@stacksjs/ts-cloud 0.16.22 → 0.16.23

package/dist/chunk-kw852q5m.js

@@ -1,709 +0,0 @@
-import{yd,O,d,Sd,L,p,ue,g,Ht,Td,ao,co,Nd,_d,xd,$d,jr,Ao,Wt,Md,Fd,jd,zd}from"./chunk-kpyhx96m.js";import{_,u}from"./chunk-mgg0psgc.js";import{le,Ot,R,Lt,s,ui,$s,Pr,Qc,Hc,Y,c,Us,He,Nr,Gc,$t,Hs,qc,kr,Gs,Br,mi,Ut,yi,Ii,Ge,Qt,ud,pd,Ci,Ei,gt,ro,i,bi,io,so}from"./chunk-pffebjr8.js";import{n,l}from"./chunk-y6k0vwfn.js";import{xt,o}from"./chunk-3zzm5f28.js";import{gn}from"./chunk-9p89msvs.js";import{mn,yu,ss,N,T,os,Iu}from"./chunk-2ap78e1s.js";import{he,rr,ls,Ze,j,ie,E,fe,sr,tt,ar}from"./chunk-p0b08g9f.js";import{z}from"./chunk-2dextjqf.js";import{b,gr,Ts,kt,mr,ku,Bt,_u,dc,Me,ot,qn,B,_t,br}from"./chunk-khatwx29.js";import{Ae}from"./chunk-badb5mf3.js";import{y}from"./chunk-9s24pbbc.js";import{xe}from"./chunk-w4s3rswa.js";import{ve}from"./chunk-np8vgbv0.js";import{h}from"./chunk-jt49qs0f.js";function sn(e){let t=$c(e.name),r=tp(e.configText);if(Iw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=uh({...e,name:t}),m=e.configText.slice(0,r.end).trimEnd(),f=e.configText.slice(r.end),v=m.endsWith("{")?`
-`:m.endsWith(",")?`
-
-`:`,
-
-`;return`${m}${v}${a}
-  ${f}`}function on(e){let t=$c(e.name),r=tp(e.configText),a=af(e.configText,r.start,r.end,t);if(!a)throw Error(`Site '${t}' does not exist in cloud.config.ts`);let m=e.configText,f=a.nameStart;while(f>0&&m[f-1]!==`
-`&&/\s/.test(m[f-1]))f--;let v=a.end+1;if(m[v]===",")v++;while(v<m.length&&m[v]!==`
-`&&/\s/.test(m[v]))v++;if(m[v]===`
-`)v++;return m.slice(0,f)+m.slice(v)}function Kl(e){let{configText:t,...r}=e,a=on({configText:t,name:r.name});return sn({configText:a,...r})}function Ki(e){let t=$c(e.siteName);if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e.key))throw Error(`Invalid property key '${e.key}'`);let r=tp(e.configText),a=af(e.configText,r.start,r.end,t);if(!a)throw Error(`Site '${t}' does not exist in cloud.config.ts`);let m=e.configText,f=m.indexOf("{",a.nameStart),v=a.end,w=m.slice(f+1,v),k=new RegExp(`(^|[\\s,{])(${rp(e.key)})\\s*:`,"m").exec(w);if(k){let x=f+1+k.index+k[1].length,F=m.indexOf(":",x),U=kw(m,F+1,v);return`${m.slice(0,x)}${e.key}: ${e.valueText}${m.slice(U)}`}let S=m.slice(0,v).trimEnd(),A=S.endsWith("{")||S.endsWith(",")?"":",";return`${S}${A}
-      ${e.key}: ${e.valueText},
-    ${m.slice(v)}`}function Wl(e){if(e===!1)return"false";if(e===!0)return"true";return`{ provider: '${no(e.provider||"letsencrypt")}' }`}function Jl(e){return`'${no(e)}'`}function Xl(e){let t=Object.entries(e).filter(([r])=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(r));if(t.length===0)return"{}";return`{
-${t.map(([r,a])=>`        ${r}: '${no(String(a))}',`).join(`
-`)}
-      }`}function Aa(e){return/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.trim())}function Yl(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];for(let r of t)if(!Aa(r))throw Error(`Alias '${r}' is not a valid hostname.`);if(t.length===0)return"[]";return`[${t.map((r)=>`'${no(r)}'`).join(", ")}]`}function Zl(e){let t=Object.entries(e).map(([r,a])=>[r.trim(),String(a).trim()]).filter(([r,a])=>r&&a);if(t.length===0)return"{}";return`{
-${t.map(([r,a])=>`        '${no(r)}': '${no(a)}',`).join(`
-`)}
-      }`}function kw(e,t,r){let a=t;while(a<r&&/\s/.test(e[a]))a++;let m=0,f,v=!1;for(;a<r;a++){let w=e[a];if(f){if(v){v=!1;continue}if(w==="\\"){v=!0;continue}if(w===f)f=void 0;continue}if(w==='"'||w==="'"||w==="`"){f=w;continue}if(w==="{"||w==="["||w==="("){m++;continue}if(w==="}"||w==="]"||w===")"){if(m===0)return a;m--;continue}if(w===","&&m===0)return a}return r}function af(e,t,r,a){let m=e.slice(t+1,r),f=new RegExp(`(^|[\\s,{])(${rp(a)})\\s*:\\s*\\{`,"m").exec(m);if(!f)return null;let v=t+1+f.index+f[1].length,w=e.indexOf("{",v);return{nameStart:v,end:cf(e,w)}}function uh(e){let r=[`    ${$c(e.name)}: {`];if(to(r,"deploy",e.deploy),to(r,"root",e.root),to(r,"path",e.path),to(r,"domain",e.domain),to(r,"type",e.type),to(r,"build",e.build),to(r,"start",e.start),e.port!==void 0)r.push(`      port: ${e.port},`);if(to(r,"pathRewriteStyle",e.pathRewriteStyle),e.ssl!==void 0)if(e.ssl===!1)r.push("      ssl: false,");else if(e.ssl===!0)r.push("      ssl: true,");else r.push(`      ssl: { provider: '${no(e.ssl.provider||"letsencrypt")}' },`);if(e.env&&Object.keys(e.env).length>0){r.push("      env: {");for(let[a,m]of Object.entries(e.env)){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(a))continue;r.push(`        ${a}: '${no(String(m))}',`)}r.push("      },")}return r.push("    },"),r.join(`
-`)}function no(e){return e.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'").replace(/\r/g,"\\r").replace(/\n/g,"\\n")}function $c(e){let t=e.trim();if(!/^[A-Za-z_$][\w$]*$/.test(t))throw Error(`Invalid site name '${e}'. Use a valid JavaScript object key, e.g. docs or marketingSite.`);return t}function to(e,t,r){if(r===void 0||r==="")return;let a=r.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'");e.push(`      ${t}: '${a}',`)}function tp(e){let t=/\bsites\s*:\s*{/g.exec(e);if(!t)throw Error("Could not find a top-level sites: { ... } block in cloud.config.ts");let r=e.indexOf("{",t.index),a=cf(e,r);return{start:r,end:a}}function Iw(e,t,r,a){let m=e.slice(t+1,r);return new RegExp(`(^|[\\s,{])${rp(a)}\\s*:`,"m").test(m)}function rp(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function cf(e,t){let r=0,a,m=!1,f=!1,v=!1;for(let w=t;w<e.length;w++){let k=e[w],S=e[w+1];if(f){if(k===`
-`)f=!1;continue}if(v){if(k==="*"&&S==="/")v=!1,w++;continue}if(a){if(m){m=!1;continue}if(k==="\\"){m=!0;continue}if(k===a)a=void 0;continue}if(k==="/"&&S==="/"){f=!0,w++;continue}if(k==="/"&&S==="*"){v=!0,w++;continue}if(k==='"'||k==="'"||k==="`"){a=k;continue}if(k==="{")r++;if(k==="}"){if(r--,r===0)return w}}throw Error("Could not find the closing brace for sites: { ... } in cloud.config.ts")}function eu(e){let{configText:t,owner:r}=e,a=[...t.matchAll(/\n( {2})cloud: \{\n([\s\S]*?)\n\1\},\n/g)],[m]=a;if(!m)throw Error("No `cloud: { ... }` block found in the cloud config");if(a.length>1)throw Error(`Found ${a.length} \`cloud: { ... }\` blocks in the cloud config, so which one to edit is ambiguous`);let[f,v,w]=m;if(v===void 0||w===void 0)throw Error("The `cloud: { ... }` block did not parse into an indent and a body");if(w.includes("{"))throw Error("The `cloud: { ... }` block holds a nested object, which this edit does not attempt to rewrite");let k=w.match(/^\s*attachTo:\s*(['"])([^'"]*)\1\s*,?\s*$/m);if(k){let[A,x="'",F=""]=k;if(F===r)return t;return t.replace(f,f.replace(A,A.replace(`${x}${F}${x}`,`'${r}'`)))}let S=`${v}  `;return t.replace(f,f.replace(`
-${v}},
-`,`
-${S}// Deploy onto the box '${r}' owns rather than provisioning one.
-${S}attachTo: '${r}',
-${v}},
-`))}import{createHash as Ew}from"node:crypto";function Rw(e){return Ew("sha256").update(ts(e)).digest("hex")}function ts(e){if(Array.isArray(e))return`[${e.map((t)=>ts(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${ts(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function C(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function tu(e,t){let r=new ui({cwd:e}),a=Rw(t),m=r.getProjectBySlug(t.project.slug),f=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,v=(m?.organizationId?r.getOrganization(m.organizationId):void 0)??r.getOrganizationBySlug(f)??r.createOrganization({id:m?.organizationId,slug:f,name:t.project.name}),w=m?m.name!==t.project.name||m.desiredConfigHash!==a||m.organizationId!==v.id?r.updateProject(m.id,m.version,{name:t.project.name,organizationId:v.id,desiredConfigHash:a}):m:r.createProject({organizationId:v.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),k=new Map;for(let[F,U]of Object.entries(t.environments??{})){let K=r.getEnvironmentBySlug(w.id,F)??r.createEnvironment({projectId:w.id,slug:F,name:F.replace(/(^|[-_])(\w)/g,(ce,Ee,Re)=>Re.toUpperCase()),kind:String(U?.type??F),region:U?.region??t.project.region,desiredState:s(U)});k.set(F,K);let X=new Map(r.listResources(w.id,K.id).map((ce)=>[`${ce.kind}:${ce.slug}`,ce])),oe=(ce,Ee,Re,de)=>{let je=`${ce}:${Ee}`,ae=X.get(je),Le=s(de);if(ae){if(ae.name!==Re||ts(ae.desiredState)!==ts(Le))X.set(je,r.updateResource(ae.id,ae.version,{name:Re,desiredState:Le}));return}let rt=r.createResource({projectId:w.id,environmentId:K.id,kind:ce,slug:Ee,name:Re,provider:t.cloud?.provider,desiredState:Le,metadata:{source:"cloud-config"}});X.set(je,rt)};for(let[ce,Ee]of Object.entries(t.sites??{}))oe("application",ce,ce,Ee);let pe=U?.app;if(pe)for(let ce of["http","queue","cli"])oe("function",ce,`${ce.toUpperCase()} function`,{...s(pe),function:ce});let ee=t.infrastructure;for(let[ce,Ee]of Object.entries(ee?.functions??{}))oe("function",ce,ce,Ee);if(ee?.compute)oe("server",`${w.slug}-server`,w.name,{...s(ee.compute),label:w.name});for(let[ce,Ee]of Object.entries(ee?.databases??{}))oe("database",ce,ce,Ee);if(ee?.appDatabase)oe("database","application-database","Application database",ee.appDatabase);else if(ee?.database)oe("database","application-database","Application database",{engine:ee.database})}let S=new c(r).recoverExpired(),A=r.reconcileOrphanedOperations({policy:"fail"}),x={requeued:S.requeued+A.requeued,failed:S.failed+S.cancelled+A.failed};return{store:r,organization:v,project:w,environments:k,reconciliation:x}}var Aw=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Wi(e,t){let{store:r,organization:a,project:m}=e,f=new Set;for(let v of t){let w=C(r,v);f.add(w.id);let k=r.getMembershipForActor(a.id,w.id);if(k&&k.source!=="legacy")continue;let S=r.listResources(m.id).filter((H)=>H.kind==="application"&&Object.hasOwn(v.sites,H.slug)),A=v.role==="admin"?"owner":"viewer",x=v.role==="admin"||S.length===0?{type:"organization"}:{type:"resource",id:S[0].id},F=k?k.roleTemplate!==A||ts(k.scope)!==ts(x)?r.updateMembership({id:k.id,roleTemplate:A,scope:x,actorId:w.id}):k:r.createMembership({organizationId:a.id,actorId:w.id,roleTemplate:A,scope:x,source:"legacy"}),U=new Set;if(v.role==="member"&&S.length===0)for(let H of Ot("viewer"))U.add(`deny|${H}|organization|`);for(let H of S){let K=v.sites[H.slug];for(let X of Aw)U.add(`allow|${X}|resource|${H.id}`);if(K==="owner")U.add(`allow|config:write|resource|${H.id}`)}for(let H of r.listGrants(F.id).filter((K)=>K.source==="legacy")){let K=`${H.effect}|${H.capability}|${H.scope.type}|${H.scope.id??""}`;if(!U.has(K))r.removeGrant(H.id,w.id)}for(let H of U){let[K,X,oe,pe]=H.split("|");r.upsertGrant({organizationId:a.id,membershipId:F.id,effect:K,capability:X,scope:oe==="organization"?{type:"organization"}:{type:oe,id:pe},source:"legacy"})}}for(let v of r.listMemberships(a.id))if(v.source==="legacy"&&!f.has(v.actorId))r.revokeMembership(v.id)}async function ke(e){let{controlPlane:t,environment:r,actor:a}=e,m=C(t.store,a),f=t.environments.get(r),v=e.resourceSlug&&f?t.store.listResources(t.project.id,f.id).find((A)=>A.slug===e.resourceSlug):void 0,w=new c(t.store,{workerId:`dashboard:${process.pid}`}),k=w.enqueue({projectId:t.project.id,environmentId:f?.id,resourceId:v?.id,actorId:m.id,kind:e.kind,input:e.input??{},lockKey:v?`resource:${v.id}`:f?`environment:${f.id}`:`project:${t.project.id}`,providerKey:v?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!w.claim(k.id)?.operation)throw Error(`Could not claim control-plane operation ${k.id}`);try{let A=await e.execute(),x=typeof A.stdout==="string"?String(A.stdout):"",F=typeof A.stderr==="string"?String(A.stderr):"";if(x)w.appendLog(k.id,x,{stream:"stdout"});if(F)w.appendLog(k.id,F,{stream:"stderr"});let U=A.ok?w.complete(k.id,df(A)):w.fail(k.id,Cw(A),df(A));return{result:A,operation:U}}catch(A){throw w.fail(k.id,A instanceof Error?A.message:String(A),{ok:!1,threw:!0}),A}}function Cw(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function df(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",m={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")m.operation=t.operation;if(typeof t.error==="string")m.error=t.error;return s(m)}var ru=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],Pw=new Map(ru.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function nu(e){return Pw.get(e)}function Sy(e,t){return ru.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Nc=()=>{};async function iu(e,t=Nc){for(let r of e){let a=new o(r.replicaRegion),m;try{m=await a.headBucket(r.replicaBucket)}catch(f){if(f?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(f?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw f}if(m.exists&&m.region&&m.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${m.region}, not ${r.replicaRegion}.`);if(!m.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function su(e,t,r=Nc){for(let a of e){let m=t[a.distributionArnOutput];if(!m)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let f=new o(a.replicaRegion),k={Version:"2012-10-17",Statement:[...((await f.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((S)=>S?.Sid!==co),Nd({replicaBucket:a.replicaBucket,distributionArn:m})]};r(`Granting ${m} read access to ${a.replicaBucket}`),await f.putBucketPolicy(a.replicaBucket,k)}}async function ou(e,t=Nc){let r={};for(let a of e){let m=new o(a.primaryRegion),f=new o(a.replicaRegion),[v,w]=await Promise.all([m.listAllObjects({bucket:a.primaryBucket}),f.listAllObjects({bucket:a.replicaBucket})]),k=new Map(w.map((A)=>[A.Key,A.Size])),S=v.filter((A)=>k.get(A.Key)!==A.Size);for(let A of S)await f.copyObject({sourceBucket:a.primaryBucket,sourceKey:A.Key,destinationBucket:a.replicaBucket,destinationKey:A.Key});if(S.length>0)t(`Copied ${S.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=S.length}return r}async function au(e,t=Nc){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import oo from"node:process";import{existsSync as _w}from"node:fs";import{join as Tw}from"node:path";async function cu(e){let t=Date.now(),r=e.sourceDir??"dist";if(!_w(Tw(r,"index.html")))return np(t,`${r}/ has no index.html — build first.`);if(!oo.env.AWS_ACCESS_KEY_ID||!oo.env.AWS_SECRET_ACCESS_KEY)return np(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=xw(e.dnsProvider);if("error"in a)return np(t,a.error);let m=await gn({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!m.success,domain:m.domain,url:m.domain?`https://${m.domain}`:m.distributionDomain?`https://${m.distributionDomain}`:void 0,bucket:m.bucket,distributionId:m.distributionId,distributionDomain:m.distributionDomain,certificateArn:m.certificateArn,filesUploaded:m.filesUploaded,filesSkipped:m.filesSkipped,message:m.message,durationMs:Date.now()-t}}function xw(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??oo.env.PORKBUN_API_KEY,m=r?.secretKey??oo.env.PORKBUN_SECRET_KEY??oo.env.PORKBUN_SECRET_API_KEY;if(!a||!m)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:m}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??oo.env.GODADDY_API_KEY,m=r?.secretKey??oo.env.GODADDY_API_SECRET,f=r?.environment??oo.env.GODADDY_ENVIRONMENT;if(!a||!m)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:m,environment:f}}return{error:`Unsupported DNS provider: ${t.provider}`}}function np(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as Dw}from"node:crypto";var Ow=`let coldStart = true
-const initializedAt = new Date().toISOString()
-export const handler = async (event) => {
-  const currentColdStart = coldStart
-  coldStart = false
-  const path = event.rawPath || event.requestContext?.http?.path || '/'
-  const statusCode = path === '/api/health' || path === '/health' ? 200 : 404
-  return {
-    statusCode,
-    headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
-    body: JSON.stringify({ ok: statusCode === 200, service: 'ts-cloud-static-api', path, coldStart: currentColdStart, initializedAt })
-  }
-}
-`;function pf(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function $w(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(pf(e))}function lf(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(pf(e))}function uf(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function ip(e){let t=e?.Aliases?.Items;if(Array.isArray(t))return t.map(String);if(typeof t==="string")return[t];return[]}function Nw(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let m=e.memorySize??256,f=e.timeout??10,v=e.logRetentionDays??14;if(m<128||m>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(f<1||f>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:m,timeout:f,logRetentionDays:v}}function ph(e){let t=e.region||"us-east-1";return{cloudfront:new y(e.profile),iam:new Ae(t,e.profile),lambda:new E(t,e.profile),logs:new fe(t,e.profile),sts:new he(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function Cy(e,t){let r=Nw(e),a=t||ph({profile:e.profile,region:r.region}),[m,f,v]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!m.Account)throw Error("AWS identity did not return an account ID");if(!f.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(ip(f).length?ip(f):ip(v.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let k,S=!0;try{k=await a.iam.getRole({RoleName:r.roleName})}catch(st){if(!$w(st))throw st;S=!1}let A=k?.Arn||`arn:aws:iam::${m.Account}:role/${r.roleName}`,x=await a.lambda.functionExists(e.functionName),F=x?await a.lambda.getFunctionUrl(e.functionName):null,U=await a.cloudfront.listOriginAccessControls(),H=`${e.functionName}-lambda-url`,K=U.some((st)=>st.Name===H&&st.OriginAccessControlOriginType==="lambda"),X=uf(v.DistributionConfig.Origins,"Origin"),oe=uf(v.DistributionConfig.CacheBehaviors,"CacheBehavior"),pe=X.some((st)=>String(st.Id)===r.originId),ee=oe.some((st)=>String(st.PathPattern)===r.pathPattern),ce=[...!S?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...x?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!F?["create private AWS_IAM function URL"]:[],...!K?[`create Lambda origin access control ${H}`]:[],"grant CloudFront function-URL and invocation permissions",`${ee?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],Ee={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!x,removeRole:!S},Re={mode:e.apply?"apply":"plan",accountId:m.Account,identityArn:m.Arn,distribution:{id:f.Id,arn:f.ARN,alias:e.expectedAlias,domainName:f.DomainName,status:f.Status},function:{name:e.functionName,existed:x,runtime:"nodejs22.x",urlExisted:!!F,url:F?.FunctionUrl},role:{name:r.roleName,existed:S,arn:A},origin:{id:r.originId,pathPattern:r.pathPattern,existed:pe,behaviorExisted:ee,accessControlExisted:K},changes:ce,rollback:Ee,applied:!1};if(!e.apply)return Re;let de=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==de)throw Error(`Pass exact confirmation token ${de} to mutate the live distribution`);if(!k)k=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${m.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(st){if(!lf(st))throw st}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let je=e.code||Ow;if(x)await a.lambda.updateFunctionCodeInline(e.functionName,je,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:k.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let st;for(let Dt=0;Dt<8;Dt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:k.Arn,Handler:"index.handler",Code:je,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),st=void 0;break}catch(or){if(st=or,!String(or.message).toLowerCase().includes("role"))throw or;await a.sleep(1000)}if(st)throw st}await a.lambda.waitForFunctionActive(e.functionName);let ae=F||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ae.FunctionUrl)throw Error("Lambda did not return a function URL");let Le=new URL(ae.FunctionUrl).hostname,rt=await a.cloudfront.findOrCreateOriginAccessControl(H,"lambda"),mt=f.ARN||`arn:aws:cloudfront::${m.Account}:distribution/${e.distributionId}`,ir=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:mt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:mt,InvokedViaFunctionUrl:!0}];for(let st of ir)try{await a.lambda.addPermission(st)}catch(Dt){if(!lf(Dt))throw Dt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Le,pathPattern:r.pathPattern,originAccessControlId:rt.Id}),{...Re,function:{...Re.function,url:ae.FunctionUrl},applied:!0}}async function Ey(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),m=new Uint8Array(await a.arrayBuffer()),f=Dw("sha256").update(m).digest("hex"),v=Date.now(),w=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),k=Date.now()-v,S=await w.text(),A=S;try{A=JSON.parse(S)}catch{}let x;if(e.logs&&e.functionName){let F=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:v-60000,filterPattern:'"Init Duration"',limit:25});for(let U of F.events||[]){let H=U.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(H)x=Number(H[1])}}return{frontend:{url:t,status:a.status,sha256:f,unchanged:e.expectedFrontendSha256?f===e.expectedFrontendSha256:void 0,bytes:m.byteLength},api:{url:r,status:w.status,latencyMs:k,healthy:w.ok&&!!A?.ok,body:A},coldStart:{observed:x!==void 0,initDurationMs:x},verifiedAt:(e.now?.()||new Date).toISOString()}}function by(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),m=r/1e6*0.2+a*0.0000166667,f=9.010025,v=16.425;return{lambdaUsd:Number(m.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as jw}from"node:crypto";function Mw(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Bw(e){return Mw(e)==="ValidationError"&&String(e.message).includes("does not exist")}function Lw(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Fw(e){let t=e?.Aliases?.Items??e?.Aliases;if(Array.isArray(t))return t.map(String);if(typeof t==="string")return[t];return[]}function mf(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let m=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(m))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:m,digest:t}}function gh(e){let t=e.region||"us-east-1";return{cloudformation:new h(t,e.profile),cloudfront:new y(e.profile),sts:new he(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function mh(e){let t=mf(e),r=xd({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=_d(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function zw(e,t,r){let a;for(let m=0;m<30;m++){let f=Date.now();try{let v=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),w=Date.now()-f,k=await v.text(),S=k;try{S=JSON.parse(k)}catch{}if(v.ok)return{url:t,status:v.status,latencyMs:w,body:S};a=Error(`origin returned ${v.status}`)}catch(v){a=v}if(m<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function vy(e,t){let r=mf(e),a=t||gh({region:r.region,profile:e.profile}),[m,f]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!m.Account)throw Error("AWS identity did not return an account ID");if(!f.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!Fw(f).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let v;try{v=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(ce){if(!Bw(ce))throw ce}let w=mh(e),k=JSON.stringify(w);if(Buffer.byteLength(k)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let S=Object.values(w.Resources||{}).reduce((ce,Ee)=>(ce[Ee.Type]=(ce[Ee.Type]||0)+1,ce),{}),A=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],x={mode:e.apply?"apply":"plan",accountId:m.Account,stack:{name:r.stackName,existed:!!v,status:v?.StackStatus,templateSha256:jw("sha256").update(k).digest("hex"),resourceCount:Object.keys(w.Resources||{}).length,resourceTypes:S},distribution:{id:f.Id,alias:e.expectedAlias,domainName:f.DomainName,status:f.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:A};if(!e.apply)return x;let F=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==F)throw Error(`Pass exact confirmation token ${F} to provision the backend and change live routing`);if(v)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:k,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(ce){if(!String(ce.message).includes("No updates are to be performed"))throw ce}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:k,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let U=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],H=Lw(U?.Outputs),K=H.AppLoadBalancerDnsName;if(!K)throw Error("Backend stack did not return AppLoadBalancerDnsName");let X=!1;if(e.originDomain&&e.originDomain!==K){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${K}`);let ce=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:K,ttl:300});if(!ce.success)throw Error(ce.message||"External DNS update failed");X=!0}let oe=e.originDomain||K,pe=e.certificateArn?"https-only":"http-only",ee=e.skipHealthCheck?void 0:await zw(a,`${pe==="https-only"?"https":"http"}://${oe}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:oe,pathPattern:r.pathPattern,protocolPolicy:pe,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...x,outputs:H,health:ee,cloudFrontApplied:!0,dnsApplied:X,applied:!0}}function Ty(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,m)=>a+m,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,m])=>[a,Number(m.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as Uw}from"node:child_process";import{createHash as qw}from"node:crypto";import{existsSync as gf,mkdirSync as Vw,mkdtempSync as Ww,readdirSync as Hw,readFileSync as Kw,rmSync as Jw,statSync as ff,writeFileSync as Gw}from"node:fs";import{tmpdir as Qw}from"node:os";import{basename as Yw,join as Ds,relative as Zw,resolve as op}from"node:path";var Xw=new Set([".git","node_modules","dist","coverage"]);function hf(e,t=e){let r=[];for(let a of Hw(e).sort()){if(Xw.has(a))continue;let m=Ds(e,a);if(Sd(m,t))continue;let f=ff(m);if(f.isDirectory())r.push(...hf(m,t));else if(f.isFile())r.push(Zw(t,m))}return r}function hh(e){let t=op(e);if(!gf(t)||!ff(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=qw("sha256");for(let a of hf(t))r.update(a),r.update("\x00"),r.update(Kw(Ds(t,a))),r.update("\x00");return r.digest("hex")}function fh(e){return{ecr:new xe(e.region||"us-east-1",e.profile),run:(t,r,a)=>{Uw(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function wy(e,t){let r=op(e.context),a=op(e.dockerfile||Ds(r,"Dockerfile"));if(!gf(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((H)=>/^[a-z0-9][a-z0-9._-]*$/.test(H)&&!/[._-]$/.test(H)&&!/[._-]{2}/.test(H)))throw Error("ECR repository name is invalid");let v=t||fh(e),w=hh(r),k=`sha-${w.slice(0,20)}`,S="";try{S=(await v.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!S)S=(await v.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!S)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await v.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let A=`${S}:${k}`,x=Ww(Ds(Qw(),"ts-cloud-container-"));try{v.run("docker",["version"],{stdio:"ignore"}),v.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",A,r],{cwd:r});let H=(await v.ecr.getAuthorizationToken()).authorizationData?.[0];if(!H?.authorizationToken||!H.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let K=H.proxyEndpoint.replace(/^https?:\/\//,""),X=Ds(x,"docker");Vw(X,{recursive:!0}),Gw(Ds(X,"config.json"),JSON.stringify({auths:{[K]:{auth:H.authorizationToken}}}),{mode:384}),v.run("docker",["push",A],{env:{...process.env,DOCKER_CONFIG:X}})}finally{Jw(x,{recursive:!0,force:!0})}let U=(await v.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:k}]})).imageDetails?.[0]?.imageDigest;if(!U||!/^sha256:[a-f0-9]{64}$/i.test(U))throw Error(`ECR did not return an immutable digest for ${Yw(A)}`);return{repository:e.repository,tag:k,imageUri:A,digest:U,digestUri:`${S}@${U}`,contextSha256:w}}import{existsSync as ek,readdirSync as tk,readFileSync as rk,statSync as nk}from"node:fs";import{join as yf,relative as ik}from"node:path";function ns(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,m=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:m,stackName:Ht(e,t),artifactBucket:Td(a,t),assetsBucket:ao(a,t)}}async function rs(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(m){let f=m?.code||m?.name||"",v=String(m?.message||"");if(f==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(v)){r=m,await new Promise((w)=>setTimeout(w,3000));continue}throw m}throw r}var vf=(e,t)=>`releases/${e}/${t}/current.json`;async function Mc(e,t,r,a){try{return await e.getObjectJson(t,vf(r,a))}catch{return null}}async function bf(e,t,r,a,m){await e.putObjectJson(t,vf(r,a),m)}async function ok(e,t){if(!e.secrets)return{};let r=new j(t),a={},m=Array.isArray(e.secrets)?e.secrets.map((f)=>({envName:f.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:f})):Object.entries(e.secrets).map(([f,v])=>({envName:f,secretId:v}));if(Array.isArray(e.secrets)){let f=new Map;for(let{envName:w,secretId:k}of m)f.set(w,[...f.get(w)??[],k]);let v=[...f.entries()].filter(([,w])=>w.length>1);if(v.length){let w=v.map(([k,S])=>`${k} ← ${S.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${w}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:f,secretId:v}of m){let k=(await r.getSecretValue({SecretId:v})).SecretString??"";try{let S=JSON.parse(k);if(S&&typeof S==="object"&&!Array.isArray(S)){for(let[A,x]of Object.entries(S))a[A]=String(x);continue}}catch{}a[f]=k}return a}function Ji(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function er(e,t,r,a,m,f,v,w={}){let k=e.kind==="php"?jd({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...k,...w,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...v?{TSCLOUD_QUEUE:v,SQS_QUEUE:v}:{},...f?{ASSET_URL:f}:{},...e.env??{},...m}}function sk(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*Sf(e){for(let t of tk(e)){let r=yf(e,t);if(nk(r).isDirectory())yield*Sf(r);else yield r}}async function ak(e,t,r,a,m=!1){let f=0;for(let v of Sf(r)){let w=ik(r,v).replace(/\\/g,"/");if(!m&&w.split("/").some((k)=>k.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${w}`,body:rk(v),contentType:sk(v),cacheControl:"public, max-age=31536000, immutable"}),f++}return f}function ck(e,t){let r=Object.entries(t).reduce((a,[m,f])=>a+Buffer.byteLength(`${m}=${f}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([m,f])=>[m,Buffer.byteLength(`${m}=${f}`,"utf8")]).sort((m,f)=>f[1]-m[1]).slice(0,5).map(([m,f])=>`${m} (${f}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function Za(e,t,r,a){ck(t,r),await rs(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let m=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await rs(()=>e.updateFunctionCode(m)),await e.waitForFunctionActive(t,120)}async function jc(e,t){let a=(await rs(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await rs(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function ya(e,t,r={}){let a=ns(e,t),{app:m,slug:f,region:v,stackName:w,artifactBucket:k}=a,S=r.projectRoot??process.cwd();os(`Deploying serverless app: ${f} (${t})`),N(`Stack: ${w}`),N(`Region: ${v}`);let A=new o(v),x=new h(v),F=new E(v),U=m.kind==="php",H=m.packaging==="image",K=Ao(m),X,oe,pe,ee,ce=[];if(H&&K.usesLayer&&K.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${K.kind}${K.kind==="node"?` ${K.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(H){T("Building + pushing container image");let{buildAndPushServerlessImage:we}=await import("./chunk-whdbz3h8.js"),De=await we({app:m,projectRoot:S,region:v,repository:`${f}-${t}`,skipBuild:r.skipBuild,onStep:(ht)=>N(`  ${ht}`)});X=De.handlers,oe={kind:"image",imageUri:De.imageUri},pe=De.tag,ce.push({ParameterKey:"ImageUri",ParameterValue:De.imageUri})}else{T("Packaging application");let we=U?zd({projectRoot:S,app:m,skipBuild:r.skipBuild,onStep:(Nt)=>N(`  ${Nt}`)}):await jr({projectRoot:S,app:m,skipBuild:r.skipBuild,onStep:(Nt)=>N(`  ${Nt}`)}),De=$d(f,t,we.sha256);if(N(`Artifact: ${we.sha256.slice(0,12)} (${(we.zip.length/1024).toFixed(0)} KB)`),X=we.handlers,pe=we.sha256,K.usesLayer){let Nt=K.layerEnvVar?process.env[K.layerEnvVar]:void 0;if(ee=m.layers??(Nt?[Nt]:void 0),!ee?.length){let $e=K.layerKind==="php"?"serverless:build-php-layer":K.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${K.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${K.layerEnvVar} env var (build one with \`cloud ${$e}\`)${K.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await A.bucketExists(k))T(`Creating artifact bucket ${k}`),await A.createBucket(k);if(await A.headObject(k,De).then((Nt)=>Nt!==null).catch(()=>!1))N("Artifact already uploaded — reusing");else T("Uploading artifact"),await A.putObject({bucket:k,key:De,body:we.zip,contentType:"application/zip"});oe={kind:"zip",bucket:k,key:De},ce.push({ParameterKey:"ArtifactBucket",ParameterValue:k},{ParameterKey:"ArtifactKey",ParameterValue:De})}let Ee=Fd({config:e,environment:t,app:m,handlers:X,runtimeLayers:ee}),Re=JSON.stringify(Ee.template),de=["CAPABILITY_NAMED_IAM"],je=await x.describeStacks({stackName:w}).then((we)=>we.Stacks[0]?.StackStatus).catch(()=>{return}),ae=je!==void 0;if(je&&/DELETE_IN_PROGRESS/.test(je))T("Waiting for an in-progress stack delete to finish"),await x.waitForStack(w,"stack-delete-complete").catch(()=>{}),ae=!1;else if(je&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(je))T(`Deleting unusable stack (status ${je}) before recreate`),await x.deleteStack(w),await x.waitForStack(w,"stack-delete-complete").catch(()=>{}),ae=!1;T(ae?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ae)await x.updateStack({stackName:w,templateBody:Re,parameters:ce,capabilities:de}),await x.waitForStack(w,"stack-update-complete");else await x.createStack({stackName:w,templateBody:Re,parameters:ce,capabilities:de,onFailure:"DELETE"}),await x.waitForStack(w,"stack-create-complete")}catch(we){if(/No updates are to be performed/i.test(String(we?.message)))N("No infrastructure changes");else throw we}let Le=await x.getStackOutputs(w).catch(()=>({})),rt;if(m.assets){let we=yf(S,m.assets);if(ek(we)){let De=m.assetDomain||Le.AssetsCdnDomain;rt=De?`https://${De}/${pe}`:void 0,T(`Syncing assets from ${m.assets}`);let ht=await ak(A,a.assetsBucket,we,pe,m.dotFilesAsAssets);N(`Uploaded ${ht} asset(s)${rt?` → ${rt}`:""}`)}else ss(`Assets directory not found: ${we}`)}T("Resolving secrets");let mt=await ok(m,v);if(m.database?.connection==="aurora-serverless")try{let De=await new j(v).getSecretValue({SecretId:`${f}/${t}/db`}),ht=JSON.parse(De.SecretString??"{}");if(ht.username)mt.DB_USERNAME=ht.username;if(ht.password)mt.DB_PASSWORD=ht.password}catch(we){ss(`Could not resolve Aurora DB credentials: ${we.message}`)}if(!await A.bucketExists(k))await A.createBucket(k);let ir=await Mc(A,k,f,t),st={},Dt=Ee.queueNames[0],or=Ji(m,Le);if(T("Activating functions"),st.http=er(m,a,t,"http",mt,rt,Dt,or),await Za(F,Ee.functionNames.http,st.http,oe),st.cli=er(m,a,t,"cli",mt,rt,Dt,or),await Za(F,Ee.functionNames.cli,st.cli,oe),Ee.queueNames.length)st.queue=er(m,a,t,"queue",mt,rt,Dt,or),await Za(F,Ee.functionNames.queue,st.queue,oe);let lt=(m.provisionedConcurrency??0)>0,Q={};if(lt){if(T("Publishing versions + flipping live alias"),Q.http=await jc(F,Ee.functionNames.http),Q.cli=await jc(F,Ee.functionNames.cli),Ee.queueNames.length)Q.queue=await jc(F,Ee.functionNames.queue)}if(await bf(A,k,f,t,{sha:pe,code:oe,previousSha:ir?.sha,previousCode:ir?.code,previousFunctionEnv:ir?.functionEnv,...lt?{functionVersions:Q,previousFunctionVersions:ir?.functionVersions}:{},functionEnv:st,functionNames:{http:Ee.functionNames.http,cli:Ee.functionNames.cli,...Ee.queueNames.length?{queue:Ee.functionNames.queue}:{}},assetUrl:rt,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&m.deploy?.length){T("Running deploy hooks");for(let we of m.deploy){N(`  deploy: ${we}`);let De=await F.invoke({FunctionName:Ee.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:we},LogType:"Tail"});if(De.FunctionError)throw yu("Deploy hook failed — the new build is ALREADY LIVE."),N(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${we}): ${De.Payload}`)}}let ye=Le.HttpApiEndpoint;if(!r.skipHealthCheck&&ye){T("Health check");try{let we=await fetch(ye,{method:"GET"});N(`GET ${ye} → ${we.status}`)}catch(we){ss(`Health check could not reach ${ye}: ${we.message}`)}}Iu(["Serverless deploy complete","",ye?`URL:   ${ye}`:"",`Stack: ${w}`,`Build: ${pe.slice(0,12)}`].filter(Boolean).join(`
-`),"green")}async function an(e,t){let r=ns(e,t),a=new o(r.region),m=new E(r.region),f=await Mc(a,r.artifactBucket,r.slug,t);if(!f)throw Error("No previous release to redeploy. Run a full deploy first.");os(`Redeploying ${r.slug} (${t}) — build ${f.sha.slice(0,12)}`);for(let[v,w]of Object.entries(f.functionNames)){if(!w)continue;T(`Re-activating ${v} (${w})`),await Za(m,w,f.functionEnv[v]??{},f.code);let k=f.functionVersions?.[v];if(k)await rs(()=>m.updateAlias({FunctionName:w,Name:"live",FunctionVersion:k}))}mn("Redeploy complete")}async function cn(e,t){let r=ns(e,t),a=new o(r.region),m=new E(r.region),f=await Mc(a,r.artifactBucket,r.slug,t);if(!f?.previousCode)throw Error("No previous release to roll back to.");os(`Rolling back ${r.slug} (${t}) → ${f.previousSha?.slice(0,12)}`);for(let[v,w]of Object.entries(f.functionNames)){if(!w)continue;T(`Restoring ${v} (${w})`);let k=f.previousFunctionEnv?.[v]??f.functionEnv[v]??{};await Za(m,w,k,f.previousCode);let S=f.previousFunctionVersions?.[v];if(S)await rs(()=>m.updateAlias({FunctionName:w,Name:"live",FunctionVersion:S}))}await bf(a,r.artifactBucket,r.slug,t,{...f,sha:f.previousSha??f.sha,code:f.previousCode,functionEnv:f.previousFunctionEnv??f.functionEnv,functionVersions:f.previousFunctionVersions??f.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),mn("Rollback complete")}async function tr(e,t,r,a){let m=ns(e,t),f=new E(m.region),v=`${m.slug}-${t}-http`,k={...(await f.getFunction(v)).Configuration?.Environment?.Variables??{}};if(k.MAINTENANCE_MODE=r?"1":"0",r&&a)k.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete k.MAINTENANCE_BYPASS_SECRET;if(await rs(()=>f.updateFunctionConfiguration({FunctionName:v,Environment:{Variables:k}})),(m.app.provisionedConcurrency??0)>0)await f.waitForFunctionActive(v,120),await jc(f,v);mn(r?"Application is now in maintenance mode (503)":"Application is live")}async function Ye(e,t,r){let a=ns(e,t),m=new E(a.region),f=`${a.slug}-${t}-cli`,v=await m.invoke({FunctionName:f,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(v.FunctionError)throw Error(`Command failed: ${v.Payload}`);return v.Payload??""}async function Tr(e,t){let r=ns(e,t),a=new h(r.region),m=new E(r.region),f=new o(r.region),v="not deployed",w={};try{let{Stacks:H}=await a.describeStacks({stackName:r.stackName});v=H?.[0]?.StackStatus??v;for(let K of H?.[0]?.Outputs??[])if(K.OutputKey)w[K.OutputKey]=K.OutputValue??""}catch{}let k=Md(r.app,r.slug,t),S=r.app.provisionedConcurrency??0,A=["http","cli",...k.length?["queue"]:[]],x=`${r.slug}-${t}`,F=[];for(let H of A){let K=`${x}-${H}`,X={mode:H,name:K,version:"$LATEST"};if(S>0){let oe=await m.getAlias(K,"live").catch(()=>null);if(oe?.FunctionVersion){X.version=oe.FunctionVersion;let pe=await m.getProvisionedConcurrencyConfig(K,"live").catch(()=>null);if(pe)X.provisioned={status:pe.Status??"-",allocated:pe.AllocatedProvisionedConcurrentExecutions??0,requested:pe.RequestedProvisionedConcurrentExecutions??0}}}F.push(X)}let U=await Mc(f,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:v,endpoint:w.HttpApiEndpoint,assetUrl:U?.assetUrl,scheduler:r.app.scheduler??"on",queues:k,provisionedConcurrency:S,functions:F,lastRelease:U?{sha:U.sha,timestamp:U.timestamp}:void 0}}function dk(e,t){return`${e}-${t}-db`}async function wf(e,t,r,a){let m=ns(e,t);if(m.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:f}=await import("./chunk-6d5e10md.js"),v=new f(m.region),w=dk(m.slug,t);T(`Scaling ${w} → ${r}–${a} ACUs`),await v.modifyDBCluster({DBClusterIdentifier:w,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),mn(`Scaling applied to ${w} (takes effect shortly).`)}class di{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new n(xt(t))}async query(e){let t=new URLSearchParams(l({Version:"2010-08-01",...e})).toString();return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:t})}async getMetricStatistics(e){let t={Action:"GetMetricStatistics",Namespace:e.Namespace,MetricName:e.MetricName,StartTime:e.StartTime.toISOString(),EndTime:e.EndTime.toISOString(),Period:e.Period};(e.Statistics??[]).forEach((f,v)=>{t[`Statistics.member.${v+1}`]=f}),(e.ExtendedStatistics??[]).forEach((f,v)=>{t[`ExtendedStatistics.member.${v+1}`]=f}),(e.Dimensions??[]).forEach((f,v)=>{t[`Dimensions.member.${v+1}.Name`]=f.Name,t[`Dimensions.member.${v+1}.Value`]=f.Value});let r=await this.query(t),m=(r.GetMetricStatisticsResult||r)?.Datapoints?.member??[];if(!Array.isArray(m))m=m?[m]:[];return m.map((f)=>{let v={},w=f.ExtendedStatistics?.entry;if(w){if(!Array.isArray(w))w=[w];for(let k of w)if(k?.key!=null)v[k.key]=Number(k.value)}return{Timestamp:f.Timestamp,Sum:f.Sum!=null?Number(f.Sum):void 0,Average:f.Average!=null?Number(f.Average):void 0,Maximum:f.Maximum!=null?Number(f.Maximum):void 0,Minimum:f.Minimum!=null?Number(f.Minimum):void 0,Percentiles:Object.keys(v).length?v:void 0,Unit:f.Unit}})}async getMetricSeries(e){let t=/^p\d/.test(e.Stat);return(await this.getMetricStatistics({Namespace:e.Namespace,MetricName:e.MetricName,Dimensions:e.Dimensions,StartTime:e.StartTime,EndTime:e.EndTime,Period:e.Period,Statistics:t?[]:[e.Stat],ExtendedStatistics:t?[e.Stat]:[]})).slice().sort((a,m)=>new Date(a.Timestamp??0).getTime()-new Date(m.Timestamp??0).getTime()).map((a)=>t?a.Percentiles?.[e.Stat]??0:a[e.Stat]??0)}async describeAlarms(e){let t={Action:"DescribeAlarms"};if(e?.AlarmNamePrefix)t.AlarmNamePrefix=e.AlarmNamePrefix;if(e?.MaxRecords)t.MaxRecords=e.MaxRecords;let r=await this.query(t),m=(r.DescribeAlarmsResult||r)?.MetricAlarms?.member??[];if(!Array.isArray(m))m=m?[m]:[];return m.map((f)=>({AlarmName:f.AlarmName,StateValue:f.StateValue,MetricName:f.MetricName,ComparisonOperator:f.ComparisonOperator,Threshold:f.Threshold!=null?Number(f.Threshold):void 0,Namespace:f.Namespace}))}async putMetricAlarm(e){let t={Action:"PutMetricAlarm",AlarmName:e.AlarmName,Namespace:e.Namespace,MetricName:e.MetricName,ComparisonOperator:e.ComparisonOperator,Threshold:e.Threshold,EvaluationPeriods:e.EvaluationPeriods,Period:e.Period,Statistic:e.Statistic};if(e.AlarmDescription)t.AlarmDescription=e.AlarmDescription;(e.Dimensions??[]).forEach((r,a)=>{t[`Dimensions.member.${a+1}.Name`]=r.Name,t[`Dimensions.member.${a+1}.Value`]=r.Value}),(e.AlarmActions??[]).forEach((r,a)=>{t[`AlarmActions.member.${a+1}`]=r}),await this.query(t)}async deleteAlarms(e){if(!e.length)return;let t={Action:"DeleteAlarms"};e.forEach((r,a)=>{t[`AlarmNames.member.${a+1}`]=r}),await this.query(t)}}class sp{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((f)=>({Name:f.Name,Priority:f.Priority,Action:f.Action?Object.keys(f.Action)[0]:f.OverrideAction?Object.keys(f.OverrideAction)[0]:"count"}))}}var lk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],uk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],pk=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],mk=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function Oe(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function gk(e){return Array.isArray(e)?e.length:0}function Un(e){let t=Oe(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function pr(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Et(e,t={}){let r=[],a=[],m=[],f=e.server??{},v=Array.isArray(e.sites)?e.sites:[],w=Array.isArray(e.services)?e.services:[],k=Array.isArray(e.workers)?e.workers:[],S=e.security??{},A=!!e._serverReachable&&!e.metricsUnavailable,x="box";if(!A)m.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let F=[...new Set(v.map((de)=>Oe(de.domain)||Oe(de.route).split("/")[0]).filter((de)=>de&&de!=="internal"&&de!=="loopback"))],U=Array.isArray(S.tlsCertificates)?S.tlsCertificates:[],H=U.filter((de)=>Number(de?.daysRemaining??999)<21).length;r.push({id:"dns",label:F.length===1?F[0]:"Public domains",kind:"dns",layer:1,status:H?"warn":F.length?"ok":"unknown",sub:F.length>1?`${F.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:F.length?F.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:U.length?`${U.length} issued`:"none reported"},...H?[{label:"Expiring",value:`${H} within 21 days`}]:[]],href:"/server/security",external:!0});let K=S.firewall??{},X=Array.isArray(S.ports)?S.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:Un(K.status),sub:Oe(K.summary,"Inbound filtering"),facts:[{label:"State",value:Oe(K.status,"unknown")},{label:"Open ports",value:X.length?X.map((de)=>Oe(de.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let oe=w.find((de)=>mk.test(Oe(de.name)));r.push({id:"proxy",label:Oe(oe?.name,"Reverse proxy"),kind:"proxy",layer:3,status:oe?Un(oe.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:Oe(oe?.name,"not detected")},{label:"State",value:Oe(oe?.status,A?"not running":"not probed")},{label:"Routes",value:`${v.length} site${v.