&&!c.password)c.password=s;let l=o.infrastructure?.compute?.managedServices?.vitess;if(s&&l&&typeof l==="object"&&!l.password)l.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),E=GT(o,e.environment),x=YT(t),D=await gs(o,E),H=new Map([[E,D]]),K=new Map([[E,Date.now()]]),X=new Map([[E,Date.now()]]),ne=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),De=V(o)!=="serverless",Ze=(I)=>{let Ee=H.get(I);if(Ee&&!nb(K.get(I),Date.now(),he))return Promise.resolve(Ee);let Ne=ne.get(I);if(Ne)return Ne;let we=!De||nb(X.get(I),Date.now(),ee),ze=gs(o,I,{includeSiteHealth:we}).then((gt)=>{let N=H.get(I),Gr=we?gt:nA(N,gt);if(H.set(I,Gr),K.set(I,Date.now()),we)X.set(I,Date.now());if(N?._serverReachable!==Gr._serverReachable||N?._metricsStatus!==Gr._metricsStatus||(N?.sitesDetail?.length??0)!==(Gr.sitesDetail?.length??0))gi();return Gr}).finally(()=>ne.delete(I));return ne.set(I,ze),ze},Fe=io(t),Vt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Vt!=="0"&&(Vt==="1"||!o.cloud?.attachTo)){let I=!1,Ee=Date.now()+300000,Ne=async()=>{if(I)return;I=!0;try{let ze=Date.now(),gt=ze>=Ee;if(gt)Ee=ze+300000;let N=a.environments.get(E);await jn({controlPlane:a.store,projectId:a.project.id,environmentId:N?.id,config:o,environment:E,force:!0,lightweight:!0,includeSiteHealth:gt})}catch(ze){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${ze instanceof Error?ze.message:String(ze)}`)}finally{I=!1}};Ne(),setInterval(()=>void Ne(),60000).unref?.()}let Ae=new Map,Ke=new Map,Tt=new Set,Ci=0;function lo(I,Ee){if(I.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${I.username.toLowerCase()}`))return I;let Ne=a.store.getActorByExternalId("user",`dashboard:${I.username.toLowerCase()}`),we=Ne?a.store.getMembershipForActor(a.organization.id,Ne.id):void 0;if(!we||we.status!=="active")return{...I,role:"member",sites:{},capabilities:[]};let ze=a.store.listGrants(we.id),gt=a.store.resolveAuthorizationTarget(a.organization.id,we.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),N=rn({membership:we,grants:ze,target:gt});if(we.roleTemplate==="owner"||we.roleTemplate==="admin")return{...I,role:"admin",sites:{},organizationRole:we.roleTemplate,organizationSource:we.source,capabilities:N};let Gr=a.environments.get(Ee),rr={};for(let Qe of a.store.listResources(a.project.id,Gr?.id).filter((st)=>st.kind==="application")){let st=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Qe.id});if(!st||!Z({membership:we,grants:ze,capability:"project:read",target:st}).allowed)continue;rr[Qe.slug]=Z({membership:we,grants:ze,capability:"config:write",target:st}).allowed?"owner":"collaborator"}return{...I,role:"member",sites:rr,organizationRole:we.roleTemplate,organizationSource:we.source,capabilities:N}}function gi(){Ci+=1,Ae.clear();for(let I of Tt)ms(I,{recursive:!0,force:!0});Tt.clear()}let Ei=(I,Ee)=>`${Ee}:${I.role==="admin"?"admin":`member:${Object.entries(I.sites).sort(([Ne],[we])=>Ne.localeCompare(we)).map(([Ne,we])=>`${Ne}=${we}`).join(",")}`}:${[...I.capabilities??[]].sort().join(",")}`;async function Ti(I,Ee){let Ne=lo(I,Ee),we=Ei(Ne,Ee),ze=Ae.get(we);if(ze)return ze;let gt=Ke.get(we);if(gt)return gt;let N=Ci,Gr=(async()=>{let rr=H.get(Ee)??await gs(o,Ee);H.set(Ee,rr);let Qe={...ql(rr,{user:Ne,slug:o.project.slug}),viewer:{role:Ne.role,organizationRole:Ne.organizationRole,organizationSource:Ne.organizationSource,capabilities:Ne.capabilities??[]}},st=await oA(t,Qe);if(st&&N!