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let de of v){let je=`site:${Oe(de.name)}`;if(!Oe(de.name))continue;r.push({id:je,label:Oe(de.name),kind:"site",layer:4,status:Un(de.status),sub:Oe(de.runtime,"runtime"),facts:[{label:"Route",value:Oe(de.route,"internal")},{label:"Runtime",value:Oe(de.runtime,"unknown")},{label:"Delivery",value:Oe(de.deploy,"unknown")},{label:"TLS",value:Oe(de.tls,"unknown")},...de.responseMs!=null?[{label:"Response",value:`${Math.round(Number(de.responseMs))} ms`}]:[],...de.httpStatus!=null?[{label:"HTTP",value:String(de.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let de of k){let je=`worker:${Oe(de.name)}`;if(!Oe(de.name))continue;r.push({id:je,label:Oe(de.name),kind:"worker",layer:5,status:Un(de.status),sub:`${Number(de.processes??1)} process${Number(de.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(de.processes??1)},{label:"State",value:Oe(de.status,"unknown")},...Oe(de.site)?[{label:"Site",value:Oe(de.site)}]:[]],href:"/operations/jobs",group:"box"})}let pe=e.serverScheduler??{};if(pe.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:Oe(pe.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let ee=w.map((de)=>{let je=Oe(de.name),ae=pk.find((Le)=>Le.match.test(je));return ae?{service:de,name:je,...ae}:null}).filter((de)=>!!de);for(let de of ee)r.push({id:`data:${de.name}`,label:de.label,kind:de.kind,layer:6,status:Un(de.service.status),sub:de.name,facts:[{label:"Unit",value:de.name},{label:"State",value:Oe(de.service.status,"unknown")}],href:"/data/services",group:"box"});let ce=e.backup??{};if(ce.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:Oe(ce.destination,"destination"),facts:[{label:"Destination",value:Oe(ce.destination,"unknown")},{label:"Schedule",value:Oe(ce.schedule,"unknown")},{label:"Retention",value:`${ce.retention??0} copies`},{label:"Last run",value:Oe(ce.last,"unknown")}],href:"/data/backups"});let Ee=new Set(r.map((de)=>de.id));pr(a,{source:"internet",target:"dns",flow:"request",label:"https"},Ee),pr(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},Ee),pr(a,{source:"firewall",target:"proxy",flow:"request"},Ee);for(let de of v){let je=`site:${Oe(de.name)}`;pr(a,{source:"proxy",target:je,flow:"request",label:Oe(de.path)||void 0,status:Un(de.status)},Ee)}for(let de of k){let je=`worker:${Oe(de.name)}`,ae=`site:${Oe(de.site)}`;if(Ee.has(ae))pr(a,{source:ae,target:je,flow:"async",label:"queue"},Ee);else pr(a,{source:"proxy",target:je,flow:"async",label:"queue"},Ee)}for(let de of k)pr(a,{source:"scheduler",target:`worker:${Oe(de.name)}`,flow:"async",label:"dispatch"},Ee);let Re=[...v.map((de)=>`site:${Oe(de.name)}`),...k.map((de)=>`worker:${Oe(de.name)}`)];for(let de of ee)for(let je of Re)pr(a,{source:je,target:`data:${de.name}`,flow:"data",label:"localhost"},Ee);if(ee.length&&Re.length)m.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let de of ee)pr(a,{source:`data:${de.name}`,target:"backup",flow:"backup",label:"snapshot"},Ee);for(let de of v)pr(a,{source:`site:${Oe(de.name)}`,target:"backup",flow:"backup"},Ee);return{mode:"server",project:Oe(t.project)||Oe(e.project?.name)||Oe(f.name,"project"),environment:Oe(t.environment)||Oe(e.environment,"production"),provider:Oe(f.provider,"unknown"),region:Oe(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:lk,groups:[{id:"box",label:Oe(f.name,"App server"),sub:[Oe(f.provider),Oe(f.region),Oe(f.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:m}}function Xi(e,t={}){let r=[],a=[],m=[],f=e.app??{},v=Array.isArray(e.functions)?e.functions:[],w=Array.isArray(e.queues)?e.queues:[],k=e.metrics??{};if(!v.length)m.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let S=Oe(f.url),A=S.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:A||"Application domain",kind:"dns",layer:1,status:A?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:S||"not resolved"}],external:!0});let x=e.waf;if(x)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:Un(x.status??"active"),sub:Oe(x.scope,"Managed rules"),facts:[{label:"Web ACL",value:Oe(x.name,"unnamed")},...x.blocked!=null?[{label:"Blocked (24h)",value:String(x.blocked)}]:[],{label:"Rules",value:String(gk(e.wafRules))}],href:"/serverless/firewall"});let F=e.assetsInfo;if(F)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:Oe(F.cdn,"CloudFront"),facts:[{label:"Distribution",value:Oe(F.cdn,"unknown")},{label:"Custom domain",value:Oe(F.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:Oe(F.bucket,"S3"),facts:[{label:"Bucket",value:Oe(F.bucket,"unknown")},...F.files?[{label:"Objects",value:String(F.files)}]:[],...F.sizeMb?[{label:"Size",value:`${F.sizeMb} MB`}]:[]],href:"/serverless/assets"});let U=v.find((ae)=>Oe(ae.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:U?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:S||"not resolved"},{label:"Invocations (24h)",value:String(k.invocations??0)},...k.errorRatePct!=null?[{label:"Error rate",value:`${k.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ae of v){let Le=`fn:${Oe(ae.name)}`;if(!Oe(ae.name))continue;let rt=Number(ae.errors??0),mt=Number(ae.invocations??0);r.push({id:Le,label:Oe(ae.key,Oe(ae.name)),kind:"function",layer:4,status:rt>0?mt&&rt/mt>0.02?"bad":"warn":mt?"ok":"idle",sub:Oe(ae.runtime,"lambda"),facts:[{label:"Function",value:Oe(ae.name)},{label:"Memory",value:`${ae.memory??0} MB`},{label:"Timeout",value:`${ae.timeout??0}s`},{label:"Invocations (24h)",value:String(mt)},{label:"Errors (24h)",value:String(rt)},{label:"p95",value:`${ae.p95??0} ms`},...ae.provisioned?[{label:"Provisioned",value:Oe(ae.provisioned)}]:[]],href:"/serverless/functions"})}for(let ae of w){let Le=`queue:${Oe(ae.name)}`;if(!Oe(ae.name))continue;let rt=Number(ae.dlq??0);r.push({id:Le,label:Oe(ae.name),kind:"queue",layer:5,status:rt>0?"bad":Number(ae.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ae.visible??0)},{label:"In flight",value:String(ae.inFlight??0)},{label:"Processed (24h)",value:String(ae.processed??0)},{label:"Dead letter",value:String(rt)}],href:"/serverless/queues"})}let H=e.aurora;if(H)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:Un(H.status),sub:Oe(H.engine,"aurora"),facts:[{label:"Cluster",value:Oe(H.id,"unknown")},{label:"Capacity",value:`${H.currentAcu??0} ACU (${H.minAcu??0}–${H.maxAcu??0})`},{label:"Connections",value:String(H.connections??0)}],href:"/serverless/data"});let K=e.proxy;if(K)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:Un(K.status),sub:"Connection pooling",facts:[{label:"Proxy",value:Oe(K.name,"unknown")},{label:"Endpoint",value:Oe(K.endpoint,"unknown")},{label:"Pooled",value:String(K.pooledConns??0)}],href:"/serverless/data"});let X=e.redis;if(X)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:Un(X.status),sub:Oe(X.node,"redis"),facts:[{label:"Group",value:Oe(X.id,"unknown")},{label:"Hit rate",value:`${X.hitRate??0}%`}],href:"/serverless/data"});let oe=e.efs;if(oe)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:Un(oe.status),sub:Oe(oe.mount,"/mnt/local"),facts:[{label:"File system",value:Oe(oe.id,"unknown")},{label:"Mount",value:Oe(oe.mount,"unknown")},{label:"Size",value:`${oe.sizeMb??0} MB`}],href:"/data/volumes"});let pe=e.scheduler??{};if(pe.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:Oe(pe.expression,"rate(1 minute)"),facts:[{label:"Expression",value:Oe(pe.expression,"unknown")},{label:"Last run",value:Oe(pe.lastRun,"unknown")}],href:"/operations/jobs"});let ee=new Set(r.map((ae)=>ae.id)),ce=ee.has("waf")?"waf":"gateway";pr(a,{source:"internet",target:"dns",flow:"request",label:"https"},ee),pr(a,{source:"dns",target:ce,flow:"request"},ee),pr(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},ee),pr(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},ee),pr(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},ee);let Ee=v.filter((ae)=>Oe(ae.key).startsWith("http")),Re=v.filter((ae)=>Oe(ae.key).startsWith("queue")),de=v.filter((ae)=>Oe(ae.key).startsWith("cli"));for(let ae of Ee)pr(a,{source:"gateway",target:`fn:${Oe(ae.name)}`,flow:"request",label:"invoke"},ee);for(let ae of de)pr(a,{source:"scheduler",target:`fn:${Oe(ae.name)}`,flow:"async",label:"schedule"},ee);for(let ae of w){for(let Le of Ee)pr(a,{source:`fn:${Oe(Le.name)}`,target:`queue:${Oe(ae.name)}`,flow:"async",label:"publish"},ee);for(let Le of Re)pr(a,{source:`queue:${Oe(ae.name)}`,target:`fn:${Oe(Le.name)}`,flow:"async",label:"consume"},ee)}let je=["rds-proxy","database","cache","efs","assets"];for(let ae of v){let Le=`fn:${Oe(ae.name)}`;if(ee.has("rds-proxy"))pr(a,{source:Le,target:"rds-proxy",flow:"data",label:"pooled"},ee);else pr(a,{source:Le,target:"database",flow:"data",label:"sql"},ee);for(let rt of je.filter((mt)=>mt!=="rds-proxy"&&mt!=="database"))pr(a,{source:Le,target:rt,flow:"data"},ee)}return pr(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},ee),{mode:"serverless",project:Oe(t.project)||Oe(f.name,"application"),environment:Oe(t.environment)||Oe(f.env,"production"),provider:"aws",region:Oe(f.region,"unknown"),generatedAt:new Date().toISOString(),layers:uk,groups:[],nodes:r,links:a,notes:m}}function Ah(e,t,r={}){return e==="serverless"?Xi(t,r):Et(t,r)}function kf(e){return String(e).padStart(2,"0")}function Os(e){return`${e.getUTCFullYear()}-${kf(e.getUTCMonth()+1)}-${kf(e.getUTCDate())}`}function fk(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function Xa(e,t,r,a,m,f){let v=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:m,EndTime:f,Period:86400,Statistics:[a]}).catch(()=>[]);if(!v.length)return 0;if(a==="Sum")return v.reduce((w,k)=>w+(k.Sum??0),0);if(a==="Maximum")return Math.max(...v.map((w)=>w.Maximum??0));return v.reduce((w,k)=>w+(k.Average??0),0)/v.length}async function ec(e,t,r,a,m,f,v){let w=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:f,EndTime:v,Period:86400,Statistics:[m]}).catch(()=>[]);if(!w.length)return 0;if(m==="Sum")return w.reduce((k,S)=>k+(S.Sum??0),0);if(m==="Maximum")return Math.max(...w.map((k)=>k.Maximum??0));return w.reduce((k,S)=>k+(S.Average??0),0)/w.length}async function ap(e,t,r,a,m){let f=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:m,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(f.reduce((v,w)=>v+(w.Percentiles?.[r]??0),0))}async function dn(e,t){let r=await Tr(e,t),a=r.region,m=new di(a),f=new E(a),v=new fe(a),w=new Date,k=new Date(w.getTime()-86400000),S=e.environments?.[t]?.app,A={};A.app={name:r.slug,env:t,region:a,runtime:S?.kind==="php"?`php-${S?.phpVersion??"8.3"} (fpm)`:S?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},A.maintenance={enabled:!1},A.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let x=0,F=0,U=0,H=[],K=[],X=[];for(let ce of r.functions){let[Ee,Re,de,je,ae,Le,rt,mt,ir]=await Promise.all([Xa(m,ce.name,"Invocations","Sum",k,w),Xa(m,ce.name,"Errors","Sum",k,w),Xa(m,ce.name,"Throttles","Sum",k,w),Xa(m,ce.name,"Duration","Average",k,w),f.getFunction(ce.name).catch(()=>null),ap(m,ce.name,"p50",k,w),ap(m,ce.name,"p95",k,w),ap(m,ce.name,"p99",k,w),m.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:ce.name}],StartTime:new Date(w.getTime()-43200000),EndTime:w,Period:3600,Stat:"Sum"}).catch(()=>[])]);x+=Ee,F+=Re,U=Math.max(U,je);let st=ae?.Configuration?.MemorySize??0,Dt=Object.keys(ae?.Configuration?.Environment?.Variables??{}),or=[],lt=0;try{let{events:ye=[]}=await v.filterLogEvents({logGroupName:`/aws/lambda/${ce.name}`,startTime:k.getTime(),limit:120});for(let we of ye){let De=(we.message??"").trim(),ht=/Max Memory Used:\s*(\d+)\s*MB/.exec(De);if(ht)lt=Math.max(lt,Number(ht[1]));if(De&&!/^(?:START|END|REPORT|INIT_START)/.test(De))X.push({source:ce.mode||ce.name,timestamp:new Date(we.timestamp??0).toISOString(),when:fk(we.timestamp??0),message:De.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(De)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(De)?"warn":"info"})}or=ye.filter((we)=>!/^(?:START|END|REPORT|INIT_START)/.test((we.message??"").trim())).slice(-6).map((we)=>({ts:new Date(we.timestamp??0).toISOString().slice(11,19),msg:(we.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(we.message??"")}))}catch{}let Q=Math.max(1,...ir);H.push({key:ce.mode,name:ce.name,version:ce.version,memory:st,timeout:ae?.Configuration?.Timeout??0,runtime:ae?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(Ee),errors:Math.round(Re),p95:rt||Math.round(je),status:"active",provisioned:ce.provisioned?`${ce.provisioned.allocated}/${ce.provisioned.requested}`:void 0}),K.push({key:ce.mode,name:ce.name,runtime:ae?.Configuration?.Runtime??"provided.al2023",arch:ae?.Configuration?.Architectures?.[0]??"x86_64",memory:st,timeout:ae?.Configuration?.Timeout??0,ephemeral:ae?.Configuration?.EphemeralStorage?.Size??512,version:ce.version,concurrency:S?.concurrency??"—",invocations:Math.round(Ee),errors:Math.round(Re),throttles:Math.round(de),p50:Le||Math.round(je),p95:rt||Math.round(je),p99:mt||Math.round(je),maxMem:lt,spark:ir.length?ir.map((ye)=>Math.round(ye/Q*100)):[0],env:Dt.length?Dt:["(none)"],recent:or.length?or:[{ts:"—",msg:"no recent events",err:!1}]})}A.functions=H,A.functionsDetail=K,A.serverlessLogs=X.sort((ce,Ee)=>String(Ee.timestamp).localeCompare(String(ce.timestamp))).slice(0,600),A.serverlessLogsEmptyReason=X.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let oe=x?Number((F/x*100).toFixed(2)):0,pe=Math.round(await Xa(m,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",k,w));A.metrics={invocations:Math.round(x),errorRatePct:oe,p95Ms:Math.round(U),coldStartPct:void 0,concurrency:pe,estCostUsd:void 0};try{let ce=new ie(a),Ee=[],Re=[],de=0;try{let{QueueUrl:ae}=await ce.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:Le}=await ce.getQueueAttributes(ae);de=Number(Le.ApproximateNumberOfMessages??0)}catch{}let je=S?Wt(S,r.slug,t):[];for(let ae of je){let Le=ae.name.replace(`${r.slug}-${t}-`,""),rt=0,mt=0;try{let{QueueUrl:st}=await ce.getQueueUrl(ae.name),{Attributes:Dt}=await ce.getQueueAttributes(st);rt=Number(Dt.ApproximateNumberOfMessages??0),mt=Number(Dt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let ir=Math.round(await ec(m,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ae.name}],"Sum",k,w));Ee.push({name:Le,visible:rt,inFlight:mt,processed:ir,dlq:de}),Re.push({name:ae.name,short:Le,visible:rt,inFlight:mt,delayed:0,processed:ir,oldestSec:0,concurrency:ae.concurrency??S?.queueConcurrency??"—",tries:S?.queueTries??3,visTimeout:(S?.queueTimeout??120)*6,dlq:de})}if(Ee.length)A.queues=Ee;if(Re.length)A.queuesDetail=Re;A.dlqItems=[]}catch{}try{let ce=new h(a),{Stacks:Ee}=await ce.describeStacks({stackName:Ht(e,t)}),Re={};for(let de of Ee?.[0]?.Outputs??[])if(de.OutputKey)Re[de.OutputKey]=de.OutputValue??"";if(S?.database?.connection==="aurora-serverless"){let de=`${r.slug}-${t}-db`,je=[{Name:"DBClusterIdentifier",Value:de}],[ae,Le]=await Promise.all([ec(m,"AWS/RDS","ServerlessDatabaseCapacity",je,"Average",k,w),ec(m,"AWS/RDS","DatabaseConnections",je,"Maximum",k,w)]);if(A.aurora={id:de,engine:"aurora-mysql",minAcu:S?.database?.minCapacity??0.5,maxAcu:S?.database?.maxCapacity??4,currentAcu:ae?Number(ae.toFixed(1)):S?.database?.minCapacity??0.5,database:"app",connections:Math.round(Le),status:Re.DbEndpoint?"available":"creating"},S?.rdsProxy)A.proxy={name:`${r.slug}-${t}-proxy`,endpoint:Re.DbProxyEndpoint??"—",pooledConns:Math.round(Le),status:"available"}}if(S?.cache?.driver==="elasticache"){let de=`${r.slug}-${t}-cache`,je=[{Name:"CacheClusterId",Value:`${de}-001`}],[ae,Le]=await Promise.all([ec(m,"AWS/ElastiCache","CacheHits",je,"Sum",k,w),ec(m,"AWS/ElastiCache","CacheMisses",je,"Sum",k,w)]),rt=ae+Le>0?Number((ae/(ae+Le)*100).toFixed(1)):0;A.redis={id:de,node:"cache.t4g.micro",engine:"redis",hitRate:rt,status:Re.CacheEndpoint?"available":"creating"}}if(S?.efs){let de=0;try{if(Re.EfsFileSystemId){let je=new ar(a),{FileSystems:ae}=await je.describeFileSystems({FileSystemId:Re.EfsFileSystemId});de=Number(((ae?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}A.efs={id:Re.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:de,status:"available"}}A.assetsInfo=Re.AssetsCdnDomain?{bucket:Re.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:Re.AssetsCdnDomain,customDomain:S?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:A.app.build}:void 0}catch{}if(A.assetsInfo)try{let Ee=await new o(a).list({bucket:A.assetsInfo.bucket,maxKeys:1000});A.assetsInfo.files=Ee.length,A.assetsInfo.sizeMb=Number((Ee.reduce((Re,de)=>Re+(de.Size??0),0)/1048576).toFixed(1)),A.assetsRecent=Ee.slice(0,8).map((Re)=>({path:`/${Re.Key}`,size:`${Math.max(1,Math.round((Re.Size??0)/1024))} KB`,type:Re.Key.split(".").pop()??""}))}catch{}try{if(S?.secrets){let ce=Array.isArray(S.secrets)?S.secrets.map((Ee)=>({key:Ee.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:Ee})):Object.entries(S.secrets).map(([Ee,Re])=>({key:Ee,source:String(Re)}));A.secretsList=ce.map((Ee)=>({...Ee,updated:"—"}))}}catch{}try{let ce=new o(a),Ee=`${r.slug}-${t}-deployments`,Re=await ce.getObjectJson(Ee,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(Re?.records?.length)A.deploymentsDetail=Re.records.slice(-12).reverse().map((de)=>({sha:(de.sha??"").slice(0,7),status:de.status??"success",when:de.timestamp??"—",took:de.took??"—",by:de.by??"—",version:de.version??"—",hooks:de.hooks??[]}))}catch{}A.metricsTotals={invocations:A.metrics.invocations,errors:Math.round(F),errorRatePct:oe,p95Ms:A.metrics.p95Ms,throttles:K.reduce((ce,Ee)=>ce+Ee.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:pe},A.metricsPerFn=K.map((ce)=>({key:ce.key,invocations:ce.invocations,errors:ce.errors,throttles:ce.throttles,avgMs:ce.p50,maxMs:ce.p99,costUsd:void 0}));try{A.invSpark=await m.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((ce)=>ce.mode==="http")?.name??""}],StartTime:new Date(w.getTime()-86400000),EndTime:w,Period:3600,Stat:"Sum"})}catch{}try{let ce=new ls,Ee=w,Re=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth(),1)),de=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth()-1,1)),[je,ae]=await Promise.all([ce.getCostByService({start:Os(Re),end:Os(Ee),granularity:"MONTHLY"}).catch(()=>[]),ce.getCostByService({start:Os(de),end:Os(Re),granularity:"MONTHLY"}).catch(()=>[])]);if(je.length){let Le=je.reduce((lt,Q)=>lt+Q.amount,0),rt=ae.reduce((lt,Q)=>lt+Q.amount,0),mt=Ee.getUTCDate(),ir=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth()+1,0)).getUTCDate();A.costSummary={monthToDateUsd:Number(Le.toFixed(2)),projectedUsd:Number((Le/mt*ir).toFixed(2)),lastMonthUsd:Number(rt.toFixed(2)),dailyAvgUsd:Number((Le/mt).toFixed(2))},A.costServices=je.filter((lt)=>lt.amount>0).sort((lt,Q)=>Q.amount-lt.amount).slice(0,12).map((lt)=>({name:lt.service,usd:Number(lt.amount.toFixed(2)),note:""})),A.metrics.estCostUsd=Number((Le/mt).toFixed(2)),A.metricsTotals.estCostUsd=A.metrics.estCostUsd,A.costTrend=await ce.getDailyTotals({start:Os(Re),end:Os(Ee)}).catch(()=>[]);let st=je.find((lt)=>/lambda/i.test(lt.service))?.amount??0,Dt=(lt)=>lt.invocations*(lt.p50/1000)*(lt.memory/1024),or=K.reduce((lt,Q)=>lt+Dt(Q),0)||1;A.costPerFn=K.map((lt)=>({key:lt.key,requests:lt.invocations,gbSec:Math.round(Dt(lt)),usd:Number((st*(Dt(lt)/or)).toFixed(2))}))}}catch{}if(S?.firewall)try{let ce=await m.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:k,EndTime:w,Period:86400,Statistics:["Sum"]}).catch(()=>[]),Ee=await m.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:k,EndTime:w,Period:86400,Statistics:["Sum"]}).catch(()=>[]);A.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(Ee.reduce((Re,de)=>Re+(de.Sum??0),0)),blocked24h:Math.round(ce.reduce((Re,de)=>Re+(de.Sum??0),0))};try{let Re=new sp(a),de=await Re.listWebACLs("REGIONAL"),je=de.find((ae)=>ae.Name?.includes(`${r.slug}-${t}`))??de[0];if(je?.Name&&je.Id){A.waf.acl=je.Name;let ae=await Re.getWebACLRules(je.Name,je.Id,"REGIONAL");if(ae.length)A.wafRules=ae.map((Le)=>({name:Le.Name??"—",detail:`priority ${Le.Priority??0}`,action:Le.Action??"count",blocked24h:0}))}}catch{}}catch{}let ee=[];if(A.aurora)ee.push({name:"Aurora Serverless v2",detail:`${A.aurora.id} · ${A.aurora.minAcu}-${A.aurora.maxAcu} ACU`,status:A.aurora.status});if(A.proxy)ee.push({name:"RDS Proxy",detail:A.proxy.name,status:A.proxy.status});if(A.redis)ee.push({name:`ElastiCache (${A.redis.engine})`,detail:`${A.redis.node} · ${A.redis.hitRate}% hit rate`,status:A.redis.status});if(A.efs)ee.push({name:"EFS",detail:`${A.efs.mount} · ${A.efs.sizeMb} MB`,status:A.efs.status});if(ee.length)A.dataServices=ee;if(r.scheduler!=="off"&&S?.kind==="php")try{let ce=await Ye(e,t,"schedule:list"),Ee=[];for(let Re of(ce||"").split(`
-`)){let de=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(Re);if(de&&/[*\d]/.test(de[1])&&de[1].trim().split(/\s+/).length===5)Ee.push({command:de[2].trim().replace(/^php artisan /,""),cron:de[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(Ee.length)A.schedulerTasks=Ee}catch{}return A.topology=Xi(A,{project:e.project.name,environment:t}),A}function lo(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function hk(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function du(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},a=[],m=t.now,f=(S,A,x,F=m)=>{if(A!==null)a.push({name:S,value:A,unit:x,timestamp:F,attributes:r})};f("storage.egress.month",lo(e.monthBytes),"bytes"),f("storage.egress.today",lo(e.todayBytes),"bytes"),f("storage.egress.projected_month",lo(e.projectedMonthBytes),"bytes");let v=lo(e.budgetBytes);if(v!==null&&v>0){f("storage.egress.budget",v,"bytes");let S=e.budgetUsedPercent,A=typeof S==="number"&&Number.isFinite(S)?S:lo(e.monthBytes)!==null?Math.round(lo(e.monthBytes)/v*1000)/10:null;f("storage.egress.budget_used_percent",A,"percent")}let w=t.maxReplayDays??45,k=Array.isArray(e.days)?e.days.slice(-w):[];for(let S of k){let A=hk(String(S?.date??"")),x=lo(S?.bytes);if(!A||x===null)continue;a.push({name:"storage.egress.day",value:x,unit:"bytes",timestamp:A,attributes:r});let F=lo(S?.downloads);if(F!==null)a.push({name:"storage.egress.day_downloads",value:F,unit:"count",timestamp:A,attributes:r})}return a}async function lu(e,t=process.env,r=fetch){let a=e.tokenEnv?t[e.tokenEnv]:void 0,m=await r(e.url,{headers:a?{Authorization:`Bearer ${a}`}:{},signal:AbortSignal.timeout(1e4)});if(!m.ok)throw Error(`HTTP ${m.status}`);return await m.json()}async function Ia(e,t){let r=[],a=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:a};let m=await Promise.all(e.map(async(f)=>{if(!f?.name||!f?.url)return{endpoint:f,error:"egress endpoint needs both a name and a url"};try{let v=await lu(f,t.env,t.fetchImpl);return{endpoint:f,report:v}}catch(v){return{endpoint:f,error:v instanceof Error?v.message:String(v)}}}));for(let f of m){let v=`egress:${f.endpoint?.name??"unnamed"}`;if("error"in f&&f.error){a.push({source:v,message:f.error});continue}r.push(...du(f.report,{name:f.endpoint.name,now:t.now}))}return{metrics:r,errors:a}}import{createHash as O_}from"node:crypto";import{existsSync as _i,mkdtempSync as Bg,readdirSync as YS,rmSync as Rs,statSync as cw}from"node:fs";import{readFile as oi,writeFile as Is}from"node:fs/promises";import{tmpdir as Hu}from"node:os";import{dirname as $_,extname as Ac,join as Vt,normalize as N_,relative as j_,resolve as M_,sep as B_}from"node:path";import{fileURLToPath as L_}from"node:url";class Oo extends Error{status;code;requestId;constructor(e,t,r,a){super(r);this.status=e;this.code=t;this.requestId=a}}class ll{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),a=await r.json().catch(()=>({}));if(!r.ok)throw new Oo(r.status,a.error?.code??"api_error",a.error?.message??"API request failed.",a.error?.requestId??r.headers.get("x-request-id")??void 0);return a}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,a])=>a!==void 0).map(([a,m])=>[a,String(m)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as oI}from"node:crypto";import{lstatSync as yk,readdirSync as vk,readFileSync as bk}from"node:fs";import{relative as Sk,resolve as If,sep as wk}from"node:path";function kk(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function is(e,t,r){return{path:e,reason:t,weight:r}}function Ef(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Ns(e,t,r,a,m,f){return{framework:e,strategy:t,confidence:r,evidence:a,defaults:{build:m,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:f}}function js(e){let t=kk(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Ns("dockerfile","dockerfile",0.99,[is("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let a=Ef(t.get("composer.json"));if(t.has("artisan")&&a.require?.["laravel/framework"])r.push(Ns("laravel","server",0.98,[is("artisan","Laravel Artisan entrypoint is present.",0.45),is("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Ns("php","server",0.82,[is("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let m=Ef(t.get("package.json"));if(t.has("package.json")){let f=t.has("bun.lock")||t.has("bun.lockb")||m.engines?.bun,v=f?"bun":"node",w=f?"bun":"node",k=[is("package.json",`Defines ${m.scripts?.build?"build and ":""}${m.scripts?.start?"start ":""}scripts.`,0.55)];if(f)k.push(is(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let S=!!(m.dependencies?.vite||m.devDependencies?.vite||m.dependencies?.["@stacksjs/bunpress"]||m.devDependencies?.["@stacksjs/bunpress"])&&!m.scripts?.start,A=S?{kind:"static",installCommand:`${v} install --frozen-lockfile`,buildCommand:`${v} run build`,publishDirectory:"dist"}:{kind:"server",runtime:v,installCommand:`${v} install --frozen-lockfile`,buildCommand:m.scripts?.build?`${v} run build`:void 0,startCommand:m.scripts?.start?`${v} run start`:v==="bun"?"bun run index.ts":"node index.js"};r.push(Ns(w,A.kind,Math.min(0.94,k.reduce((x,F)=>x+F.weight,0)),k,A,S?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${v} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Ns("static","static",0.78,[is(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Ns("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((f,v)=>v.confidence-f.confidence||f.framework.localeCompare(v.framework))}function cp(e,t={}){let r=If(e),a=t.maxFiles??1e4,m=t.maxContentBytes??262144,f=[],v=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),w=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),k=(S)=>{for(let A of vk(S).sort()){if(w.has(A))continue;let x=If(S,A),F=Sk(r,x).split(wk).join("/");if(!F||F.startsWith("../"))throw Error("Detection path escaped the application root");let U=yk(x);if(U.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${F}`);if(U.isDirectory())k(x);else if(U.isFile()){if(f.length>=a)throw Error("Application file-count limit exceeded");let H={path:F,size:U.size};if(v.has(F)&&U.size<=m)H.content=bk(x,"utf8");f.push(H)}}};return k(r),f}function lp(e){if(Array.isArray(e))return`[${e.map(lp).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${lp(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function tc(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function Rn(e,t,r,a){return{path:e,code:t,message:r,alternatives:a}}function dp(e){return JSON.parse(JSON.stringify(e))}function Ik(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,a])=>[r,typeof a==="string"?a:`\${${a.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return dp({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return dp({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return dp({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function Vn(e,t=[]){let r=[],a=(H)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(H),m=Object.fromEntries(Object.entries(e.environment??{}).map(([H,K])=>{if(typeof K==="string"&&a(H))return r.push(Rn(`environment.${H}`,"write_only_secret_required",`${H} must be supplied through the write-only secrets boundary.`)),[H,{secretRef:H}];return[H,K]})),f=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let H=Object.fromEntries(Object.entries(e.build.buildArgs).map(([K,X])=>{if(a(K))return r.push(Rn(`build.buildArgs.${K}`,"write_only_build_secret_required",`${K} must be declared in secretNames instead of buildArgs.`)),[K,"[REDACTED]"];return[K,X]}));f={...e.build,buildArgs:H}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(Rn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!tc((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(Rn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((H)=>!tc(H)))r.push(Rn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!tc(e.build.context)||!tc(e.build.dockerfile)))r.push(Rn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!tc(e.build.publishDirectory))r.push(Rn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(Rn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(Rn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(Rn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(Rn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(Rn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let v=e.runtime.healthCheck;if(v&&v.protocol!=="tcp"&&(!v.path||!v.path.startsWith("/")||/[\r\n]/.test(v.path)))r.push(Rn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(Rn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let w=Object.values(m).flatMap((H)=>typeof H==="object"?[H.secretRef]:[]),k=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...w])].sort(),S=new Set(t),A=k.filter((H)=>!S.has(H)),x={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:f,runtime:e.runtime,environment:m,domain:e.domain}},F=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),U=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&A.length===0,issues:r,missingSecrets:A,manifest:x,configPatch:Ik({...e,build:f,environment:m}),capabilityRequirements:F,costDrivers:U,serializedManifest:`${lp(x)}
-`}}function Rf(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function Af(e,t,r={}){let a=r.maxBytes??104857600,m=r.maxEntries??1e4,f=r.maxExpandedBytes??524288000;if(e.byteLength>a)throw Error("Archive exceeds the compressed size limit");let v=new DataView(e.buffer,e.byteOffset,e.byteLength),w=[],k=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let A=0;while(A+30<=e.length){let x=v.getUint32(A,!0);if(x===33639248||x===101010256)break;if(x!==67324752)throw Error("Malformed ZIP local header");let F=v.getUint16(A+6,!0),U=v.getUint32(A+18,!0),H=v.getUint32(A+22,!0),K=v.getUint16(A+26,!0),X=v.getUint16(A+28,!0);if(F&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let oe=new TextDecoder().decode(e.subarray(A+30,A+30+K));if(!Rf(oe))throw Error(`Unsafe archive path: ${oe}`);if(w.push(oe),k+=H,w.length>m||k>f)throw Error("Archive expansion limit exceeded");A+=30+K+X+U}return{format:"zip",entries:w.length,expandedBytes:k,paths:w}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let S=0;while(S+512<=e.length){let A=e.subarray(S,S+512);if(A.every((K)=>K===0))break;let x=(K,X)=>new TextDecoder().decode(A.subarray(K,K+X)).replace(/\0.*$/,""),F=`${x(345,155)}${x(345,155)?"/":""}${x(0,100)}`,U=Number.parseInt(x(124,12).trim()||"0",8),H=String.fromCharCode(A[156]??0);if(!Rf(F))throw Error(`Unsafe archive path: ${F}`);if(H==="1"||H==="2")throw Error(`Archive links are not accepted: ${F}`);if(!Number.isFinite(U)||U<0)throw Error("Malformed TAR entry size");if(w.push(F),k+=U,w.length>m||k>f)throw Error("Archive expansion limit exceeded");S+=512+Math.ceil(U/512)*512}return{format:"tar",entries:w.length,expandedBytes:k,paths:w}}var Cf=new Set(["source","build","runtime","environment","domain","review"]);function Pf(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function _f(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function Tf(e){for(let[r,a]of Object.entries(e.environment??{}))if(typeof a==="string"&&_f(r)&&a)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,a]of Object.entries(e.build.buildArgs??{}))if(_f(r)&&a)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function xf(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:Pf(e.input,{}),suppliedSecretNames:Pf(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class up{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(Tf(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),a=this.now(),m=e.step??"source";if(!Cf.has(m))throw Error("Invalid draft step");let f=[...new Set(e.suppliedSecretNames??[])].sort(),v=Vn(e.draft,f).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),m,JSON.stringify(e.draft),JSON.stringify(f),v,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:m,status:v,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?xf(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(xf)}update(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!Cf.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==a.projectId)throw Error("Draft project cannot be changed");Tf(r.draft);let m=[...new Set(r.suppliedSecretNames??a.suppliedSecretNames)].sort(),f=Vn(r.draft,m).valid?"ready":"draft",v=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(m),f,v,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:f}}),this.get(e)}markApplied(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let m=Vn(a.input,a.suppliedSecretNames);if(!m.valid)throw Error(`Draft is not deployable: ${[...m.issues.map((v)=>v.message),...m.missingSecrets.map((v)=>`Missing secret ${v}`)].join("; ")}`);let f=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[f,e,t]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r,type:"application.draft.applied",payload:s({draftId:e,manifest:m.manifest})}),this.get(e)}}import{createCipheriv as Ek,createDecipheriv as Rk,createHash as $f,randomBytes as Ak}from"node:crypto";function rc(e){return typeof e==="string"&&e?e:void 0}function pp(e){return $f("sha256").update(e).digest("hex").slice(0,16)}function Df(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function Ck(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:rc(e.credential_fingerprint),credentialExpiresAt:rc(e.credential_expires_at),status:String(e.status),healthMessage:rc(e.health_message),lastTestedAt:rc(e.last_tested_at),version:Number(e.version),createdByActorId:rc(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class mp{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=$f("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Ak(12),r=Ek("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,m]=e.split(".");if(t!=="v1"||!r||!a||!m)throw Error("Registry credential envelope is invalid");let f=Rk("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return f.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([f.update(Buffer.from(m,"base64url")),f.final()]).toString("utf8")}current(e){let t=Ck(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),a=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),Df(e.host),t?this.encrypt(t):null,t?pp(t):null,e.credentialExpiresAt??null,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:Df(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let a=this.get(e);if(!a||a.status==="disconnected")throw Error("Registry connection was not found");let m=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(m),pp(m),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:pp(m),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let a=this.credential(e),m=t.fetch??fetch,f=new AbortController,v=setTimeout(()=>f.abort(),t.timeoutMs??15000),w=a?.token?`Bearer ${a.token}`:a?.username||a?.password?`Basic ${Buffer.from(`${a.username??""}:${a.password??""}`).toString("base64")}`:void 0;try{let k=await m(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:f.signal,headers:w?{Authorization:w}:void 0}),S=k.headers.get("www-authenticate")??"";if(k.status===401&&S.startsWith("Bearer ")&&a){let F=Object.fromEntries([...S.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((oe)=>[oe[1],oe[2]])),U=new URL(F.realm??"");if(U.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(F.service)U.searchParams.set("service",F.service);if(t.image)U.searchParams.set("scope",`repository:${Nf(t.image).repository}:pull`);let H=await m(U,{signal:f.signal,redirect:"error",headers:w?{Authorization:w}:void 0});if(!H.ok)throw Error(`Registry authentication failed (${H.status})`);let K=await H.json(),X=K.token??K.access_token;if(!X)throw Error("Registry did not return an access token");k=t.image?await Of(m,r.host,t.image,X,f.signal):await m(`${r.host}/v2/`,{signal:f.signal,redirect:"error",headers:{Authorization:`Bearer ${X}`}})}else if(k.ok&&t.image)k=await Of(m,r.host,t.image,a?.token,f.signal,w);let A=k.ok?"healthy":"degraded",x=k.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${k.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[A,x,this.now(),this.now(),e]),this.get(e)}catch(k){let S=f.signal.aborted?"Registry request timed out.":k instanceof Error?k.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[S.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(v)}}}function Nf(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let a=t.slice(r+1),m=a.lastIndexOf("@"),f=a.lastIndexOf(":"),v=m>=0?m:f>a.lastIndexOf("/")?f:-1,w=v>=0?a.slice(0,v):a,k=v>=0?a.slice(v+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(w)||!/^[A-Za-z0-9_.:+-]+$/.test(k))throw Error("Image reference is invalid");return{repository:w,reference:k}}async function Of(e,t,r,a,m,f){let v=Nf(r);return e(`${t}/v2/${v.repository}/manifests/${encodeURIComponent(v.reference)}`,{method:"HEAD",redirect:"error",signal:m,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...a?{Authorization:`Bearer ${a}`}:f?{Authorization:f}:{}}})}import{createHash as Pk}from"node:crypto";import{chmodSync as jf,existsSync as Mf,mkdirSync as _k,renameSync as Tk,unlinkSync as Bf,writeFileSync as xk}from"node:fs";import{basename as Dk,join as Ok}from"node:path";function gp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class fp{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=d(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=Dk(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let a=Af(e.bytes,r),m=Pk("sha256").update(e.bytes).digest("hex"),f=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,m);if(f)return gp(f);let v=this.idFn();_k(this.root,{recursive:!0,mode:448}),jf(this.root,448);let w=Ok(this.root,`${v}.archive`),k=`${w}.partial`;try{xk(k,e.bytes,{mode:384,flag:"wx"}),Tk(k,w),jf(w,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[v,e.organizationId,e.projectId,r,w,m,e.bytes.byteLength,a.format,a.entries,a.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(S){if(Mf(k))Bf(k);if(Mf(w))Bf(w);throw S}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:v,filename:r,sha256:m,size:e.bytes.byteLength,entries:a.entries}}),this.get(v)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?gp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(gp)}}function Bc(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),a=r?e.controlPlane.listEnvironments(r.id).find((S)=>S.id===t.input.environmentId):void 0;if(!r||!a||a.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==a.slug)throw Error(`Type ${a.slug} to confirm this deployment target`);let m=Vn(t.input,t.suppliedSecretNames);if(!m.valid)throw Error(`Application plan is invalid: ${[...m.issues.map((S)=>S.message),...m.missingSecrets.map((S)=>`Missing secret ${S}`)].join("; ")}`);let f=e.controlPlane.listResources(r.id,a.id).find((S)=>S.kind==="application"&&S.slug===t.input.slug),v=JSON.parse(JSON.stringify({manifest:m.manifest,configPatch:m.configPatch})),w=f?e.controlPlane.updateResource(f.id,f.version,{name:t.input.name,desiredState:v}):e.controlPlane.createResource({projectId:r.id,environmentId:a.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:v,metadata:{source:"application-onboarding",draftId:t.id}}),k=new c(e.controlPlane).enqueue({projectId:r.id,environmentId:a.id,resourceId:w.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:v,lockKey:`resource:${w.id}`,providerKey:w.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:w.id,operationId:k.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:a.slug,strategy:t.input.build.kind,costDrivers:m.costDrivers}}),{plan:m,resource:w,operation:k}}function Wr(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,a=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",m=(f,v)=>v&&(f==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:m("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:m("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:m("blue_green",a),explanation:a?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:m("canary",a),explanation:a?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Mi(e,t){let r=Wr(e).find((a)=>a.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as $k}from"node:crypto";var Nk=/^sha256:[a-f0-9]{64}$/,jk=/^[a-f0-9]{40,64}$/i;function ei(e){return typeof e==="string"&&e?e:void 0}function as(e,t){try{return JSON.parse(String(e))}catch{return t}}function Lf(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:as(e.provenance,{}),attestation:as(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Ff(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:ei(e.source_sha),configHash:String(e.config_hash),manifest:as(e.manifest,{}),provenance:as(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:as(e.health_gate,void 0),hooks:as(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:ei(e.previous_release_id),promotedFromReleaseId:ei(e.promoted_from_release_id),actorId:ei(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:ei(e.pin_reason),activatedAt:ei(e.activated_at),failedAt:ei(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Mk(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:ei(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:as(e.health,{}),message:String(e.message),operationId:ei(e.operation_id),createdAt:String(e.created_at)}}function Bk(e,t){let r=[],a=(m,f,v)=>{if(JSON.stringify(f)===JSON.stringify(v))return;if(f&&v&&typeof f==="object"&&typeof v==="object"&&!Array.isArray(f)&&!Array.isArray(v)){for(let w of[...new Set([...Object.keys(f),...Object.keys(v)])].sort())a(m?`${m}.${w}`:w,f[w],v[w]);return}r.push({path:m,...f!==void 0?{before:f}:{},...v!==void 0?{after:v}:{}})};return a("",e,t),r}class Lo{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Nk.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return Lf(t);let r=this.id(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(s(e.provenance??{})),JSON.stringify(s(e.attestation??{})),a,a]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?Lf(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),a=this.controlPlane.listEnvironments(e.projectId).find((x)=>x.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!a)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!jk.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Mi({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let m=s(e.config),f=$k("sha256").update(JSON.stringify(m)).digest("hex"),v=this.active(e.resourceId),w=this.id(),k=this.now().toISOString(),S=e.approvalRequired?"awaiting_approval":"built",A=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[w,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,f,JSON.stringify(s(e.manifest)),JSON.stringify(s(e.provenance??{})),e.strategy,S,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(A),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,v?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",k,k]),this.recordTransition(w,void 0,S,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(w)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Ff(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Ff).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(Mk)}recordTransition(e,t,r,a){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,a.trafficPercent??null,JSON.stringify(s(a.health??{})),a.message.slice(0,1000),a.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let a=this.get(e);if(!a)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[a.status].includes(t))throw Error(`Invalid release transition ${a.status} → ${t}`);let f=this.now().toISOString();if(t==="active"){let v=this.active(a.resourceId);if(v&&v.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[f,v.id]),this.recordTransition(v.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,f,t,f,f,e]),this.recordTransition(e,a.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let a=this.id(),m=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,m]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:ei(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),a=this.get(t);if(!r||!a)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==a.artifactId,sourceChanged:r.sourceSha!==a.sourceSha,configChanged:r.configHash!==a.configHash,manifestChanges:Bk(r.manifest,a.manifest),dataCaveat:a.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${a.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let a of this.list()){let m=r.get(a.resourceId)??[];m.push(a),r.set(a.resourceId,m)}return[...r.values()].flatMap((a)=>a.slice(t)).filter((a)=>new Date(a.createdAt)<e.before&&!a.pinned&&!["active","activating","awaiting_approval"].includes(a.status)&&!this.list().some((m)=>m.previousReleaseId===a.id&&["active","activating"].includes(m.status)))}}class ft{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Lo(e),this.queue=new c(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let a=t.action??"activate",m=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${a}`,idempotencyKey:`release:${r.id}:${a}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${a} queued.`,operationId:m.id,trafficPercent:0}),m}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let a=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),m=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!m)return{release:a};let f=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:m.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:a,rollbackOperation:f}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let a=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!a||a.resourceId!==r.resourceId||!["superseded","active"].includes(a.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${a.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:a.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function Gm(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function ul(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Mi({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:Gm(t.release)})}async function pl(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var qm=["release.activate","release.rollback"];function Lk(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function gl(e){let t=new ft(e.store),r=async(a)=>{let m=Lk(a.operation.input),f=typeof m.releaseId==="string"?m.releaseId:"",v=t.releases.get(f);if(!v)throw Error(`Queued release ${f||"(missing)"} was not found`);if(v.projectId!==a.operation.projectId||v.environmentId!==a.operation.environmentId||v.resourceId!==a.operation.resourceId)throw Error("Queued release does not match the operation scope");let w=t.releases.getArtifact(v.artifactId);if(!w||w.digest!==t.releases.getArtifact(v.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let k=typeof m.targetReleaseId==="string"&&m.targetReleaseId?m.targetReleaseId:v.previousReleaseId,S=k?t.releases.get(k):void 0;if(S&&(S.resourceId!==v.resourceId||S.artifactId===v.artifactId&&S.id===v.id))throw Error("Rollback target does not match the release resource");let A=await e.resolveDriver(v);a.checkpoint("verify",`Verifying ${w.digest} and ${v.configHash} for ${A.name}.`),a.log(`Artifact ${w.digest}; source ${v.sourceSha??"not recorded"}; config ${v.configHash}.`,{stream:"system"}),a.throwIfCancellationRequested();let x;try{x=a.operation.kind==="release.rollback"?await pl(A,{release:v,artifact:w,previous:S}):await ul(A,{release:v,artifact:w,previous:S})}catch(F){if(a.operation.kind==="release.activate"&&t.releases.get(v.id)?.status==="activating")t.completeHealthGate(v.id,{healthy:!1,operationId:a.operation.id,message:F instanceof Error?F.message:String(F)});throw F}for(let F of x.transitions)t.releases.progress(v.id,{message:`${a.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${F.trafficPercent}%.`,trafficPercent:F.trafficPercent,health:F.observed,operationId:a.operation.id}),a.log(`Traffic ${F.trafficPercent}%: ${F.healthy?"healthy":"unhealthy"}.`,{stream:F.healthy?"step":"stderr",step:"health"});if(a.checkpoint("health","Evaluating the provider health result."),!x.activated||!x.healthy){if(a.operation.kind==="release.activate"&&t.releases.get(v.id)?.status==="activating")t.completeHealthGate(v.id,{healthy:!1,operationId:a.operation.id,health:{resourceVersions:x.resourceVersions},message:x.error??"Provider health gate failed."});throw Error(x.error??`${A.name} reported an unhealthy release`)}if(a.operation.kind==="release.activate"&&v.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(v.id,{healthy:!1,operationId:a.operation.id,message:`Named health gate ${v.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${v.healthGate.name} is unavailable`);a.checkpoint("named-health-gate",`Waiting on ${v.healthGate.name}.`);let F=await e.resolveHealthGate(v.healthGate.name,v);if(a.log(`${v.healthGate.name}: ${F.healthy?"healthy":"unhealthy"}${F.message?` — ${F.message}`:""}.`,{stream:F.healthy?"step":"stderr",step:"health"}),!F.healthy)throw t.completeHealthGate(v.id,{healthy:!1,operationId:a.operation.id,health:F.evidence,message:F.message??`Named health gate ${v.healthGate.name} failed.`}),Error(F.message??`Named health gate ${v.healthGate.name} failed`)}if(a.operation.kind==="release.rollback"){let F=t.releases.get(v.id);if(F.status!=="rolled_back")t.releases.transition(F.id,"rolled_back",{message:`Traffic restored through ${A.name}.`,operationId:a.operation.id,trafficPercent:0,health:{resourceVersions:x.resourceVersions}});if(S&&S.status!=="active"){let U=S.status==="activating"?S:t.releases.transition(S.id,"activating",{message:"Rollback target restoring traffic.",operationId:a.operation.id,trafficPercent:0});t.releases.transition(U.id,"active",{message:"Previous immutable release restored.",operationId:a.operation.id,trafficPercent:100,health:{resourceVersions:x.resourceVersions}})}}else t.completeHealthGate(v.id,{healthy:!0,operationId:a.operation.id,health:{providerVersion:x.providerVersion??null,resourceVersions:x.resourceVersions},message:"Provider activation and health gates completed."});return a.checkpoint("finalize","Persisted the terminal release state."),{releaseId:v.id,artifactDigest:w.digest,provider:A.name,providerVersion:x.providerVersion??null,resourceVersions:x.resourceVersions,status:t.releases.get(v.id).status}};return Object.fromEntries(qm.map((a)=>[a,r]))}import{createCipheriv as Fk,createDecipheriv as zk,createHash as Wf,randomBytes as hp}from"node:crypto";var Hf={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Gt(e){return typeof e==="string"&&e?e:void 0}function ds(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function ti(e){return JSON.stringify(s(e))}function cs(e){return Wf("sha256").update(e).digest("hex")}function zf(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Uf(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function yp(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function qf(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Lc(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function Uk(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function qk(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Gt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Gt(e.credential_fingerprint),grantedScopes:ds(e.granted_scopes,[]),capabilities:ds(e.capabilities,Hf[String(e.provider)]),status:String(e.status),healthMessage:Gt(e.health_message),lastTestedAt:Gt(e.last_tested_at),lastSyncedAt:Gt(e.last_synced_at),credentialExpiresAt:Gt(e.credential_expires_at),version:Number(e.version),createdByActorId:Gt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function vp(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:ds(e.metadata,{}),syncedAt:String(e.synced_at)}}function Vf(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Gt(e.environment_id),resourceId:Gt(e.resource_id),connectionId:String(e.connection_id),repositoryId:Gt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Gt(e.branch_rule),tagRule:Gt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:ds(e.include_paths,[]),excludePaths:ds(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Gt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Gt(e.disabled_reason),version:Number(e.version),createdByActorId:Gt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function bp(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Gt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Sp(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Gt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Gt(e.provider_webhook_id),events:ds(e.events,[]),status:String(e.status),healthMessage:Gt(e.health_message),lastDeliveryAt:Gt(e.last_delivery_at),lastReconciledAt:Gt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function wp(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Gt(e.action),commitSha:Gt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:ds(e.payload_summary,{}),operationId:Gt(e.operation_id),error:Gt(e.error),receivedAt:String(e.received_at),processedAt:Gt(e.processed_at)}}class $o{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?Wf("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=hp(12),r=Fk("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,a,m]=e.split(".");if(t!=="v1"||!r||!a||!m)throw Error("Encrypted source credential is unavailable");let f=zk("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return f.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([f.update(Buffer.from(m,"base64url")),f.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),a=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Uf(e.name),zf(e.host),e.owner?.trim()||null,e.authKind??(a?"access_token":"none"),a?this.encrypt(a):null,a?cs(a).slice(0,16):null,ti([...new Set(e.grantedScopes??[])].sort()),ti(Hf[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:zf(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=qk(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let a=this.getConnection(e);if(!a||a.status==="disconnected")throw Error("Active source connection was not found");let m=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(m),cs(m).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:cs(m).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let a=this.now(),m=t.grantedScopes?[...new Set(t.grantedScopes.map((f)=>f.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,m?ti(m):null,t.tested?a:null,t.synced?a:null,a,e]),m&&JSON.stringify(m)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:m}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),a=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),m=a?String(a.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[m,e.connectionId,e.providerRepositoryId,yp(e.fullName),Uk(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,ti(e.metadata),r]),vp(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(m))}listRepositories(e,t,r=100){let a=t?.trim().toLowerCase();return(a?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${a}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(vp)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?vp(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),a=this.now(),m=`sha256:${cs(e.publicKey.trim())}`,f=`sha256:${cs(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Uf(e.name),e.publicKey.trim(),m,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),f,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:m,hostFingerprint:f}}),bp(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?bp(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(bp)}revokeDeployKey(e,t){let r=this.getDeployKey(e),a=r?this.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Deploy key was not found");let m=this.listBindings({connectionId:a.id}).filter((v)=>v.deployKeyId===e),f=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[f,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:a.id,deployKeyId:e,affectedBindingIds:m.map((v)=>v.id)}}),{affectedBindings:m}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),a=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`,[r,e.projectId,e.environmentId??null,e.resourceId??null,e.connectionId,e.repositoryId??null,yp(e.repositoryFullName),e.defaultBranch?.trim()||"main",e.branchRule?.trim()||null,e.tagRule?.trim()||null,qf(e.monorepoRoot??"."),ti(Lc(e.includePaths)),ti(Lc(e.excludePaths)),e.submodules?1:0,e.cloneDepth??null,e.deployKeyId??null,e.autoDeploy===!1?0:1,e.pullRequestPreviews===!1?0:1,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:e.projectId,actorId:e.actorId,type:"source.binding.created",payload:{bindingId:r,connectionId:e.connectionId,repository:e.repositoryFullName,branch:e.defaultBranch??"main"}}),this.getBinding(r)}getBinding(e){let t=this.controlPlane.database.query("SELECT * FROM source_bindings WHERE id = ?").get(e);return t?Vf(t):void 0}listBindings(e={}){return this.controlPlane.database.query("SELECT * FROM source_bindings ORDER BY created_at DESC").all().map(Vf).filter((r)=>(!e.connectionId||r.connectionId===e.connectionId)&&(!e.projectId||r.projectId===e.projectId)&&(!e.status||r.status===e.status))}updateBinding(e,t,r){let a=this.getBinding(e);if(!a||a.version!==t)throw Error(`Source binding ${e} changed since version ${t}`);let m=this.getConnection(a.connectionId);if((!m||["disconnected","expired"].includes(m.status))&&(r.status==="active"||r.autoDeploy===!0))throw Error("Rotate or reconnect the source credential before enabling this binding");if(r.deployKeyId&&this.getDeployKey(r.deployKeyId)?.connectionId!==a.connectionId)throw Error("Deploy key does not belong to this connection");let f=this.now();if(this.controlPlane.database.run("UPDATE source_bindings SET default_branch=?, branch_rule=?, tag_rule=?, monorepo_root=?, include_paths=?, exclude_paths=?, submodules=?, clone_depth=?, deploy_key_id=?, auto_deploy=?, pull_request_previews=?, status=?, disabled_reason=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.defaultBranch?.trim()||a.defaultBranch,r.branchRule===void 0?a.branchRule??null:r.branchRule.trim()||null,r.tagRule===void 0?a.tagRule??null:r.tagRule.trim()||null,r.monorepoRoot===void 0?a.monorepoRoot:qf(r.monorepoRoot),ti(r.includePaths===void 0?a.includePaths:Lc(r.includePaths)),ti(r.excludePaths===void 0?a.excludePaths:Lc(r.excludePaths)),r.submodules??a.submodules?1:0,r.cloneDepth===void 0?a.cloneDepth??null:r.cloneDepth,r.deployKeyId===void 0?a.deployKeyId??null:r.deployKeyId,r.autoDeploy??a.autoDeploy?1:0,r.pullRequestPreviews??a.pullRequestPreviews?1:0,r.status??a.status,r.disabledReason===void 0?a.disabledReason??null:r.disabledReason.slice(0,1000),f,e,t]).changes!==1)throw Error(`Source binding ${e} changed since version ${t}`);let w=this.getConnection(a.connectionId);return this.controlPlane.appendEvent({organizationId:w.organizationId,projectId:a.projectId,actorId:r.actorId,type:"source.binding.updated",payload:{bindingId:e,fromVersion:t,toVersion:t+1,status:r.status??a.status}}),this.getBinding(e)}createWebhook(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");let r=this.idFn(),a=this.now(),m=e.endpointToken??hp(24).toString("base64url"),f=e.secret??hp(32).toString("base64url"),v=[...new Set(e.events??["push","pull_request"])].filter((w)=>["push","pull_request"].includes(w));if(!v.length)throw Error("At least one supported webhook event is required");return this.run("INSERT INTO source_webhooks (id, connection_id, repository_id, repository_full_name, endpoint_token_hash, endpoint_token_ciphertext, secret_ciphertext, events, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)",[r,e.connectionId,e.repositoryId??null,yp(e.repositoryFullName),cs(m),this.encrypt(m),this.encrypt(f),ti(v),a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,type:"source.webhook.created",payload:{webhookId:r,connectionId:t.id,repository:e.repositoryFullName,events:v}}),{webhook:{...this.getWebhook(r),endpointToken:m},secret:f}}getWebhook(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE id = ?").get(e);return t?Sp(t):void 0}getWebhookByEndpointToken(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE endpoint_token_hash = ?").get(cs(e));return t?Sp(t):void 0}getWebhookSecret(e){let t=this.controlPlane.database.query("SELECT secret_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t)throw Error("Source webhook was not found");return this.decrypt(String(t.secret_ciphertext))}getWebhookEndpointToken(e){let t=this.controlPlane.database.query("SELECT endpoint_token_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t?.endpoint_token_ciphertext)throw Error("Source webhook endpoint token is unavailable");return this.decrypt(String(t.endpoint_token_ciphertext))}listWebhooks(e){return this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE connection_id = ? ORDER BY repository_full_name").all(e).map(Sp)}updateWebhookState(e,t){let r=this.getWebhook(e);if(!r)throw Error("Source webhook was not found");let a=this.now();this.run("UPDATE source_webhooks SET provider_webhook_id=COALESCE(?, provider_webhook_id), status=?, health_message=?, last_reconciled_at=COALESCE(?, last_reconciled_at), updated_at=? WHERE id=?",[t.providerWebhookId??null,t.status,t.healthMessage?.slice(0,1000)??null,t.reconciled?a:null,a,e]);let m=this.getConnection(r.connectionId);if(m)this.controlPlane.appendEvent({organizationId:m.organizationId,type:"source.webhook.updated",payload:{webhookId:e,connectionId:m.id,repository:r.repositoryFullName,status:t.status,reconciled:t.reconciled??!1,providerWebhookId:t.providerWebhookId??r.providerWebhookId??null}});return this.getWebhook(e)}getDeliveryByProviderId(e,t){let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE connection_id = ? AND provider_delivery_id = ?").get(e,t);return r?wp(r):void 0}recordDelivery(e){let t=this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId);if(t)return{delivery:t,duplicate:!0};let r=this.idFn(),a=this.now();return this.controlPlane.database.transaction(()=>{this.run("INSERT INTO source_webhook_deliveries (id, connection_id, webhook_id, provider_delivery_id, event, action, commit_sha, signature_status, status, payload_summary, operation_id, error, received_at, processed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,e.webhookId,e.providerDeliveryId,e.event.slice(0,100),e.action?.slice(0,100)??null,e.commitSha?.slice(0,128)??null,e.signatureStatus,e.status,ti(e.payloadSummary??{}),e.operationId??null,e.error?.slice(0,2000)??null,a,["enqueued","ignored","rejected","failed"].includes(e.status)?a:null]),this.run("UPDATE source_webhooks SET last_delivery_at=?, updated_at=? WHERE id=?",[a,a,e.webhookId])})(),{delivery:this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId),duplicate:!1}}updateDelivery(e,t){this.run("UPDATE source_webhook_deliveries SET status=?, operation_id=?, error=?, processed_at=? WHERE id=?",[t.status,t.operationId??null,t.error?.slice(0,2000)??null,this.now(),e]);let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE id = ?").get(e);if(!r)throw Error("Source webhook delivery was not found");return wp(r)}listDeliveries(e,t=100){return this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE webhook_id = ? ORDER BY received_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(wp)}disconnectConnection(e,t){let r=this.getConnection(e);if(!r)throw Error("Source connection was not found");let a=this.listBindings({connectionId:e,status:"active"}),m=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_connections SET status='disconnected', credential_ciphertext=NULL, health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[m,e]),this.run("UPDATE source_bindings SET status='disabled', auto_deploy=0, disabled_reason='Source connection was disconnected', version=version+1, updated_at=? WHERE connection_id=? AND status='active'",[m,e]),this.run("UPDATE source_webhooks SET status='disabled', health_message='Source connection was disconnected', updated_at=? WHERE connection_id=?",[m,e])})(),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"source.connection.disconnected",level:"warning",payload:{connectionId:e,affectedBindingIds:a.map((f)=>f.id),affectedRepositories:a.map((f)=>f.repositoryFullName)}}),{connection:this.getConnection(e),affectedBindings:a}}}import{createSign as Vk}from"node:crypto";class Jt extends Error{status;retryAfterSeconds;constructor(e,t,r){super(e);this.status=t;this.retryAfterSeconds=r;this.name="SourceProviderError"}}var Jf={repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0};function uo(e){let t=Number(e??"1");return Number.isInteger(t)&&t>0?t:1}function po(e){return Math.max(1,Math.min(100,e??50))}function jn(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function nc(e){let t=new URL(e);if(t.username||t.password||t.protocol!=="https:")throw Error("Webhook endpoint must be credential-free HTTPS");return t.href}function Kf(e){return Buffer.from(e).toString("base64url")}function Wk(e,t){if(!e.appId||!e.privateKey)throw Error("GitHub App credentials require appId and privateKey");let r=Kf(JSON.stringify({alg:"RS256",typ:"JWT"})),a=Math.floor(t.getTime()/1000)-30,m=Kf(JSON.stringify({iat:a,exp:a+540,iss:e.appId})),f=Vk("RSA-SHA256");return f.update(`${r}.${m}`),f.end(),`${r}.${m}.${f.sign(e.privateKey).toString("base64url")}`}class ic{connection;credential;capabilities=Jf;fetchFn;timeoutMs;nowFn;constructor(e,t,r={}){this.connection=e;this.credential=t;this.fetchFn=r.fetch??((a,m)=>globalThis.fetch(a,m)),this.timeoutMs=Math.max(100,r.timeoutMs??20000),this.nowFn=r.now??(()=>new Date)}async request(e,t={}){let r=new URL(`${this.apiRoot().replace(/\/$/,"")}/`),a=new URL(e.replace(/^\//,""),r);if(a.origin!==r.origin)throw Error("Provider pagination cannot leave the configured host");let m=new AbortController,f=setTimeout(()=>m.abort(),this.timeoutMs);try{let v=await this.fetchFn(a,{...t,redirect:"error",signal:m.signal,headers:{Accept:"application/json","User-Agent":"ts-cloud-source/1",...await this.authorization(),...t.headers}});if(!v.ok){let w=Number(v.headers.get("retry-after")??""),k=v.headers.get("x-request-id")??v.headers.get("x-github-request-id");throw new Jt(`Source provider request failed (${v.status})${k?` [request ${k}]`:""}`,v.status,Number.isFinite(w)?w:void 0)}if(v.status===204)return{data:void 0,headers:v.headers};return{data:await v.json(),headers:v.headers}}catch(v){if(v instanceof Jt)throw v;if(m.signal.aborted)throw new Jt(`Source provider request exceeded ${this.timeoutMs}ms`);throw new Jt(v instanceof Error?v.message.replace(/(?:token|password|secret)=[^\s&]+/gi,"$1=[REDACTED]"):"Source provider request failed")}finally{clearTimeout(f)}}async deleteWebhook(e,t){await this.request(this.webhookPath(e,t),{method:"DELETE"})}}class ml extends ic{provider="github";installationToken;apiRoot(){return this.connection.host==="https://github.com"?"https://api.github.com":`${this.connection.host}/api/v3`}async authorization(){if(this.credential?.token)return{Authorization:`Bearer ${this.credential.token}`,"X-GitHub-Api-Version":"2022-11-28"};if(!this.credential?.installationId)return{};if(!this.installationToken||this.installationToken.expiresAt<this.nowFn().getTime()+60000){let e=Wk(this.credential,this.nowFn()),t=this.apiRoot().replace(/\/$/,""),r=new AbortController,a=setTimeout(()=>r.abort(),this.timeoutMs);try{let m=await this.fetchFn(`${t}/app/installations/${encodeURIComponent(this.credential.installationId)}/access_tokens`,{method:"POST",signal:r.signal,redirect:"error",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":"2022-11-28","User-Agent":"ts-cloud-source/1"}});if(!m.ok)throw new Jt(`GitHub App token refresh failed (${m.status})`,m.status);let f=await m.json();this.installationToken={value:f.token,expiresAt:new Date(f.expires_at).getTime()}}finally{clearTimeout(a)}}return{Authorization:`Bearer ${this.installationToken.value}`,"X-GitHub-Api-Version":"2022-11-28"}}async testConnection(){let e=this.credential?.installationId?"/installation/repositories?per_page=1":"/user",{data:t,headers:r}=await this.request(e);return{ok:!0,account:t.login??this.connection.owner,scopes:(r.get("x-oauth-scopes")??this.connection.grantedScopes.join(",")).split(",").map((a)=>a.trim()).filter(Boolean),message:"GitHub connection is healthy"}}async listRepositories(e={}){let t=po(e.limit),r=uo(e.cursor),a=this.credential?.installationId?`/installation/repositories?per_page=${t}&page=${r}`:`/user/repos?per_page=${t}&page=${r}&sort=updated`,{data:m}=await this.request(a),f=Array.isArray(m)?m:m.repositories;return{repositories:(e.search?f.filter((w)=>w.full_name.toLowerCase().includes(e.search.toLowerCase())):f).map((w)=>({providerRepositoryId:String(w.id),fullName:w.full_name,cloneUrl:w.clone_url,defaultBranch:w.default_branch||"main",visibility:w.visibility??(w.private?"private":"public"),archived:!!w.archived,metadata:{}})),nextCursor:f.length===t?String(r+1):void 0}}async refs(e,t,r={}){let a=po(r.limit),m=uo(r.cursor),{data:f}=await this.request(`/repos/${jn(e)}/${t}?per_page=${a}&page=${m}`);return{refs:f.map((v)=>({name:v.name,commitSha:v.commit.sha,protected:v.protected})),nextCursor:f.length===a?String(m+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${jn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events,url:e.config.url??""}}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:JSON.stringify({name:"web",active:!0,events:t.events,config:{url:nc(t.url),content_type:"json",secret:t.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:JSON.stringify({active:!0,events:r.events,config:{url:nc(r.url),content_type:"json",secret:r.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${jn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}class hl extends ic{provider="gitlab";apiRoot(){return`${this.connection.host}/api/v4`}async authorization(){return this.credential?.token?{"PRIVATE-TOKEN":this.credential.token}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username,scopes:this.connection.grantedScopes,message:"GitLab connection is healthy"}}async listRepositories(e={}){let t=po(e.limit),r=uo(e.cursor),a=e.search?`&search=${encodeURIComponent(e.search)}`:"",{data:m,headers:f}=await this.request(`/projects?membership=true&simple=true&order_by=last_activity_at&per_page=${t}&page=${r}${a}`);return{repositories:m.map((v)=>({providerRepositoryId:String(v.id),fullName:v.path_with_namespace,cloneUrl:v.http_url_to_repo,defaultBranch:v.default_branch??"main",visibility:v.visibility??"unknown",archived:!!v.archived,metadata:{}})),nextCursor:f.get("x-next-page")||void 0}}async refs(e,t,r={}){let a=po(r.limit),m=uo(r.cursor),{data:f,headers:v}=await this.request(`/projects/${encodeURIComponent(jn(e))}/repository/${t}?per_page=${a}&page=${m}`);return{refs:f.map((w)=>({name:w.name,commitSha:w.commit.id,protected:w.protected})),nextCursor:v.get("x-next-page")||void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/projects/${encodeURIComponent(jn(e))}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:!0,events:[...e.push_events?["push"]:[],...e.merge_requests_events?["pull_request"]:[]],url:e.url}}body(e){return JSON.stringify({url:nc(e.url),token:e.secret,enable_ssl_verification:!0,push_events:e.events.includes("push"),merge_requests_events:e.events.includes("pull_request")})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="failure"||r.state==="error"?"failed":r.state;await this.request(`/projects/${encodeURIComponent(jn(e))}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,target_url:r.url,description:r.description.slice(0,255),name:r.context??"ts-cloud/preview"})})}}class fl extends ic{provider="bitbucket";apiRoot(){return this.connection.host==="https://bitbucket.org"?"https://api.bitbucket.org/2.0":`${this.connection.host}/2.0`}async authorization(){return this.credential?.token?{Authorization:`Bearer ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username??e.display_name,scopes:this.connection.grantedScopes,message:"Bitbucket connection is healthy"}}async listRepositories(e={}){if(!this.connection.owner)throw Error("Bitbucket repository discovery requires an owner/workspace");let t=uo(e.cursor),r=po(e.limit),a=e.search?`&q=name~%22${encodeURIComponent(e.search)}%22`:"",{data:m}=await this.request(`/repositories/${encodeURIComponent(this.connection.owner)}?pagelen=${r}&page=${t}${a}`);return{repositories:m.values.map((f)=>({providerRepositoryId:f.uuid,fullName:f.full_name,cloneUrl:f.links.clone.find((v)=>v.name==="https")?.href??f.links.clone[0]?.href??"",defaultBranch:f.mainbranch?.name??"main",visibility:f.is_private?"private":"public",archived:!1,metadata:{}})),nextCursor:m.next?String(t+1):void 0}}async refs(e,t,r={}){let a=uo(r.cursor),m=po(r.limit),{data:f}=await this.request(`/repositories/${jn(e)}/refs/${t}?pagelen=${m}&page=${a}`);return{refs:f.values.map((v)=>({name:v.name,commitSha:v.target.hash})),nextCursor:f.next?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repositories/${jn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:e.uuid,active:e.active,events:e.events.map((t)=>t.replace("repo:push","push").replace("pullrequest:","pull_request:")),url:e.url}}body(e){return JSON.stringify({description:"ts-cloud deploy",url:nc(e.url),active:!0,events:e.events.map((t)=>t==="push"?"repo:push":t.replace("pull_request:","pullrequest:"))})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.values.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="success"?"SUCCESSFUL":r.state==="pending"?"INPROGRESS":"FAILED";await this.request(`/repositories/${jn(e)}/commit/${encodeURIComponent(t)}/statuses/build/ts-cloud-preview`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,key:"ts-cloud-preview",name:r.context??"ts-cloud/preview",url:r.url,description:r.description.slice(0,255)})})}}class Al extends ic{provider="gitea";capabilities={...Jf,tokenRefresh:!1};apiRoot(){return`${this.connection.host}/api/v1`}async authorization(){return this.credential?.token?{Authorization:`token ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.login,scopes:this.connection.grantedScopes,message:"Gitea connection is healthy"}}async listRepositories(e={}){let t=uo(e.cursor),r=po(e.limit),a=e.search?`/repos/search?q=${encodeURIComponent(e.search)}&limit=${r}&page=${t}`:`/user/repos?limit=${r}&page=${t}`,{data:m,headers:f}=await this.request(a),v=Array.isArray(m)?m:m.data;return{repositories:v.map((w)=>({providerRepositoryId:String(w.id),fullName:w.full_name,cloneUrl:w.clone_url,defaultBranch:w.default_branch??"main",visibility:w.private?"private":"public",archived:!!w.archived,metadata:{}})),nextCursor:f.get("x-hasmore")==="true"||v.length===r?String(t+1):void 0}}async refs(e,t,r={}){let a=uo(r.cursor),m=po(r.limit),{data:f}=await this.request(`/repos/${jn(e)}/${t}?limit=${m}&page=${a}`);return{refs:f.map((v)=>({name:v.name,commitSha:v.commit.id})),nextCursor:f.length===m?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${jn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events??[],url:e.config.url??""}}body(e){return JSON.stringify({type:"gitea",active:!0,events:e.events,config:{url:nc(e.url),content_type:"json",secret:e.secret,insecure_ssl:"0"}})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${jn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}function Je(e,t,r={}){switch(e.provider){case"github":return new ml(e,t,r);case"gitlab":return new hl(e,t,r);case"bitbucket":return new fl(e,t,r);case"gitea":return new Al(e,t,r);default:throw Error(`${e.provider} uses bounded Git discovery instead of a hosted provider API`)}}import{createHmac as Hk,timingSafeEqual as Kk}from"node:crypto";function hn(e,t){if(e instanceof Headers)return e.get(t)??void 0;return Object.entries(e).find(([a])=>a.toLowerCase()===t.toLowerCase())?.[1]}function Gf(e,t){let r=Buffer.from(e),a=Buffer.from(t);return r.length===a.length&&Kk(r,a)}function Jk(e,t){return Hk("sha256",e).update(t).digest("hex")}function Gk(e,t,r,a,m){if(e==="gitlab")return Gf(hn(r,"x-gitlab-token")??"",t);let f=e==="github"?hn(r,"x-hub-signature-256"):e==="gitea"?hn(r,"x-gitea-signature"):hn(r,"x-hub-signature")??hn(r,"x-ts-cloud-signature");if(!f)return!1;if(e==="generic_https"||e==="generic_ssh"){let v=Number(hn(r,"x-ts-cloud-timestamp"));if(!Number.isFinite(v)||Math.abs(m.getTime()-v*1000)>300000)return!1}return Gf(f.replace(/^sha256=/,""),Jk(t,a))}function Qk(e,t){return{github:["x-github-delivery"],gitlab:["x-gitlab-event-uuid","x-request-id"],bitbucket:["x-request-uuid"],gitea:["x-gitea-delivery"],generic_https:["x-ts-cloud-delivery"],generic_ssh:["x-ts-cloud-delivery"]}[e].map((a)=>hn(t,a)?.trim()).find(Boolean)}function mo(e){let t=String(e??"").trim().replace(/^\/+|\/+$/g,"");return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t)?t:""}function kp(e){return[...new Set(e.flatMap((t)=>{if(!t||typeof t!=="object")return[];let r=t;return[...r.added??[],...r.modified??[],...r.removed??[]].map(String)}).filter((t)=>t&&!t.includes("\x00")).slice(0,500))]}function Vm(e,t,r){let a=e,m=t,f=r;if(a==="github"){let v=hn(m,"x-github-event"),w=mo(f.repository?.full_name);if(v==="push")return{event:"push",repository:w,ref:String(f.ref??""),branch:String(f.ref??"").replace(/^refs\/heads\//,""),tag:String(f.ref??"").startsWith("refs/tags/")?String(f.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(f.after??f.head_commit?.id??""),changedPaths:kp(f.commits??[]),deleted:f.deleted===!0||/^0{40,64}$/.test(String(f.after??""))};if(v==="pull_request")return{event:"pull_request",action:String(f.action??""),repository:w,branch:String(f.pull_request?.head?.ref??""),commitSha:String(f.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(f.number)||void 0,fork:mo(f.pull_request?.head?.repo?.full_name)!==w}}if(a==="gitlab"){let v=String(f.object_kind??"").toLowerCase(),w=mo(f.project?.path_with_namespace);if(v==="push"||v==="tag_push")return{event:"push",repository:w,ref:String(f.ref??""),branch:String(f.ref??"").replace(/^refs\/heads\//,""),tag:v==="tag_push"?String(f.ref??"").replace(/^refs\/tags\//,""):void 0,commitSha:String(f.checkout_sha??f.after??""),changedPaths:kp(f.commits??[]),deleted:/^0{40,64}$/.test(String(f.after??""))};if(v==="merge_request")return{event:"pull_request",action:String(f.object_attributes?.action??f.object_attributes?.state??""),repository:w,branch:String(f.object_attributes?.source_branch??""),commitSha:String(f.object_attributes?.last_commit?.id??""),changedPaths:[],pullRequestNumber:Number(f.object_attributes?.iid)||void 0,fork:f.object_attributes?.source_project_id!==f.object_attributes?.target_project_id}}if(a==="bitbucket"){let v=hn(m,"x-event-key")??"",w=mo(f.repository?.full_name);if(v==="repo:push"){let k=f.push?.changes?.[0]??{},S=k.new??k.old??{},A=k.new?.target??k.old?.target;return{event:"push",repository:w,ref:String(S.name??""),branch:S.type==="branch"?String(S.name):void 0,tag:S.type==="tag"?String(S.name):void 0,commitSha:String(A?.hash??""),changedPaths:[],deleted:k.closed===!0||k.new==null}}if(v.startsWith("pullrequest:"))return{event:"pull_request",action:v.replace("pullrequest:",""),repository:w,branch:String(f.pullrequest?.source?.branch?.name??""),commitSha:String(f.pullrequest?.source?.commit?.hash??""),changedPaths:[],pullRequestNumber:Number(f.pullrequest?.id)||void 0,fork:mo(f.pullrequest?.source?.repository?.full_name)!==w}}if(a==="gitea"){let v=hn(m,"x-gitea-event"),w=mo(f.repository?.full_name);if(v==="push")return{event:"push",repository:w,ref:String(f.ref??""),branch:String(f.ref??"").replace(/^refs\/heads\//,""),tag:String(f.ref??"").startsWith("refs/tags/")?String(f.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(f.after??""),changedPaths:kp(f.commits??[]),deleted:f.deleted===!0||/^0{40,64}$/.test(String(f.after??""))};if(v==="pull_request")return{event:"pull_request",action:String(f.action??""),repository:w,branch:String(f.pull_request?.head?.ref??""),commitSha:String(f.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(f.number)||void 0,fork:mo(f.pull_request?.head?.repo?.full_name)!==w}}if(a==="generic_https"||a==="generic_ssh"){if(f.event!=="push"&&f.event!=="pull_request")return;return{event:f.event,action:typeof f.action==="string"?f.action:void 0,repository:mo(f.repository),ref:typeof f.ref==="string"?f.ref:void 0,branch:typeof f.branch==="string"?f.branch:void 0,tag:typeof f.tag==="string"?f.tag:void 0,commitSha:String(f.commitSha??""),changedPaths:Array.isArray(f.changedPaths)?f.changedPaths.map(String).slice(0,500):[],pullRequestNumber:Number(f.pullRequestNumber)||void 0,fork:f.fork===!0,deleted:f.deleted===!0}}return}function Ms(e,t){let r="^";for(let a=0;a<t.length;a++){let m=t[a];if(m==="*"&&t[a+1]==="*")r+=".*",a++;else if(m==="*")r+="[^/]*";else if(m==="?")r+="[^/]";else r+=m.replace(/[|\\{}()[\]^$+?.]/g,"\\$&")}return new RegExp(`${r}$`).test(e)}function Yk(e,t){if(t.event==="pull_request")return e.pullRequestPreviews;if(!e.autoDeploy)return!1;if(t.tag)return!!e.tagRule&&Ms(t.tag,e.tagRule);return Ms(t.branch??"",e.branchRule??e.defaultBranch)}function Zk(e,t){if(!t.length)return!0;return t.filter((a)=>!e.excludePaths.some((m)=>Ms(a,m))).some((a)=>!e.includePaths.length||e.includePaths.some((m)=>Ms(a,m)))}function Qf(e,t){return hn(t,e==="github"?"x-github-event":e==="gitlab"?"x-gitlab-event":e==="bitbucket"?"x-event-key":e==="gitea"?"x-gitea-event":"x-ts-cloud-event")??"unknown"}function us(){return{accepted:!1,duplicate:!1,status:"rejected",operations:[],message:"Webhook unavailable"}}async function yl(e){if(e.rawBody.byteLength>2097152)return us();let t=e.sources.getWebhookByEndpointToken(e.endpointToken);if(!t||t.status==="disabled")return us();let r=e.sources.getConnection(t.connectionId);if(!r||r.status==="disconnected"||r.status==="expired")return us();let a=Qk(r.provider,e.headers);if(!a||a.length>200)return us();if(!Gk(r.provider,e.sources.getWebhookSecret(t.id),e.headers,e.rawBody,e.now??new Date))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:Qf(r.provider,e.headers),signatureStatus:hn(e.headers,"x-hub-signature-256")||hn(e.headers,"x-gitlab-token")||hn(e.headers,"x-hub-signature")||hn(e.headers,"x-gitea-signature")?"invalid":"missing",status:"rejected",error:"Webhook signature verification failed"}),us();let f;try{f=JSON.parse(new TextDecoder().decode(e.rawBody))}catch{return us()}let v=Vm(r.provider,e.headers,f);if(!v||!v.repository||!/^[a-f0-9]{7,64}$/i.test(v.commitSha))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:Qf(r.provider,e.headers),signatureStatus:"verified",status:"rejected",error:"Unsupported or malformed source event"}),us();let w=e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:v.event,action:v.action,commitSha:v.commitSha,signatureStatus:"verified",status:"accepted",payloadSummary:{repository:v.repository,ref:v.ref??null,branch:v.branch??null,tag:v.tag??null,commitSha:v.commitSha,pullRequestNumber:v.pullRequestNumber??null,changedPathCount:v.changedPaths.length}});if(w.duplicate&&w.delivery.status!=="accepted")return{accepted:!0,duplicate:!0,status:"duplicate",operations:[],message:"Delivery already processed"};let k=new He(e.controlPlane),S=e.sources.listBindings({connectionId:r.id,status:"active"}).filter((U)=>{if(U.repositoryFullName.toLowerCase()!==v.repository.toLowerCase()||!Zk(U,v.changedPaths))return!1;let H=U.resourceId?k.getDefinitionForResource(U.resourceId):void 0,K=v.event==="push"&&!!H?.branchRule&&!!v.branch&&Ms(v.branch,H.branchRule);return Yk(U,v)||K});if(!S.length)return e.sources.updateDelivery(w.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:w.duplicate,status:"ignored",operations:[],message:"Verified event did not match an active deployment rule"};let A=new c(e.controlPlane),x=new Set(["closed","merged","declined"]),F=S.flatMap((U)=>{if(v.event==="push"&&U.resourceId&&v.branch){let K=k.getDefinitionForResource(U.resourceId);if(K?.branchRule&&Ms(v.branch,K.branchRule)){let X=k.findForBranch(K.id,v.repository,v.branch);if(v.deleted){if(!K.cleanupOnClose||!X||X.status==="destroyed")return[];let ce=A.enqueue({projectId:U.projectId,environmentId:U.environmentId,resourceId:U.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${X.id}:branch-delete:${a}`,correlationId:`preview:${X.id}`,input:{previewId:X.id,reason:"branch_deleted",source:{repository:v.repository,commitSha:v.commitSha,branch:v.branch}},lockKey:`preview:${X.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(X.id,"queued",{operationId:ce.id}),[ce]}let oe=k.upsert({definitionId:K.id,sourceProvider:r.provider,repository:v.repository,branch:v.branch,commitSha:v.commitSha});if(!oe.changed)return[];let pe=oe.created?"preview.create":"preview.update",ee=A.enqueue({projectId:U.projectId,environmentId:U.environmentId,resourceId:U.resourceId,kind:pe,idempotencyKey:`preview:${oe.preview.id}:${v.commitSha}`,correlationId:`preview:${oe.preview.id}`,input:{previewId:oe.preview.id,source:{connectionId:r.id,bindingId:U.id,repository:v.repository,commitSha:v.commitSha,branch:v.branch,monorepoRoot:U.monorepoRoot,submodules:U.submodules,cloneDepth:U.cloneDepth??null}},lockKey:`preview:${oe.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(oe.preview.id,"queued",{operationId:ee.id}),[ee]}}if(v.event==="pull_request"&&U.resourceId&&v.pullRequestNumber){let K=k.getDefinitionForResource(U.resourceId);if(K){let X=x.has(String(v.action??"").toLowerCase()),oe=k.findForPullRequest(K.id,v.repository,v.pullRequestNumber);if(X){if(!K.cleanupOnClose||!oe||oe.status==="destroyed")return[];let pe=A.enqueue({projectId:U.projectId,environmentId:U.environmentId,resourceId:U.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${oe.id}:destroy:${a}`,correlationId:`preview:${oe.id}`,input:{previewId:oe.id,reason:"pull_request_closed",source:{repository:v.repository,commitSha:v.commitSha,branch:v.branch??null,pullRequestNumber:v.pullRequestNumber}},lockKey:`preview:${oe.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(oe.id,"queued",{operationId:pe.id}),[pe]}try{let pe=k.upsert({definitionId:K.id,sourceProvider:r.provider,repository:v.repository,branch:v.branch??`pr-${v.pullRequestNumber}`,pullRequestNumber:v.pullRequestNumber,fork:v.fork,commitSha:v.commitSha});if(!pe.changed)return[];let ee=pe.created?"preview.create":"preview.update",ce=A.enqueue({projectId:U.projectId,environmentId:U.environmentId,resourceId:U.resourceId,kind:ee,idempotencyKey:`preview:${pe.preview.id}:${v.commitSha}`,correlationId:`preview:${pe.preview.id}`,input:{previewId:pe.preview.id,source:{connectionId:r.id,bindingId:U.id,repository:v.repository,commitSha:v.commitSha,branch:v.branch??null,pullRequestNumber:v.pullRequestNumber,fork:!!v.fork,monorepoRoot:U.monorepoRoot,submodules:U.submodules,cloneDepth:U.cloneDepth??null},inheritedSecretNames:pe.inheritedSecrets},lockKey:`preview:${pe.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(pe.preview.id,"queued",{operationId:ce.id}),[ce]}catch(pe){return e.controlPlane.appendEvent({projectId:U.projectId,resourceId:U.resourceId,type:"preview.rejected",level:"warning",payload:{repository:v.repository,pullRequestNumber:v.pullRequestNumber,fork:!!v.fork,reason:pe instanceof Error?pe.message:String(pe)}}),[]}}}let H=v.event==="pull_request"?"deploy.preview":"deploy.source";return[A.enqueue({projectId:U.projectId,environmentId:U.environmentId,resourceId:U.resourceId,kind:H,idempotencyKey:`source:${r.id}:${a}:${U.id}:${v.commitSha}`,correlationId:`source:${a}`,input:{source:{connectionId:r.id,bindingId:U.id,repository:v.repository,commitSha:v.commitSha,branch:v.branch??null,tag:v.tag??null,monorepoRoot:U.monorepoRoot,submodules:U.submodules,cloneDepth:U.cloneDepth??null},preview:v.event==="pull_request"?{number:v.pullRequestNumber??null,action:v.action??null}:null},lockKey:U.resourceId?`resource:${U.resourceId}`:`environment:${U.environmentId??U.projectId}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:v.event==="pull_request"?14:90}).operation]});if(!F.length)return e.sources.updateDelivery(w.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:w.duplicate,status:"ignored",operations:[],message:"Verified event required no preview lifecycle change"};return e.sources.updateDelivery(w.delivery.id,{status:"enqueued",operationId:F[0]?.id}),e.controlPlane.appendEvent({organizationId:r.organizationId,projectId:S[0]?.projectId,operationId:F[0]?.id,type:"source.webhook.enqueued",payload:{webhookId:t.id,deliveryId:w.delivery.id,repository:v.repository,commitSha:v.commitSha,operationIds:F.map((U)=>U.id)}}),{accepted:!0,duplicate:w.duplicate,status:"enqueued",operations:F,message:`${F.length} deployment operation${F.length===1?"":"s"} enqueued`}}function Xt(e,t){if(!t.endpointToken)throw Error("The webhook endpoint token is only available at creation time");let r=new URL(e);if(r.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(r.hostname))throw Error("Webhook base URL must use HTTPS");return new URL(`/api/source/webhooks/${encodeURIComponent(t.endpointToken)}`,r).href}import{chmodSync as Yf,mkdtempSync as Xk,rmSync as eI,writeFileSync as Zf}from"node:fs";import{tmpdir as tI}from"node:os";import{join as Fc,resolve as rI}from"node:path";function vh(e,t){let r=e.trim();if(/\r|\n|\0/.test(r))throw Error("Git remote contains control characters");if(r.startsWith("https://")){let m=new URL(r);if(m.username||m.password||m.search||m.hash)throw Error("HTTPS Git remotes cannot contain credentials, queries, or fragments");return m.href}let a=r.startsWith("ssh://")?new URL(r).hostname:r.match(/^git@([A-Za-z0-9.-]+):/)?.[1];if(!a)throw Error("Git remote must use credential-free HTTPS or SSH");if(!t||t.host.toLowerCase()!==a.toLowerCase())throw Error("SSH Git remote requires a deploy key with a pinned key for the same host");return r}function nI(e,t,r){let a=e.replaceAll(t,"[REMOTE]").slice(0,4000);for(let m of[r?.token,r?.privateKey])if(m)a=a.replaceAll(m,"[REDACTED]");return a}function iI(e){let t={PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",GIT_TERMINAL_PROMPT:"0",GIT_CONFIG_NOSYSTEM:"1",GIT_OPTIONAL_LOCKS:"0"},r;if(e.credential?.token){let a=e.credential.username??"oauth2";t.GIT_CONFIG_COUNT="1",t.GIT_CONFIG_KEY_0="http.extraHeader",t.GIT_CONFIG_VALUE_0=`Authorization: Basic ${Buffer.from(`${a}:${e.credential.token}`).toString("base64")}`}if(e.deployKey){r=Xk(Fc(tI(),"ts-cloud-git-transport-"));let a=Fc(r,"key"),m=Fc(r,"known_hosts");Zf(a,e.deployKey.privateKey,{mode:384}),Zf(m,`${e.deployKey.host} ${e.deployKey.hostKey}