==Ci)return ms(st,{recursive:!0,force:!0}),Fe?.uiRoot;if(st)Tt.add(st);let Ar=st??Fe?.uiRoot;if(Ar)Ae.set(we,Ar);return Ar})();Ke.set(we,Gr);try{return await Gr}finally{Ke.delete(we)}}let ki=await Ti({username:"",passwordHash:"",role:"admin",sites:{}},E);if(!ki)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let G=new WeakMap,pe=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ce=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ce&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Re=!Ce,Nt=Qh(t),qt=Re?ey(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,ve=new ke(a.store,{encryptionKey:k(t)}),ut=new Be(a.store),et=new Rt(a.store),Ue=new Jt(a.store,{encryptionKey:k(t)}),Jr=new kn(a.store),fs=new xn(a.store,{cwd:t}),Pi=new _n(a.store,{encryptionKey:k(t)}),kt=new b(a.store,{workerId:`dashboard:${process.pid}`}),$t=new Gt(a.store),Ui=new Kt(a.store,k(t)),po=new Sr(a.store),Va=new Pr($t,kt,Ui),go=o.project?.region??"us-east-1",op=k(t),zn=new Er(po,{encryptionKey:op,backends:[new bt(a.store,op),new br(new q(go),go),new vr(new je(go),go),new Tr]});await en(zn,a,o);let Td=new ue(go),fb={aws_rds:new En(new Rn(Td)),aws_aurora:new wn(new Pn(Td)),aws_elasticache:new Cn(new Nn(new te(go))),server:new An(new rt),container:new In(new rt)},sp=(I)=>fb[I.provider],nr=new Un(a.store),$o=new Lr(nr,kt),ap=new Bn(Ui),hb={managed_database:new gu($t,Td),logical_database:new bu($t,Ui),volume:new vu,files:new yu(t),control_plane:new Iu(a.store,t),infrastructure:new Eu(new fa(go))},yb=(I)=>hb[I.resourceKind],bb=(I)=>I.provider==="aws_backup"?void 0:ap,Ad=new dt(a.store),kd=[new Dt,new qr(A(t,"volumes"))],zi=new Hr(Ad,kd,kt),sa=new Ie(a.store),Di=new mn(sa,[new tt("aws"),new tt("hetzner"),new tt("ssh")],kt),fo=new gn(a.store),cp=new fn(fo,sa),Mo=new hn(a.store),dp=new yn(Mo,kt),Vi=new Sn(a.store),Rd=new bn(Vi,kt),up=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((I)=>new vn(I,a.store,a.project.id,a.organization.id)),Ir=new $r(a.store),lp=new Mn(Ir,{queue:kt}),Ht=new qe(a.store),ho=new He(a.store),ii=new nt(a.store),Je=new pt(a.store,{encryptionKey:k(t)}),Sb=()=>lb(a.store);for(let I of a.environments.values())Or(Ir,o,{organization:a.organization,project:a.project,environment:I,resources:a.store.listResources(a.project.id,I.id)});let oi=new dr(Je,{emailImpl:async(I)=>{let{email:Ee}=await import("./chunk-ysv52qcc.js");return Ee.send(I)}}),pp=async(I)=>{let Ee=Wr(Je,a.project.id,I),Ne=[];for(let we of Ee.filter((ze)=>ze.notify&&ze.alert))Ne.push(...await oi.deliverAll(oi.enqueue(a.organization.id,we.alert,we.transition)));return Ne.push(...await oi.deliverAll(oi.enqueueRemindersAndEscalations(a.organization.id,Je.listAlerts(a.project.id,{environmentId:I,states:["firing"]})))),Ne.push(...await oi.retryDue()),{evaluations:Ee,deliveries:Ne}},Pd=!1,vb=async()=>{if(Pd)return;Pd=!0;try{for(let I of a.environments.values())for(let Ee of Je.listHealthChecks(a.project.id,I.id).filter((Ne)=>Ne.enabled)){let Ne=Je.listHealthResults(Ee.id,1)[0];if(Ne&&Date.now()-new Date(Ne.checkedAt).getTime()<Ee.intervalSeconds*1000)continue;let we=await new Oe(Je).runAndEvaluate(Ee);for(let ze of we.evaluations.filter((gt)=>gt.notify&&gt.alert))await oi.deliverAll(oi.enqueue(a.organization.id,ze.alert,ze.transition))}}finally{Pd=!1}},gp=setInterval(()=>{for(let I of a.environments.values())pp(I.id).catch((Ee)=>console.error("ts-cloud alert evaluation failed:",Ee))},60000);gp.unref?.();let mp=setInterval(()=>{vb().catch((I)=>console.error("ts-cloud health check evaluation failed:",I))},30000);mp.unref?.