-`,{mode:384}),Yf(a,384),Yf(m,384),t.GIT_SSH_COMMAND=`ssh -i ${a} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=${m} -o GlobalKnownHostsFile=/dev/null -o BatchMode=yes`}return{env:t,cleanup:()=>{if(r)eI(r,{recursive:!0,force:!0})}}}async function ps(e,t,r){let a=iI(r),m=Bun.spawn([r.executable??"git",...e],{stdout:"pipe",stderr:"pipe",env:a.env}),f=Math.max(100,r.timeoutMs??120000),v,w=new Promise((k,S)=>{v=setTimeout(()=>{m.kill(),S(Error(`Git operation exceeded ${f}ms`))},f)});try{let k=Promise.all([m.exited,new Response(m.stdout).text(),new Response(m.stderr).text()]),[S,A,x]=await Promise.race([k,w]);if(S!==0)throw Error(nI(x||`Git exited with ${S}`,t,r.credential));return A}finally{if(v)clearTimeout(v);a.cleanup()}}function Xf(e,t){let r=new Map;for(let a of e.split(`
-`)){let m=a.trim().match(/^([a-f0-9]{40,64})\s+(.+)$/i);if(!m||!m[2].startsWith(t)||m[2].endsWith("^{}"))continue;let f=m[2].slice(t.length);r.set(f,{name:f,commitSha:m[1]})}return[...r.values()].sort((a,m)=>a.name.localeCompare(m.name))}async function Mo(e,t={}){let r=vh(e,t.deployKey),a=await ps(["ls-remote","--heads","--tags","--",r],r,t);return{branches:Xf(a,"refs/heads/"),tags:Xf(a,"refs/tags/")}}async function Fo(e,t={}){let r=vh(e.remote,t.deployKey),a=rI(e.destination),m=e.ref?.trim()||e.binding.defaultBranch;if(!/^[A-Za-z0-9._/-]{1,255}$/.test(m)||m.startsWith("-")||m.includes(".."))throw Error("Git ref contains unsupported characters");let f=["clone","--no-tags","--single-branch","--branch",m],v=[...new Set(e.sparsePaths??[])];if(v.some((k)=>!k||k.startsWith("/")||k.split("/").includes("..")||/[\0\r\n]/.test(k)))throw Error("Sparse checkout paths must stay inside the repository");if(v.length)f.push("--filter=blob:none","--no-checkout");if(e.binding.cloneDepth)f.push("--depth",String(e.binding.cloneDepth));if(e.binding.submodules)f.push("--recurse-submodules","--shallow-submodules");if(f.push("--",r,a),await ps(f,r,t),v.length)await ps(["-C",a,"sparse-checkout","set","--cone","--",...v],r,t),await ps(["-C",a,"checkout","--force"],r,t);if(e.commitSha){if(!/^[a-f0-9]{40,64}$/i.test(e.commitSha))throw Error("Expected source commit must be an immutable 40-64 character SHA");await ps(["-C",a,"fetch","--no-tags","--depth","1","origin",e.commitSha],r,t),await ps(["-C",a,"checkout","--detach","--force",e.commitSha],r,t)}let w=(await ps(["-C",a,"rev-parse","HEAD"],r,t)).trim();if(!/^[a-f0-9]{40,64}$/i.test(w))throw Error("Git clone did not produce a valid commit SHA");if(e.commitSha&&w.toLowerCase()!==e.commitSha.toLowerCase())throw Error(`Git checkout resolved ${w} instead of the requested immutable commit`);return{directory:e.binding.monorepoRoot==="."?a:Fc(a,e.binding.monorepoRoot),commitSha:w}}function oc(e){return["github","gitlab","bitbucket","gitea"].includes(e)}async function Uo(e,t,r){let a=e.getConnection(t);if(!a||["disconnected","expired"].includes(a.status))throw Error("Active source connection was not found");try{if(oc(a.provider)){let v=await Je(a,e.getCredential(a.id)).testConnection();return e.updateHealth(a.id,{status:v.ok?"healthy":"degraded",message:v.message,tested:!0,grantedScopes:v.scopes})}let m=r?e.getRepository(r):e.listRepositories(a.id,void 0,1)[0];if(!m)return e.updateHealth(a.id,{status:"degraded",message:"Add a repository URL before testing this generic connection.",tested:!0});let f=a.provider==="generic_ssh"?e.listBindings({connectionId:a.id}).map((v)=>v.deployKeyId).filter(Boolean).map((v)=>e.getDeployKey(v)).find(Boolean):void 0;return await Mo(m.cloneUrl,{credential:e.getCredential(a.id),deployKey:f?{...f,privateKey:e.getDeployPrivateKey(f.id)}:void 0}),e.updateHealth(a.id,{status:"healthy",message:"Git repository access is healthy.",tested:!0})}catch(m){return e.updateHealth(a.id,{status:"degraded",message:m instanceof Error?m.message:"Connection test failed",tested:!0})}}async function Fi(e,t,r={}){let a=e.getConnection(t);if(!a||!oc(a.provider)||["disconnected","expired"].includes(a.status))throw Error("A hosted active source connection is required for repository discovery");let m=Je(a,e.getCredential(a.id)),f=[],v;for(let w=0;w<Math.min(20,Math.max(1,r.maxPages??10));w++){let k=await m.listRepositories({cursor:v,search:r.search,limit:100});for(let S of k.repositories)f.push(e.upsertRepository({connectionId:a.id,...S}));if(v=k.nextCursor,!v)break}return e.updateHealth(a.id,{status:"healthy",message:`${f.length} repositories synchronized.`,synced:!0}),f}async function Ui(e,t){let r=e.getConnection(t.connectionId);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");if(oc(r.provider)){let w=Je(r,e.getCredential(r.id));return t.type==="tags"?w.listTags(t.repository,t):w.listBranches(t.repository,t)}let a=t.repositoryId?e.getRepository(t.repositoryId):e.listRepositories(r.id).find((w)=>w.fullName===t.repository);if(!a||a.connectionId!==r.id)throw Error("Generic repository metadata was not found");let m=t.deployKeyId?e.getDeployKey(t.deployKeyId):void 0;if(m&&m.connectionId!==r.id)throw Error("Deploy key does not belong to this connection");let f=await Mo(a.cloneUrl,{credential:e.getCredential(r.id),deployKey:m?{...m,privateKey:e.getDeployPrivateKey(m.id)}:void 0});return{refs:(t.type==="tags"?f.tags:f.branches).slice(0,Math.min(500,t.limit??100))}}async function Jr(e,t,r){let a=e.getWebhook(t),m=a?e.getConnection(a.connectionId):void 0;if(!a||!m||["disconnected","expired"].includes(m.status))throw Error("Active source webhook was not found");let f=Xt(r,{...a,endpointToken:e.getWebhookEndpointToken(a.id)});if(!oc(m.provider))return e.updateWebhookState(a.id,{status:"healthy",healthMessage:"Manual webhook endpoint is ready.",reconciled:!0});try{let v=Je(m,e.getCredential(m.id)),w=e.getWebhookSecret(a.id),k=a.providerWebhookId?await v.updateWebhook(a.repositoryFullName,a.providerWebhookId,{url:f,secret:w,events:a.events}):await v.createWebhook(a.repositoryFullName,{url:f,secret:w,events:a.events});return e.updateWebhookState(a.id,{providerWebhookId:k.providerWebhookId,status:k.active?"healthy":"degraded",healthMessage:k.active?"Provider webhook is synchronized.":"Provider webhook exists but is inactive.",reconciled:!0})}catch(v){return e.updateWebhookState(a.id,{status:"degraded",healthMessage:v instanceof Error?v.message:"Webhook reconciliation failed",reconciled:!0})}}async function Il(e,t){let r=e.getWebhook(t),a=r?e.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Source webhook was not found");if(oc(a.provider)&&r.providerWebhookId&&!["disconnected","expired"].includes(a.status))await Je(a,e.getCredential(a.id)).deleteWebhook(r.repositoryFullName,r.providerWebhookId);return e.updateWebhookState(r.id,{status:"disabled",healthMessage:"Webhook disabled."})}var Qi="1.6.0";function Qo(){let e={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},t=(a)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:a},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),r=(a)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:t(a)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:Qi,description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{...so(),"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:r({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:r({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:r({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:r({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:r({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:r({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:e}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}function sI(e){return Buffer.from(JSON.stringify(e)).toString("base64url")}function aI(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return t&&typeof t==="object"&&!Array.isArray(t)?t:void 0}catch{return}}function yn(e,t,r,a=["createdAt","id"]){let m=Math.min(100,Math.max(1,Number(t.searchParams.get("limit"))||50)),f=aI(t.searchParams.get("cursor"));if(t.searchParams.has("cursor")&&!f)throw new i("invalid_cursor","The pagination cursor is invalid.",400);let v=0;if(f){let A=e.findIndex((x)=>a.every((F)=>x[F]===f[F]));if(A<0)throw new i("invalid_cursor","The pagination cursor is no longer available.",400);v=A+1}let w=e.slice(v,v+m),k=v+m<e.length,S=w.at(-1);return{data:w,page:{hasMore:k,nextCursor:k&&S?sI(Object.fromEntries(a.map((A)=>[A,S[A]]))):void 0},requestId:r}}function Ho(e){let t=new bi(e.controlPlane,e.identities),r=new c(e.controlPlane),a=new Nr(e.controlPlane),m=new Br(e.controlPlane),f=new ft(e.controlPlane),v=e.spend?.store??new mi(e.controlPlane,{now:e.now}),w={store:v,service:e.spend?.service??new Ut(v)},k=new Map,S=e.now??(()=>new Date),A=e.rateLimit??120,x=(U,H,K,X={})=>new Response(JSON.stringify(U),{status:H,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":K,"x-api-version":Qi,...X}}),F=(U,H,K,X,oe,pe)=>x({error:{code:U,message:H,requestId:X,details:oe}},K,X,pe);return async(U,H)=>{let K=new URL(U.url);if(!K.pathname.startsWith("/api/v1"))return;let X=crypto.randomUUID();if(K.pathname==="/api/v1/openapi.json"&&U.method==="GET")return x(Qo(),200,X,{"cache-control":"public, max-age=300"});let oe=U.headers.get("authorization")??"",pe=oe.startsWith("Bearer ")?oe.slice(7).trim():"",ee=pe?e.identities.verifyToken(pe,H):void 0;if(!ee)return F("unauthorized","A valid bearer token is required.",401,X,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let ce=k.get(ee.token.id),Ee=S().getTime(),Re=!ce||Ee-ce.start>=60000?{start:Ee,count:0}:ce;Re.count+=1,k.set(ee.token.id,Re);let de=Math.max(0,A-Re.count),je={"x-ratelimit-limit":String(A),"x-ratelimit-remaining":String(de),"x-ratelimit-reset":String(Math.ceil((Re.start+60000)/1000))};if(Re.count>A)return F("rate_limited","API rate limit exceeded.",429,X,void 0,{...je,"retry-after":String(Math.max(1,Math.ceil((Re.start+60000-Ee)/1000)))});try{let ae,Le=async()=>{let Q=await U.text();if(Q.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(Q)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}},rt=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(K.pathname),mt=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(K.pathname),ir=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(K.pathname),st=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(K.pathname),Dt=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(K.pathname),or=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(K.pathname),lt=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(K.pathname);if(U.method==="GET"&&K.pathname==="/api/v1/projects")ae=yn(t.listProjects(ee),K,X);else if(U.method==="GET"&&rt)ae=yn(t.listEnvironments(ee,decodeURIComponent(rt[1])),K,X);else if(U.method==="GET"&&K.pathname==="/api/v1/services"){let Q=K.searchParams.get("projectId");if(!Q)throw new i("validation_error","projectId is required.",422);ae=yn(t.listServices(ee,Q,K.searchParams.get("environmentId")??void 0),K,X)}else if(U.method==="GET"&&K.pathname==="/api/v1/operations")ae=yn(t.listOperations(ee,K.searchParams.get("projectId")??void 0),K,X);else if(U.method==="GET"&&K.pathname==="/api/v1/previews"){let Q=K.searchParams.get("projectId")??void 0,ye=a.previews.listInstances({projectId:Q}).filter((we)=>{try{return t.authorize(ee,"deployments:read",{type:"resource",id:we.resourceId}),!0}catch{return!1}}).map((we)=>({...we}));ae=yn(ye,K,X)}else if(U.method==="GET"&&K.pathname==="/api/v1/compose-templates")ae=yn(Pr().map((Q)=>({...Q})),K,X,["id","version"]);else if(U.method==="GET"&&K.pathname==="/api/v1/releases/capabilities"){let Q=String(K.searchParams.get("kind")??"");ae={capabilities:Wr({kind:Q,hasHealthGate:K.searchParams.get("health")==="true",replicas:Number(K.searchParams.get("replicas"))||1}),requestId:X}}else if(U.method==="GET"&&K.pathname==="/api/v1/releases"){let Q=K.searchParams.get("projectId");if(!Q)throw new i("validation_error","projectId is required.",422);t.authorize(ee,"project:read",{type:"project",id:Q});let ye=f.releases.list({projectId:Q,environmentId:K.searchParams.get("environmentId")??void 0,resourceId:K.searchParams.get("resourceId")??void 0}).filter((we)=>{try{return t.authorize(ee,"deployments:read",{type:"resource",id:we.resourceId}),!0}catch{return!1}}).map((we)=>({...we,artifact:f.releases.getArtifact(we.artifactId),transitions:f.releases.transitions(we.id),approvals:f.releases.approvals(we.id)}));ae=yn(ye,K,X)}else if(U.method==="POST"&&K.pathname==="/api/v1/release-artifacts"){let Q=await Le();t.authorize(ee,"applications:manage",{type:"organization"}),ae={artifact:f.releases.registerArtifact({organizationId:ee.serviceAccount.organizationId,digest:String(Q.digest??""),kind:String(Q.kind??""),uri:String(Q.uri??""),size:Number(Q.size),mediaType:typeof Q.mediaType==="string"?Q.mediaType:void 0,provenance:Q.provenance,attestation:Q.attestation}),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/releases"){let Q=await Le(),ye=String(Q.resourceId??"");t.authorize(ee,"applications:manage",{type:"resource",id:ye}),ae={release:f.releases.create({organizationId:ee.serviceAccount.organizationId,projectId:String(Q.projectId??""),environmentId:String(Q.environmentId??""),resourceId:ye,artifactId:String(Q.artifactId??""),kind:String(Q.kind??""),sourceSha:typeof Q.sourceSha==="string"?Q.sourceSha:void 0,config:Q.config??{},manifest:Q.manifest??{},provenance:Q.provenance,strategy:String(Q.strategy??"atomic"),healthGate:Q.healthGate,hooks:Q.hooks,drainSeconds:Number(Q.drainSeconds)||void 0,graceSeconds:Number(Q.graceSeconds)||void 0,automaticRollback:Q.automaticRollback!==!1,actorId:ee.actor.id,trigger:typeof Q.trigger==="string"?Q.trigger:"api",approvalRequired:Q.approvalRequired===!0,replicas:Number(Q.replicas)||void 0}),requestId:X}}else if(U.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(K.pathname)){let Q=decodeURIComponent(K.pathname.split("/").at(-1)),ye=f.releases.get(Q);if(!ye)throw new i("not_found","Release was not found.",404);t.authorize(ee,"deployments:read",{type:"resource",id:ye.resourceId}),ae={release:ye,artifact:f.releases.getArtifact(ye.artifactId),transitions:f.releases.transitions(Q),approvals:f.releases.approvals(Q),requestId:X}}else if(U.method==="POST"&&lt){let Q=f.releases.get(decodeURIComponent(lt[1]));if(!Q)throw new i("not_found","Release was not found.",404);let ye=await Le(),we=lt[2];if(we==="promote"){let De=String(ye.targetResourceId??"");t.authorize(ee,"deployments:create",{type:"resource",id:De}),ae={release:f.releases.promote(Q.id,{targetEnvironmentId:String(ye.targetEnvironmentId??""),targetResourceId:De,config:ye.config??{},strategy:ye.strategy,healthGate:ye.healthGate,actorId:ee.actor.id,approvalRequired:ye.approvalRequired===!0}),requestId:X}}else if(we==="approve")t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId}),ae={release:f.releases.approve(Q.id,{actorId:ee.actor.id,decision:ye.decision==="rejected"?"rejected":"approved",comment:typeof ye.comment==="string"?ye.comment:void 0}),requestId:X};else if(we==="activate")t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId}),ae={operation:t.operation(f.enqueueActivation(Q,{actorId:ee.actor.id})),requestId:X};else if(we==="rollback")t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId}),ae={operation:t.operation(f.enqueueRollback(Q,{actorId:ee.actor.id,targetReleaseId:typeof ye.targetReleaseId==="string"?ye.targetReleaseId:void 0})),requestId:X};else if(we==="health"){t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId});let De=f.completeHealthGate(Q.id,{healthy:ye.healthy===!0,operationId:typeof ye.operationId==="string"?ye.operationId:void 0,health:ye.health,message:typeof ye.message==="string"?ye.message:void 0});ae={release:De.release,rollbackOperation:De.rollbackOperation?t.operation(De.rollbackOperation):void 0,requestId:X}}else t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId}),ae={release:f.releases.pin(Q.id,ye.pinned!==!1,typeof ye.reason==="string"?ye.reason:void 0),requestId:X}}else if(U.method==="GET"&&K.pathname==="/api/v1/compose-applications"){let Q=K.searchParams.get("projectId");if(!Q)throw new i("validation_error","projectId is required.",422);t.authorize(ee,"project:read",{type:"project",id:Q});let ye=m.applications.list({projectId:Q,environmentId:K.searchParams.get("environmentId")??void 0}).filter((we)=>{try{return t.authorize(ee,"deployments:read",{type:"resource",id:we.resourceId}),!0}catch{return!1}}).map((we)=>({...we,services:m.applications.services(we.id)}));ae=yn(ye,K,X)}else if(U.method==="POST"&&K.pathname==="/api/v1/compose-applications/preview"){let Q=await Le(),ye=String(Q.projectId??"");t.authorize(ee,"project:read",{type:"project",id:ye}),ae={result:m.applications.preview(String(Q.source??""),{name:String(Q.name??""),slug:typeof Q.slug==="string"?Q.slug:void 0,projectId:ye,environmentId:String(Q.environmentId??"")}),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/compose-applications"){let Q=await Le(),ye=String(Q.projectId??"");t.authorize(ee,"applications:manage",{type:"environment",id:String(Q.environmentId??"")});let we={name:String(Q.name??""),slug:typeof Q.slug==="string"?Q.slug:void 0,projectId:ye,environmentId:String(Q.environmentId??""),createdByActorId:ee.actor.id},De=typeof Q.templateId==="string"?m.applications.fromTemplate(Q.templateId,Q.inputs&&typeof Q.inputs==="object"&&!Array.isArray(Q.inputs)?Q.inputs:{},{...we,version:typeof Q.templateVersion==="string"?Q.templateVersion:void 0}):m.applications.import(String(Q.source??""),we);ae={application:De.application,diagnostics:De.parsed.diagnostics,requestId:X}}else if(U.method==="GET"&&or){let Q=m.applications.get(decodeURIComponent(or[1]));if(!Q)throw new i("not_found","Compose application was not found.",404);t.authorize(ee,"deployments:read",{type:"resource",id:Q.resourceId}),ae={application:Q,services:m.applications.services(Q.id),requestId:X}}else if(U.method==="POST"&&Dt){let Q=m.applications.get(decodeURIComponent(Dt[1]));if(!Q)throw new i("not_found","Compose application was not found.",404);let ye=Dt[2],we=await Le();t.authorize(ee,ye==="delete"||ye==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:Q.resourceId}),ae={operation:t.operation(m.enqueue(Q,ye,{actorId:ee.actor.id,service:typeof we.service==="string"?we.service:void 0,replicas:Number.isFinite(Number(we.replicas))?Number(we.replicas):void 0,removeVolumes:we.removeVolumes===!0,confirmation:typeof we.confirm==="string"?we.confirm:void 0})),requestId:X}}else if(U.method==="GET"&&K.pathname==="/api/v1/preview-definitions"){let Q=K.searchParams.get("projectId");if(!Q)throw new i("validation_error","projectId is required.",422);t.authorize(ee,"project:read",{type:"project",id:Q}),ae=yn(a.previews.listDefinitions(Q).map((ye)=>({...ye})),K,X)}else if(U.method==="POST"&&K.pathname==="/api/v1/preview-definitions"){let Q=await Le();t.authorize(ee,"config:write",{type:"resource",id:String(Q.resourceId??"")}),ae={definition:a.previews.createDefinition({...Q,projectId:String(Q.projectId??""),resourceId:String(Q.resourceId??""),baseEnvironmentId:String(Q.baseEnvironmentId??""),domainPattern:String(Q.domainPattern??""),createdByActorId:ee.actor.id}),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/previews"){let Q=await Le(),ye=a.previews.getDefinition(String(Q.definitionId??""));if(!ye)throw new i("not_found","Preview definition was not found.",404);t.authorize(ee,"deployments:create",{type:"resource",id:ye.resourceId});let we=a.previews.upsert({definitionId:ye.id,sourceProvider:"api",repository:typeof Q.repository==="string"?Q.repository:"api",branch:String(Q.branch??""),pullRequestNumber:Number(Q.pullRequestNumber)||void 0,fork:Q.fork===!0,commitSha:String(Q.commitSha??""),createdByActorId:ee.actor.id});ae={preview:we.preview,operation:t.operation(a.enqueueDeploy(we.preview,{created:we.created,actorId:ee.actor.id})),requestId:X}}else if(U.method==="POST"&&st){let Q=a.previews.getInstance(decodeURIComponent(st[1]));if(!Q)throw new i("not_found","Preview was not found.",404);let ye=await Le(),we=st[2];if(we==="destroy"){if(t.authorize(ee,"deployments:cancel",{type:"resource",id:Q.resourceId}),ye.confirm!==Q.name)throw new i("confirmation_required",`Type ${Q.name} to confirm preview teardown.`,409);ae={operation:t.operation(a.enqueueDestroy(Q,"api",ee.actor.id)),requestId:X}}else if(we==="extend")t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId}),ae={preview:a.previews.extend(Q.id,Number(ye.hours)),requestId:X};else t.authorize(ee,"deployments:create",{type:"resource",id:Q.resourceId}),ae={operation:t.operation(a.enqueueDeploy(Q,{actorId:ee.actor.id,reason:"manual_rebuild"})),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/previews/cleanup"){t.authorize(ee,"automation:manage",{type:"organization"});let Q=await Le();if(!Q.dryRun&&Q.confirm!=="cleanup previews")throw new i("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);ae={...a.cleanup({dryRun:Q.dryRun===!0,maxAgeHours:Number(Q.maxAgeHours)||void 0,keepCount:Number(Q.keepCount)||void 0,actorId:ee.actor.id}),requestId:X}}else if(U.method==="GET"&&K.pathname==="/api/v1/queue"){let Q=K.searchParams.get("projectId")??void 0,ye=K.searchParams.get("state"),we=r.list({projectId:Q,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(ye)?ye:void 0,limit:500}).filter((De)=>{let ht=De.operation.resourceId?{type:"resource",id:De.operation.resourceId}:De.operation.environmentId?{type:"environment",id:De.operation.environmentId}:De.operation.projectId?{type:"project",id:De.operation.projectId}:{type:"organization"};try{return t.authorize(ee,"deployments:read",ht),!0}catch{return!1}}).map((De)=>({...t.operation(De.operation),queue:De.job,approximatePosition:De.approximatePosition}));ae=yn(we,K,X)}else if(U.method==="GET"&&K.pathname==="/api/v1/queue/settings")t.authorize(ee,"deployments:read",ee.token.scope),ae={concurrency:r.limits,requestId:X};else if(U.method==="PATCH"&&K.pathname==="/api/v1/queue/settings"){t.authorize(ee,"automation:manage",{type:"organization"});let Q=await Le();if(Q.confirm!=="update queue limits")throw new i("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);ae={concurrency:r.configureConcurrency(Q.concurrency??{},{organizationId:ee.serviceAccount.organizationId,actorId:ee.actor.id}),requestId:X}}else if(U.method==="DELETE"&&K.pathname==="/api/v1/queue/history"){t.authorize(ee,"automation:manage",{type:"organization"});let Q=await Le();if(Q.confirm!=="clear completed")throw new i("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);ae={deleted:r.clearCompleted({before:typeof Q.before==="string"?Q.before:void 0,actorId:ee.actor.id,projectId:typeof Q.projectId==="string"?Q.projectId:void 0}),requestId:X}}else if(U.method==="GET"&&mt){let Q=e.controlPlane.getOperation(decodeURIComponent(mt[1]));if(!Q)throw new i("not_found","Operation was not found.",404);let ye=Q.resourceId?{type:"resource",id:Q.resourceId}:Q.environmentId?{type:"environment",id:Q.environmentId}:Q.projectId?{type:"project",id:Q.projectId}:{type:"organization"};t.authorize(ee,"deployments:read",ye);let we=U.headers.get("last-event-id")?.trim(),De=Number(we||K.searchParams.get("after")||0);if(mt[2]==="stream"){let Nt=new TextEncoder,$e=De,wt,ut=!1,et=new ReadableStream({start(Vr){let As=()=>{if(ut)return;if(!e.identities.verifyToken(pe,H)){if(ut=!0,wt)clearInterval(wt);Vr.close();return}let Zn=r.logs(Q.id,{after:$e,limit:500});for(let cr of Zn)$e=cr.sequence,Vr.enqueue(Nt.encode(`id: ${cr.sequence}
-event: log
-data: ${JSON.stringify(cr)}
-
-`));let Kt=e.controlPlane.getOperation(Q.id);if(Kt&&["succeeded","failed","cancelled","timed_out"].includes(Kt.state)&&!r.logs(Q.id,{after:$e,limit:1}).length){if(ut=!0,wt)clearInterval(wt);Vr.enqueue(Nt.encode(`event: complete
-data: ${JSON.stringify({state:Kt.state,cursor:$e})}
-
-`)),Vr.close()}};if(As(),!ut)wt=setInterval(As,500);U.signal.addEventListener("abort",()=>{if(ut=!0,wt)clearInterval(wt);try{Vr.close()}catch{}},{once:!0})},cancel(){if(ut=!0,wt)clearInterval(wt)}});return new Response(et,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no","x-request-id":X,...je}})}let ht=r.logs(Q.id,{after:De,limit:Number(K.searchParams.get("limit"))||void 0});ae={data:ht,cursor:ht.at(-1)?.sequence??De,hasMore:ht.length>=Math.min(1000,Math.max(1,Number(K.searchParams.get("limit"))||200)),requestId:X}}else if(U.method==="POST"&&ir){let Q=e.controlPlane.getOperation(decodeURIComponent(ir[1]));if(!Q)throw new i("not_found","Operation was not found.",404);let ye=Q.resourceId?{type:"resource",id:Q.resourceId}:Q.environmentId?{type:"environment",id:Q.environmentId}:Q.projectId?{type:"project",id:Q.projectId}:{type:"organization"},we=await Le();if(ir[2]==="cancel")t.authorize(ee,"deployments:cancel",ye),ae={operation:t.operation(r.requestCancellation(Q.id,ee.actor.id)),requestId:X};else t.authorize(ee,"deployments:create",ye),ae={operation:t.operation(r.retry(Q.id,String(we.errorClass??"manual"),{delayMs:Number(we.delayMs)||0,actorId:ee.actor.id})),requestId:X}}else if(U.method==="GET"&&K.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(ee,"sources:read",ee.token.scope),ae=yn(e.sources.listConnections(ee.serviceAccount.organizationId),K,X,["createdAt","id"])}else if(U.method==="GET"&&K.pathname==="/api/v1/source/repositories"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(ee,"sources:read",ee.token.scope);let Q=e.sources.getConnection(K.searchParams.get("connectionId")??"");if(!Q||Q.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);if(K.searchParams.get("sync")==="true")t.authorize(ee,"sources:manage",{type:"organization"}),await Fi(e.sources,Q.id,{search:K.searchParams.get("search")??void 0});ae=yn(e.sources.listRepositories(Q.id,K.searchParams.get("search")??void 0),K,X,["fullName","id"])}else if(U.method==="GET"&&K.pathname==="/api/v1/source/refs"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(ee,"sources:read",ee.token.scope);let Q=K.searchParams.get("connectionId")??"",ye=e.sources.getConnection(Q);if(!ye||ye.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);ae=await Ui(e.sources,{connectionId:Q,repository:K.searchParams.get("repository")??"",repositoryId:K.searchParams.get("repositoryId")??void 0,type:K.searchParams.get("type")==="tags"?"tags":"branches",cursor:K.searchParams.get("cursor")??void 0,deployKeyId:K.searchParams.get("deployKeyId")??void 0})}else if(U.method==="POST"&&K.pathname==="/api/v1/application-detections"){t.authorize(ee,"applications:manage",ee.token.scope);let Q=await Le();if(!Array.isArray(Q.files)||Q.files.length>1e4)throw new i("validation_error","files must contain at most 10,000 entries.",422);ae={candidates:js(Q.files.map((ye)=>({path:String(ye.path??""),size:Number(ye.size??0),content:typeof ye.content==="string"?ye.content.slice(0,262144):void 0}))),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/application-plans"){t.authorize(ee,"applications:manage",ee.token.scope);let Q=await Le();ae={plan:Vn(Q.draft,Array.isArray(Q.suppliedSecretNames)?Q.suppliedSecretNames.map(String):[]),requestId:X}}else if(U.method==="GET"&&K.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let Q=K.searchParams.get("projectId")??"";t.authorize(ee,"applications:read",{type:"project",id:Q}),ae=yn(e.applications.drafts.list(Q),K,X,["updatedAt","id"])}else if(U.method==="POST"&&K.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let Q=await Le(),ye=String(Q.projectId??Q.draft?.projectId??"");t.authorize(ee,"applications:manage",{type:"project",id:ye});let we=e.controlPlane.getProject(ye);if(!we||we.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);let De=e.applications.drafts.create({organizationId:we.organizationId,projectId:ye,name:String(Q.name??Q.draft?.name??"Application draft"),draft:{...Q.draft,projectId:ye},step:Q.step,suppliedSecretNames:Array.isArray(Q.suppliedSecretNames)?Q.suppliedSecretNames.map(String):[],actorId:ee.actor.id});return x({draft:De,requestId:X},201,X,je)}else if(U.method==="PATCH"&&K.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let Q=await Le(),ye=e.applications.drafts.get(String(Q.id??""));if(!ye)throw new i("not_found","Application draft was not found.",404);t.authorize(ee,"applications:manage",{type:"project",id:ye.projectId}),ae={draft:e.applications.drafts.update(ye.id,Number(Q.version),{draft:{...Q.draft,projectId:ye.projectId},step:Q.step,suppliedSecretNames:Array.isArray(Q.suppliedSecretNames)?Q.suppliedSecretNames.map(String):void 0,actorId:ee.actor.id}),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/applications"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let Q=U.headers.get("idempotency-key")??"";if(!Q)throw new i("idempotency_required","Idempotency-Key is required for application creation.",428);if(!/^[A-Za-z0-9._:-]{8,128}$/.test(Q))throw new i("validation_error","Idempotency-Key must contain 8-128 safe characters.",422);let ye=await Le(),we=e.applications.drafts.get(String(ye.draftId??""));if(!we)throw new i("not_found","Application draft was not found.",404);t.authorize(ee,"applications:manage",{type:"project",id:we.projectId});let De=oI("sha256").update(`POST
-/api/v1/applications
-${JSON.stringify(ye)}`).digest("hex"),ht=e.identities.getIdempotency(ee.token.id,Q);if(ht){if(ht.requestHash!==De)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let $e=ht.operationId?e.controlPlane.getOperation(ht.operationId):void 0,wt=$e?.resourceId?e.controlPlane.getResource($e.resourceId):void 0;if(!$e||!wt)throw new i("idempotency_unavailable","The original application operation is no longer available.",409);return x({resource:wt,operation:t.operation($e),plan:Vn(we.input,we.suppliedSecretNames),idempotentReplay:!0,requestId:X},202,X,{...je,"idempotent-replayed":"true"})}let Nt=Bc({controlPlane:e.controlPlane,drafts:e.applications.drafts,draftId:we.id,expectedVersion:Number(ye.version),confirmEnvironment:String(ye.confirmEnvironment??""),actorId:ee.actor.id});return e.identities.saveIdempotency({tokenId:ee.token.id,key:Q,requestHash:De,operationId:Nt.operation.id,responseStatus:202,responseBody:{draftId:we.id}}),x({resource:Nt.resource,operation:t.operation(Nt.operation),plan:Nt.plan,idempotentReplay:!1,requestId:X},202,X,je)}else if(U.method==="GET"&&K.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(ee,"applications:read",ee.token.scope),ae=yn(e.applications.registries.list(ee.serviceAccount.organizationId),K,X,["createdAt","id"])}else if(U.method==="POST"&&K.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(ee,"applications:manage",{type:"organization"});let Q=await Le(),ye=e.applications.registries.create({organizationId:ee.serviceAccount.organizationId,provider:Q.provider,name:String(Q.name??"Container registry"),host:String(Q.host??""),credential:Q.token||Q.password?{username:typeof Q.username==="string"?Q.username:void 0,password:typeof Q.password==="string"?Q.password:void 0,token:typeof Q.token==="string"?Q.token:void 0}:void 0,credentialExpiresAt:typeof Q.credentialExpiresAt==="string"?Q.credentialExpiresAt:void 0,actorId:ee.actor.id});return x({registry:ye,requestId:X},201,X,je)}else if(U.method==="PATCH"&&K.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(ee,"applications:manage",{type:"organization"});let Q=await Le(),ye=e.applications.registries.get(String(Q.id??""));if(!ye||ye.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);if(Q.action==="test")ae={registry:await e.applications.registries.test(ye.id,{image:typeof Q.image==="string"?Q.image:void 0}),requestId:X};else if(Q.action==="rotate")ae={registry:e.applications.registries.rotate(ye.id,{username:Q.username,password:Q.password,token:Q.token},{expiresAt:Q.expiresAt,actorId:ee.actor.id}),requestId:X};else throw new i("validation_error","action must be test or rotate.",422)}else if(U.method==="DELETE"&&K.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(ee,"applications:manage",{type:"organization"});let Q=await Le(),ye=e.applications.registries.get(String(Q.id??""));if(!ye||ye.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);ae={registry:e.applications.registries.disconnect(ye.id,ee.actor.id),requestId:X}}else if(U.method==="POST"&&K.pathname==="/api/v1/application-artifacts"){if(!e.applications?.artifacts)throw new i("not_found","Application artifact storage is unavailable.",404);let Q=U.headers.get("x-project-id")??"";t.authorize(ee,"applications:manage",{type:"project",id:Q});let ye=e.controlPlane.getProject(Q);if(!ye||ye.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);if(Number(U.headers.get("content-length")??0)>104857600)throw new i("payload_too_large","Artifact exceeds 100 MB.",413);let De=e.applications.artifacts.create({organizationId:ye.organizationId,projectId:Q,filename:U.headers.get("x-artifact-filename")??"application.zip",bytes:new Uint8Array(await U.arrayBuffer()),actorId:ee.actor.id});return x({artifact:De,requestId:X},201,X,je)}else if(U.method==="POST"&&K.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(ee,"sources:manage",{type:"organization"});let Q=await Le(),ye=String(Q.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(ye))throw new i("validation_error","A supported provider is required.",422);let we=ye==="github"&&(Q.privateKey||Q.appId)?{appId:typeof Q.appId==="string"?Q.appId:void 0,installationId:typeof Q.installationId==="string"?Q.installationId:void 0,privateKey:typeof Q.privateKey==="string"?Q.privateKey:void 0}:ye!=="generic_ssh"&&Q.token?{token:String(Q.token),username:typeof Q.username==="string"?Q.username:void 0}:void 0,De,ht,Nt;return e.controlPlane.database.transaction(()=>{if(De=e.sources.createConnection({organizationId:ee.serviceAccount.organizationId,provider:ye,name:String(Q.name??ye),host:String(Q.host??""),owner:typeof Q.owner==="string"?Q.owner:void 0,authKind:Q.authKind,credential:we,createdByActorId:ee.actor.id}),typeof Q.repositoryUrl==="string"&&typeof Q.repositoryFullName==="string")ht=e.sources.upsertRepository({connectionId:De.id,providerRepositoryId:`manual:${Q.repositoryFullName}`,fullName:Q.repositoryFullName,cloneUrl:Q.repositoryUrl,defaultBranch:String(Q.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"api"}});if(ye==="generic_ssh")Nt=e.sources.createDeployKey({connectionId:De.id,name:String(Q.deployKeyName??"Repository deploy key"),publicKey:String(Q.publicKey??""),privateKey:String(Q.deployPrivateKey??""),host:String(Q.sshHost??""),hostKey:String(Q.hostKey??""),actorId:ee.actor.id})})(),x({connection:De,repository:ht,deployKey:Nt,requestId:X},201,X,je)}else if(U.method==="POST"&&K.pathname==="/api/v1/source/bindings"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);let Q=await Le(),ye=String(Q.projectId??"");t.authorize(ee,"sources:manage",{type:"project",id:ye});let we=e.sources.getConnection(String(Q.connectionId??""));if(!we||we.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let De=e.sources.createBinding({projectId:ye,environmentId:typeof Q.environmentId==="string"?Q.environmentId:void 0,resourceId:typeof Q.resourceId==="string"?Q.resourceId:void 0,connectionId:we.id,repositoryId:typeof Q.repositoryId==="string"?Q.repositoryId:void 0,repositoryFullName:String(Q.repositoryFullName??""),defaultBranch:String(Q.defaultBranch??"main"),branchRule:typeof Q.branchRule==="string"?Q.branchRule:void 0,tagRule:typeof Q.tagRule==="string"?Q.tagRule:void 0,monorepoRoot:String(Q.monorepoRoot??"."),includePaths:Array.isArray(Q.includePaths)?Q.includePaths.map(String):[],excludePaths:Array.isArray(Q.excludePaths)?Q.excludePaths.map(String):[],submodules:Q.submodules===!0,cloneDepth:typeof Q.cloneDepth==="number"?Q.cloneDepth:void 0,deployKeyId:typeof Q.deployKeyId==="string"&&Q.deployKeyId?Q.deployKeyId:void 0,autoDeploy:Q.autoDeploy!==!1,pullRequestPreviews:Q.pullRequestPreviews!==!1,actorId:ee.actor.id});return x({binding:De,requestId:X},201,X,je)}else if(U.method==="POST"&&K.pathname==="/api/v1/source/webhooks"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(ee,"sources:manage",{type:"organization"});let Q=await Le(),ye=e.sources.getConnection(String(Q.connectionId??""));if(!ye||ye.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let we=typeof Q.baseUrl==="string"?Q.baseUrl:void 0;if(!we)throw new i("validation_error","baseUrl is required.",422);let De=e.sources.createWebhook({connectionId:ye.id,repositoryId:typeof Q.repositoryId==="string"?Q.repositoryId:void 0,repositoryFullName:String(Q.repositoryFullName??""),events:Array.isArray(Q.events)?Q.events.map(String):void 0}),ht=Xt(we,De.webhook),Nt=Q.reconcile===!1?De.webhook:await Jr(e.sources,De.webhook.id,we);return x({webhook:Nt,endpoint:ht,endpointRevealOnce:!0,requestId:X},201,X,je)}else if(U.method==="DELETE"&&K.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(ee,"sources:manage",{type:"organization"});let Q=await Le(),ye=e.sources.getConnection(String(Q.id??""));if(!ye||ye.organizationId!==ee.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let we=e.sources.listBindings({connectionId:ye.id,status:"active"});if(Q.preview===!0)return x({preview:!0,affectedBindings:we,requestId:X},200,X,je);return x({...e.sources.disconnectConnection(ye.id,ee.actor.id),requestId:X},200,X,je)}else if(U.method==="GET"&&(K.pathname==="/api/v1/events"||K.pathname==="/api/v1/events/stream")){let Q=t.listEvents(ee,K.searchParams.get("projectId")??void 0,Number(K.searchParams.get("after"))||void 0);if(K.pathname.endsWith("/stream")){let ye=new TextEncoder,we=Q.reduce(($e,wt)=>Math.max($e,Number(wt.sequence)),Number(K.searchParams.get("after"))||0),De,ht=!1,Nt=new ReadableStream({start($e){let wt=(ut)=>$e.enqueue(ye.encode(`id: ${ut.sequence}
-event: ${ut.type}
-data: ${JSON.stringify(ut)}
-
-`));if(Q.length)Q.forEach(wt);else $e.enqueue(ye.encode(`: connected
-
-`));De=setInterval(()=>{if(ht)return;let ut=e.identities.verifyToken(pe,H);if(!ut){if(ht=!0,De)clearInterval(De);$e.close();return}try{let et=t.listEvents(ut,K.searchParams.get("projectId")??void 0,we);for(let Vr of et)wt(Vr),we=Math.max(we,Number(Vr.sequence));if(!et.length)$e.enqueue(ye.encode(`: heartbeat ${Date.now()}
-
-`))}catch{if(ht=!0,De)clearInterval(De);$e.close()}},1000),U.signal.addEventListener("abort",()=>{if(ht=!0,De)clearInterval(De);try{$e.close()}catch{}},{once:!0})},cancel(){if(ht=!0,De)clearInterval(De)}});return new Response(Nt,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":X,...je}})}ae=yn(Q,K,X,["sequence","id"])}else if(U.method==="POST"&&K.pathname==="/api/v1/deployments"){let Q=U.headers.get("idempotency-key")??"";if(!Q)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let ye=await U.text();if(ye.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let we;try{we=JSON.parse(ye)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!we||typeof we.projectId!=="string"||typeof we.environmentId!=="string"||we.action!==void 0&&!["deploy","rollback"].includes(we.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let De=t.createDeployment(ee,we,Q);return x({operation:De.operation,idempotentReplay:De.replay,requestId:X},202,X,{...je,...De.replay?{"idempotent-replayed":"true"}:{}})}else{let Q=await io({...w,authorization:t,now:S},ee,{method:U.method,url:K,body:Le});if(Q===void 0)throw new i("not_found","API resource was not found.",404);ae=Q}return x(ae,200,X,je)}catch(ae){if(ae instanceof i)return F(ae.code,ae.message,ae.status,X,ae.details,je);if(K.pathname.startsWith("/api/v1/source/")||K.pathname.startsWith("/api/v1/application")||K.pathname.startsWith("/api/v1/compose-")||K.pathname==="/api/v1/registry-connections")return F("validation_error",ae instanceof Error?ae.message:"Integration request could not be completed.",422,X,void 0,je);return F("internal_error","The API request could not be completed.",500,X,void 0,je)}}}import{createCipheriv as lI,createDecipheriv as uI,createHash as Rh,randomBytes as li}from"node:crypto";import{createHmac as cI,timingSafeEqual as dI}from"node:crypto";var Ip="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Oi(e){let t=0,r=0,a="";for(let m of e){r=r<<8|m,t+=8;while(t>=5)a+=Ip[r>>>t-5&31],t-=5}if(t>0)a+=Ip[r<<5-t&31];return a}function tl(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,a=0,m=[];for(let f of t){let v=Ip.indexOf(f);if(v<0)throw Error("Invalid base32 secret");if(a=a<<5|v,r+=5,r>=8)m.push(a>>>r-8&255),r-=8}return Buffer.from(m)}function No(e,t,r=6){let a=Buffer.alloc(8);a.writeBigUInt64BE(BigInt(t));let m=cI("sha1",tl(e)).update(a).digest(),f=m[m.length-1]&15,v=(m[f]&127)<<24|(m[f+1]&255)<<16|(m[f+2]&255)<<8|m[f+3]&255;return String(v%10**r).padStart(r,"0")}function Um(e,t=Date.now(),r=30){return No(e,Math.floor(t/1000/r))}function Qm(e,t,r=Date.now(),a=1){return zr(e,t,r,a)!==void 0}function zr(e,t,r=Date.now(),a=1){let m=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(m))return;let f=Buffer.from(m),v=Math.floor(r/1000/30);for(let w=-a;w<=a;w++){if(v+w<0)continue;let k=Buffer.from(No(e,v+w));if(f.length===k.length&&dI(f,k))return v+w}return}function ko(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var rl=1800000,Ke=43200000,nl=3600000,il=300000,sl=600000;function Tn(e){return typeof e==="string"?e:void 0}function Ch(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function pI(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function Ep(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function mI(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function gI(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function fI(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function hI(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Wn(e){return Rh("sha256").update(e).digest("hex")}function sc(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:Tn(e.email),emailVerifiedAt:Tn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:Tn(e.disabled_at),lastLoginAt:Tn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function bh(e,t){let r=Tn(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Ch(e.metadata),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function Rp(e,t){let r=Tn(e.revoked_at),a=String(e.idle_expires_at),m=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:Tn(e.user_agent),networkHint:Tn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:a,absoluteExpiresAt:m,recentAuthAt:String(e.recent_auth_at),mfaAt:Tn(e.mfa_at),revokedAt:r,state:r?"revoked":a<=t||m<=t?"expired":"active"}}function wh(e){let t=Tn(e.verified_at),r=Tn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function Ap(e,t){let r=Tn(e.consumed_at),a=String(e.expires_at),m=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:m,expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":m>=5?"locked":a<=t?"expired":"pending"}}function kh(e){let t=Ch(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function zc(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:kh(e.scopes),allowedDomains:kh(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Eh(e,t){let r=Tn(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function yI(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Li{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Rh("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=li(12),r=lI("aes-256-gcm",this.encryptionKey,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,a,m]=e.split(".");if(t!=="v1"||!r||!a||!m)throw Error("Encrypted authentication value is unavailable");let f=uI("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return f.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([f.update(Buffer.from(m,"base64url")),f.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=pI(e.username),r=Ep(e.email),a=e.id??this.idFn(),m=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.actorId,t,r??null,e.emailVerified&&r?m:null,e.passwordHash,e.requiresPasswordUpgrade?1:0,m,m]),this.getIdentity(a)}getIdentity(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(e);return t?sc(t):void 0}getIdentityByActor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(e);return t?sc(t):void 0}getIdentityByUsername(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(e.trim());return t?sc(t):void 0}getIdentityByEmail(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(e.trim().toLowerCase());return t?sc(t):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(sc)}updatePassword(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let m=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
-        requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[t,r.requiresUpgrade?1:0,m,e]),r.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[m,e])}),this.getIdentity(e)}rehashPassword(e,t){let r=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[t,r,e]);let a=this.getIdentity(e);if(!a)throw Error("Authentication identity was not found");return a}setVerifiedEmail(e,t){let r=Ep(t),a=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[r,a,a,e]);let m=this.getIdentity(e);if(!m)throw Error("Authentication identity was not found");return m}recordLogin(e){let t=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[t,t,e]);let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");return r}setDisabled(e,t){let r=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[t?r:null,r,e]),t)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[r,e])});let a=this.getIdentity(e);if(!a)throw Error("Authentication identity was not found");return a}createActionToken(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let a=li(32).toString("base64url"),m=this.idFn(),f=this.now(),v=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,r.ttlMs??nl))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[m,e,t,Wn(a),JSON.stringify(r.metadata??{}),v,f]),{actionToken:this.getActionToken(m),token:a}}getActionToken(e){let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(e);return t?bh(t,this.now()):void 0}consumeActionToken(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(Wn(e),t);if(!r)throw Error("Action token is invalid");let a=bh(r,this.now());if(a.state!=="pending")throw Error(`Action token is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(a.id)})}revokeActionTokens(e,t){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),e,t]).changes}createSession(e){let t=this.getIdentity(e.identityId);if(!t||t.disabledAt)throw Error("Authentication identity is unavailable");let r=this.idFn(),a=li(32).toString("base64url"),m=`v2.${r}.${a}`,f=this.now(),v=Math.min(86400000,Math.max(60000,e.idleTtlMs??rl)),w=Math.min(2592000000,Math.max(v,e.absoluteTtlMs??Ke));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
-      created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,t.id,Wn(m),t.credentialVersion,e.authMethod??"local",e.userAgent?.slice(0,256)??null,e.networkHint?.slice(0,128)??null,f,f,new Date(this.nowFn().getTime()+v).toISOString(),new Date(this.nowFn().getTime()+w).toISOString(),e.recentAuthAt??f,e.mfaAt??null]),{session:this.getSession(r),token:m}}getSession(e){let t=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ?").get(e);return t?Rp(t,this.now()):void 0}verifySessionToken(e){let t=/^v2\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!t)return;let r=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ? AND token_hash = ?").get(t[1],Wn(e));if(!r)return;let a=Rp(r,this.now()),m=this.getIdentity(a.identityId);if(!m||m.disabledAt||a.state!=="active"||a.credentialVersion!==m.credentialVersion)return;let f=this.now(),v=new Date(r.idle_expires_at).getTime()-new Date(r.last_used_at).getTime();return this.run("UPDATE auth_sessions SET last_used_at = ?, idle_expires_at = ? WHERE id = ?",[f,new Date(Math.min(this.nowFn().getTime()+v,new Date(a.absoluteExpiresAt).getTime())).toISOString(),a.id]),{identity:m,session:this.getSession(a.id)}}listSessions(e,t={}){let r=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE identity_id = ? ORDER BY last_used_at DESC").all(e).map((a)=>Rp(a,this.now()));return t.includeInactive?r:r.filter((a)=>a.state==="active")}revokeSession(e,t){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND identity_id = ? AND revoked_at IS NULL",[this.now(),t,e]).changes===1}revokeOtherSessions(e,t){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND id != ? AND revoked_at IS NULL",[this.now(),e,t]).changes}getMfaFactor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(e);return t?wh(t):void 0}beginTotpEnrollment(e,t={}){let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");let a=this.getMfaFactor(e);if(a?.state==="active")throw Error("MFA is already enabled");let m=Oi(li(20)),f=t.label?.trim().slice(0,80)||r.email||r.username,v=a?.id??this.idFn(),w=this.now();return this.controlPlane.transaction(()=>{if(a)this.run("UPDATE auth_mfa_factors SET label = ?, secret_ciphertext = ?, created_at = ?, verified_at = NULL, disabled_at = NULL WHERE id = ?",[f,this.encrypt(m),w,v]);else this.run("INSERT INTO auth_mfa_factors (id, identity_id, label, secret_ciphertext, created_at) VALUES (?, ?, ?, ?, ?)",[v,e,f,this.encrypt(m),w]);this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e])}),{factor:this.getMfaFactor(e),secret:m,uri:ko({secret:m,account:f,issuer:t.issuer})}}verifyTotpEnrollment(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(e);if(!r||wh(r).state!=="pending")throw Error("MFA enrollment is not pending");let a=zr(this.decrypt(String(r.secret_ciphertext)),t,this.nowFn().getTime());if(a===void 0)throw Error("Authenticator code is invalid");let m=Array.from({length:10},()=>{let v=Oi(li(8)).slice(0,12);return`${v.slice(0,4)}-${v.slice(4,8)}-${v.slice(8)}`}),f=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET verified_at = ?, disabled_at = NULL, last_used_step = ? WHERE identity_id = ?",[f,a,e]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e]);for(let v of m)this.run("INSERT INTO auth_recovery_codes (id, identity_id, code_hash, created_at) VALUES (?, ?, ?, ?)",[this.idFn(),e,Wn(`${e}:${v.replace(/-/g,"").toUpperCase()}`),f])}),{factor:this.getMfaFactor(e),recoveryCodes:m}}verifyMfaCode(e,t,r={}){let a=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ? AND verified_at IS NOT NULL AND disabled_at IS NULL").get(e);if(!a)return{valid:!1};let m=zr(this.decrypt(String(a.secret_ciphertext)),t,this.nowFn().getTime());if(m!==void 0){if(this.controlPlane.database.run("UPDATE auth_mfa_factors SET last_used_step = ? WHERE identity_id = ? AND (last_used_step IS NULL OR last_used_step < ?)",[m,e,m]).changes===1)return{valid:!0,method:"totp"}}let f=t.replace(/[-\s]/g,"").toUpperCase();if(!/^[A-Z2-7]{12}$/.test(f))return{valid:!1};let v=Wn(`${e}:${f}`),w=this.controlPlane.database.query("SELECT * FROM auth_recovery_codes WHERE identity_id = ? AND code_hash = ? AND consumed_at IS NULL").get(e,v);if(!w)return{valid:!1};if(r.consumeRecovery!==!1){if(this.controlPlane.database.run("UPDATE auth_recovery_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL",[this.now(),String(w.id)]).changes!==1)return{valid:!1}}return{valid:!0,method:"recovery"}}remainingRecoveryCodes(e){return Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM auth_recovery_codes WHERE identity_id = ? AND consumed_at IS NULL").get(e)?.count??0)}disableMfa(e){let t=this.now();this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET disabled_at = ? WHERE identity_id = ? AND disabled_at IS NULL",[t,e]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e]),this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND consumed_at IS NULL",[t,e])})}createMfaChallenge(e,t){if(this.getMfaFactor(e)?.state!=="active")throw Error("MFA is not enabled");let r=li(32).toString("base64url"),a=this.idFn(),m=this.now(),f=new Date(this.nowFn().getTime()+il).toISOString();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND purpose = ? AND consumed_at IS NULL",[m,e,t]),this.run("INSERT INTO auth_mfa_challenges (id, identity_id, purpose, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)",[a,e,t,Wn(r),f,m])}),{challenge:this.getMfaChallenge(a),token:r}}getMfaChallenge(e){let t=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE id = ?").get(e);return t?Ap(t,this.now()):void 0}inspectMfaChallengeToken(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(Wn(e),t);return r?Ap(r,this.now()):void 0}completeMfaChallenge(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(Wn(e),r);if(!a)throw Error("MFA challenge is invalid");let m=Ap(a,this.now());if(m.state!=="pending")throw Error(`MFA challenge is ${m.state}`);let f=this.verifyMfaCode(m.identityId,t);if(!f.valid||!f.method)throw this.run("UPDATE auth_mfa_challenges SET attempts = attempts + 1 WHERE id = ?",[m.id]),Error("Authenticator or recovery code is invalid");if(this.controlPlane.database.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND attempts < 5 AND expires_at > ?",[this.now(),m.id,this.now()]).changes!==1)throw Error("MFA challenge is no longer available");return{identity:this.getIdentity(m.identityId),challenge:this.getMfaChallenge(m.id),method:f.method}}markSessionStepUp(e,t=!1){let r=this.now();this.run("UPDATE auth_sessions SET recent_auth_at = ?, mfa_at = CASE WHEN ? = 1 THEN ? ELSE mfa_at END WHERE id = ? AND revoked_at IS NULL",[r,t?1:0,r,e]);let a=this.getSession(e);if(!a)throw Error("Authentication session was not found");return a}isRecentlyAuthenticated(e,t=600000){return this.nowFn().getTime()-new Date(e.recentAuthAt).getTime()<=t}upsertOidcProvider(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("OIDC provider organization was not found");let t=mI(e.slug),r=e.name.trim().slice(0,80);if(!r)throw Error("OIDC provider name is required");let a=gI(e.issuer),m=e.clientId.trim();if(!m||m.length>512)throw Error("OIDC client ID is required");let f=hI(e.scopes),v=fI(e.allowedDomains),w=e.id?this.getOidcProvider(e.id):this.getOidcProviderBySlug(t),k=this.now();if(w){if(w.organizationId!==e.organizationId)throw Error("OIDC provider belongs to another organization");return this.run(`UPDATE auth_oidc_providers SET slug = ?, name = ?, issuer = ?, client_id = ?,
-        client_secret_ciphertext = COALESCE(?, client_secret_ciphertext), scopes = ?, allowed_domains = ?,
-        default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,m,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(f),JSON.stringify(v),e.defaultRole??w.defaultRole,e.enabled??w.enabled?1:0,e.enforceSso??w.enforceSso?1:0,k,w.id]),this.getOidcProvider(w.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let S=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
-      client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[S,e.organizationId,t,r,a,m,this.encrypt(e.clientSecret),JSON.stringify(f),JSON.stringify(v),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,k,k]),this.getOidcProvider(S)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?zc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?zc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(zc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:zc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let m=this.idFn(),f=li(32).toString("base64url"),v=li(32).toString("base64url"),w=li(64).toString("base64url"),k=this.now(),S=new Date(this.nowFn().getTime()+sl).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e,Wn(f),this.encrypt(v),this.encrypt(w),t,r,S,k]),{transaction:this.getOidcTransaction(m),state:f,nonce:v,verifier:w}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Wn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?yI(r):void 0}linkOidcSubject(e,t,r,a){let m=this.getOidcProvider(e),f=this.getIdentity(t);if(!m||!f)throw Error("OIDC provider or identity was not found");let v=Ep(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let w=this.getOidcSubject(e,r);if(w&&w.identityId!==t)throw Error("OIDC subject is already linked to another identity");let k=this.now();if(w)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[v,k,w.id]),this.getOidcSubject(e,r);let S=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[S,e,t,r,v,k,k]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Kr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-2fa9cdyf.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as vI}from"node:crypto";import{chmodSync as bI,existsSync as SI,mkdirSync as wI,readFileSync as kI,writeFileSync as II}from"node:fs";import{dirname as EI}from"node:path";function Hm(){return O("auth-encryption-key")}function We(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(SI(r)){let m=kI(r,"utf8").trim();if(m)return m}}catch{}let a=vI(32).toString("base64url");try{wI(EI(r),{recursive:!0,mode:448}),II(r,`${a}
-`,{mode:384}),bI(r,384)}catch{}return a}import{constants as RI,createHash as Cp,createPublicKey as AI,createVerify as CI,timingSafeEqual as PI}from"node:crypto";var _h=new Set(["RS256","PS256","ES256"]),Ph=60;function Uc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function Pp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function _p(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let m=await e.text();if(m.length>1048576)throw Error(`${t} response is too large`);try{return Pp(JSON.parse(m),t)}catch(f){if(f instanceof Error&&f.message===`${t} is invalid`)throw f;throw Error(`${t} returned invalid JSON`)}}function _I(e,t){let r=Cp("sha256").update(e).digest(),a=Cp("sha256").update(t).digest();return PI(r,a)}function ol(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function Bo(e,t=fetch){let r=Uc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),m=await _p(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(m.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let v of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof m[v]!=="string")throw Error(`OIDC discovery is missing ${v}`);Uc(m[v],`OIDC ${v}`)}if(Array.isArray(m.response_types_supported)&&!m.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(m.code_challenge_methods_supported)&&!m.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let f=Array.isArray(m.id_token_signing_alg_values_supported)?m.id_token_signing_alg_values_supported.filter((v)=>typeof v==="string"):[];if(f.length>0&&!f.some((v)=>_h.has(v)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return m}async function _o(e,t,r,a,m=fetch){let f=e.getOidcProviderBySlug(t);if(!f?.enabled)throw Error("OIDC provider is unavailable");let v=Uc(r,"Application origin").origin,w=await Bo(f,m),k=`${v}/auth/oidc/${encodeURIComponent(f.slug)}/callback`,S=e.beginOidcTransaction(f.id,k,ol(a)),A=new URL(w.authorization_endpoint);return A.searchParams.set("response_type","code"),A.searchParams.set("client_id",f.clientId),A.searchParams.set("redirect_uri",k),A.searchParams.set("scope",f.scopes.join(" ")),A.searchParams.set("state",S.state),A.searchParams.set("nonce",S.nonce),A.searchParams.set("code_challenge",Cp("sha256").update(S.verifier).digest("base64url")),A.searchParams.set("code_challenge_method","S256"),{authorizationUrl:A.href,expiresAt:S.transaction.expiresAt}}function TI(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:Pp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:Pp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function xI(e,t,r){let a=TI(e),m=typeof a.header.alg==="string"?a.header.alg:"",f=typeof a.header.kid==="string"?a.header.kid:"";if(!_h.has(m)||!f)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(m))throw Error("OIDC ID-token algorithm was not advertised by the provider");let v=await _p(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(v.keys))throw Error("OIDC signing-key response is invalid");let w=v.keys.find((x)=>{if(!x||typeof x!=="object"||Array.isArray(x))return!1;let F=x;return F.kid===f&&(!F.alg||F.alg===m)&&(!F.use||F.use==="sig")});if(!w)throw Error("OIDC ID-token signing key was not found");let k=AI({key:w,format:"jwk"}),S=CI("SHA256").update(a.signingInput).end();if(!(m==="PS256"?S.verify({key:k,padding:RI.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):m==="ES256"?S.verify({key:k,dsaEncoding:"ieee-p1363"},a.signature):S.verify(k,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function DI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let m=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((k)=>typeof k==="string"):[];if(!m.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((m.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let f=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<f-Ph)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>f+Ph)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!_I(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let v=e.email.trim().toLowerCase();if(v.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v))throw Error("OIDC provider returned an invalid email address");let w=v.split("@")[1];if(!w||!t.allowedDomains.includes(w))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:v,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function xo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let m=Uc(t.origin,"Application origin").origin,f=e.consumeOidcTransaction(a.id,t.state),v=`${m}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(f.transaction.redirectUri!==v)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:w}=e.getOidcProviderCredentials(a.id),k=await Bo(a,r),S=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:f.transaction.redirectUri,code_verifier:f.verifier}),A={accept:"application/json","content-type":"application/x-www-form-urlencoded"},x=k.token_endpoint_auth_methods_supported??["client_secret_basic"];if(x.includes("client_secret_basic")){let H=(X)=>new URLSearchParams({value:X}).toString().slice(6),K=`${H(a.clientId)}:${H(w)}`;A.authorization=`Basic ${Buffer.from(K).toString("base64")}`}else if(x.includes("client_secret_post"))S.set("client_id",a.clientId),S.set("client_secret",w);else throw Error("OIDC provider does not support a configured client authentication method");let F=await _p(await r(k.token_endpoint,{method:"POST",headers:A,body:S,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof F.id_token!=="string")throw Error("OIDC token response did not include an ID token");let U=await xI(F.id_token,k,r);return{identity:DI(U,a,f.nonce,t.now??new Date),returnPath:f.transaction.returnPath}}import{createHash as OI,randomBytes as $I}from"node:crypto";var xh=new Set(le),al=7776000000,cl=31536000000,dl=86400000;function pi(e){return typeof e==="string"?e:void 0}function Th(e){return OI("sha256").update(e).digest("hex")}function NI(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&xh.has(r)):[]}catch{return[]}}function jI(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Tp(e){let t=pi(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:pi(e.description),createdByActorId:pi(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function xp(e,t){let r=pi(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:NI(e.capabilities),scope:jI(e),expiresAt:a,lastUsedAt:pi(e.last_used_at),lastNetworkHint:pi(e.last_network_hint),revokedAt:r,rotatedFromTokenId:pi(e.rotated_from_token_id),createdByActorId:pi(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function MI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:pi(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class $i{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),m=this.idFn(),f=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,f,f]);let v=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),w=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:m,roleTemplate:e.roleTemplate,scope:{type:w.type,id:w.id??null}}}),{serviceAccount:this.getServiceAccount(m),membership:v}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Tp(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Tp(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Tp).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let m=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(m?.status==="active")this.controlPlane.revokeMembership(m.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((F)=>!xh.has(F)))throw Error("API token requires valid explicit capabilities");let m=e.scope??r.scope,f=this.controlPlane.resolveAuthorizationTarget(t.organizationId,m);if(!f)throw Error("API token scope was not found in this organization");for(let F of a)if(!R({membership:r,grants:this.controlPlane.listGrants(r.id),capability:F,target:f}).allowed)throw Error(`Service-account membership does not grant ${F} at the token scope`);let v=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+al);if(!Number.isFinite(v.getTime())||v.getTime()<=this.nowFn().getTime()+60000||v.getTime()>this.nowFn().getTime()+cl)throw Error("API token expiry must be between one minute and one year from now");let w=this.idFn(),k=$I(32).toString("base64url"),S=`tsc_v1.${w}.${k}`,A=`tsc_v1.${w.slice(0,8)}`,x=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
-      expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[w,t.id,e.name.trim().slice(0,100)||"API token",Th(S),A,JSON.stringify(a.sort()),m.type,m.type==="organization"?null:m.id??null,v.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,x,x]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:w,prefix:A,capabilities:a,scope:{type:m.type,id:m.id??null},expiresAt:v.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(w),secret:S}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?xp(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>xp(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],Th(e));if(!a)return;let m=xp(a,this.now()),f=this.getServiceAccount(m.serviceAccountId);if(!f||f.state!=="active"||m.state!=="active")return;let v=this.controlPlane.getActor(f.actorId),w=this.controlPlane.getMembershipForActor(f.organizationId,f.actorId);if(!v||v.disabledAt||!w||w.status!=="active")return;let k=this.now(),S=!m.lastUsedAt||this.nowFn().getTime()-new Date(m.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[k,t?.slice(0,128)??null,k,m.id]),S)this.controlPlane.appendEvent({organizationId:f.organizationId,actorId:v.id,type:"api.token.used",payload:{serviceAccountId:f.id,tokenId:m.id,prefix:m.prefix}});return{serviceAccount:f,token:this.getToken(m.id),actor:v,membership:w}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),m=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let m=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:m?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?MI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),m=new Date(this.nowFn().getTime()+dl).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.tokenId,e.key,e.requestHash,e.operationId??null,e.responseStatus,JSON.stringify(e.responseBody),m,a]),this.getIdempotency(e.tokenId,e.key)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[e,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,r=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[e]).changes;return{tokens:t,idempotency:r}}}import{isIP as Mh}from"node:net";var BI={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},LI={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},Dh={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function Oh(e){try{return new Intl.DateTimeFormat("en",{timeZone:e}).format(new Date),e}catch{throw Error(`Unknown schedule timezone: ${e}`)}}function Vc(e,t,r,a){let m=t[e.toUpperCase()]??Number(e);if(!Number.isInteger(m)||m<r||m>a)throw Error(`Schedule field value ${e} is outside ${r}-${a}.`);return m}function Bs(e,t,r,a={},m){if(e==="*"||e==="?")return;let f=new Set;for(let v of e.split(",")){let[w,k]=v.split("/"),S=k?Vc(k,{},1,r-t+1):1,A,x;if(w==="*")A=t,x=r;else if(w.includes("-")){let F=w.split("-");A=Vc(F[0],a,t,r),x=Vc(F[1],a,t,r)}else A=Vc(w,a,t,r),x=A;if(x<A)throw Error("Schedule ranges must be ascending.");for(let F=A;F<=x;F+=S)f.add(m?m(F):F===7&&r===7?0:F)}return f}function FI(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(e).map((a)=>[a.type,a.value]));return{minute:Number(r.minute),hour:Number(r.hour),day:Number(r.day),month:Number(r.month),weekday:Dh[r.weekday.toUpperCase()],year:Number(r.year),key:`${r.year}-${r.month}-${r.day} ${r.hour}:${r.minute}`}}function $h(e){let r=(e.startsWith("cron(")?e.slice(5,-1).trim():e.trim()).split(/\s+/);if(r.length!==5&&r.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[a,m,f,v,w,k]=r,S=r.length===6;return{minute:Bs(a,0,59),hour:Bs(m,0,23),day:Bs(f,1,31),month:Bs(v,1,12,LI),weekday:Bs(w,S?1:0,7,Dh,S?(A)=>A===7?6:A-1:void 0),year:k?Bs(k,1970,2199):void 0,dayWildcard:f==="*"||f==="?",weekdayWildcard:w==="*"||w==="?"}}function zI(e,t){if(!((!t.minute||t.minute.has(e.minute))&&(!t.hour||t.hour.has(e.hour))&&(!t.month||t.month.has(e.month))&&(!t.year||t.year.has(e.year))))return!1;let a=!t.day||t.day.has(e.day),m=!t.weekday||t.weekday.has(e.weekday);return t.dayWildcard?m:t.weekdayWildcard?a:a||m}function Nh(e){let t=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(e);if(!t)return;let r=Number(t[1]);if(r<1)throw Error("Rate amount must be positive.");return r*(t[2].toLowerCase().startsWith("minute")?60000:t[2].toLowerCase().startsWith("hour")?3600000:86400000)}function Xe(e){let t=e.trim(),r=BI[t.toLowerCase()]??t;if(!r)throw Error("Schedule expression is required.");let a=Nh(r);if(a){let m=a/60000;return{original:t,normalized:`rate(${m} minutes)`,kind:"rate",description:m%1440===0?`Every ${m/1440} day(s)`:m%60===0?`Every ${m/60} hour(s)`:`Every ${m} minute(s)`}}return $h(r),{original:t,normalized:r.startsWith("cron(")?r:`cron(${r})`,kind:"cron",description:`Cron ${r.replace(/^cron\(|\)$/g,"")}`}}function St(e,t,r=new Date,a=5){let m=Xe(e),f=Oh(t),v=Math.min(20,Math.max(1,a)),w=Nh(m.normalized);if(w)return Array.from({length:v},(U,H)=>new Date(r.getTime()+w*(H+1)).toISOString());let k=$h(m.normalized),S=[],A=new Set,x=new Date(Math.floor(r.getTime()/60000)*60000+60000),F=0;while(S.length<v&&F<1100000){let U=FI(x,f);if(zI(U,k)&&!A.has(U.key))S.push(x.toISOString()),A.add(U.key);x=new Date(x.getTime()+60000),F++}if(S.length<v)throw Error("Schedule produced no runs within the bounded preview horizon.");return S}function Ct(e,t="UTC",r=new Date,a=5){let m=Xe(e),f=St(m.normalized,t,r,a),v=m.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...m,timezone:Oh(t),nextRuns:f,capabilities:{server:m.kind==="cron",eventbridge:!0,notes:v}}}function en(e){let t=Xe(e.expression),r=t.normalized.slice(5,-1).trim().split(/\s+/),a=t.kind==="cron"&&r.length===5;if(e.provider==="server")return{provider:"server",supported:a,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[t.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":r.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",e.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(e.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(e.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function qi(e){let t=en({...e,provider:"server"});if(!t.supported)throw Error(t.notes.join(" "));let a=Xe(e.expression).normalized.slice(5,-1);return{path:`/etc/cron.d/ts-cloud-${e.id}`,content:`CRON_TZ=${e.timezone}
-${a} root /usr/local/bin/cloud jobs:dispatch ${e.id} --scheduled >/dev/null 2>&1
-`}}function UI(e){let t=Xe(e);if(t.kind==="rate")return e;let r=t.normalized.slice(5,-1).trim().split(/\s+/);if(r.length===6)return t.normalized;let[a,m,f,v,w]=r,k=w==="*"?"?":w.replace(/(^|[,-])0(?=$|[,-])/g,(S,A)=>`${A}1`);return f==="*"&&w!=="*"?`cron(${a} ${m} ? ${v} ${k} *)`:`cron(${a} ${m} ${f} ${v} ? *)`}function xl(e){let t=en(e);if(!t.supported)throw Error(t.notes.join(" "));return{Name:`ts-cloud-${e.id}`,ScheduleExpression:UI(e.expression),ScheduleExpressionTimezone:e.timezone,State:e.enabled?"ENABLED":"DISABLED",FlexibleTimeWindow:e.flexibleMinutes?{Mode:"FLEXIBLE",MaximumWindowInMinutes:e.flexibleMinutes}:{Mode:"OFF"},Target:{kind:e.target.kind,functionName:e.target.functionName??null,payloadRefs:e.payloadRefs},RetryPolicy:{MaximumRetryAttempts:e.retryPolicy.maxAttempts,MaximumEventAgeInSeconds:e.timeoutSeconds},DeadLetterRef:e.retryPolicy.deadLetterRef??null}}function hy(e,t){if(!t)return{status:"unavailable",observedState:{message:"Provider observation is unavailable."}};let r=String(t.expression??""),a=t.enabled;return{status:r&&r!==e.normalizedExpression||typeof a==="boolean"&&a!==e.enabled?"drifted":"in_sync",observedState:t}}function rh(e){if(e.provider==="server"){let t=qi(e);return{path:t.path,content:t.content,enabled:e.enabled}}if(e.provider==="eventbridge")return xl(e);throw Error(`No reconciliation adapter is configured for ${e.provider} schedules.`)}function Dp(e,t){if(Array.isArray(e))return Array.isArray(t)&&e.length===t.length&&e.every((r,a)=>Dp(r,t[a]));if(e&&typeof e==="object"){if(!t||typeof t!=="object"||Array.isArray(t))return!1;return Object.entries(e).every(([r,a])=>Dp(a,t[r]))}return e===t}class nh{transport;provider="server";constructor(e){this.transport=e}async observe(e){let t=qi(e),r=await this.transport.read(t.path);return r==null?void 0:{path:t.path,content:r,enabled:!0}}async apply(e,t){let r=String(t.path??"");if(!e.enabled){await this.transport.removeRootOwned(r);return}await this.transport.writeRootOwned(r,String(t.content??""))}async remove(e){await this.transport.removeRootOwned(qi(e).path)}matches(e,t){if(e.enabled===!1)return!1;return e.path===t.path&&e.content===t.content}}class ih{transport;provider="eventbridge";constructor(e){this.transport=e}observe(e){return this.transport.get(`ts-cloud-${e.id}`)}apply(e,t){return this.transport.put(t)}remove(e){return this.transport.remove(`ts-cloud-${e.id}`)}matches(e,t){return Dp(e,t)}}class sh{store;constructor(e){this.store=e}async reconcile(e,t,r={}){if(t.provider!==e.provider)return this.store.reconcile(e.id,"unsupported",{provider:t.provider,message:`Adapter ${t.provider} cannot reconcile ${e.provider}.`});try{let a=rh(e),m=await t.observe(e);if(m&&t.matches(a,m))return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:m});if(r.apply===!1)return this.store.reconcile(e.id,m?"drifted":"unavailable",{provider:t.provider,observed:m??null,applyRequired:!0});if(await t.apply(e,a),!e.enabled)return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:null,disabled:!0});let f=await t.observe(e);return this.store.reconcile(e.id,f&&t.matches(a,f)?"in_sync":"drifted",{provider:t.provider,observed:f??null,applied:!0})}catch(a){return this.store.reconcile(e.id,"unavailable",{provider:t.provider,error:a instanceof Error?a.message:String(a)})}}async remove(e,t){if(e.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");if(t.provider!==e.provider)throw Error(`Adapter ${t.provider} cannot remove ${e.provider}.`);await t.remove(e),this.store.remove(e.id)}}function qI(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,a]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:a}})}function Wo(e,t,r){let a=new Set,m=new Set,f=new Map(r.resources.map((x)=>[x.slug,x])),v=0,w=0;for(let[x,F]of Object.entries(t.sites??{})){let U=f.get(x);if(F.scheduler){let X=`config:site:${x}:scheduler`;a.add(X),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:U?.id,name:`${x} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${x}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:X,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),v++}let H=F,K=Array.isArray(H.queues??H.workers)?H.queues??H.workers:[];for(let[X,oe]of K.entries()){let pe=typeof oe==="string"?{queue:oe}:oe,ee=String(pe.queue??pe.name??"default"),ce=`config:site:${x}:worker:${X}:${ee}`;m.add(ce),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:U?.id,name:`${x}:${ee}`,provider:"systemd",queue:ee,processes:Number(pe.processes)||1,timeoutSeconds:Number(pe.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${x}`,site:x},enabled:!0,origin:"config",sourceKey:ce,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),w++}}let k=t.infrastructure?.compute?.backups;if(k?.enabled)a.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(k.schedule??"0 2 * * *"),timezone:String(k.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),v++;let S=t.environments?.[r.environment.slug]?.app;if(S){if(S.scheduler!=="off"){let x=`config:serverless:${r.environment.slug}:scheduler`;a.add(x),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:S.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:S.cliTimeout??900,enabled:!0,origin:"config",sourceKey:x,observedState:{source:"cloud.config.ts",mode:S.scheduler??"on"},reconciliationStatus:"pending"}),v++}for(let{queue:x,processes:F}of qI(S)){let U=`config:serverless:${r.environment.slug}:worker:${x}`;m.add(U),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${x}`,provider:"lambda",queue:x,processes:F,timeoutSeconds:S.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:x},enabled:!0,origin:"config",sourceKey:U,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),w++}}let A=0;for(let x of e.list(r.project.id,{environmentId:r.environment.id}).filter((F)=>F.origin==="config"&&F.sourceKey&&!a.has(F.sourceKey)))e.reconcile(x.id,"drifted",{...x.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),A++;for(let x of e.listWorkers(r.project.id,r.environment.id).filter((F)=>F.origin==="config"&&F.sourceKey&&!m.has(F.sourceKey)))e.reconcileWorker(x.id,"drifted",{...x.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),A++;return{jobs:v,workers:w,drifted:A}}class Jo{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new c(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),a=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,m=this.store.activeExecution(e.id);if(m&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:m.id}});if(m&&e.overlapPolicy==="replace"&&m.operationId)try{this.queue.requestCancellation(m.operationId,t.actorId)}catch{}let f=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"queued",output:{semantics:"at_least_once"}});if(f.operationId)return f;let v=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:f.id},idempotencyKey:`job-execution:${f.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${f.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(f.id,v.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let a=r.nextRunAt,m=St(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let f=a,v=0;while(f<=e.toISOString()&&v<10)t.push(this.enqueue(r,{trigger:f===a?"scheduled":"catch_up",scheduledFor:f})),f=St(r.normalizedExpression,r.timezone,new Date(f),1)[0],v++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:a}));this.store.markScheduled(r.id,a,m)}return t}}function Ol(e){return{"job.execute":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},m=e.store.get(String(a.jobId??"")),f=e.store.getExecution(String(a.executionId??""));if(!m||!f)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(f.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${m.name} on ${m.provider}.`),r.log(`Trigger ${f.trigger}; scheduled for ${f.scheduledFor}; semantics at-least-once.`,{stream:"system"});let v=await e.executor(m,m.target,r);if(v.stdout)r.log(v.stdout,{stream:"stdout"});if(v.stderr)r.log(v.stderr,{stream:"stderr"});if(!v.ok){if(e.store.transitionExecution(f.id,r.operation.attempt>=m.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:v.stderr??"Job execution failed."}),v.retryable)throw new Y(v.stderr??"Scheduled job failed transiently.","job_transient");throw Error(v.stderr??"Scheduled job failed.")}return e.store.transitionExecution(f.id,"succeeded",{attempt:r.operation.attempt,output:v.output??{}}),{jobId:m.id,executionId:f.id,provider:m.provider}}}}var Gr=(e)=>typeof e==="string"&&e?e:void 0,jh=(e)=>Number(e)===1,ms=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},go=(e,t,r,a)=>{let m=Number(e);return Number.isFinite(m)?Math.min(a,Math.max(r,Math.floor(m))):t};function Wc(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Gr(e.environment_id),resourceId:Gr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:Gr(e.starts_at),endsAt:Gr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:ms(e.target),payloadRefs:ms(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:ms(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:jh(e.enabled),origin:String(e.origin),sourceKey:Gr(e.source_key),ownerActorId:Gr(e.owner_actor_id),observedState:ms(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:Gr(e.next_run_at),lastScheduledFor:Gr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Kc(e){return{id:String(e.id),jobId:String(e.job_id),operationId:Gr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:Gr(e.started_at),finishedAt:Gr(e.finished_at),output:ms(e.output),error:Gr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Op(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Gr(e.environment_id),resourceId:Gr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:ms(e.target),enabled:jh(e.enabled),origin:String(e.origin),sourceKey:Gr(e.source_key),ownerActorId:Gr(e.owner_actor_id),observedState:ms(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Ko{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=Ct(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),a=this.now().toISOString(),m=e.startsAt?new Date(e.startsAt).toISOString():void 0,f=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(m&&f&&m>=f)throw Error("Schedule start must be before end.");let v=t.nextRuns.find((w)=>(!m||w>=m)&&(!f||w<=f));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,m??null,f??null,go(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:go(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:go(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),go(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,v??null,1,a,a]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?Wc(t):void 0}getBySource(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return a?Wc(a):void 0}list(e,t={}){let r=["project_id=?"],a=[e];if(t.environmentId)r.push("environment_id=?"),a.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),a.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),a.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...a).map(Wc)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let a=t.expression??r.expression,m=t.timezone??r.timezone,f=Ct(a,m,this.now(),1),v=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[a,f.normalized,m,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,go(t.timeoutSeconds,r.timeoutSeconds,1,86400),f.nextRuns[0],"pending",v,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=Ct(e.expression,e.timezone,this.now(),1),a=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],a,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(Wc)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Kc(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),a,a]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?Kc(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(Kc)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?Kc(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let a=this.now().toISOString(),m=t==="running"?a:null,f=["succeeded","failed","skipped","dead"].includes(t)?a:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,m,f,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,a,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?Op(t):void 0,a=r?.id??crypto.randomUUID(),m=this.now().toISOString(),f=go(e.processes,1,0,1000),v=go(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===f&&r.timeoutSeconds===v&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[a,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),f,v,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??m,m]),this.getWorker(a)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?Op(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Op)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[go(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let a=this.getWorker(e);if(!a)throw Error("Worker was not found.");return a}}var Rt=(e)=>e==null?void 0:String(e),Jc=(e)=>Number(e)===1,fo=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Bh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:Rt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:Rt(e.bucket),prefix:String(e.prefix),region:Rt(e.region),forcePathStyle:Jc(e.force_path_style),credentialRef:Rt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:Rt(e.encryption_key_ref),immutability:fo(e.immutability,{}),status:String(e.status),lastTestedAt:Rt(e.last_tested_at),lastSuccessAt:Rt(e.last_success_at),lastFailureAt:Rt(e.last_failure_at),lastError:Rt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function $p(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Rt(e.environment_id),resourceId:Rt(e.resource_id),dataServiceId:Rt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:fo(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:fo(e.include_patterns,[]),excludePatterns:fo(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:Rt(e.health_check_id),enabled:Jc(e.enabled),nextRunAt:Rt(e.next_run_at),lastRunAt:Rt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Np(e){return{id:String(e.id),projectId:String(e.project_id),policyId:Rt(e.policy_id),destinationId:String(e.destination_id),resourceId:Rt(e.resource_id),dataServiceId:Rt(e.data_service_id),backupJobId:Rt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:fo(e.manifest,{}),toolVersion:Rt(e.tool_version),engineVersion:Rt(e.engine_version),expiresAt:Rt(e.expires_at),lockedUntil:Rt(e.locked_until),held:Jc(e.held),pinned:Jc(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:Rt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function jp(e){return{id:String(e.id),projectId:String(e.project_id),policyId:Rt(e.policy_id),recoveryPointId:Rt(e.recovery_point_id),operationId:Rt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:fo(e.target,{}),restoreMode:Rt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:Rt(e.safety_backup_id),healthResult:e.health_result?fo(e.health_result,{}):void 0,progress:fo(e.progress,{}),error:Rt(e.error),startedAt:Rt(e.started_at),finishedAt:Rt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function VI(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(Mh(t)===6)return t==="::1"||t.startsWith("fe80:");if(Mh(t)!==4)return!1;let[r,a]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&a===254||r===172&&a>=16&&a<=31||r===192&&a===168}function yh(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(VI(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class Sa{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){yh(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Bh(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Bh)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=Xe(e.schedule),a=St(r.normalized,e.timezone,this.now(),1)[0],m=crypto.randomUUID(),f=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[m,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,a,e.lastRunAt??null,1,f,f]),this.getPolicy(m)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?$p(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map($p)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map($p)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let a=St(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,a,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return jp(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,a,a]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?jp(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(jp)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,a.recoveryPointId??null,JSON.stringify(a.progress),a.healthResult?JSON.stringify(a.healthResult):null,a.error??null,a.startedAt??null,a.finishedAt??null,a.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((a)=>e.uri.startsWith(a)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?Np(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(Np)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[a.status,a.verificationState,a.verifiedAt??null,a.held?1:0,a.pinned?1:0,JSON.stringify(a.manifest),a.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
-        WHERE rp.status='available' AND rp.held=0 AND rp.pinned=0
-          AND rp.expires_at IS NOT NULL AND rp.expires_at<=?
-          AND (rp.locked_until IS NULL OR rp.locked_until<=?)