();let fp=setInterval(()=>{try{lp.tick()}catch(I){console.error("ts-cloud scheduled job evaluation failed:",I)}},30000);fp.unref?.();let hp=setInterval(()=>{try{$o.enqueueDue(),$o.enqueueRetention()}catch(I){console.error("ts-cloud backup policy evaluation failed:",I)}},30000);hp.unref?.(),Ht.cleanup();let yp=setInterval(()=>{try{Ht.cleanup()}catch(I){console.error("ts-cloud preview cleanup failed:",I)}},3600000);yp.unref?.();let wb=e.queueWorker??!0,Ib=cA(),Cb=async(I,Ee)=>{let we=(I.environmentId?a.store.listEnvironments(I.projectId).find((ze)=>ze.id===I.environmentId):void 0)?.slug??String(E);if(Ee.kind==="dashboard_operation"&&Ee.operationId){let ze=H.get(we)??D,gt=$n(Ee.operationId,o,ze);if(!gt||gt.danger||!["scheduler","backup","worker"].includes(gt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let N=await _r(o,we,gt);return{ok:N.ok,stdout:N.stdout,stderr:N.stderr??N.error,retryable:/temporar|unavailable|timeout|network/i.test(N.stderr??N.error??""),output:{command:N.command??null,operation:N.operation}}}if(Ee.kind==="serverless_scheduler"){let ze=await Xl(o,we,"run");return{ok:ze.ok,stdout:ze.stdout,stderr:ze.error,retryable:/temporar|unavailable|timeout|network/i.test(ze.error??""),output:{command:ze.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Ee.kind}.`}},qa=wb?new Qo(kt,{...$a({store:a.store,execute:async(I,Ee)=>{let Ne=Ee.operation.input&&typeof Ee.operation.input==="object"&&!Array.isArray(Ee.operation.input)?Ee.operation.input:{},we=Ne.source&&typeof Ne.source==="object"?Ne.source:void 0,ze=t,gt,N,Gr;try{if(we?.bindingId&&we?.connectionId&&we?.commitSha){let Qe=Ue.getBinding(String(we.bindingId)),st=Ue.getConnection(String(we.connectionId));if(!Qe||!st||Qe.connectionId!==st.id)throw Error("Queued source binding is no longer available");let gr=(Qe.repositoryId?Ue.getRepository(Qe.repositoryId):Ue.listRepositories(st.id).find((Ss)=>Ss.fullName.toLowerCase()===Qe.repositoryFullName.toLowerCase()))?.cloneUrl;if(!gr&&st.provider==="generic_ssh")gr=`git@${new URL(st.host).hostname}:${Qe.repositoryFullName}.git`;if(!gr)gr=new URL(`/${Qe.repositoryFullName}.git`,st.host.endsWith("/")?st.host:`${st.host}/`).href;let ye=Qe.deployKeyId?Ue.getDeployKey(Qe.deployKeyId):void 0,Mt=ye&&Qe.deployKeyId?{...ye,privateKey:Ue.getDeployPrivateKey(Qe.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(st.provider)&&I.target.previewId){let Ss=wo(st,Ue.getCredential(st.id)),de=Ht.previews.getInstance(I.target.previewId);Gr=async(si,Ka)=>{try{await Ss.setCommitStatus(Qe.repositoryFullName,String(we.commitSha),{state:si,url:de?.url,description:Ka})}catch(ws){Ee.log(`Could not publish source status: ${ws instanceof Error?ws.message:String(ws)}`,{stream:"stderr"})}},await Gr("pending",`Preview deployment started for ${String(we.commitSha).slice(0,12)}`)}gt=ip(Et(Cd(),"ts-cloud-queued-source-")),Ee.log(`Checking out immutable source commit ${we.commitSha}.`,{stream:"system"}),ze=(await Wd({remote:gr,binding:Qe,destination:Et(gt,"checkout"),ref:String(we.branch??Qe.defaultBranch),commitSha:String(we.commitSha)},{credential:Ue.getCredential(st.id),deployKey:Mt})).directory}if(Ee.operation.kind!=="preview.destroy"){let Qe=I.target.previewId?Ht.previews.getInstance(I.target.previewId):void 0,st=Qe?Ht.previews.getDefinition(Qe.definitionId):void 0,Ar=Ee.operation.resourceId?a.store.getResource(Ee.operation.resourceId):void 0;if(N=await zn.resolve({projectId:a.project.id,environmentId:Ee.operation.environmentId,resourceId:Ee.operation.resourceId,functionId:Ar?.kind==="function"?Ar.id:void 0,previewId:Qe?.id,trustedPreview:!!Qe&&!Qe.fork,allowedPreviewSecrets:st?.inheritedSecrets}),N.warnings.some((gr)=>gr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${N.warnings.filter((gr)=>gr.code==="missing_required").map((gr)=>gr.key).join(", ")}`);if(Ee.operation.resourceId)for(let gr of Object.values(N.entries))po.setDependency({entryId:gr.id,resourceId:Ee.operation.resourceId,injectionTarget:"environment",required:gr.required,requiresRedeploy:!0});Ee.log(`Resolved configuration ${N.configurationHash.slice(0,18)} for ${Object.keys(N.values).length} keys.`,{stream:"system"})}let rr=await np(I,{cwd:ze,cliEntry:i,signal:Ee.signal,env:N?.values,onOutput:(Qe,st)=>Ee.log(st,{stream:Qe,step:"execute",secrets:[...Ib,...Object.entries(N?.entries??{}).filter(([,Ar])=>Ar.kind==="secret").map(([Ar])=>N.values[Ar]).filter(Boolean)]})});if(rr.ok&&Ee.operation.resourceId&&N)for(let Qe of Object.values(N.entries))po.setDependency({entryId:Qe.id,resourceId:Ee.operation.resourceId,injectionTarget:"environment",required:Qe.required,requiresRedeploy:!1,lastDeployedVersion:Qe.version});return await Gr?.(rr.ok?"success":"failure",rr.ok?`Preview is ready at ${String(we?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(we?.commitSha).slice(0,12)}`),rr}catch(rr){throw await Gr?.("error",`Preview deployment could not complete at ${String(we?.commitSha).slice(0,12)}`),rr}finally{if(gt)ms(gt,{recursive:!0,force:!0})}}}),...Mg({store:Ir,executor:Cb}),...Hg({store:$t,secrets:Ui,resolveAdapter:sp}),...Nf(sa,Di.drivers),...th(Mo,[new Sl("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Hf({store:Vi,cleanup:up}),...xa(Ad,kd),...qg({store:nr,queue:kt,resolveSource:yb,resolveDestination:bb,validateHealth:async(I,Ee)=>{if(!I.healthCheckId)return{healthy:!0,mode:"adapter"};let Ne=Je.getHealthCheck(I.healthCheckId);if(!Ne||Ne.projectId!==I.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let we=await new Oe(Je).runAndEvaluate(Ne);return{healthy:we.result.status==="healthy",healthCheckId:Ne.id,healthResultId:we.result.id,target:Ee}}}),...Wp({store:a.store,resolveDriver:e.releaseDriver??((I)=>({name:`${a.store.getResource(I.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:I.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(I,Ee)=>{let Ne=Je.listHealthChecks(Ee.projectId,Ee.environmentId).find((ze)=>ze.enabled&&ze.name===I&&(!ze.resourceId||ze.resourceId===Ee.resourceId));if(!Ne)return{healthy:!1,message:`Named health gate ${I} was not found for this release.`};let we=await new Oe(Je).runAndEvaluate(Ne);return{healthy:we.result.status==="healthy",evidence:{healthCheckId:Ne.id,healthResultId:we.result.id,status:we.result.status,timings:we.result.timings},message:we.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(I)=>console.error("ts-cloud deployment queue worker failed:",I)}):void 0;if(On(a),od(et,ae(a,String(E)),D),qt)sd(a,qt.users),ny(ve,a,qt.users);let Bt=ty({cwd:t,enabled:Re,secret:Nt,authentication:ve,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(E)}}),or=new Il,bp=setInterval(()=>or.sweep(),60000);bp.unref?.();let Ja=new Ba,xd=new Ba(3,900000,900000),Wa=new Ba(8,900000,900000),Sp=setInterval(()=>Ja.prune(),300000),vp=setInterval(()=>xd.prune(),300000),wp=setInterval(()=>Wa.prune(),300000);if(Sp.unref?.(),vp.unref?.(),wp.unref?.(),Re){if(qt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${qt.generated.username}
     password: ${qt.generated.password}