-          AND NOT EXISTS (
-            SELECT 1 FROM backup_jobs bj WHERE bj.recovery_point_id=rp.id
-            AND bj.kind IN ('restore','drill') AND bj.status IN ('queued','running','cleanup_required')
-          )
-        ORDER BY rp.expires_at,rp.id`).all(e.toISOString(),e.toISOString()).map(Np),r=new Set;for(let a of new Set(t.map((m)=>m.projectId)))for(let m of this.listPolicies(a)){let f=this.listRecoveryPoints(m.projectId,m.id).filter((w)=>w.status==="available").sort((w,k)=>k.pointInTime.localeCompare(w.pointInTime));for(let w of f.slice(0,Math.max(0,m.retention.keepLast??0)))r.add(w.id);let v=[[m.retention.hourly,(w)=>w.toISOString().slice(0,13)],[m.retention.daily,(w)=>w.toISOString().slice(0,10)],[m.retention.weekly,(w)=>new Date(Date.UTC(w.getUTCFullYear(),w.getUTCMonth(),w.getUTCDate()-(w.getUTCDay()+6)%7)).toISOString().slice(0,10)],[m.retention.monthly,(w)=>w.toISOString().slice(0,7)]];for(let[w,k]of v){let S=new Set;for(let A of f){let x=k(new Date(A.pointInTime));if(S.has(x))continue;if(S.add(x),S.size<=Math.max(0,w??0))r.add(A.id)}}}return t.filter((a)=>!r.has(a.id))}coverage(e,t=this.now()){let r=new Map(this.listDestinations(e).map((a)=>[a.id,a]));return this.listPolicies(e).map((a)=>{let m=this.listRecoveryPoints(e,a.id).filter((w)=>w.status==="available"),f=m[0],v=f?(t.getTime()-new Date(f.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:a,lastRecoveryPoint:f,missedRpo:a.enabled&&v>a.expectedRpoMinutes,unverified:m.filter((w)=>w.verificationState!=="verified").length,destinationHealthy:r.get(a.destinationId)?.status==="healthy"}})}}import{createCipheriv as WI,createDecipheriv as HI,createHash as Lh,randomBytes as Fh}from"node:crypto";var Mp=Buffer.from("TSCB1"),Yc=(e)=>`sha256:${Lh("sha256").update(e).digest("hex")}`;function zh(e){return Lh("sha256").update(e).digest()}function Ih(e,t,r){let a=r?Buffer.from(r):Fh(12);if(a.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let m=WI("aes-256-gcm",zh(t),a),f=Buffer.concat([m.update(e),m.final()]),v=m.getAuthTag();return Buffer.concat([Mp,a,v,f])}function Sh(e,t){let r=Buffer.from(e);if(!r.subarray(0,Mp.length).equals(Mp))throw Error("Backup does not contain a valid encrypted envelope.");let a=r.subarray(5,17),m=r.subarray(17,33),f=r.subarray(33),v=HI("aes-256-gcm",zh(t),a);return v.setAuthTag(m),Buffer.concat([v.update(f),v.final()])}function KI(e){let t;try{t=JSON.parse(e)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!t.accessKeyId||!t.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(t.expiresAt){let r=new Date(String(t.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(t.accessKeyId),secretAccessKey:String(t.secretAccessKey),sessionToken:t.sessionToken?String(t.sessionToken):void 0}}async function uu(e,t,r=new Date){if(!e.credentialRef)return{status:"default"};try{let a=JSON.parse(await t.resolve(e.credentialRef));if(!a.accessKeyId||!a.secretAccessKey)return{status:"invalid"};if(!a.expiresAt)return{status:"static"};let m=new Date(String(a.expiresAt));if(!Number.isFinite(m.getTime()))return{status:"invalid"};let f=m.getTime()-r.getTime();return{status:f<=0?"expired":f<=604800000?"expiring":"valid",expiresAt:m.toISOString()}}catch{return{status:"invalid"}}}class Ca{secrets;clientFactory;multipartThreshold;partSize;constructor(e,t=(m,f)=>new o(m.region??"us-east-1",void 0,{endpoint:m.endpoint?new URL(m.endpoint).host:void 0,forcePathStyle:m.forcePathStyle,credentials:f}),r=8388608,a=8388608){this.secrets=e;this.clientFactory=t;this.multipartThreshold=r;this.partSize=a}async client(e){let t=e.credentialRef?KI(await this.secrets.resolve(e.credentialRef)):void 0;return this.clientFactory(e,t)}async test(e){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let t=await this.client(e),r=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await t.putObject({bucket:e.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let a=await t.getObjectBytes(e.bucket,r);if(Buffer.from(a.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await t.deleteObject(e.bucket,r)}}async upload(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),a=Yc(t.body),m=e.encryption!=="provider"?await this.secrets.resolve(e.encryptionKeyRef):void 0,f=m?t.resume?.encryptionIv?Buffer.from(t.resume.encryptionIv,"base64url"):Fh(12):void 0,v=m?Ih(t.body,m,f):Buffer.from(t.body),w=Yc(v),k=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}${t.key.replace(/^\/+/,"")}`,S=t.contentType??"application/octet-stream",A={"ts-cloud-format":"v1","ts-cloud-sha256":w.slice(7),"ts-cloud-encrypted":m?"true":"false"};if(t.resume&&t.resume.key!==k)throw Error("Multipart checkpoint does not match the requested backup key.");if(t.resume&&m&&!t.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(t.resume&&m&&t.resume.plaintextChecksum!==a)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(v.length<this.multipartThreshold)await r.putObject({bucket:e.bucket,key:k,body:v,contentType:S,metadata:A});else{let x=t.resume?void 0:await r.createMultipartUpload(e.bucket,k,{contentType:S,metadata:A}),F=t.resume??{uploadId:x.UploadId,key:k,parts:[],bytesUploaded:0,encryptionIv:f?.toString("base64url"),plaintextChecksum:a},U=new Map(F.parts.map((K)=>[K.PartNumber,K])),H=Math.ceil(v.length/this.partSize);for(let K=0;K<H;K++){let X=K+1;if(!U.has(X)){let oe=K*this.partSize,pe=await r.uploadPart(e.bucket,k,F.uploadId,X,v.subarray(oe,Math.min(v.length,oe+this.partSize)));U.set(X,{PartNumber:X,ETag:pe.ETag})}F.parts=[...U.values()].sort((oe,pe)=>oe.PartNumber-pe.PartNumber),F.bytesUploaded=Math.min(v.length,X*this.partSize),t.checkpoint?.(F)}await r.completeMultipartUpload(e.bucket,k,F.uploadId,F.parts)}return{uri:`s3://${e.bucket}/${k}`,key:k,sizeBytes:v.length,checksum:w,manifest:{format:"ts-cloud-backup-v1",encrypted:!!m,plaintextChecksum:a,storageChecksum:w,contentType:S}}}async download(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),a=await r.getObjectBytes(e.bucket,t.key),m=Buffer.from(a.body);if(Yc(m)!==t.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let f=t.manifest.encrypted?Sh(m,await this.secrets.resolve(e.encryptionKeyRef)):m;if(Yc(f)!==t.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return f}async abortPartial(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).abortMultipartUpload(e.bucket,t.key,t.uploadId)}async delete(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).deleteObject(e.bucket,t)}}import{createHash as JI}from"node:crypto";var GI=(e)=>`sha256:${JI("sha256").update(e).digest("hex")}`;class Yi{store;queue;now;constructor(e,t,r=()=>new Date){this.store=e;this.queue=t;this.now=r}enqueueBackup(e,t=this.now().toISOString(),r){if(!e.enabled)throw Error("Backup policy is disabled.");let a=this.store.createJob({projectId:e.projectId,policyId:e.id,kind:"backup",status:"queued",idempotencyKey:`backup:${e.id}:${t}`,target:{scheduledFor:t},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!a.operationId){let m=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:a.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`backup-policy:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(a.id,{operationId:m.operation.id})}return a}enqueueDue(e=this.now()){return this.store.duePolicies(e).map((t)=>{let r=t.nextRunAt;return this.store.advancePolicy(t.id,r),this.enqueueBackup(t,r)})}enqueueVerification(e){let t=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"verify",status:"queued",idempotencyKey:`verify:${e.id}:${e.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!t.operationId){let r=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.verify",input:{backupJobId:t.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(t.id,{operationId:r.operation.id})}return t}planRestore(e,t){if(e.status!=="available")throw Error("Only available recovery points can be restored.");if(e.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(t.mode==="in_place"){if(!t.recentAuth)throw Error("In-place restore requires recent authentication.");if(t.confirm!==t.targetName)throw Error(`Type ${t.targetName} to confirm in-place restore.`);if(!t.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=t.safetyBackupId?this.store.getRecoveryPoint(t.safetyBackupId):void 0;if(!r||r.id===e.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==e.resourceId||r.dataServiceId!==e.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:e,mode:t.mode,target:{...t.target,inPlace:t.mode==="in_place",restoreMode:t.mode},warnings:t.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(e,t){let r=this.planRestore(e,t),a=t.drill?"drill":"restore",m=GI(JSON.stringify({point:e.id,mode:t.mode,target:t.target,safety:t.safetyBackupId,drill:!!t.drill})),f=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:a,status:"queued",idempotencyKey:`${a}:${m}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:t.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!f.operationId){let v=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,actorId:t.actorId,kind:t.drill?"backup.drill":"backup.restore",input:{backupJobId:f.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(f.id,{operationId:v.operation.id})}return f}enqueueRetention(e=this.now()){return this.store.retentionCandidates(e).map((t)=>{let r=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${t.id}:${t.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let a=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:a.operation.id})}return r})}}function pu(e){let t=e.now??(()=>new Date),r=new Yi(e.store,e.queue,t),a=(w)=>{let k=w.recoveryPointId?e.store.getRecoveryPoint(w.recoveryPointId):void 0,S=w.policyId?e.store.getPolicy(w.policyId):k?.policyId?e.store.getPolicy(k.policyId):void 0;if(!S)throw Error("Backup policy was not found.");let A=e.store.getDestination(k?.destinationId??S.destinationId),x=e.resolveSource(S);if(!A)throw Error("Backup destination was not found.");if(!x)throw Error(`No ${S.resourceKind} backup adapter is configured.`);return{point:k,policy:S,destination:A,source:x}},m=(w)=>{let k=w.operation.input,S=e.store.getJob(String(k.backupJobId??""));if(!S)throw Error("Backup job was not found.");return e.store.updateJob(S.id,{status:"running",startedAt:S.startedAt??t().toISOString(),progress:{...S.progress,phase:"running"}}),S},f=(w,k)=>{let S=e.store.getJob(w.id)??w;e.store.updateJob(w.id,{status:"failed",finishedAt:t().toISOString(),error:k instanceof Error?k.message:String(k),progress:{...S.progress,phase:"failed"}})};return{"backup.run":async(w)=>{let k=m(w);try{let{policy:S,destination:A,source:x}=a(k),F=await x.create(S,w),U=e.resolveDestination(A),H=F.mode==="object"?await(async()=>{if(!U)throw Error("Backup destination adapter is not configured.");let pe=e.store.getJob(k.id)?.progress,ee=pe?.multipart,ce=ee&&typeof ee==="object"&&!Array.isArray(ee)&&typeof ee.uploadId==="string"&&typeof ee.key==="string"&&Array.isArray(ee.parts)?ee:void 0;return U.upload(A,{key:F.key,body:F.body,contentType:F.contentType,resume:ce,checkpoint:(Ee)=>{w.checkpoint("uploading",`Uploaded ${Number(Ee.bytesUploaded??0)} backup bytes.`),e.store.updateJob(k.id,{progress:{phase:"uploading",multipart:{...Ee}}})}})})():{uri:F.uri,key:F.uri,sizeBytes:F.sizeBytes,checksum:F.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:F.checksum,storageChecksum:F.checksum,contentType:"application/provider-snapshot"}},K=S.retention.expireAfterDays?new Date(t().getTime()+S.retention.expireAfterDays*86400000).toISOString():void 0,X=e.store.getJob(k.id)?.startedAt,oe=e.store.createRecoveryPoint({projectId:S.projectId,policyId:S.id,destinationId:A.id,resourceId:S.resourceId,dataServiceId:S.dataServiceId,backupJobId:k.id,kind:S.resourceKind,pointInTime:t().toISOString(),uri:H.uri,sizeBytes:H.sizeBytes,checksum:H.checksum,manifest:{...F.manifest,...H.manifest,storageKey:H.key},toolVersion:F.toolVersion,engineVersion:F.engineVersion,expiresAt:K,lockedUntil:A.immutability.defaultRetentionDays?new Date(t().getTime()+A.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,t().getTime()-new Date(X??t().toISOString()).getTime())});if(F.mode==="external"&&A.provider==="aws_backup")e.store.recordDestinationTest(A.id,{ok:!0});return e.store.updateJob(k.id,{status:"succeeded",recoveryPointId:oe.id,finishedAt:t().toISOString(),progress:{phase:"stored",recoveryPointId:oe.id}}),r.enqueueVerification(oe),{backupJobId:k.id,recoveryPointId:oe.id}}catch(S){let A=e.store.getJob(k.id),x=A?.progress.multipart,F=(()=>{try{return a(k)}catch{return}})();if(F?.destination.provider==="aws_backup")e.store.recordDestinationTest(F.destination.id,{ok:!1,error:S instanceof Error?S.message:String(S)});let U=!1;if(x&&typeof x==="object"&&!Array.isArray(x)&&F){let H=e.resolveDestination(F.destination);if(U=!0,H?.abortPartial)try{await H.abortPartial(F.destination,x),U=!1,e.store.updateJob(k.id,{progress:{...A.progress,partialCleanup:"aborted"}})}catch{e.store.updateJob(k.id,{progress:{...A.progress,partialCleanup:"required"}})}}if(U)e.store.updateJob(k.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:S instanceof Error?S.message:String(S),progress:{...e.store.getJob(k.id)?.progress??{},phase:"cleanup_required"}});else f(k,S);throw S}},"backup.verify":async(w)=>{let k=m(w);try{let{point:S,destination:A,source:x}=a(k);if(!S)throw Error("Recovery point was not found.");e.store.updateRecoveryPoint(S.id,{verificationState:"verifying"});let F;if(S.uri.startsWith("s3:")){let U=e.resolveDestination(A);if(!U)throw Error("Backup destination adapter is not configured.");let H=await U.download(A,{key:String(S.manifest.storageKey??""),checksum:S.checksum,manifest:S.manifest}),K=x.verify?await x.verify(S,H,w):{};F={bytes:H.length,checksum:S.checksum,...K}}else if(x.verifyExternal)F=await x.verifyExternal(S,w);else throw Error("External recovery point verification is not supported.");return e.store.updateRecoveryPoint(S.id,{verificationState:"verified",verifiedAt:t().toISOString(),manifest:{...S.manifest,verification:F}}),e.store.updateJob(k.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"verified",evidence:F}}),{backupJobId:k.id,recoveryPointId:S.id,evidence:F}}catch(S){if(k.recoveryPointId)e.store.updateRecoveryPoint(k.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(S instanceof Error?S.message:String(S))?"corrupt":"failed"});throw f(k,S),S}},"backup.restore":async(w)=>v(w,!1),"backup.drill":async(w)=>v(w,!0),"backup.cleanup":async(w)=>{let k=m(w);try{let{point:S,destination:A,source:x}=a(k);if(!S)throw Error("Recovery point was not found.");if(!e.store.retentionCandidates(t()).some((F)=>F.id===S.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(e.store.updateRecoveryPoint(S.id,{status:"deleting"}),S.uri.startsWith("s3:")){let F=e.resolveDestination(A);if(!F)throw Error("Destination cleanup is unavailable.");await F.delete(A,String(S.manifest.storageKey??""))}else if(x.deleteExternal)await x.deleteExternal(S,w);else throw Error("External recovery point cleanup is unavailable.");return e.store.updateRecoveryPoint(S.id,{status:"deleted"}),e.store.updateJob(k.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"deleted"}}),{backupJobId:k.id,recoveryPointId:S.id,deleted:!0}}catch(S){throw f(k,S),S}}};async function v(w,k){let S=m(w);try{let{point:A,policy:x,destination:F,source:U}=a(S);if(!A)throw Error("Recovery point was not found.");if(k&&!U.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let H=A.uri.startsWith("s3:")?e.resolveDestination(F):void 0,K=H?await H.download(F,{key:String(A.manifest.storageKey??""),checksum:A.checksum,manifest:A.manifest}):void 0,X=await U.restore(A,K,S.target,w),oe=U.validateHealth?await U.validateHealth({...S.target,...X},w):{healthy:!0,mode:"adapter"},pe=e.validateHealth?await e.validateHealth(x,S.target):{healthy:!0,mode:"not_configured"},ee={...oe,healthy:oe.healthy===!0&&pe.healthy===!0,configured:pe};if(ee.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(k&&U.cleanup)await U.cleanup({...S.target,provider:A.manifest.provider??null},w);return e.store.updateJob(S.id,{status:"succeeded",finishedAt:t().toISOString(),healthResult:ee,progress:{phase:k?"drill_cleaned":"restored",restored:X}}),{backupJobId:S.id,recoveryPointId:A.id,restored:X,health:ee,cleaned:k}}catch(A){let x=(()=>{try{return a(S)}catch{return}})(),F=A instanceof Error?A.message:String(A),U=!1;if(k&&x?.source.cleanup)try{await x.source.cleanup({...S.target,provider:x.point?.manifest.provider??null},w)}catch{U=!0}if(U)e.store.updateJob(S.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:F,progress:{...S.progress,phase:"cleanup_required"}});else f(S,A);throw A}}}import{createHash as QI}from"node:crypto";var YI=(e)=>`sha256:${QI("sha256").update(e).digest("hex")}`;class Ea{dataServices;client;constructor(e,t=new z){this.dataServices=e;this.client=t}service(e){let t=e.dataServiceId?this.dataServices.get(e.dataServiceId):void 0;if(!t||!["aws_rds","aws_aurora"].includes(t.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return t}async waitForSnapshot(e,t,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let a=e==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:t})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:t})).DBSnapshots?.[0];if(!a)throw Error("Provider snapshot was not found.");let m=a,f=String(m.Status??m.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${t} is ${f}.`),f==="available")return m;if(["deleted","deleting","failed"].includes(f))throw Error(`Provider snapshot ${t} failed with state ${f}.`);await Bun.sleep(5000)}}async create(e,t){let r=this.service(e),a=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),m=`${r.placement.slice(0,42).replace(/-+$/,"")}-${a}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,m);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:m});await this.waitForSnapshot(r.provider,m,t);let f=`${r.provider}:${r.placement}:${m}`;return{mode:"external",uri:`aws-backup:${f}`,checksum:YI(f),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:m,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(e,t){let r=String(e.manifest.snapshotId??""),a=String(e.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let m=await this.waitForSnapshot(a,r,t),f=String(m.Status??m.DBSnapshotStatus??"unknown");return{snapshotId:r,status:f,encrypted:m.Encrypted??m.StorageEncrypted??!0}}async restore(e,t,r,a){let m=String(r.targetId??""),f=String(e.manifest.snapshotId??""),v=String(e.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(m))throw Error("Managed restore requires a valid distinct targetId.");if(m===e.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(v==="aws_aurora"){let w=e.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:m,SnapshotIdentifier:f,Engine:w,EngineVersion:e.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${m}-writer-1`,DBClusterIdentifier:m,DBInstanceClass:String(r.plan??e.manifest.plan??"db.serverless"),Engine:w,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:m,DBSnapshotIdentifier:f,DBInstanceClass:String(r.plan??e.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:m,provider:v,status:"creating",isolated:!0}}async validateHealth(e,t){let r=String(e.targetId??""),a=String(e.provider??"");for(;;){t.throwIfCancellationRequested?.(),t.heartbeat?.();let m=a==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!m)throw Error("Restored managed database was not found.");let f=String(m.Status??m.DBInstanceStatus??"unknown");if(t.checkpoint?.("provider_restore",`Restored database ${r} is ${f}.`),f==="available")return{healthy:!0,targetId:r,provider:a,status:f};if(["deleted","deleting","failed","incompatible-restore"].includes(f))throw Error(`Restored managed database ${r} failed with state ${f}.`);await Bun.sleep(5000)}}async cleanup(e,t){let r=String(e.targetId??""),a=String(e.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(a==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(e,t){let r=String(e.manifest.snapshotId??"");if(e.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var Qr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Mr=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function tn(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),a=["server","container"].includes(t),m=["postgres","mysql","mariadb"].includes(e),f=e==="redis",v={};return v.create=t==="external"?Mr("External services can be adopted as read-only inventory."):Qr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),v.observe=t==="external"?Mr("External observation requires a configured provider adapter."):Qr("Provider/runtime health and endpoint metadata are observable."),v.connect=Qr("Connection guidance uses secret references and never returns a password by default."),v.backup=m&&(r||a)?Qr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Mr("This cache path is not a durable backup source."),v.restore=r&&m?Qr("Restore creates a reviewed provider target.","required",!0):Mr("Restore requires a configured provider restore runner."),v.restart=t==="external"?Mr("External restart requires a configured provider adapter."):Qr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),v.resize=t==="aws_elasticache"?Mr("ElastiCache resizing requires a replication-group migration runner."):r?Qr("Provider plan/storage modification may enter a maintenance window.","possible"):a?Qr("Edit host/container resources and reconcile.","required"):Mr("External resize requires a configured provider adapter."),v.version=a?Mr("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?Qr(m?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Mr("External upgrades require a configured provider adapter."),v.rotate=t==="aws_elasticache"||t==="external"||a&&!m&&!f?Mr("Credential rotation is not available for this provider/engine path."):Qr("Rotate through the secret backend, update the engine, then flag dependent releases."),v.expose=a?Mr("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?Qr("Exposure is reconciled through security groups; public access defaults off."):Mr("Exposure changes require a provider-specific network runner."),v.delete=t==="external"?Mr("External deletion requires a configured provider adapter."):Qr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),v.logs=a?Qr("Read bounded service logs from the runtime."):Mr("Provider log export is not configured for this adapter."),v.slow_queries=a&&m?Qr("Read bounded runtime logs after engine slow-query logging is enabled."):Mr("A slow-query log runner is not configured for this provider."),v.users=a&&m?Qr("Logical users can be listed; creation requires a referenced secondary credential."):Mr("User management requires an engine connection runner."),v.databases=a&&m?Qr("Logical databases can be listed, created, and confirmation-gated for deletion."):Mr("Logical database management requires an engine connection runner."),{actions:v,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:f?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var Ls=(e)=>e==null?void 0:String(e),Xc=(e)=>Number(e)===1,Zc=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function Uh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Ls(e.environment_id),resourceId:Ls(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:Ls(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:Xc(e.high_availability),publicExposure:Xc(e.public_exposure),allowedCidrs:Zc(e.allowed_cidrs),desiredState:Zc(e.desired_state),observedState:Zc(e.observed_state),capabilities:Zc(e.capabilities),credentialRef:Ls(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:Xc(e.management_enabled),ownerActorId:Ls(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Xo{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),a=tn(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(a),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?Uh(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Uh)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Data service was not found.");if(a.version!==t)throw Error("Data service changed; refresh before retrying.");let m={...a,...r};if(m.publicExposure&&(!m.allowedCidrs.length||m.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[m.plan,m.storageGb??null,m.engineVersion??null,m.highAvailability?1:0,m.publicExposure?1:0,JSON.stringify(m.allowedCidrs),JSON.stringify(m.desiredState),JSON.stringify(m.observedState),m.status,m.managementEnabled?1:0,m.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:Ls(t.rotated_at)}:void 0}saveCredential(e,t,r){let a=this.credential(e),m=a?.id??crypto.randomUUID(),f=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[m,e,t,r,a?.version??1,a?.createdAt??f,a?f:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:Xc(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function qh(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function Ll(e,t){return t.map((r)=>{let a=r.type==="tunnel"?"127.0.0.1":r.host,m=e.engine==="redis"?`redis-cli -h ${a} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${a} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${a}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${a}:${r.port}`:`mysql --host=${a} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:m,secretRef:e.credentialRef}})}class Vi{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let a=e.username??"app",m=qh();r=`secret://data-services/${e.projectId}/${e.name}/${a}`,await this.secrets.put(r,m),t={username:a,password:m,secretRef:r}}try{let a=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(a.id,t.username,t.secretRef);let m=this.enqueue(a,"create",{});return{service:a,credential:t,operationId:m}}catch(a){if(r)await this.secrets.remove(r);throw a}}plan(e,t,r={}){let a=e.capabilities.actions[t],m=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:a,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||m,compatibilityRequired:m,typedConfirmation:a.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...a.downtime!=="none"?[`Downtime is ${a.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,a){let m=this.plan(e,t,r);if(!m.capability.supported)throw Error(m.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(m.preflight.typedConfirmation&&r.confirm!==m.preflight.typedConfirmation)throw Error(`Type ${m.preflight.typedConfirmation} to confirm ${t}.`);if(m.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(m.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let f=String(r.backupId??""),v=String(r.targetId??"");if(!f||!v)throw Error("Restore requires both backupId and targetId.");if(v===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(v))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:a,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let a=this.store.credential(e.id);if(!a)throw Error("Data service credential metadata was not found.");let m=qh(),f=`${a.secretRef}/v${a.version+1}`;await this.secrets.put(f,m);try{return await t.action(e,"rotate",{username:a.username,secretRef:f},m,r),this.store.saveCredential(e.id,a.username,f),this.store.update(e.id,e.version,{credentialRef:f}),{credential:{username:a.username,password:m,secretRef:f},dependencies:this.store.dependencies(e.id).filter((v)=>v.requiresRedeploy).map((v)=>v.resourceId)}}catch(v){throw await this.secrets.remove(f),v}}}function $l(e){return{"data_service.action":async(t)=>{let r=t.operation.input,a=e.store.get(String(r.serviceId??"")),m=String(r.action??"");if(!a)throw Error("Data service was not found.");let f=e.resolveAdapter(a);if(!f||f.provider!==a.provider||!f.engines.includes(a.engine))throw Error(`No ${a.provider}/${a.engine} adapter is configured.`);if(m==="rotate"){let w=await new Vi(e.store,new c(e.store.controlPlane),e.secrets).rotate(a,f,t);return{serviceId:a.id,action:m,username:w.credential.username,secretRef:w.credential.secretRef,dependencies:w.dependencies}}let v=a.credentialRef?await e.secrets.resolve(a.credentialRef):void 0;try{let w=m==="observe"?await f.observe(a):m==="create"?await f.apply(a,v,t):await f.action(a,m,r,v,t),k=e.store.get(a.id);return e.store.update(a.id,k.version,{observedState:w,status:m==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:a.id,action:m,observed:w}}catch(w){let k=e.store.get(a.id);if(e.store.update(a.id,k.version,{status:"failed",observedState:{...k.observedState,error:w instanceof Error?w.message:String(w)}}),/temporar|timeout|unavailable|throttl/i.test(w instanceof Error?w.message:String(w)))throw new Y(w instanceof Error?w.message:String(w),"provider_transient");throw w}}}}class Fs{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,a,m){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},a,m)}}class Yo extends Fs{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class Zo extends Fs{provider="aws_aurora";engines=["postgres","mysql"]}class ea extends Fs{provider="aws_elasticache";engines=["redis"]}class ta extends Fs{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class ra extends Fs{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var rd=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},fr=(e,t,r)=>{let a=rd(e,t);return a==null?r:String(a)},An=(e,t)=>{let r=rd(e,t);return r==null?void 0:Number(r)},ho=(e,t)=>{let r=rd(e,t);return r==null?void 0:r===!0||r==="true"},zs=(e,t)=>{let r=rd(e,t);return Array.isArray(r)?r.map(String):[]},td=(e,t)=>fr(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function ed(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class na{client;constructor(e=new z){this.client=e}async observe(e){return ed(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),a=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:fr(e,"username","app"),MasterUserPassword:t,DBName:fr(e,"database"),AllocatedStorage:An(e,"storageGb"),VpcSecurityGroupIds:zs(e,"securityGroupIds"),DBSubnetGroupName:fr(e,"subnetGroup"),BackupRetentionPeriod:An(e,"backupRetentionDays")??7,MultiAZ:ho(e,"highAvailability"),EngineVersion:fr(e,"engineVersion"),PubliclyAccessible:ho(e,"publicExposure")??!1,StorageType:fr(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:fr(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return ed(a.DBInstance)}async execute(e,t,r,a,m){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let f=td(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:f}),{status:"snapshotting",snapshotId:f}}if(t==="restore"){let f=String(r.targetId),v=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:f,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:fr(r,"plan"),DBSubnetGroupName:fr(r,"subnetGroup"),MultiAZ:ho(r,"highAvailability"),PubliclyAccessible:!1,StorageType:fr(r,"storageType"),VpcSecurityGroupIds:zs(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...ed(v.DBInstance),sourceId:e,restoreTargetId:f}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let f=td(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:f,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:f}}if(["resize","version","rotate","expose"].includes(t)){let f=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:fr(r,"plan"),AllocatedStorage:An(r,"storageGb"),MasterUserPassword:t==="rotate"?a:void 0,EngineVersion:fr(r,"engineVersion"),MultiAZ:ho(r,"highAvailability"),PubliclyAccessible:ho(r,"publicExposure"),VpcSecurityGroupIds:zs(r,"securityGroupIds"),ApplyImmediately:ho(r,"applyImmediately")??!0});return ed(f.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function Bp(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class ia{client;constructor(e=new z){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return Bp(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),a=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:a,EngineVersion:fr(e,"engineVersion"),MasterUsername:fr(e,"username","app"),MasterUserPassword:t,DatabaseName:fr(e,"database"),DBSubnetGroupName:fr(e,"subnetGroup"),VpcSecurityGroupIds:zs(e,"securityGroupIds"),BackupRetentionPeriod:An(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:fr(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:An(e,"minCapacity")??0.5,MaxCapacity:An(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:a,PubliclyAccessible:ho(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,a){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let m=td(e,r);return await this.client.createDBClusterSnapshot(e,m),{status:"snapshotting",snapshotId:m}}if(t==="restore"){let m=String(r.targetId),f=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",v=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:m,SnapshotIdentifier:String(r.backupId),Engine:f,EngineVersion:fr(r,"engineVersion"),DBSubnetGroupName:fr(r,"subnetGroup"),VpcSecurityGroupIds:zs(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:An(r,"minCapacity")??0.5,MaxCapacity:An(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${m}-writer-1`,DBClusterIdentifier:m,DBInstanceClass:fr(r,"plan","db.serverless"),Engine:f,PubliclyAccessible:!1}),{...Bp(v.DBCluster),sourceId:e,restoreTargetId:m}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let m=td(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,m),{status:"deleting",finalSnapshotId:m}}if(["resize","version","rotate"].includes(t)){let m=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:An(r,"minCapacity")==null&&An(r,"maxCapacity")==null?void 0:{MinCapacity:An(r,"minCapacity")??0.5,MaxCapacity:An(r,"maxCapacity")??4},EngineVersion:fr(r,"engineVersion"),MasterUserPassword:t==="rotate"?a:void 0,ApplyImmediately:ho(r,"applyImmediately")??!0});return Bp(m.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class sa{client;constructor(e=new tt){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:An(e,"nodes")??1,engineVersion:fr(e,"engineVersion"),port:An(e,"port"),securityGroupIds:zs(e,"securityGroupIds"),subnetGroupName:fr(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let a=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,a?.CacheNodes?.map((m)=>m.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as ZI,writeFile as XI}from"node:fs/promises";import{join as eE}from"node:path";async function xn(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),m=new Response(a.stdout).text(),f=new Response(a.stderr).text();if(t!=null)a.stdin.write(t),a.stdin.end();let[v,w,k]=await Promise.all([a.exited,m,f]);if(v!==0&&!r)throw Error(`Docker command failed (${v}): ${k.trim()||w.trim()}`);return{code:v,stdout:w,stderr:k}}class Ml{async ensureNetwork(e){if((await xn(["network","inspect",e],void 0,!0)).code!==0)await xn(["network","create","--internal",e])}async seedSecret(e,t){await xn(["volume","create",e]),await xn(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await xn(["volume","rm",e],void 0,!0)}async inspect(e){let t=await xn(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await xn(["run",...e])}async exec(e,t,r){return(await xn(["exec","-i",e,...t],r)).stdout}async update(e,t){await xn(["update",...t,e])}async restart(e){await xn(["restart",e])}async remove(e){await xn(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await xn(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await xn(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var tE={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function gi(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function gs(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function rE(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function ac(e){return e.Config?.Labels??{}}class Yt{runtime;backupRoot;constructor(e=new Ml,t=d(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=gs(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let a=ac(r),m=await this.runtime.stats(t),f=r.NetworkSettings?.Ports??{},v=Object.values(f).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:a["ts-cloud.engine"]??null,engineVersion:a["ts-cloud.engine-version"]??null,username:a["ts-cloud.username"]??null,database:a["ts-cloud.database"]??null,endpoint:v?.HostIp||"127.0.0.1",port:v?.HostPort?Number(v.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:m}}async apply(e,t){let r=String(e.id),a=gs(r),m=String(e.engine);if(m==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let f=tE[m];if(!f)throw Error(`Unsupported runtime data engine ${m}.`);if(!t)throw Error(`${m} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let v=gi(e.username),w=gi(rE(e,"database")),k=`${a}-secret`,S=`${a}-data`,A=m==="redis"?`appendonly yes
-protected-mode yes
-requirepass ${t.replaceAll("\\","\\\\").replaceAll(`
-`,"")}
-`:t;await this.runtime.ensureNetwork("ts-cloud-data"),await this.runtime.seedSecret(k,A);let x=["-d","--name",a,"--restart","unless-stopped","--network","ts-cloud-data","--label","managed-by=ts-cloud","--label",`ts-cloud.engine=${m}`,"--label",`ts-cloud.engine-version=${e.engineVersion??""}`,"--label",`ts-cloud.username=${v}`,"--label",`ts-cloud.database=${w}`,"-p",`127.0.0.1:${f.port}:${f.port}`,"-v",`${S}:${f.dataPath}`,"-v",`${k}:/run/ts-cloud-secrets:ro`];if(m==="postgres")x.push("-e",`POSTGRES_USER=${v}`,"-e",`POSTGRES_DB=${w}`,"-e","POSTGRES_PASSWORD_FILE=/run/ts-cloud-secrets/credential");if(m==="mysql"||m==="mariadb")x.push("-e",`MYSQL_USER=${v}`,"-e",`MYSQL_DATABASE=${w}`,"-e","MYSQL_PASSWORD_FILE=/run/ts-cloud-secrets/credential","-e","MYSQL_ROOT_PASSWORD_FILE=/run/ts-cloud-secrets/credential");if(m==="mongodb")x.push("-e",`MONGO_INITDB_ROOT_USERNAME=${v}`,"-e","MONGO_INITDB_ROOT_PASSWORD_FILE=/run/ts-cloud-secrets/credential");if(x.push(f.image),m==="redis")x.push("redis-server","/run/ts-cloud-secrets/credential");return await this.runtime.run(x),{providerId:a,status:"starting",engine:m,endpoint:"127.0.0.1",port:f.port,username:v,database:w}}async exportLogicalBackup(e){let t=gs(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let a=ac(r),m=a["ts-cloud.engine"],f=gi(a["ts-cloud.username"]),v=gi(a["ts-cloud.database"]),w;if(m==="postgres")w=await this.runtime.exec(t,["sh","-c",'export PGPASSWORD="$(cat /run/ts-cloud-secrets/credential)"; exec pg_dumpall --clean --if-exists -U "$POSTGRES_USER"']);else if(m==="mysql"||m==="mariadb")w=await this.runtime.exec(t,["sh","-c",'export MYSQL_PWD="$(cat /run/ts-cloud-secrets/credential)"; exec mysqldump -u root --all-databases --single-transaction --add-drop-database --routines --events --triggers']);else throw Error(`${m} does not support engine-native SQL backups.`);return{body:new TextEncoder().encode(w),engine:m,database:v,username:f,engineVersion:a["ts-cloud.engine-version"]||void 0}}async restoreLogicalBackup(e){let t=gs(e.sourceId),r=gs(e.targetId),a=await this.runtime.inspect(t);if(!a)throw Error(`Data container ${t} was not found.`);let m=ac(a),f=m["ts-cloud.engine"],v=gi(m["ts-cloud.username"]),w=gi(m["ts-cloud.database"]);if(!["postgres","mysql","mariadb"].includes(f))throw Error(`${f} does not support engine-native SQL restores.`);if(!e.inPlace){if(e.sourceId===e.targetId)throw Error("An isolated restore requires a distinct target identifier.");if(await this.runtime.inspect(r))throw Error(`Restore target ${r} already exists.`);await this.apply({id:e.targetId,engine:f,engineVersion:m["ts-cloud.engine-version"]??"",username:v,database:w,publicExposure:!1},e.credential)}let k=f==="postgres"?["sh","-c",'export PGPASSWORD="$(cat /run/ts-cloud-secrets/credential)"; exec psql -v ON_ERROR_STOP=1 -U "$POSTGRES_USER" -d postgres']:["sh","-c",'export MYSQL_PWD="$(cat /run/ts-cloud-secrets/credential)"; exec mysql -u root'],S=new TextDecoder("utf-8",{fatal:!0}).decode(e.body),A;for(let x=0;x<30;x++)try{await this.runtime.exec(r,k,S);let F=f==="postgres"?["sh","-c",'export PGPASSWORD="$(cat /run/ts-cloud-secrets/credential)"; exec psql -U "$POSTGRES_USER" -Atc "SELECT 1"']:["sh","-c",'export MYSQL_PWD="$(cat /run/ts-cloud-secrets/credential)"; exec mysql -u root -N -e "SELECT 1"'];if((await this.runtime.exec(r,F)).trim()!=="1")throw Error("Restored database health probe returned an unexpected result.");return{status:"available",providerId:r,engine:f,database:w,username:v,healthy:!0}}catch(F){if(A=F,x<29)await Bun.sleep(1000)}throw A instanceof Error?A:Error("Restored database did not become ready.")}async removeRestoredService(e){let t=gs(e);await this.runtime.remove(t),await this.runtime.removeVolume(`${t}-secret`),await this.runtime.removeVolume(`${t}-data`)}async backup(e,t){let r=await this.exportLogicalBackup(e),{engine:a,database:m,username:f}=r,v=String(t.snapshotId??`${e}-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`);if(!/^[A-Za-z0-9_.-]{2,120}$/.test(v))throw Error("Backup identifier contains unsupported characters.");await ZI(this.backupRoot,{recursive:!0,mode:448});let w=eE(this.backupRoot,`${v}.sql`);return await XI(w,r.body,{mode:384}),{status:"available",backupId:v,path:w,engine:a,database:m,username:f}}async execute(e,t,r,a){let m=gs(e);if(t==="observe")return this.observe(e);if(t==="backup")return this.backup(e,r);if(t==="restart")return await this.runtime.restart(m),{status:"restarting"};if(t==="logs"||t==="slow_queries")return{logs:await this.runtime.logs(m,Number(r.lines)||500)};if(t==="databases"||t==="users"){let f=await this.runtime.inspect(m);if(!f)throw Error(`Data container ${m} was not found.`);let v=ac(f),w=v["ts-cloud.engine"],k=gi(v["ts-cloud.username"]),S=String(r.operation??"list");if(!["postgres","mysql","mariadb"].includes(w))throw Error(`${t} is available only for SQL runtime engines.`);if(t==="users"&&S!=="list")throw Error("Creating users requires a referenced secondary credential.");if(S==="list"){let A=w==="postgres"?["sh","-c",`export PGPASSWORD="$(cat /run/ts-cloud-secrets/credential)"; exec psql -U "$POSTGRES_USER" -Atc '${t==="databases"?"SELECT datname FROM pg_database WHERE datistemplate = false ORDER BY datname":"SELECT usename FROM pg_user ORDER BY usename"}'`]:["sh","-c",`export MYSQL_PWD="$(cat /run/ts-cloud-secrets/credential)"; exec mysql -u root -N -e '${t==="databases"?"SHOW DATABASES":"SELECT User FROM mysql.user ORDER BY User"}'`],x=await this.runtime.exec(m,A);return{[t]:x.split(`
-`).map((F)=>F.trim()).filter(Boolean)}}if(t==="databases"&&["create","delete"].includes(S)){let A=gi(r.database);if(S==="delete"&&r.confirm!==A)throw Error(`Type ${A} to confirm logical database deletion.`);let x=w==="postgres"?`${S==="create"?"CREATE":"DROP"} DATABASE "${A}";
-`:`${S==="create"?"CREATE":"DROP"} DATABASE \`${A}\`;
-`,F=w==="postgres"?["sh","-c",'export PGPASSWORD="$(cat /run/ts-cloud-secrets/credential)"; exec psql -U "$POSTGRES_USER"']:["sh","-c",'export MYSQL_PWD="$(cat /run/ts-cloud-secrets/credential)"; exec mysql -u root'];return await this.runtime.exec(m,F,x),{status:"available",database:A,operation:S}}throw Error(`Unsupported ${t} operation ${S}.`)}if(t==="resize"){let f=[];if(r.memoryMb)f.push("--memory",`${Number(r.memoryMb)}m`);if(r.cpus)f.push("--cpus",String(Number(r.cpus)));if(!f.length)throw Error("Resize requires memoryMb or cpus.");return await this.runtime.update(m,f),{status:"running",memoryMb:r.memoryMb??null,cpus:r.cpus??null}}if(t==="rotate"){if(!a)throw Error("Credential rotation requires a generated secret.");let f=await this.runtime.inspect(m);if(!f)throw Error(`Data container ${m} was not found.`);let v=ac(f),w=v["ts-cloud.engine"],k=gi(v["ts-cloud.username"]),S=a.replaceAll("'","''").replaceAll(`
-`,"");if(w==="postgres")await this.runtime.exec(m,["sh","-c",'export PGPASSWORD="$(cat /run/ts-cloud-secrets/credential)"; exec psql -U "$POSTGRES_USER"'],`ALTER USER "${k}" PASSWORD '${S}';
-`);else if(w==="mysql"||w==="mariadb")await this.runtime.exec(m,["sh","-c",'export MYSQL_PWD="$(cat /run/ts-cloud-secrets/credential)"; exec mysql -u root'],`ALTER USER '${k}'@'%' IDENTIFIED BY '${S}';
-`);else if(w!=="redis")throw Error(`${w} credential rotation requires an engine runner.`);let A=w==="redis"?`appendonly yes
-protected-mode yes
-requirepass ${a.replaceAll("\\","\\\\").replaceAll(`
-`,"")}
-`:a;if(await this.runtime.seedSecret(`${m}-secret`,A),w==="redis")await this.runtime.restart(m);return{status:w==="redis"?"restarting":"running",username:k}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let f=await this.backup(e,r);return await this.runtime.remove(m),await this.runtime.removeVolume(`${m}-secret`),await this.runtime.removeVolume(`${m}-data`),{status:"deleted",finalBackupId:f.backupId??null,backupPath:f.path??null}}if(t==="expose")throw Error("Direct container exposure is refused; use a reviewed firewall and proxy policy.");throw Error(`${t} requires a configured engine lifecycle runner.`)}}import{createCipheriv as nE,createDecipheriv as iE,createHash as Vh,randomBytes as oE}from"node:crypto";class oa{controlPlane;now;key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Data-service encryption key is required.");this.key=Vh("sha256").update(`ts-cloud:data-services:${t}`).digest()}encrypt(e){let t=oE(12),r=nE("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,m]=e.split(".");if(t!=="v1"||!r||!a||!m)throw Error("Encrypted data-service secret is unavailable.");try{let f=iE("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return f.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([f.update(Buffer.from(m,"base64url")),f.final()]).toString("utf8")}catch{throw Error("Encrypted data-service secret could not be decrypted.")}}async put(e,t){if(!/^secret:\/\/data-services\/[A-Za-z0-9._/-]+$/.test(e))throw Error("Invalid data-service secret reference.");if(!t)throw Error("Data-service secret cannot be empty.");let r=this.now().toISOString();this.controlPlane.database.run("INSERT INTO data_service_secrets (reference,ciphertext,fingerprint,created_at,updated_at) VALUES (?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,updated_at=excluded.updated_at",[e,this.encrypt(t),Vh("sha256").update(t).digest("hex"),r,r])}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM data_service_secrets WHERE reference = ?").get(e);if(!t)throw Error("Data-service secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM data_service_secrets WHERE reference = ?",[e])}}import{existsSync as cc}from"node:fs";import{mkdir as id,readdir as sE,rename as Lp,rm as qs}from"node:fs/promises";import{relative as aE,resolve as vn,sep as od}from"node:path";function bt(e,t){if(t==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(e)));return Buffer.from(e)}function Be(e,t){if(t==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(e)));return Buffer.from(e)}async function Fp(e,t){let r=Bun.spawn(["tar",...e],{stdin:t?Buffer.from(t):void 0,stdout:"pipe",stderr:"pipe"}),[a,m,f]=await Promise.all([r.exited,new Response(r.stdout).arrayBuffer(),new Response(r.stderr).text()]);if(a!==0)throw Error(f.trim()||`tar exited with status ${a}.`);return{stdout:Buffer.from(m),stderr:f}}function cE(e){let t=e.replaceAll("\\","/").replace(/^\.\//,"");return!!t&&!t.startsWith("/")&&!t.split("/").includes("..")}class gu{async create(e,t,r){return(await Fp(["-C",e,"-cf","-",...r.map((m)=>`--exclude=${m}`),"--",...t])).stdout}async extract(e,t){await id(t,{recursive:!0,mode:448}),await Fp(["-C",t,"-xf","-"],e)}async inspect(e){let t=await Fp(["-tf","-"],e),r=t.stdout.toString().split(`
-`).filter(Boolean);if(r.some((a)=>!cE(a)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:e.byteLength}}}function Wh(e,t){if(!t.trim())throw Error("File backup paths cannot be empty.");let r=vn(e,t),a=aE(e,r);if(a===".."||a.startsWith(`..${od}`)||a==="")throw Error(`File backup path ${t} is outside the project root.`);return a}function nd(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("File restores require a safe target name.");return t}class ba{runtime;root;restoreRoot;constructor(e,t=new gu,r=d(e,"restores","files")){this.runtime=t;this.root=vn(e),this.restoreRoot=vn(r)}paths(e){let t=[...new Set(e.includePatterns.map((r)=>Wh(this.root,r)))];if(!t.length)throw Error("File backup policies require at least one project-relative path.");for(let r of t)if(!cc(vn(this.root,r)))throw Error(`File backup path ${r} was not found.`);return t.filter((r)=>!t.some((a)=>a!==r&&r.startsWith(`${a}${od}`)))}async create(e,t){let r=this.paths(e),a=await this.runtime.create(this.root,r,e.excludePatterns),m=await this.runtime.inspect(a),f=e.compression??"none",v=bt(a,f),w=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/files/${w}.tar${f==="none"?"":f==="gzip"?".gz":".zst"}`,body:v,contentType:f==="gzip"?"application/gzip":f==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:f,sourcePaths:r,excluded:e.excludePatterns,entries:m.entries.length},toolVersion:"system-tar"}}async restore(e,t,r,a){if(!t)throw Error("File restore requires an archive payload.");let m=Be(t,String(e.manifest.compression??"none"));if(await this.runtime.inspect(m),r.restoreMode==="in_place"){let v=vn(this.restoreRoot,`.staging-${nd(r)}`),w=vn(this.restoreRoot,`.rollback-${nd(r)}`),k=Array.isArray(e.manifest.sourcePaths)?e.manifest.sourcePaths.map(String):[];if(!k.length)throw Error("File recovery point has no source path manifest.");await qs(v,{recursive:!0,force:!0}),await qs(w,{recursive:!0,force:!0}),await this.runtime.extract(m,v),await id(w,{recursive:!0,mode:448});let S=[];try{for(let A of k){let x=vn(this.root,Wh(this.root,A)),F=vn(v,A),U=vn(w,A);if(await id(vn(U,".."),{recursive:!0}),cc(x))await Lp(x,U);await id(vn(x,".."),{recursive:!0}),await Lp(F,x),S.push(A)}}catch(A){for(let x of S.reverse()){let F=vn(this.root,x),U=vn(w,x);if(await qs(F,{recursive:!0,force:!0}),cc(U))await Lp(U,F)}throw A}finally{await qs(v,{recursive:!0,force:!0})}return await qs(w,{recursive:!0,force:!0}),{path:this.root,restoredPaths:k,inPlace:!0}}let f=vn(this.restoreRoot,nd(r));if(cc(f))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(m,f),{path:f,isolated:!0}}async verify(e,t,r){let a=Be(t,String(e.manifest.compression??"none")),m=await this.runtime.inspect(a);return{archive:"tar",entries:m.entries.length,uncompressedBytes:m.bytes}}async validateHealth(e,t){let r=String(e.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${od}`)||!cc(r))throw Error("Isolated file restore target was not found.");let a=await sE(r);return{healthy:!0,path:r,topLevelEntries:a.length}}async cleanup(e,t){let r=nd(e),a=vn(this.restoreRoot,r);if(!a.startsWith(`${this.restoreRoot}${od}`))throw Error("Refusing to clean a file restore outside the restore root.");await qs(a,{recursive:!0,force:!0})}}class va{services;secrets;transport;constructor(e,t,r=new Yt){this.services=e;this.secrets=t;this.transport=r}async create(e,t){if(!e.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(e.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let a=await this.transport.exportLogicalBackup(r.id),m=e.compression??"none",f=bt(a.body,m),v=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/databases/${r.id}/${v}.sql${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/sql",engineVersion:a.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:a.engine,database:a.database,username:a.username,compression:m}}}async restore(e,t,r,a){if(!t)throw Error("Logical database backup body is unavailable.");let m=String(e.dataServiceId??e.manifest.sourceDataServiceId??""),f=String(r.dataServiceId??r.targetId??""),v=r.inPlace===!0;if(!m||!f)throw Error("Logical database restore requires source and target identifiers.");if(v&&f!==m)throw Error("An in-place restore must target the source data service.");let w=this.services.get(m);if(!w?.credentialRef)throw Error("Logical database credential reference was not found.");let k=await this.secrets.resolve(w.credentialRef);return this.transport.restoreLogicalBackup({sourceId:m,targetId:f,body:Be(t,String(e.manifest.compression??"none")),credential:k,inPlace:v})}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(e.dataServiceId??e.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var zp=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function fs(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),m=new Response(a.stdout).arrayBuffer(),f=new Response(a.stderr).text();if(t)a.stdin.write(t),a.stdin.end();let[v,w,k]=await Promise.all([a.exited,m,f]);if(v!==0&&!r)throw Error(`Docker volume command failed (${v}): ${k.trim()}`);return{code:v,stdout:Buffer.from(w),stderr:k}}class mu{async exists(e){return(await fs(["volume","inspect",e],void 0,!0)).code===0}async export(e){return(await fs(["run","--rm","-v",`${e}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(e,t,r=!1){if(!await this.exists(e))await fs(["volume","create",e]);try{if(r)await fs(["run","--rm","-v",`${e}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await fs(["run","--rm","-i","-v",`${e}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],t)}catch(a){throw await this.remove(e),a}}async remove(e){await fs(["volume","rm",e],void 0,!0)}async probe(e){let t=(await fs(["run","--rm","-v",`${e}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,a]=t.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(a))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:a}}}class Ta{runtime;constructor(e=new mu){this.runtime=e}async create(e,t){let r=String(e.includePatterns?.[0]??e.resourceId??"");if(!zp.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let a=await this.runtime.export(r),m=Buffer.from(Bun.gunzipSync(Uint8Array.from(a))),f=e.compression??"gzip",v=f==="gzip"?a:bt(m,f),w=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/volumes/${r}/${w}.tar${f==="none"?"":f==="gzip"?".gz":".zst"}`,body:v,contentType:f==="gzip"?"application/gzip":f==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:f,sourceVolume:r}}}async restore(e,t,r,a){if(!t)throw Error("Volume backup body is unavailable.");let m=String(e.manifest.sourceVolume??e.resourceId??""),f=String(r.volumeName??r.targetId??"");if(!zp.test(f))throw Error("Volume restore requires a valid target volume name.");if(f===m&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let v=await this.runtime.exists(f);if(!r.inPlace&&v)throw Error(`Restore target volume ${f} already exists.`);if(r.inPlace===!0&&f!==m)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!v)throw Error("The in-place target volume was not found.");let w=String(e.manifest.compression??"gzip"),k=w==="gzip"?Buffer.from(t):Buffer.from(Bun.gzipSync(Uint8Array.from(Be(t,w))));await this.runtime.import(f,k,r.inPlace===!0);let S=await this.runtime.probe(f);return{volumeName:f,healthy:!0,...S}}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(e.volumeName??e.targetId??"");if(!zp.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}import{existsSync as Up}from"node:fs";import{mkdir as dE,readFile as Hh,rm as lE,writeFile as Kh}from"node:fs/promises";import{basename as Zh,resolve as yo,sep as Jh}from"node:path";import{Database as uE}from"bun:sqlite";function Gh(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("Control-plane restores require a safe target name.");return t}function Qh(e){let t=JSON.parse(Buffer.from(e).toString());if(t.format!=="ts-cloud-control-plane-v1"||!t.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(t.config)||t.config.some((r)=>Zh(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return t}function Yh(e){let t=uE.deserialize(Uint8Array.from(e));try{let r=t.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",a=t.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:a}}finally{t.close()}}class wa{controlPlane;root;restoreRoot;constructor(e,t,r=d(t,"restores","control-plane")){this.controlPlane=e;this.root=yo(t),this.restoreRoot=yo(r)}async create(e,t){let r=e.includePatterns.length?e.includePatterns:["cloud.config.ts"],a=[];for(let k of r){let S=Zh(k),A=yo(this.root,S);if(S!==k&&k!==`./${S}`)throw Error("Control-plane config paths must be project-root files.");if(Up(A))a.push({name:S,body:(await Hh(A)).toString("base64")})}let m={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:a},f=e.compression??"none",v=bt(Buffer.from(JSON.stringify(m)),f),w=String(t.operation?.id??m.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/control-plane/${w}.json${f==="none"?"":f==="gzip"?".gz":".zst"}`,body:v,contentType:f==="gzip"?"application/gzip":f==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:m.format,configFiles:a.map((k)=>k.name),sensitive:!0,compression:f},toolVersion:"bun-sqlite-serialize"}}async restore(e,t,r,a){if(!t)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let m=Qh(Be(t,String(e.manifest.compression??"none"))),f=yo(this.restoreRoot,Gh(r));if(Up(f))throw Error("The isolated control-plane restore target already exists.");await dE(f,{recursive:!0,mode:448}),await Kh(yo(f,"control-plane.sqlite"),Buffer.from(m.database,"base64"),{mode:384});for(let v of m.config)await Kh(yo(f,v.name),Buffer.from(v.body,"base64"),{mode:384});return{path:f,isolated:!0,configFiles:m.config.length}}async verify(e,t,r){let a=Qh(Be(t,String(e.manifest.compression??"none")));return{...Yh(Buffer.from(a.database,"base64")),configFiles:a.config.length}}async validateHealth(e,t){let r=String(e.path??""),a=yo(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${Jh}`)||!Up(a))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...Yh(await Hh(a))}}async cleanup(e,t){let r=yo(this.restoreRoot,Gh(e));if(!r.startsWith(`${this.restoreRoot}${Jh}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await lE(r,{recursive:!0,force:!0})}}import{createHash as pE}from"node:crypto";function qp(e,t){return e.find((r)=>r.startsWith(`${t}:`))?.slice(t.length+1)}function mE(e){let t=qp(e.includePatterns,"resource")??e.includePatterns.find((m)=>m.startsWith("arn:")),r=qp(e.includePatterns,"role"),a=qp(e.includePatterns,"vault")??"Default";if(!t?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(a))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:t,roleArn:r,vaultName:a}}async function gE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeBackupJob(t),m=String(a.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${t} is ${m||"pending"}.`),m==="COMPLETED"&&a.RecoveryPointArn)return{recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(m))throw Error(`AWS Backup job ${t} failed: ${a.StatusMessage??m}.`);await Bun.sleep(5000)}}async function fE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeRestoreJob(t),m=String(a.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${t} is ${m||"pending"}.`),m==="COMPLETED"&&a.CreatedResourceArn)return a.CreatedResourceArn;if(["ABORTED","FAILED"].includes(m))throw Error(`AWS Backup restore ${t} failed: ${a.StatusMessage??m}.`);await Bun.sleep(5000)}}class Ra{client;constructor(e=new rr){this.client=e}async create(e,t){let r=mE(e),a=String(t.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),m=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:a}),f=await gE(this.client,m.BackupJobId,t),v=`sha256:${pE("sha256").update(f.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:f.recoveryPointArn,checksum:v,sizeBytes:f.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:m.BackupJobId,recoveryPointArn:f.recoveryPointArn}}}async verifyExternal(e,t){let r=String(e.manifest.providerBackupJobId??""),a=await this.client.describeBackupJob(r);if(a.State!=="COMPLETED"||a.RecoveryPointArn!==e.uri)throw Error(`AWS Backup recovery point verification failed: ${a.StatusMessage??a.State??"unknown"}.`);return{state:a.State,recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??e.sizeBytes)}}async restore(e,t,r,a){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let m=String(r.roleArn??e.manifest.roleArn??""),f=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([k,S])=>[k,String(S)])):{};if(!m.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(f).length)throw Error("AWS Backup restore requires provider restore metadata.");let v=await this.client.startRestoreJob({RecoveryPointArn:e.uri,IamRoleArn:m,Metadata:f,IdempotencyToken:String(a.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),w=await fE(this.client,v.RestoreJobId,a);return{providerRestoreJobId:v.RestoreJobId,createdResourceArn:w,isolated:!0,healthy:!0}}async validateHealth(e,t){let r=String(e.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(e,t){await this.client.deleteRecoveryPoint(String(e.manifest.vaultName??""),e.uri)}}import{existsSync as CA}from"node:fs";import{join as Uv}from"node:path";import{pathToFileURL as PA}from"node:url";import{existsSync as Xh,statSync as ey}from"fs";import{resolve as uc}from"path";import hE from"process";import{existsSync as bE,mkdirSync as b$,readdirSync as S$,readFileSync as SE,writeFileSync as w$}from"fs";import{homedir as Vs}from"os";import{dirname as E$,resolve as ri}from"path";import Yd from"process";import{existsSync as ty,statSync as ry}from"fs";import{existsSync as dm,mkdirSync as wE,readdirSync as kE,writeFileSync as IE}from"fs";import{homedir as Ws}from"os";import{dirname as ny,resolve as Sn}from"path";import ys from"process";import{join as EE,relative as RE,resolve as iy}from"path";import Dd from"process";import{existsSync as av,mkdirSync as $$,readdirSync as N$,writeFileSync as j$}from"fs";import{homedir as Vp}from"os";import{dirname as L$,resolve as bn}from"path";import mc from"process";import{join as AE,relative as CE,resolve as oy}from"path";import Od from"process";import{existsSync as cv,mkdirSync as V$,readdirSync as W$,writeFileSync as H$}from"fs";import{dirname as J$,resolve as Bd}from"path";import lm from"process";import{Buffer as vo}from"buffer";import{createCipheriv as PE,createDecipheriv as _E,randomBytes as Wp}from"crypto";import{closeSync as Hp,createReadStream as sy,createWriteStream as TE,existsSync as Kp,fsyncSync as ay,openSync as cy,writeFileSync as xE}from"fs";import{access as DE,constants as dy,mkdir as OE,readdir as sd,rename as ky,stat as Ks,unlink as ad,writeFile as Jp}from"fs/promises";import{join as Js}from"path";import Lr from"process";import{pipeline as $E}from"stream/promises";import{createGzip as Ry}from"zlib";import Qs from"process";import vi from"process";import{Buffer as fi}from"buffer";import{createCipheriv as NE,createDecipheriv as jE,randomBytes as Gp}from"crypto";import{closeSync as Qp,createReadStream as Py,createWriteStream as ME,existsSync as cd,fsyncSync as _y,openSync as xy,writeFileSync as BE}from"fs";import{access as LE,constants as Dy,mkdir as FE,readdir as dd,rename as Oy,stat as Ys,unlink as ld,writeFile as Yp}from"fs/promises";import{isAbsolute as zE,join as Zs,resolve as UE}from"path";import Ft from"process";import{pipeline as qE}from"stream/promises";import{createGzip as $y}from"zlib";import Xs from"process";import Si from"process";import md from"process";import{existsSync as gd}from"fs";import{resolve as Zp}from"path";import{existsSync as VE}from"fs";import{existsSync as WE,readdirSync as HE}from"fs";import{extname as Xp,resolve as Ny}from"path";import KE from"process";import{join as JE,relative as GE,resolve as jy}from"path";import Ld from"process";import{Buffer as hi}from"buffer";import{createCipheriv as QE,createDecipheriv as YE,randomBytes as em}from"crypto";import{closeSync as tm,createReadStream as My,createWriteStream as ZE,existsSync as fd,fsyncSync as By,openSync as Ly,writeFileSync as XE}from"fs";import{access as eR,constants as Fy,mkdir as tR,readdir as hd,rename as zy,stat as xa,unlink as vd,writeFile as rm}from"fs/promises";import{isAbsolute as rR,join as Oa,resolve as nR}from"path";import zt from"process";import{pipeline as iR}from"stream/promises";import{createGzip as Uy}from"zlib";import $a from"process";import wi from"process";import wd from"process";import{existsSync as kd}from"fs";import{resolve as rv}from"path";import{existsSync as EA}from"fs";class nv{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let m=this.generateKey(e,r),f=a??this.options.ttl,v=this.estimateSize(t);this.cache.set(m,{value:t,timestamp:new Date,ttl:f,hits:0,size:v}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Xh(e))return!0;return ey(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let m=Xh(r)?ey(r):null,f=m?m.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,m)=>a+m.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class iv{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),m=new Date;try{let f=await t(),v=performance.now()-a;return this.recordMetric({operation:e,duration:v,timestamp:m,...r}),f}catch(f){let v=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:v,timestamp:m,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((m)=>m.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((m)=>m.duration),a=r.reduce((m,f)=>m+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Pd=new nv,wm=new iv;var ov=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function sv(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let m=r===void 0?[]:Array.isArray(r)?r:[r];for(let f of m){if(!f)continue;if(a.push(f,`.${f}.config`,`${f}.config`,`.${f}`),t)a.push(`${t}.${f}.config`,`.${t}.${f}.config`)}return Array.from(new Set(a.filter(Boolean)))}function yE(e){return sv(e).flatMap((r)=>ov.map((a)=>uc(e.directory,`${r}${a}`)))}function vE(e={}){let t=uc(e.cwd||hE.cwd());return Array.from(new Set([t,uc(t,"config"),uc(t,".config"),e.configDir?uc(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var oR=Object.defineProperty,sR=(e)=>e;function aR(e,t){this[e]=sR.bind(null,t)}var cR=(e,t)=>{for(var r in t)oR(e,r,{get:t[r],enumerable:!0,configurable:!0,set:aR.bind(t,r)})},dR=(e,t)=>()=>(e&&(t=e(e=0)),t),dv={};cR(dv,{withErrorRecovery:()=>pv,tryLoadConfig:()=>DR,loadConfigWithResult:()=>TR,loadConfig:()=>yv,isRetryableError:()=>ER,isConfigNotFoundError:()=>IR,isBunfigError:()=>mv,globalPerformanceMonitor:()=>hc,globalCache:()=>ja,getEnvOrDefault:()=>RR,generateConfigTypes:()=>OR,defaultGeneratedDir:()=>Rv,defaultConfigDir:()=>Ev,deepMergeWithArrayStrategy:()=>Am,deepMerge:()=>gv,createLibraryConfig:()=>$R,config:()=>xR,bunfigPlugin:()=>NR,applyEnvVarsToConfig:()=>pc,TypeGenerationError:()=>ym,SchemaValidationError:()=>fc,PluginError:()=>bm,PerformanceMonitor:()=>Im,FileSystemError:()=>hm,ErrorFactory:()=>bo,EnvVarError:()=>Kd,EnvProcessor:()=>Zd,ConfigValidator:()=>Cm,ConfigValidationError:()=>gm,ConfigNotFoundError:()=>Hd,ConfigMergeError:()=>fm,ConfigLoader:()=>Pm,ConfigLoadError:()=>gc,ConfigFileLoader:()=>Xd,ConfigCache:()=>km,CacheUtils:()=>bv,BunfigError:()=>Dn,BrowserConfigError:()=>vm,ArrayMergeStrategies:()=>kv});class km{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let m=this.generateKey(e,r),f=a??this.options.ttl,v=this.estimateSize(t);this.cache.set(m,{value:t,timestamp:new Date,ttl:f,hits:0,size:v}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!ty(e))return!0;return ry(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let m=ty(r)?ry(r):null,f=m?m.mtime:new Date;this.set(e,{value:t,fileTimestamp:f},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,m)=>a+m.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class Im{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),m=new Date;try{let f=await t(),v=performance.now()-a;return this.recordMetric({operation:e,duration:v,timestamp:m,...r}),f}catch(f){let v=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:v,timestamp:m,...r}),f}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((m)=>m.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((m)=>m.duration),a=r.reduce((m,f)=>m+f,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function lR(e,t={}){let a=Object.keys(t).sort().map((m)=>`${m}:${t[m]}`).join("|");return a?`${e}:${a}`:e}function uR(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function pR(e){return e.getStats().size*2}function Em(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&lr(t[0])&&"id"in t[0]&&t[0].id===3&&lr(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(lr(t)&&lr(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(lr(e)&&"arr"in e&&Array.isArray(e.arr)&&lr(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&lr(t[0])&&lr(e[0])){let a=[...t];for(let m of e)if(lr(m)&&"name"in m){if(!a.find((v)=>lr(v)&&("name"in v)&&v.name===m.name))a.push(m)}else if(lr(m)&&"path"in m){if(!a.find((v)=>lr(v)&&("path"in v)&&v.path===m.path))a.push(m)}else if(!a.some((f)=>Ud(f,m)))a.push(m);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let m of e)if(!a.includes(m))a.push(m);return a}return t}if(!lr(t)||!lr(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let m=t[a];if(m===null||m===void 0)continue;else if(lr(m)&&lr(r[a]))r[a]=Em(r[a],m);else if(Array.isArray(m)&&Array.isArray(r[a]))if(m.length>0&&r[a].length>0&&lr(m[0])&&lr(r[a][0])){let f=[...m];for(let v of r[a])if(lr(v)&&"name"in v){if(!f.find((k)=>lr(k)&&("name"in k)&&k.name===v.name))f.push(v)}else if(lr(v)&&"path"in v){if(!f.find((k)=>lr(k)&&("path"in k)&&k.path===v.path))f.push(v)}else if(!f.some((w)=>Ud(w,v)))f.push(v);r[a]=f}else if(m.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...m];for(let v of r[a])if(!f.includes(v))f.push(v);r[a]=f}else r[a]=m;else r[a]=m}return r}function Ud(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!Ud(e[r],t[r]))return!1;return!0}if(lr(e)&&lr(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let m of r){if(!Object.prototype.hasOwnProperty.call(t,m))return!1;if(!Ud(e[m],t[m]))return!1}return!0}return!1}function lr(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function mR(e,t){if(!cv(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return Em(t,a)}catch{return null}}catch{return null}}async function gR({name:e="",cwd:t,defaultConfig:r}){let a=t||lm.cwd(),m=[".ts",".js",".mjs",".cjs",".json"],f=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let v of f)for(let w of m){let k=Bd(a,`${v}${w}`),S=await mR(k,r);if(S!==null)return S}try{let v=Bd(a,"package.json");if(cv(v)){let k=(await import(v))[e];if(k&&typeof k==="object"&&!Array.isArray(k))try{return Em(r,k)}catch{}}}catch{}return r}function fR(e,t={}){let r=Od.cwd();while(r.includes("storage"))r=oy(r,"..");let a=oy(r,e||"");if(t?.relative)return CE(Od.cwd(),a);return a}async function hR(){try{let e=await gR({name:"clarity",defaultConfig:Ed,cwd:Od.cwd(),endpoint:"",headers:{}});return{...Ed,...e}}catch{return Ed}}function yr(){if(vi.env.NODE_ENV==="test"||vi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function yR(){if(vi.env.NODE_ENV==="test"||vi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof vi<"u"){let e=vi.type;if(e==="renderer"||e==="worker")return!1;return!!(vi.versions&&(vi.versions.node||vi.versions.bun))}return!1}class lv{async format(e){let t=await yR(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Qs.pid,hostname:t(),environment:Qs.env.NODE_ENV||"development",platform:Qs.platform,version:Qs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Qs.env.NODE_ENV||Qs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class qd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...pm},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new lv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Lr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let m=this.generateKeyId(),f=this.generateKey();this.currentKeyId=m,this.keys.set(m,f),this.encryptionKeys.set(m,{key:f,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Rd,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Rd};return{...Rd,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:pm.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let m,f=0,v=3,w=1000;while(f<v)try{try{try{await DE(this.config.logDirectory,dy.F_OK|dy.W_OK)}catch(S){if(S instanceof Error&&"code"in S)if(S.code==="ENOENT")await OE(this.config.logDirectory,{recursive:!0,mode:493});else if(S.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw S;else throw S}}catch(S){throw console.error("Debug: [writeToFile] Failed to create log directory:",S),S}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:vo.from(e);try{if(!Kp(this.currentLogFile))await Jp(this.currentLogFile,"",{mode:420});if(m=cy(this.currentLogFile,"a",420),xE(m,k,{flag:"a"}),ay(m),m!==void 0)Hp(m),m=void 0;if((await Ks(this.currentLogFile)).size===0){if(await Jp(this.currentLogFile,k,{flag:"w",mode:420}),(await Ks(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(S){let A=S;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(f<v-1){let x=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${v}:`,x);let F=w*2**f;await new Promise((U)=>setTimeout(U,F)),f++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(m!==void 0)try{Hp(m)}catch(S){console.error("Debug: [writeToFile] Error closing file descriptor:",S)}}}catch(k){if(f===v-1){let A=k,x=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",x),k}f++;let S=w*2**(f-1);await new Promise((A)=>setTimeout(A,S))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(m){throw console.error("Debug: [writeToFile] Error in operation:",m),m}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Js(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Js(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Js(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(yr())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((m)=>{console.error("Error rotating keys:",m)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let m=Array.from(this.encryptionKeys.entries()).sort(([,w],[,k])=>k.createdAt.getTime()-w.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,v=Math.max(1,f);if(m.length>v)for(let[w]of m.slice(v))this.encryptionKeys.delete(w),this.keys.delete(w)}generateKeyId(){return Wp(16).toString("hex")}generateKey(){return Wp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Wp(16),a=PE("aes-256-gcm",t,r),m=vo.concat([a.update(e,"utf8"),a.final()]),f=a.getAuthTag();return{encrypted:vo.concat([r,m,f]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=Ry(),m=[];a.on("data",(f)=>m.push(f)),a.on("end",()=>t(vo.from(vo.concat(m)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(yr())return;let e=await Ks(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let m=await sd(this.config.logDirectory),f=m.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,S)=>{let A=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),v=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,w=`${r}.${v}`;if(await Ks(r).catch(()=>null))try{if(await ky(r,w),t.compress)try{let k=`${w}.gz`;await this.compressLogFile(w,k),await ad(w)}catch(k){console.error("Error compressing rotated file:",k)}if(f.length===0&&!m.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await Jp(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let m=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${m}.log`);if(await Ks(r).catch(()=>null))await ky(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await sd(this.config.logDirectory)).filter((v)=>v.startsWith(this.name)).sort((v,w)=>w.localeCompare(v));for(let v of f.slice(t.maxFiles))await ad(Js(this.config.logDirectory,v))}}}async compressLogFile(e,t){let r=sy(e),a=TE(t),m=Ry();await $E(r,m,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Kp(this.currentLogFile))try{let e=cy(this.currentLogFile,"r+");ay(e),Hp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!yr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await sd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await ad(Js(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?nr.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:m,level:f,showTimestamp:v=!0}=e,w=(U)=>U.replace(this.ANSI_PATTERN,"");if(!this.fancy){let U=[];if(v)U.push(t);if(f==="warning")U.push("WARN");else if(f==="error")U.push("ERROR");else if(r)U.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)U.push(a.replace(/[[\]]/g,""));return U.push(m),U.join(" ")}let k=Lr.stdout.columns||120,S="";if(f==="warning"||f==="error")S=`${r} ${m}`;else if(f==="info"||f==="success")S=`${r} ${a} ${m}`;else S=`${r} ${a} ${nr.cyan(m)}`;if(!v)return S.trim();let A=w(S).trim().length,x=w(t).length,F=Math.max(1,k-2-A-x);return`${S.trim()}${" ".repeat(F)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,v)=>{let w=Number.parseInt(v,10);return w<t[0].length?String(t[0][w]):f});let r=/%([sdijfo%])/g,a=0,m=e.replace(r,(f,v)=>{if(v==="%")return"%";if(a>=t.length)return f;let w=t[a++];switch(v){case"s":return String(w);case"d":case"i":return Number(w).toString();case"j":case"o":return JSON.stringify(w,null,2);default:return f}});if(a<t.length)m+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return m}async log(e,t,...r){let a=new Date,m=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),v,w;if(t instanceof Error)v=t.message,w=t.stack;else v=this.formatMessage(t,r);if(this.fancy&&!yr()){let S=Sv[e],A=this.options.showTags!==!1&&this.name?nr.gray(this.formatTag(this.name)):"",x;switch(e){case"debug":x=this.formatConsoleMessage({timestamp:m,icon:S,tag:A,message:nr.gray(v),level:e}),console.error(x);break;case"info":x=this.formatConsoleMessage({timestamp:m,icon:S,tag:A,message:v,level:e}),console.error(x);break;case"success":x=this.formatConsoleMessage({timestamp:m,icon:S,tag:A,message:nr.green(v),level:e}),console.error(x);break;case"warning":x=this.formatConsoleMessage({timestamp:m,icon:S,tag:A,message:v,level:e}),console.warn(x);break;case"error":if(x=this.formatConsoleMessage({timestamp:m,icon:S,tag:A,message:v,level:e}),console.error(x),w){let F=w.split(`
-`);for(let U of F)if(U.trim()&&!U.includes(v))console.error(this.formatConsoleMessage({timestamp:m,message:nr.gray(`  ${U}`),level:e,showTimestamp:!1}))}break}}else if(!yr()){if(console.error(`${f} ${this.environment}.${e.toUpperCase()}: ${v}`),w)console.error(w)}if(!this.shouldLog(e))return;let k=`${f} ${this.environment}.${e.toUpperCase()}: ${v}
-`;if(w)k+=`${w}
-`;k=k.replace(this.ANSI_PATTERN,""),await this.writeToFile(k)}time(e){let t=performance.now();if(this.fancy&&!yr()){let r=this.options.showTags!==!1&&this.name?nr.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:nr.blue("◐"),tag:r,message:`${nr.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),m=Math.round(a-t),f=`${e} completed in ${m}ms`,v=new Date,w=this.formatConsoleTimestamp(v),S=`${this.formatFileTimestamp(v)} ${this.environment}.INFO: ${f}`;if(r)S+=` ${JSON.stringify(r)}`;if(S+=`
-`,S=S.replace(this.ANSI_PATTERN,""),this.fancy&&!yr()){let A=this.options.showTags!==!1&&this.name?nr.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:w,icon:nr.green("✓"),tag:A,message:`${f}${r?` ${JSON.stringify(r)}`:""}`}))}else if(!yr())console.error(S.trim());await this.writeToFile(S)}}async debug(e,...t){await this.log("debug",e,...t)}async info(e,...t){await this.log("info",e,...t)}async success(e,...t){await this.log("success",e,...t)}async warn(e,...t){await this.log("warning",e,...t)}async error(e,...t){await this.log("error",e,...t)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let e=this.config.rotation,{encrypt:t}=e;return!!t}async only(e){if(!this.enabled)return;return await e()}isEnabled(){return this.enabled}setEnabled(e){this.enabled=e}extend(e){let t=`${this.name}:${e}`,r=new qd(t,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(r),r}createReadStream(){if(yr())throw Error("createReadStream is not supported in browser environments");if(!Kp(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return sy(this.currentLogFile,{encoding:"utf8"})}async decrypt(e){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let t=this.config.rotation;if(!t.encrypt||typeof t.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let r=this.keys.get(this.currentKeyId);try{let a=vo.isBuffer(e)?e:vo.from(e,"base64"),m=a.slice(0,16),f=a.slice(-16),v=a.slice(16,-16),w=_E("aes-256-gcm",r,m);return w.setAuthTag(f),vo.concat([w.update(v),w.final()]).toString("utf8")}catch(a){throw Error(`Decryption failed: ${a instanceof Error?a.message:String(a)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return yr()}isServerMode(){return!yr()}setTestEncryptionKey(e,t){this.currentKeyId=e,this.keys.set(e,t)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(e){if(!this.enabled)return;let t=new Date,r=this.formatConsoleTimestamp(t),a=this.formatFileTimestamp(t);if(this.fancy&&!yr()){let f=e.split(`
-`),v=Math.max(...f.map((A)=>A.length))+2,w=`┌${"─".repeat(v)}┐`,k=`└${"─".repeat(v)}┘`,S=f.map((A)=>{let x=" ".repeat(v-A.length-2);return`│ ${A}${x} │`});if(this.options.showTags!==!1&&this.name)console.error(this.formatConsoleMessage({timestamp:r,message:nr.gray(this.formatTag(this.name)),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:r,message:nr.cyan(w)})),S.forEach((A)=>console.error(this.formatConsoleMessage({timestamp:r,message:nr.cyan(A),showTimestamp:!1}))),console.error(this.formatConsoleMessage({timestamp:r,message:nr.cyan(k),showTimestamp:!1}))}else if(!yr())console.error(`${a} ${this.environment}.INFO: [BOX] ${e}`);let m=`${a} ${this.environment}.INFO: [BOX] ${e}
-`.replace(this.ANSI_PATTERN,"");await this.writeToFile(m)}async prompt(e){if(yr())return Promise.resolve(!0);return new Promise((t)=>{console.error(`${nr.cyan("?")} ${e} (y/n) `);let r=(a)=>{let m=a.toString().trim().toLowerCase();Lr.stdin.removeListener("data",r);try{if(typeof Lr.stdin.setRawMode==="function")Lr.stdin.setRawMode(!1)}catch{}Lr.stdin.pause(),console.error(""),t(m==="y"||m==="yes")};try{if(typeof Lr.stdin.setRawMode==="function")Lr.stdin.setRawMode(!0)}catch{}Lr.stdin.resume(),Lr.stdin.once("data",r)})}setFancy(e){this.fancy=e}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(e,...t){if(!this.enabled)return;let r=e;if(t&&t.length>0){let v=/%([sdijfo%])/g,w=0;if(r=e.replace(v,(k,S)=>{if(S==="%")return"%";if(w>=t.length)return k;let A=t[w++];switch(S){case"s":return String(A);case"d":case"i":return Number(A).toString();case"j":case"o":return JSON.stringify(A,null,2);default:return k}}),w<t.length)r+=` ${t.slice(w).map((k)=>typeof k==="object"?JSON.stringify(k,null,2):String(k)).join(" ")}`}if(this.fancy&&!yr()){let v=this.options.showTags!==!1&&this.name?nr.gray(this.formatTag(this.name)):"",w=nr.blue("◐");console.error(`${w} ${v} ${nr.cyan(r)}`)}let f=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${r}
-`.replace(this.ANSI_PATTERN,"");await this.writeToFile(f)}progress(e,t=""){if(!this.enabled||!this.fancy||yr()||e<=0)return{update:()=>{},finish:()=>{},interrupt:()=>{}};if(this.activeProgressBar)console.warn("Warning: Another progress bar is already active. Finishing the previous one."),this.finishProgressBar(this.activeProgressBar,"[Auto-finished]");let r=20;return this.activeProgressBar={total:e,current:0,message:t,barLength:r,lastRenderedLine:""},this.renderProgressBar(this.activeProgressBar),{update:(v,w)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||yr())return;if(this.activeProgressBar.current=Math.max(0,Math.min(e,v)),w!==void 0)this.activeProgressBar.message=w;let k=this.activeProgressBar.current===this.activeProgressBar.total;this.renderProgressBar(this.activeProgressBar,k)},finish:(v)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||yr())return;if(this.activeProgressBar.current=this.activeProgressBar.total,v!==void 0)this.activeProgressBar.message=v;this.renderProgressBar(this.activeProgressBar,!0),this.finishProgressBar(this.activeProgressBar)},interrupt:(v,w="info")=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||yr())return;Lr.stdout.write(`${"\r".padEnd(Lr.stdout.columns||80)}\r`),this.log(w,v),setTimeout(()=>{if(this.activeProgressBar)this.renderProgressBar(this.activeProgressBar)},50)}}}renderProgressBar(e,t=!1){if(!this.enabled||!this.fancy||yr()||!Lr.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(e.current/e.total*100))),a=Math.round(e.barLength*r/100),m=e.barLength-a,f=nr.green("━".repeat(a)),v=nr.gray("━".repeat(m)),w=`[${f}${v}]`,k=`${r}%`.padStart(4),S=e.message?` ${e.message}`:"",A=t||r===100?nr.green("✓"):nr.blue("▶"),x=this.options.showTags!==!1&&this.name?` ${nr.gray(this.formatTag(this.name))}`:"",F=`\r${A}${x} ${w} ${k}${S}`,U=Lr.stdout.columns||80,H=" ".repeat(Math.max(0,U-F.replace(this.ANSI_PATTERN,"").length));if(e.lastRenderedLine=`${F}${H}`,Lr.stdout.write(e.lastRenderedLine),t)Lr.stdout.write(`
-`)}finishProgressBar(e,t){if(!this.enabled||!this.fancy||yr()||!Lr.stdout.isTTY){this.activeProgressBar=null;return}if(e.current<e.total)e.current=e.total;if(t)e.message=t;this.renderProgressBar(e,!0),this.activeProgressBar=null}async clear(e={}){if(yr()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let t=await sd(this.config.logDirectory),r=[];for(let a of t){if(!(e.name?new RegExp(e.name.replace("*",".*")).test(a):a.startsWith(this.name))||!a.endsWith(".log"))continue;let f=Js(this.config.logDirectory,a);if(e.before)try{if((await Ks(f)).mtime>=e.before)continue}catch(v){console.error(`Failed to get stats for file ${f}:`,v);continue}r.push(f)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let a of r)try{await ad(a),console.warn(`Deleted log file: ${a}`)}catch(m){console.error(`Failed to delete log file ${a}:`,m)}console.warn("Log clearing process finished.")}catch(t){console.error("Error during log clearing process:",t)}}}function Id(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&qt(t[0])&&"id"in t[0]&&t[0].id===3&&qt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(qt(t)&&qt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(qt(e)&&"arr"in e&&Array.isArray(e.arr)&&qt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&qt(t[0])&&qt(e[0])){let a=[...t];for(let m of e)if(qt(m)&&"name"in m){if(!a.find((v)=>qt(v)&&("name"in v)&&v.name===m.name))a.push(m)}else if(qt(m)&&"path"in m){if(!a.find((v)=>qt(v)&&("path"in v)&&v.path===m.path))a.push(m)}else if(!a.some((f)=>Vd(f,m)))a.push(m);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let m of e)if(!a.includes(m))a.push(m);return a}return t}if(!qt(t)||!qt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let m=t[a];if(m===null||m===void 0)continue;else if(qt(m)&&qt(r[a]))r[a]=Id(r[a],m);else if(Array.isArray(m)&&Array.isArray(r[a]))if(m.length>0&&r[a].length>0&&qt(m[0])&&qt(r[a][0])){let f=[...m];for(let v of r[a])if(qt(v)&&"name"in v){if(!f.find((k)=>qt(k)&&("name"in k)&&k.name===v.name))f.push(v)}else if(qt(v)&&"path"in v){if(!f.find((k)=>qt(k)&&("path"in k)&&k.path===v.path))f.push(v)}else if(!f.some((w)=>Vd(w,v)))f.push(v);r[a]=f}else if(m.every((f)=>typeof f==="string")&&r[a].every((f)=>typeof f==="string")){let f=[...m];for(let v of r[a])if(!f.includes(v))f.push(v);r[a]=f}else r[a]=m;else r[a]=m}return r}function Rm(e,t,r="replace"){if(t===null||t===void 0)return e;if(Array.isArray(t))return r==="replace"?t:Id(e,t);if(Array.isArray(e))return r==="replace"?t:Id(e,t);if(!qt(t)||!qt(e))return t;let a={...e};for(let m of Object.keys(t)){if(!Object.prototype.hasOwnProperty.call(t,m))continue;let f=t[m],v=a[m];if(f===null||f===void 0)continue;if(Array.isArray(f)||Array.isArray(v))if(r==="replace")a[m]=f;else a[m]=Id(v,f);else if(qt(f)&&qt(v))a[m]=Rm(v,f,r);else a[m]=f}return a}function Vd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!Vd(e[r],t[r]))return!1;return!0}if(qt(e)&&qt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let m of r){if(!Object.prototype.hasOwnProperty.call(t,m))return!1;if(!Vd(e[m],t[m]))return!1}return!0}return!1}function qt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function bd(e,t,r="replace"){if(!av(e))return null;try{let a=await import(e),m=a.default||a;if(typeof m!=="object"||m===null||Array.isArray(m))return null;try{return Rm(t,m,r)}catch{return null}}catch{return null}}function vR(e,t,r=!1){if(!e)return t;let a=e.toUpperCase().replace(/-/g,"_"),m={...t};function f(v,w=[]){let k={...v};for(let[S,A]of Object.entries(v)){let x=[...w,S],F=(K)=>K.replace(/([A-Z])/g,"_$1").toUpperCase(),U=`${a}_${x.map(F).join("_")}`,H=`${a}_${x.map((K)=>K.toUpperCase()).join("_")}`;if(r)Ur.info(`Checking environment variable ${U} for config ${e}.${x.join(".")}`);if(typeof A==="object"&&A!==null&&!Array.isArray(A))k[S]=f(A,x);else{let K=mc.env[U]||mc.env[H];if(K!==void 0){if(r)Ur.info(`Using environment variable ${K?U:H} for config ${e}.${x.join(".")}`);if(typeof A==="number")k[S]=Number(K);else if(typeof A==="boolean")k[S]=K.toLowerCase()==="true";else if(Array.isArray(A))try{let X=JSON.parse(K);if(Array.isArray(X))k[S]=X;else k[S]=K.split(",").map((oe)=>oe.trim())}catch{k[S]=K.split(",").map((X)=>X.trim())}else k[S]=K}}}return k}return f(m)}async function bR({name:e="",alias:t,cwd:r,configDir:a,defaultConfig:m,verbose:f=!1,checkEnv:v=!0,arrayStrategy:w="replace"}){let k=v&&typeof m==="object"&&m!==null&&!Array.isArray(m)?vR(e,m,f):m,S=r||mc.cwd(),A=[".ts",".js",".mjs",".cjs",".json"];if(f)Ur.info(`Loading configuration for "${e}"${t?` (alias: "${t}")`:""} from ${S}`);let x=[e,`.${e}`].filter(Boolean),F=[`${e}.config`,`.${e}.config`].filter(Boolean),U=t?[t,`.${t}`]:[],H=t?[`${t}.config`,`.${t}.config`]:[],K=Array.from(new Set([S,bn(S,"config"),bn(S,".config"),a?bn(S,a):void 0].filter(Boolean)));for(let X of K){if(f)Ur.info(`Searching for configuration in: ${X}`);let pe=[bn(S,"config"),bn(S,".config")].concat(a?[bn(S,a)]:[]).includes(X)?[...x,...F,...U,...H]:[...F,...x,...H,...U];for(let ee of pe)for(let ce of A){let Ee=bn(X,`${ee}${ce}`),Re=await bd(Ee,k,w);if(Re!==null){if(f)Ur.success(`Configuration loaded from: ${Ee}`);return Re}}}if(e){let X=bn(Vp(),".config",e),oe=["config",`${e}.config`];if(t)oe.push(`${t}.config`);if(f)Ur.info(`Checking user config directory: ${X}`);for(let pe of oe)for(let ee of A){let ce=bn(X,`${pe}${ee}`),Ee=await bd(ce,k,w);if(Ee!==null){if(f)Ur.success(`Configuration loaded from user config directory: ${ce}`);return Ee}}}if(e){let X=bn(Vp(),".config"),oe=[`.${e}.config`];if(t)oe.push(`.${t}.config`);if(f)Ur.info(`Checking user config directory for dotfile configs: ${X}`);for(let pe of oe)for(let ee of A){let ce=bn(X,`${pe}${ee}`),Ee=await bd(ce,k,w);if(Ee!==null){if(f)Ur.success(`Configuration loaded from user config directory dotfile: ${ce}`);return Ee}}}if(e){let X=Vp(),oe=[`.${e}.config`,`.${e}`];if(t)oe.push(`.${t}.config`),oe.push(`.${t}`);if(f)Ur.info(`Checking user home directory for dotfile configs: ${X}`);for(let pe of oe)for(let ee of A){let ce=bn(X,`${pe}${ee}`),Ee=await bd(ce,k,w);if(Ee!==null){if(f)Ur.success(`Configuration loaded from user home directory: ${ce}`);return Ee}}}try{let X=bn(S,"package.json");if(av(X)){let oe=await import(X),pe=oe[e];if(!pe&&t){if(pe=oe[t],pe&&f)Ur.success(`Using alias "${t}" configuration from package.json`)}if(pe&&typeof pe==="object"&&!Array.isArray(pe))try{if(f)Ur.success(`Configuration loaded from package.json: ${pe===oe[e]?e:t}`);return Rm(k,pe,w)}catch(ee){if(f)Ur.warn("Failed to merge package.json config:",ee)}}}catch(X){if(f)Ur.warn("Failed to load package.json:",X)}if(f)Ur.info(`No configuration found for "${e}"${t?` or alias "${t}"`:""}, using default configuration with environment variables`);return k}function SR(e,t={}){let r=Dd.cwd();while(r.includes("storage"))r=iy(r,"..");let a=iy(r,e||"");if(t?.relative)return RE(Dd.cwd(),a);return a}async function wR(){try{let e=await bR({name:"clarity",alias:"logging",defaultConfig:Ad,cwd:Dd.cwd()});return{...Ad,...e||{}}}catch{return Ad}}function Rr(){if(Si.env.NODE_ENV==="test"||Si.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function kR(){if(Si.env.NODE_ENV==="test"||Si.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof Si<"u"){let e=Si.type;if(e==="renderer"||e==="worker")return!1;return!!(Si.versions&&(Si.versions.node||Si.versions.bun))}return!1}class uv{async format(e){let t=await kR(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Xs.pid,hostname:t(),environment:Xs.env.NODE_ENV||"development",platform:Xs.platform,version:Xs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Xs.env.NODE_ENV||Xs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Wd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...mm},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new uv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Ft.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let m=this.generateKeyId(),f=this.generateKey();this.currentKeyId=m,this.keys.set(m,f),this.encryptionKeys.set(m,{key:f,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...Cd,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...Cd};return{...Cd,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:mm.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!Rr()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let m,f=0,v=3,w=1000;while(f<v)try{try{try{await LE(this.config.logDirectory,Dy.F_OK|Dy.W_OK)}catch(S){if(S instanceof Error&&"code"in S)if(S.code==="ENOENT")await FE(this.config.logDirectory,{recursive:!0,mode:493});else if(S.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw S;else throw S}}catch(S){throw console.error("Debug: [writeToFile] Failed to create log directory:",S),S}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:fi.from(e);try{if(!cd(this.currentLogFile))await Yp(this.currentLogFile,"",{mode:420});if(m=xy(this.currentLogFile,"a",420),BE(m,k,{flag:"a"}),_y(m),m!==void 0)Qp(m),m=void 0;if((await Ys(this.currentLogFile)).size===0){if(await Yp(this.currentLogFile,k,{flag:"w",mode:420}),(await Ys(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(S){let A=S;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(f<v-1){let x=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${v}:`,x);let F=w*2**f;await new Promise((U)=>setTimeout(U,F)),f++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(m!==void 0)try{Qp(m)}catch(S){console.error("Debug: [writeToFile] Error closing file descriptor:",S)}}}catch(k){if(f===v-1){let A=k,x=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",x),k}f++;let S=w*2**(f-1);await new Promise((A)=>setTimeout(A,S))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(m){throw console.error("Debug: [writeToFile] Error in operation:",m),m}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Zs(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Zs(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Zs(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Rr())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((m)=>{console.error("Error rotating keys:",m)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let m=Array.from(this.encryptionKeys.entries()).sort(([,w],[,k])=>k.createdAt.getTime()-w.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,v=Math.max(1,f);if(m.length>v)for(let[w]of m.slice(v))this.encryptionKeys.delete(w),this.keys.delete(w)}generateKeyId(){return Gp(16).toString("hex")}generateKey(){return Gp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Gp(16),a=NE("aes-256-gcm",t,r),m=fi.isBuffer(e)?e:fi.from(e,"utf8"),f=a.update(m),v=a.final(),w=f.length+v.length,k=a.getAuthTag(),S=fi.allocUnsafe(16+w+16);return r.copy(S,0),f.copy(S,16),v.copy(S,16+f.length),k.copy(S,16+w),{encrypted:S,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=$y(),m=[];a.on("data",(f)=>m.push(f)),a.on("end",()=>t(fi.from(fi.concat(m)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Rr())return;if(!this.shouldWriteToFile())return;let e=await Ys(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let m=await dd(this.config.logDirectory),f=m.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,S)=>{let A=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),v=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,w=`${r}.${v}`;if(await Ys(r).catch(()=>null))try{if(await Oy(r,w),t.compress)try{let k=`${w}.gz`;await this.compressLogFile(w,k),await ld(w)}catch(k){console.error("Error compressing rotated file:",k)}if(f.length===0&&!m.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await Yp(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let m=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${m}.log`);if(await Ys(r).catch(()=>null))await Oy(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await dd(this.config.logDirectory)).filter((v)=>v.startsWith(this.name)).sort((v,w)=>w.localeCompare(v));for(let v of f.slice(t.maxFiles))await ld(Zs(this.config.logDirectory,v))}}}async compressLogFile(e,t){let r=Py(e),a=ME(t),m=$y();await qE(r,m,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),cd(this.currentLogFile))try{let e=xy(this.currentLogFile,"r+");_y(e),Qp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Rr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await dd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await ld(Zs(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?Tt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Rr())return!1;let e=typeof Ft.env.NO_COLOR<"u",t=Ft.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof Ft.stderr<"u"&&Ft.stderr.isTTY||typeof Ft.stdout<"u"&&Ft.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:m,level:f,showTimestamp:v=!0}=e,w=(U)=>U.replace(this.ANSI_PATTERN,"");if(!this.fancy){let U=[];if(v)U.push(t);if(f==="warning")U.push("WARN");else if(f==="error")U.push("ERROR");else if(r)U.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)U.push(a.replace(/[[\]]/g,""));return U.push(m),U.join(" ")}let k=Ft.stdout.columns||120,S="";if(f==="warning"||f==="error")S=`${r} ${m}`;else if(f==="info"||f==="success")S=`${r} ${a} ${m}`;else S=`${r} ${a} ${Tt.cyan(m)}`;if(!v)return S.trim();let A=w(S).trim().length,x=w(t).length,F=Math.max(1,k-2-A-x);return`${S.trim()}${" ".repeat(F)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,v)=>{let w=Number.parseInt(v,10);return w<t[0].length?String(t[0][w]):f});let r=/%([sdijfo%])/g,a=0,m=e.replace(r,(f,v)=>{if(v==="%")return"%";if(a>=t.length)return f;let w=t[a++];switch(v){case"s":return String(w);case"d":case"i":return Number(w).toString();case"j":case"o":return JSON.stringify(w,null,2);default:return f}});if(a<t.length)m+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return m}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,m)=>{let f=Tt.underline(Tt.blue(a)),v=this.toAbsoluteFilePath(m);if(v&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let w=`file://${encodeURI(v)}`,k="\x1B]8;;",S="\x1B\\";return`\x1B]8;;${w}\x1B\\${f}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${m}\x1B\\${f}\x1B]8;;\x1B\\`;return f}),t=t.replace(/`([^`]+)`/g,(r,a)=>Tt.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>Tt.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>Tt.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>Tt.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>Tt.strikethrough(a)),t}supportsHyperlinks(){if(Rr())return!1;let e=Ft.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=Ft.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(zE(t)||t.startsWith("./")||t.startsWith("../"))t=UE(t);else return null;return cd(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){let a=new Date,m=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),v,w;if(t instanceof Error)v=t.message,w=t.stack;else v=this.formatMessage(t,r);let{consoleText:k,fileText:S}=this.buildOutputTexts(v);if(this.shouldStyleConsole()){let x=this.options.showIcons===!1?"":wv[e],F=this.options.showTags!==!1&&this.name?Tt.gray(this.formatTag(this.name)):"",U;switch(e){case"debug":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:Tt.gray(k),level:e}),console.error(U);break;case"info":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:k,level:e}),console.warn(U);break;case"success":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:Tt.green(k),level:e}),console.error(U);break;case"warning":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:k,level:e}),console.warn(U);break;case"error":if(U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:k,level:e}),console.error(U),w){let H=w.split(`
-`);for(let K of H)if(K.trim()&&!K.includes(v))console.error(this.formatConsoleMessage({timestamp:m,message:Tt.gray(`  ${K}`),level:e,showTimestamp:!1}))}break}}else if(!Rr()){if(console.error(`${f} ${this.environment}.${e.toUpperCase()}: ${v}`),w)console.error(w)}if(!this.shouldLog(e))return;let A=`${f} ${this.environment}.${e.toUpperCase()}: ${S}
-`;if(w)A+=`${w}
-`;if(A=A.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(A)}progress(e,t=""){let r={update:(w,k)=>{},finish:(w)=>{},interrupt:(w,k)=>{}};if(!this.enabled)return r;let a=30;if(this.activeProgressBar={total:Math.max(1,e||1),current:0,message:t||"",barLength:a,lastRenderedLine:""},this.shouldStyleConsole()&&!Rr()&&Ft.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(w,k)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,w),this.activeProgressBar.total),k!==void 0)this.activeProgressBar.message=k;if(this.shouldStyleConsole()&&!Rr()&&Ft.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(w)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,w)},interrupt:(w,k="info")=>{if(!Rr()&&Ft.stdout.isTTY)Ft.stdout.write(`
-`);if(this[k==="warning"?"warn":k](w),this.activeProgressBar&&this.shouldStyleConsole()&&!Rr()&&Ft.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)}}}time(e){let t=performance.now();if(this.shouldStyleConsole()){let r=this.options.showTags!==!1&&this.name?Tt.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:this.options.showIcons===!1?"":Tt.blue("◐"),tag:r,message:`${Tt.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),m=Math.round(a-t),f=`${e} completed in ${m}ms`,v=new Date,w=this.formatConsoleTimestamp(v),S=`${this.formatFileTimestamp(v)} ${this.environment}.INFO: ${f}`;if(r)S+=` ${JSON.stringify(r)}`;if(S+=`
-`,S=S.replace(this.ANSI_PATTERN,""),this.shouldStyleConsole()){let A=this.options.showTags!==!1&&this.name?Tt.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:w,icon:this.options.showIcons===!1?"":Tt.green("✓"),tag:A,message:`${f}${r?` ${JSON.stringify(r)}`:""}`}))}else if(!Rr())console.error(S.trim());if(this.shouldWriteToFile())await this.writeToFile(S)}}async debug(e,...t){await this.log("debug",e,...t)}async info(e,...t){await this.log("info",e,...t)}async success(e,...t){await this.log("success",e,...t)}async warn(e,...t){await this.log("warning",e,...t)}async error(e,...t){await this.log("error",e,...t)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let e=this.config.rotation,{encrypt:t}=e;return!!t}async only(e){if(!this.enabled)return;return await e()}isEnabled(){return this.enabled}setEnabled(e){this.enabled=e}extend(e){let t=`${this.name}:${e}`,r=new Wd(t,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(r),r}createReadStream(){if(Rr())throw Error("createReadStream is not supported in browser environments");if(!cd(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return Py(this.currentLogFile,{encoding:"utf8"})}async decrypt(e){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let t=this.config.rotation;if(!t.encrypt||typeof t.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let r=this.keys.get(this.currentKeyId);try{let a=fi.isBuffer(e)?e:fi.from(e,"base64"),m=a.subarray(0,16),f=a.subarray(a.length-16),v=a.subarray(16,a.length-16),w=jE("aes-256-gcm",r,m);w.setAuthTag(f);let k=w.update(v),S=w.final(),A=k.length+S.length,x=fi.allocUnsafe(A);return k.copy(x,0),S.copy(x,k.length),x.toString("utf8")}catch(a){throw Error(`Decryption failed: ${a instanceof Error?a.message:String(a)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return Rr()}isServerMode(){return!Rr()}setTestEncryptionKey(e,t){this.currentKeyId=e,this.keys.set(e,t)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(e){if(!this.enabled)return;let t=new Date,r=this.formatConsoleTimestamp(t),a=this.formatFileTimestamp(t),{consoleText:m,fileText:f}=this.buildOutputTexts(e);if(this.shouldStyleConsole()){let w=m.split(`
-`),k=Math.max(...w.map((F)=>F.length))+2,S=`┌${"─".repeat(k)}┐`,A=`└${"─".repeat(k)}┘`,x=w.map((F)=>this.formatConsoleMessage({timestamp:r,message:Tt.cyan(F),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:r,message:Tt.cyan(S),showTimestamp:!1})),x.forEach((F)=>console.error(F)),console.error(this.formatConsoleMessage({timestamp:r,message:Tt.cyan(A),showTimestamp:!1}))}else if(!Rr())console.error(`${a} ${this.environment}.INFO: [BOX] ${f}`);let v=`${a} ${this.environment}.INFO: [BOX] ${f}
-`.replace(this.ANSI_PATTERN,"");if(this.shouldWriteToFile())await this.writeToFile(v)}async prompt(e){if(Rr())return Promise.resolve(!0);return new Promise((t)=>{console.error(`${Tt.cyan("?")} ${e} (y/n) `);let r=(a)=>{let m=a.toString().trim().toLowerCase();Ft.stdin.removeListener("data",r);try{if(typeof Ft.stdin.setRawMode==="function")Ft.stdin.setRawMode(!1)}catch{}Ft.stdin.pause(),console.error(""),t(m==="y"||m==="yes")};try{if(typeof Ft.stdin.setRawMode==="function")Ft.stdin.setRawMode(!0)}catch{}Ft.stdin.resume(),Ft.stdin.once("data",r)})}setFancy(e){this.fancy=e}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(e,...t){if(!this.enabled)return;let r=e;if(t&&t.length>0){let k=/%([sdijfo%])/g,S=0;if(r=e.replace(k,(A,x)=>{if(x==="%")return"%";if(S>=t.length)return A;let F=t[S++];switch(x){case"s":return String(F);case"d":case"i":return Number(F).toString();case"j":case"o":return JSON.stringify(F,null,2);default:return A}}),S<t.length)r+=` ${t.slice(S).map((A)=>typeof A==="object"?JSON.stringify(A,null,2):String(A)).join(" ")}`}let{consoleText:a,fileText:m}=this.buildOutputTexts(r);if(this.shouldStyleConsole()){let k=this.options.showTags!==!1&&this.name?Tt.gray(this.formatTag(this.name)):"",S=this.options.showIcons===!1?"":`${Tt.blue("◐")} `;console.error(`${S}${k} ${Tt.cyan(a)}`)}let w=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${m}
-`.replace(this.ANSI_PATTERN,"");if(this.shouldWriteToFile())await this.writeToFile(w)}renderProgressBar(e,t=!1){if(!this.enabled||!this.shouldStyleConsole()||!Ft.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(e.current/e.total*100))),a=Math.round(e.barLength*r/100),m=e.barLength-a,f=Tt.green("━".repeat(a)),v=Tt.gray("━".repeat(m)),w=`[${f}${v}]`,k=`${r}%`.padStart(4),S=e.message?` ${e.message}`:"",A=this.options.showIcons===!1?"":t||r===100?Tt.green("✓"):Tt.blue("▶"),x=this.options.showTags!==!1&&this.name?` ${Tt.gray(this.formatTag(this.name))}`:"",F=`\r${A}${x} ${w} ${k}${S}`,U=Ft.stdout.columns||80,H=" ".repeat(Math.max(0,U-F.replace(this.ANSI_PATTERN,"").length));if(e.lastRenderedLine=`${F}${H}`,Ft.stdout.write(e.lastRenderedLine),t)Ft.stdout.write(`
-`)}finishProgressBar(e,t){if(!this.enabled||!this.fancy||Rr()||!Ft.stdout.isTTY){this.activeProgressBar=null;return}if(e.current<e.total)e.current=e.total;if(t)e.message=t;this.renderProgressBar(e,!0),this.activeProgressBar=null}async clear(e={}){if(Rr()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let t=await dd(this.config.logDirectory),r=[];for(let a of t){if(!(e.name?new RegExp(e.name.replace("*",".*")).test(a):a.startsWith(this.name))||!a.endsWith(".log"))continue;let f=Zs(this.config.logDirectory,a);if(e.before)try{if((await Ys(f)).mtime>=e.before)continue}catch(v){console.error(`Failed to get stats for file ${f}:`,v);continue}r.push(f)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let a of r)try{await ld(a),console.warn(`Deleted log file: ${a}`)}catch(m){console.error(`Failed to delete log file ${a}:`,m)}console.warn("Log clearing process finished.")}catch(t){console.error("Error during log clearing process:",t)}}}async function pv(e,t={}){let{maxRetries:r=3,retryDelay:a=1000,isRetryable:m=()=>!0,fallback:f}=t,v=Error("Unknown error occurred");for(let w=0;w<=r;w++)try{return await e()}catch(k){if(v=k instanceof Error?k:Error(String(k)),w===r||!m(v))break;if(a>0)await new Promise((S)=>setTimeout(S,a))}if(f!==void 0)return f;throw v instanceof Error?v:Error(`Unknown error: ${String(v)}`)}function mv(e){return e instanceof Dn}function IR(e){return e instanceof Hd}function ER(e){if(mv(e))return e.code==="FILE_SYSTEM_ERROR"||e.code==="BROWSER_CONFIG_ERROR";return["ENOENT","EACCES","EMFILE","ENFILE","EBUSY","network","timeout","connection"].some((r)=>e.message.toLowerCase().includes(r.toLowerCase()))}class Zd{defaultParsers;constructor(){this.defaultParsers=[{name:"boolean",canParse:(e,t)=>t==="boolean"||["true","false","1","0","yes","no"].includes(e.toLowerCase()),parse:(e)=>{let t=e.toLowerCase();return["true","1","yes"].includes(t)}},{name:"number",canParse:(e,t)=>t==="number"||!Number.isNaN(Number(e))&&!Number.isNaN(Number.parseFloat(e)),parse:(e)=>{let t=Number(e);if(Number.isNaN(t))throw TypeError(`Cannot parse "${e}" as number`);return t}},{name:"array",canParse:(e,t)=>t==="array"||e.startsWith("[")||e.includes(","),parse:(e)=>{try{let t=JSON.parse(e);if(Array.isArray(t))return t}catch{}return e.split(",").map((t)=>t.trim())}},{name:"json",canParse:(e,t)=>t==="object"||(e.startsWith("{")&&e.endsWith("}")||e.startsWith("[")&&e.endsWith("]")),parse:(e)=>{try{return JSON.parse(e)}catch(t){throw Error(`Cannot parse "${e}" as JSON: ${t}`)}}}]}async applyEnvironmentVariables(e,t,r={}){let{prefix:a,useCamelCase:m=!0,useBackwardCompatibility:f=!0,customParsers:v={},verbose:w=!1,trackPerformance:k=!0}=r,S=async()=>{if(!e)return{config:t,source:{type:"environment",priority:50,timestamp:new Date}};let A=a||this.generateEnvPrefix(e),x={...t};return this.processObject(x,[],A,{useCamelCase:m,useBackwardCompatibility:f,customParsers:v,verbose:w,configName:e}),{config:x,source:{type:"environment",priority:50,timestamp:new Date}}};if(k)return hc.track("applyEnvironmentVariables",S,{configName:e});return S()}generateEnvPrefix(e){return e.toUpperCase().replace(/-/g,"_")}formatEnvKey(e,t){if(!t)return e.toUpperCase();return e.replace(/([A-Z])/g,"_$1").toUpperCase()}processObject(e,t,r,a){for(let[m,f]of Object.entries(e)){let v=[...t,m],w=v.map((A)=>this.formatEnvKey(A,a.useCamelCase)),k=`${r}_${w.join("_")}`,S=a.useBackwardCompatibility?`${r}_${v.map((A)=>A.toUpperCase()).join("_")}`:null;if(a.verbose);if(typeof f==="object"&&f!==null&&!Array.isArray(f))this.processObject(f,v,r,a);else{let A=md.env[k]||(S?md.env[S]:void 0);if(A!==void 0){if(a.verbose){let x=md.env[k]?k:S}try{e[m]=this.parseEnvironmentValue(A,typeof f,k,a.customParsers,a.configName)}catch(x){if(x instanceof Kd)throw x;throw bo.envVar(k,A,typeof f,a.configName)}}}}}parseEnvironmentValue(e,t,r,a,m){for(let[f,v]of Object.entries(a))try{return v(e)}catch{continue}for(let f of this.defaultParsers)if(f.canParse(e,t))try{return f.parse(e)}catch{throw bo.envVar(r,e,`${t} (via ${f.name} parser)`,m)}return e}getEnvironmentVariables(e){let t={},r=e.toUpperCase();for(let[a,m]of Object.entries(md.env))if(a.startsWith(r)&&m!==void 0)t[a]=m;return t}validateEnvironmentVariable(e,t,r){let a=[];if(!/^[A-Z_][A-Z0-9_]*$/.test(e))a.push(`Environment variable key "${e}" should only contain uppercase letters, numbers, and underscores`);if(r)try{this.parseEnvironmentValue(e,t,r,{})}catch(m){a.push(`Cannot parse value "${t}" as ${r}: ${m}`)}return{isValid:a.length===0,errors:a}}generateEnvVarDocs(e,t,r={}){let{prefix:a,format:m="text"}=r,f=a||this.generateEnvPrefix(e),v=[];switch(this.extractEnvVarInfo(t,[],f,v),m){case"markdown":return this.formatAsMarkdown(v,e);case"json":return JSON.stringify(v,null,2);default:return this.formatAsText(v,e)}}extractEnvVarInfo(e,t,r,a){for(let[m,f]of Object.entries(e)){let v=[...t,m],w=`${r}_${v.map((k)=>this.formatEnvKey(k,!0)).join("_")}`;if(typeof f==="object"&&f!==null&&!Array.isArray(f))this.extractEnvVarInfo(f,v,r,a);else a.push({key:w,type:Array.isArray(f)?"array":typeof f,description:`Configuration for ${v.join(".")}`,example:this.generateExample(f)})}}generateExample(e){if(Array.isArray(e))return JSON.stringify(e);if(typeof e==="object"&&e!==null)return JSON.stringify(e);return String(e)}formatAsText(e,t){let r=`Environment Variables for ${t}:
-
-`;for(let a of e)r+=`${a.key}
-`,r+=`  Type: ${a.type}
-`,r+=`  Description: ${a.description}
-`,r+=`  Example: ${a.example}
-
-`;return r}formatAsMarkdown(e,t){let r=`# Environment Variables for ${t}
-
-`;r+=`| Variable | Type | Description | Example |
-`,r+=`|----------|------|-------------|----------|
-`;for(let a of e)r+=`| \`${a.key}\` | ${a.type} | ${a.description} | \`${a.example}\` |
-`;return r}}function RR(e,t){let r=vv("process");if(typeof r>"u"||!r.env)return t;let a=r.env[e];return a!==void 0?a:t}function gv(e,t,r={}){return fv(e,t,r,new WeakMap)}function fv(e,t,r,a){let{arrayMergeMode:m="replace",skipNullish:f=!1,customMerger:v}=r;if(t===null||t===void 0)return f?e:t;if(v){let w=v(e,t);if(w!==void 0)return w}if(Array.isArray(t)||Array.isArray(e))return hv(e,t,m,a);if(!Mn(t)||!Mn(e))return t;return _R(e,t,r,a)}function hv(e,t,r,a){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return AR(e,t);case"smart":return CR(e,t,a);default:return t}return t}function AR(e,t){let r=[...t];for(let a of e)if(!r.some((m)=>um(m,a)))r.push(a);return r}function CR(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(Mn(t[0])&&Mn(e[0]))return PR(e,t,r);if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let m of e)if(!a.includes(m))a.push(m);return a}return t}function PR(e,t,r){let a=[...t];for(let m of e){if(!Mn(m)){a.push(m);continue}let f=["id","name","key","path","type"],v=!1;for(let w of f)if(w in m){if(a.find((S)=>Mn(S)&&(w in S)&&S[w]===m[w])){v=!0;break}}if(!v)a.push(m)}return a}function _R(e,t,r,a){let m=t;if(Mn(m)&&a.has(m))return a.get(m);let f={...e};if(Mn(m))a.set(m,f);for(let v in m){if(!Object.prototype.hasOwnProperty.call(m,v))continue;let w=m[v],k=f[v];if(r.skipNullish&&(w===null||w===void 0))continue;if(w===null||w===void 0){f[v]=w;continue}if(Mn(w)&&Mn(k))f[v]=fv(k,w,r,a);else if(Array.isArray(w)||Array.isArray(k))f[v]=hv(k,w,r.arrayMergeMode||"smart",a);else f[v]=w}return f}function Am(e,t,r="replace"){return gv(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function um(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!um(e[r],t[r]))return!1;return!0}if(Mn(e)&&Mn(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let m of r){if(!Object.prototype.hasOwnProperty.call(t,m))return!1;if(!um(e[m],t[m]))return!1}return!0}return!1}function Mn(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class Xd{extensions=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];async loadFromPath(e,t,r={}){let{arrayStrategy:a="replace",useCache:m=!0,cacheTtl:f,trackPerformance:v=!0,verbose:w=!1}=r;if(m){let S=ja.getWithFileCheck("file",e);if(S){if(w)console.log(`Configuration loaded from cache: ${e}`);return S}}let k=async()=>{if(!gd(e))return null;try{let S=`?t=${Date.now()}`,A=await import(e+S),x=A.default||A,F="default"in A,U=Object.keys(A).length>0;if(!F&&!U)throw new gc(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof x!=="object"||x===null||Array.isArray(x))throw new gc(e,Error("Configuration must export a valid object"),"unknown");let X={config:Am(t,x,a),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(m)ja.setWithFileCheck("file",X,e,f);return X}catch(S){throw S instanceof Error?bo.configLoad(e,S):bo.configLoad(e,Error(String(S)))}};if(v)return hc.track("loadFromPath",k,{path:e});return k()}async tryLoadFromPaths(e,t,r={}){for(let a of e)try{let m=await this.loadFromPath(a,t,r);if(m)return m}catch(m){if(m instanceof Error&&m.name==="ConfigLoadError")throw m;if(r.verbose)console.warn(`Failed to load config from ${a}:`,m)}return null}generateConfigPaths(e,t,r){let a=this.generateNamePatterns(e,r),m=[];for(let f of a)for(let v of this.extensions)m.push(Zp(t,`${f}${v}`));return m}generateNamePatterns(e,t){let r=[];if(r.push("config",".config"),e)r.push(e,`.${e}.config`,`${e}.config`,`.${e}`);if(t){if(r.push(t,`.${t}.config`,`${t}.config`,`.${t}`),e)r.push(`${e}.${t}.config`,`.${e}.${t}.config`)}return r.filter(Boolean)}checkFileAccess(e){return pv(async()=>gd(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let a=[];if(!gd(e))return a;if(t||r){let m=this.generateNamePatterns(t||"",r);for(let f of m)for(let v of this.extensions){let w=Zp(e,`${f}${v}`);if(await this.checkFileAccess(w))a.push(w)}}else try{let{readdirSync:m}=await import("fs"),f=m(e);for(let v of f)if(this.looksLikeConfigFile(v)){let w=Zp(e,v);if(await this.checkFileAccess(w))a.push(w)}}catch{return[]}return a}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!gd(e))return t.push("Configuration file does not exist"),t;let r=await import(e),a=r.default||r;if(a===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof a!=="object"||a===null)t.push("Configuration must be an object");else if(Array.isArray(a))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:m}=await import("fs"),f=m(e,"utf8");JSON.parse(f)}catch(m){t.push(`Invalid JSON syntax: ${m}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(a)=>{try{let m=await this.loadFromPath(a,{},t);if(m)r.set(a,m.config)}catch(m){if(t.verbose)console.warn(`Failed to preload ${a}:`,m)}})),r}}class Cm{async validateConfiguration(e,t,r={}){let{stopOnFirstError:a=!1,validateRequired:m=!0,validateTypes:f=!0,customRules:v=[],trackPerformance:w=!0,verbose:k=!1}=r,S=async()=>{let A=[],x=[],F={stopOnFirstError:a,validateRequired:m,validateTypes:f,customRules:v,trackPerformance:w,verbose:k};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,F);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...v],F);else return this.validateWithJSONSchema(e,t,F)}catch(U){return A.push({path:"",message:`Validation failed: ${U}`,rule:"system"}),{isValid:!1,errors:A,warnings:x}}};if(w)return await hc.track("validateConfiguration",S);return S()}async validateWithSchemaFile(e,t,r){try{if(!VE(t))throw new fc(t,[{path:"",message:"Schema file does not exist"}]);let a=await import(t),m=a.default||a;if(Array.isArray(m))return this.validateWithRules(e,m,r);else return this.validateWithJSONSchema(e,m,r)}catch(a){throw new fc(t,[{path:"",message:`Failed to load schema: ${a}`}])}}validateWithJSONSchema(e,t,r){let a=[],m=[];return this.validateObjectAgainstSchema(e,t,"",a,m,r),{isValid:a.length===0,errors:a,warnings:m}}validateObjectAgainstSchema(e,t,r,a,m,f){if(f.validateTypes&&t.type){let v=Array.isArray(e)?"array":typeof e,w=Array.isArray(t.type)?t.type:[t.type];if(!w.includes(v)){if(a.push({path:r,message:`Expected type ${w.join(" or ")}, got ${v}`,expected:w.join(" or "),actual:v,rule:"type"}),f.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(a.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),f.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)a.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)a.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))a.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)a.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)a.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let v=0;v<e.length;v++){let w=r?`${r}[${v}]`:`[${v}]`;if(this.validateObjectAgainstSchema(e[v],t.items,w,a,m,f),f.stopOnFirstError&&a.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let v=e;if(f.validateRequired&&t.required){for(let w of t.required)if(!(w in v)){if(a.push({path:r?`${r}.${w}`:w,message:`Missing required property '${w}'`,expected:"required",rule:"required"}),f.stopOnFirstError)return}}if(t.properties){for(let[w,k]of Object.entries(t.properties))if(w in v){let S=r?`${r}.${w}`:w;if(this.validateObjectAgainstSchema(v[w],k,S,a,m,f),f.stopOnFirstError&&a.length>0)return}}if(t.additionalProperties===!1){let w=new Set(Object.keys(t.properties||{}));for(let k of Object.keys(v))if(!w.has(k))m.push({path:r?`${r}.${k}`:k,message:`Additional property '${k}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let a=[],m=[];for(let f of t)try{let v=this.getValueByPath(e,f.path),w=this.validateWithRule(v,f,f.path);if(a.push(...w),r.stopOnFirstError&&a.length>0)break}catch(v){a.push({path:f.path,message:`Rule validation failed: ${v}`,rule:"system"})}return{isValid:a.length===0,errors:a,warnings:m}}validateWithRule(e,t,r){let a=[];if(t.required&&(e===void 0||e===null))return a.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),a;if(e===void 0||e===null)return a;if(t.type){let m=Array.isArray(e)?"array":typeof e;if(m!==t.type)a.push({path:r,message:t.message||`Expected type ${t.type}, got ${m}`,expected:t.type,actual:m,rule:"type"})}if(t.min!==void 0){let m=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(m<t.min)a.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:m,rule:"min"})}if(t.max!==void 0){let m=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(m>t.max)a.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:m,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))a.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))a.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let m=t.validator(e);if(m)a.push({path:r,message:t.message||m,rule:"custom"})}return a}getValueByPath(e,t){if(!t)return e;let r=t.split("."),a=e;for(let m of r)if(a&&typeof a==="object"&&m in a)a=a[m];else return;return a}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let a of r){let[,m,f,v]=a;t.push({path:m,required:!f,type:this.mapTypeScriptType(v)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:Iv},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}class Pm{fileLoader=new Xd;envProcessor=new Zd;validator=new Cm;async loadConfig(e){let t=Date.now(),{cache:r,performance:a,schema:m,validate:f,...v}=e;try{if(r?.enabled){let k=this.checkCache(v.name||"",v);if(k)return k}let w;try{w=await this.loadConfigurationStrategies(v,!0,r)}catch(k){let S=v.__strictErrorHandling;if(k instanceof Error&&k.name==="ConfigNotFoundError"){if(S)throw k;w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:[`No configuration file found for "${v.name||"config"}", using defaults with environment variables`]}}else if(k instanceof Error&&k.name==="ConfigLoadError"){let A=k.message.includes("EACCES")||k.message.includes("EPERM")||k.message.includes("permission denied"),x=!A&&(k.message.includes("syntax")||k.message.includes("Expected")||k.message.includes("Unexpected")||k.message.includes("BuildMessage")||k.message.includes("errors building")),F=k.message.includes("Configuration must export a valid object")||k.message.includes("Configuration file is empty and exports nothing");if(S&&(F||A))throw k;if(x&&(!S||!F))w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!S)w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:[`Configuration loading error, using defaults: ${k.message}`]};else throw k}else w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${k instanceof Error?k.message:String(k)}`]}}if(m||f)await this.validateConfiguration(w.config,m,f,v.name);if(r?.enabled&&w)this.cacheResult(v.name||"",w,r,v);if(a?.enabled){let k={operation:"loadConfig",duration:Date.now()-t,configName:v.name,timestamp:new Date};if(a.onMetrics)a.onMetrics(k);if(a.slowThreshold&&k.duration>a.slowThreshold)Kn.warn(`Slow configuration loading detected: ${k.duration}ms for ${v.name}`);w.metrics=k}return w}catch(w){let k=Date.now()-t;throw Kn.error(`Configuration loading failed after ${k}ms:`,[w instanceof Error?w:Error(String(w))]),w}}async loadConfigurationStrategies(e,t=!1,r){let{name:a="",alias:m,cwd:f,configDir:v,defaultConfig:w,checkEnv:k=!0,arrayStrategy:S="replace",verbose:A=!1}=e,x=f||ys.cwd(),F=[],U=await this.loadLocalConfiguration(a,m,x,v,w,S,A,k,r);if(U)return F.push(...this.getLocalSearchPaths(a,m,x,v)),this.finalizeResult(U,F,k,a,A);let H=await this.loadHomeConfiguration(a,m,w,S,A,k);if(H)return F.push(...this.getHomeSearchPaths(a,m)),this.finalizeResult(H,F,k,a,A);let K=await this.loadPackageJsonConfiguration(a,m,x,w,S,A,k);if(K)return F.push(Sn(x,"package.json")),this.finalizeResult(K,F,k,a,A);if(F.push(...this.getAllSearchPaths(a,m,x,v)),t)throw bo.configNotFound(a,F,m);return{...await this.applyEnvironmentVariables(a,w,k,A),warnings:[`No configuration file found for "${a}"${m?` or alias "${m}"`:""}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,a,m,f,v,w,k){let S=w?pc(e,m,v):m,A=this.getLocalDirectories(r,a);for(let x of A){if(v)Kn.info(`Searching for configuration in: ${x}`);let F=this.fileLoader.generateConfigPaths(e,x,t),U=await this.fileLoader.tryLoadFromPaths(F,S,{arrayStrategy:f,verbose:v,cacheTtl:k?.ttl,useCache:!k?.ttl||k.ttl>100});if(U){if(v)Kn.success(`Configuration loaded from: ${U.source.path}`);return U}}return null}async loadHomeConfiguration(e,t,r,a,m,f){if(!e)return null;let v=f?pc(e,r,m):r,w=[Sn(Ws(),".config",e),Sn(Ws(),".config"),Ws()];for(let k of w){if(m)Kn.info(`Checking home directory: ${k}`);let S=this.fileLoader.generateConfigPaths(e,k,t),A=await this.fileLoader.tryLoadFromPaths(S,v,{arrayStrategy:a,verbose:m});if(A){if(m)Kn.success(`Configuration loaded from home directory: ${A.source.path}`);return A}}return null}async loadPackageJsonConfiguration(e,t,r,a,m,f,v){let w=v?pc(e,a,f):a;try{let k=Sn(r,"package.json");if(!dm(k))return null;let S=await import(k),A=S[e],x=e;if(!A&&t)A=S[t],x=t;if(A&&typeof A==="object"&&!Array.isArray(A)){if(f)Kn.success(`Configuration loaded from package.json: ${x}`);return{config:Am(w,A,m),source:{type:"package.json",path:k,priority:30,timestamp:new Date}}}}catch(k){if(f)Kn.warn("Failed to load package.json:",[k instanceof Error?k:Error(String(k))])}return null}async applyEnvironmentVariables(e,t,r,a){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:pc(e,t,a),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,a,m){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,a){let m=[];if(r){let f=r(e);if(f)m.push(...f)}if(t){let f=await this.validator.validateConfiguration(e,t);if(!f.isValid)m.push(...f.errors.map((v)=>v.path?`${v.path}: ${v.message}`:v.message))}if(m.length>0)throw bo.configValidation(a||"unknown",m,a)}checkCache(e,t){let r=this.generateCacheKey(e,t);return ja.get(r)||null}cacheResult(e,t,r,a){let m=this.generateCacheKey(e,a);ja.set(m,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias)r.push(`alias:${t.alias}`);if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return Array.from(new Set([e,Sn(e,"config"),Sn(e,".config"),t?Sn(e,t):void 0].filter(Boolean)))}getAllSearchPaths(e,t,r,a){let m=[];return m.push(...this.getLocalSearchPaths(e,t,r,a)),m.push(...this.getHomeSearchPaths(e,t)),m.push(Sn(r,"package.json")),m}getLocalSearchPaths(e,t,r,a){let m=this.getLocalDirectories(r,a),f=[];for(let v of m)f.push(...this.fileLoader.generateConfigPaths(e,v,t));return f}getHomeSearchPaths(e,t){if(!e)return[];let r=[Sn(Ws(),".config",e),Sn(Ws(),".config"),Ws()],a=[];for(let m of r)a.push(...this.fileLoader.generateConfigPaths(e,m,t));return a}async loadConfigWithResult(e){return this.loadConfig(e)}}function qy(e){let r=!(e.message.includes("EACCES")||e.message.includes("EPERM")||e.message.includes("permission denied"))&&(e.message.includes("syntax")||e.message.includes("Expected")||e.message.includes("Unexpected")||e.message.includes("BuildMessage")),a=e.message.includes("Configuration must export a valid object")||e.message.includes("Configuration file is empty and exports nothing");return r||a}async function TR(e){return ki.loadConfig({...e,__strictErrorHandling:!0})}async function yv(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let a;if(r)a=await ki.loadConfig(e);else a=await ki.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return a?.config??t}catch(a){let m=a instanceof Error?a.name:"UnknownError",f=a instanceof Error?a.message:String(a);if(!(m==="ConfigNotFoundError"||m==="ConfigLoadError"||m==="ConfigValidationError"||f.includes("config"))&&e.verbose)Kn.warn("Unexpected error loading config, using defaults:",[a instanceof Error?a:Error(String(a))]);let w=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await ki.applyEnvironmentVariables(w.name||"",t,!0,w.verbose||!1))?.config??t;return t}}async function xR(e={defaultConfig:{}}){if(typeof e==="string"){let{cwd:t}=await import("process");try{return(await ki.loadConfig({name:e,cwd:t(),generatedDir:"./generated",configDir:"./config",defaultConfig:{},checkEnv:!0,arrayStrategy:"replace"})).config}catch(r){if(r instanceof Error&&(r.name==="ConfigNotFoundError"||r.name==="ConfigLoadError"&&qy(r)))return(await ki.applyEnvironmentVariables(e,{},!0,!1)).config;throw r}}try{return(await ki.loadConfig({...e,cwd:e.cwd||ys.cwd(),cache:{enabled:!0},performance:{enabled:!1}})).config}catch(t){if(t instanceof Error&&(t.name==="ConfigNotFoundError"||t.name==="ConfigLoadError"&&qy(t)))return(await ki.applyEnvironmentVariables(e.name||"",e.defaultConfig||{},e.checkEnv!==!1,e.verbose||!1)).config;throw t}}async function DR(e,t,r="replace"){let a=new Xd;try{let m=await a.loadFromPath(e,t,{arrayStrategy:r,useCache:!1,trackPerformance:!1});return m?m.config:null}catch{return null}}function pc(e,t,r=!1){let a=new Zd,m=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function f(v,w=[]){let k={...v};for(let[S,A]of Object.entries(v)){let x=[...w,S],F=[`${m}_${x.join("_").toUpperCase()}`,`${m}_${x.map((K)=>K.toUpperCase()).join("")}`,`${m}_${x.map((K)=>K.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],U,H;for(let K of F)if(U=ys.env[K],U!==void 0){H=K;break}if(U!==void 0&&H)if(typeof A==="boolean")k[S]=["true","1","yes"].includes(U.toLowerCase());else if(typeof A==="number"){let K=Number(U);if(!Number.isNaN(K))k[S]=K}else if(Array.isArray(A))try{k[S]=JSON.parse(U)}catch{k[S]=U.split(",").map((K)=>K.trim())}else k[S]=U;else if(A&&typeof A==="object"&&!Array.isArray(A))k[S]=f(A,x)}return k}return f(t)}function OR(e){let t=Sn(ys.cwd(),e.configDir),r=Sn(ys.cwd(),e.generatedDir),a=Sn(r,"config-types.ts");if(!dm(ny(a)))wE(ny(a),{recursive:!0,mode:511});let m=dm(t)?kE(t).map((v)=>v.replace(/\.(ts|js|mjs|cjs|mts|cts|json)$/,"")).sort():[],f=`// Generated by bunfig v${cA}
-export type ConfigNames = ${m.length?`'${m.join("' | '")}'`:"string"}
-`;IE(a,f,{mode:438})}function $R(e){let t=null,r=null,a=()=>{if(!r)r=yv(e).then((f)=>(t=f,f),(f)=>{let v="defaultConfig"in e?e.defaultConfig:{};if(t=v,"verbose"in e&&e.verbose)Kn.warn("Config loading failed, using defaults:",[f instanceof Error?f:Error(String(f))]);return v});return r},m="defaultConfig"in e?e.defaultConfig:{};return t=m,a(),new Proxy({},{get(f,v){if(t)return t[v];let w=m[v];return a(),w},has(f,v){return v in(t||m)},ownKeys(){return Object.keys(t||m)},getOwnPropertyDescriptor(f,v){return Object.getOwnPropertyDescriptor(t||m,v)},set(f,v,w){if(!t)t={...m};return t[v]=w,!0}})}function NR(e){let t=Ny(KE.cwd(),e?.configDir||"./config");function r(){if(!WE(t))return[];let m=new Set([".ts",".js",".mjs",".cjs",".mts",".cts",".json"]),f=[".ts",".mts",".cts",".js",".mjs",".cjs",".json"],v=HE(t).filter((k)=>m.has(Xp(k))).map((k)=>({base:k.replace(/\.(?:ts|js|mjs|cjs|mts|cts|json)$/i,""),file:k})),w=new Map;for(let{base:k,file:S}of v){let A=Xp(S).toLowerCase(),x=w.get(k);if(!x){w.set(k,S);continue}let F=Xp(x).toLowerCase();if(f.indexOf(A)<f.indexOf(F))w.set(k,S)}return Array.from(w.entries()).map(([k,S])=>({base:k,file:S})).sort((k,S)=>k.base.localeCompare(S.base))}function a(){let m=r(),f=m.map((S)=>S.base),v=f.length?f.map((S)=>`'${S}'`).join(" | "):"string",w=m.length?`{
-${m.map((S)=>{let A=Ny(t,S.file).replace(/\\/g,"/");return`  '${S.base}': typeof import('${A}').default`}).join(`,
-`)}
-}`:"Record<string, any>";return`export type ConfigNames = ${v}
-export type ConfigByName = ${w}
-export type Config<N extends ConfigNames> = N extends keyof ConfigByName ? ConfigByName[N] : unknown
-export type ConfigOf = Config
-`}return{name:"bunfig-plugin",setup(m){m.onResolve({filter:/^virtual:bunfig-types$/},(f)=>({path:f.path,namespace:"bunfig-virtual"})),m.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>({contents:a(),loader:"ts"}))}}}var vv,ja,hc,bv,jR,MR,Vy,Ed,pm,Fr,nr,BR,Wy,LR,Hy,FR,zR,nm,UR,Ky,Jy,im,qR,VR,WR,HR,Rd,Sv,KR,Ur,JR,GR,Gy,Ad,mm,Ar,Tt,QR,Qy,YR,Yy,ZR,XR,om,eA,Zy,Xy,tA,sm,rA,nA,iA,oA,sA,Cd,wv,aA,cA="0.15.6",Dn,Hd,gc,gm,fm,Kd,hm,ym,fc,vm,bm,bo,kv,Iv,Kn,ki,Ev,Rv,dA=dR(async()=>{vv=import.meta.require,ja=new km,hc=new Im,bv={createKey:lR,isEquivalent:uR,estimateMemoryUsage:pR},jR=Bd(lm.cwd(),"config"),MR=Bd(lm.cwd(),"src/generated"),Vy=Od.env.CLARITY_LOG_DIR||AE(fR(),"logs"),Ed={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Vy,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},pm=await hR(),Fr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,reset:"\x1B[0m"},nr=Fr,BR=Fr.red,Wy=Fr.green,LR=Fr.yellow,Hy=Fr.blue,FR=Fr.magenta,zR=Fr.cyan,nm=Fr.white,UR=Fr.gray,Ky=Fr.bgRed,Jy=Fr.bgYellow,im=Fr.bold,qR=Fr.dim,VR=Fr.italic,WR=Fr.underline,HR=Fr.reset,Rd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},Sv={debug:"\uD83D\uDD0D",info:Hy("ℹ"),success:Wy("✓"),warning:Jy(nm(im(" WARN "))),error:Ky(nm(im(" ERROR ")))},KR=new qd("stacks"),Ur=new qd("bunfig",{showTags:!0}),JR=bn(mc.cwd(),"config"),GR=bn(mc.cwd(),"src/generated"),Gy=Dd.env.CLARITY_LOG_DIR||EE(SR(),"logs"),Ad={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Gy,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},mm=await wR(),Ar={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},Tt=Ar,QR=Ar.red,Qy=Ar.green,YR=Ar.yellow,Yy=Ar.blue,ZR=Ar.magenta,XR=Ar.cyan,om=Ar.white,eA=Ar.gray,Zy=Ar.bgRed,Xy=Ar.bgYellow,tA=Ar.bgGray,sm=Ar.bold,rA=Ar.dim,nA=Ar.italic,iA=Ar.underline,oA=Ar.strikethrough,sA=Ar.reset,Cd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},wv={debug:"\uD83D\uDD0D",info:Yy("ℹ"),success:Qy("✓"),warning:Xy(om(sm(" WARN "))),error:Zy(om(sm(" ERROR ")))},aA=new Wd("stacks"),Dn=class extends Error{timestamp;context;constructor(t,r={}){super(t);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let t=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,a])=>`${r}: ${a}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${t}`}},Hd=class extends Dn{code="CONFIG_NOT_FOUND";constructor(t,r,a){let m=a?` or alias "${a}"`:"";super(`Configuration "${t}"${m} not found`,{configName:t,alias:a,searchPaths:r,searchPathCount:r.length})}},gc=class extends Dn{code="CONFIG_LOAD_ERROR";constructor(t,r,a){super(`Failed to load configuration from "${t}": ${r.message}`,{configPath:t,configName:a,originalError:r.name,originalMessage:r.message});this.cause=r}},gm=class extends Dn{code="CONFIG_VALIDATION_ERROR";constructor(t,r,a){super(`Configuration validation failed for "${t}"`,{configPath:t,configName:a,validationErrors:r,errorCount:r.length})}},fm=class extends Dn{code="CONFIG_MERGE_ERROR";constructor(t,r,a,m){super(`Failed to merge configuration from "${t}" with "${r}": ${a.message}`,{sourcePath:t,targetPath:r,configName:m,originalError:a.name,originalMessage:a.message});this.cause=a}},Kd=class extends Dn{code="ENV_VAR_ERROR";constructor(t,r,a,m){super(`Failed to parse environment variable "${t}" with value "${r}" as ${a}`,{envKey:t,envValue:r,expectedType:a,configName:m})}},hm=class extends Dn{code="FILE_SYSTEM_ERROR";constructor(t,r,a){super(`File system ${t} failed for "${r}": ${a.message}`,{operation:t,path:r,originalError:a.name,originalMessage:a.message});this.cause=a}},ym=class extends Dn{code="TYPE_GENERATION_ERROR";constructor(t,r,a){super(`Failed to generate types from "${t}" to "${r}": ${a.message}`,{configDir:t,outputPath:r,originalError:a.name,originalMessage:a.message});this.cause=a}},fc=class extends Dn{code="SCHEMA_VALIDATION_ERROR";constructor(t,r,a){super(`Schema validation failed${a?` for config "${a}"`:""}`,{schemaPath:t,configName:a,validationErrors:r,errorCount:r.length})}},vm=class extends Dn{code="BROWSER_CONFIG_ERROR";constructor(t,r,a,m){super(`Failed to fetch configuration from "${t}": ${r} ${a}`,{endpoint:t,status:r,statusText:a,configName:m})}},bm=class extends Dn{code="PLUGIN_ERROR";constructor(t,r,a){super(`Plugin "${t}" failed during ${r}: ${a.message}`,{pluginName:t,operation:r,originalError:a.name,originalMessage:a.message});this.cause=a}},bo={configNotFound(e,t,r){return new Hd(e,t,r)},configLoad(e,t,r){return new gc(e,t,r)},configValidation(e,t,r){return new gm(e,t,r)},configMerge(e,t,r,a){return new fm(e,t,r,a)},envVar(e,t,r,a){return new Kd(e,t,r,a)},fileSystem(e,t,r){return new hm(e,t,r)},typeGeneration(e,t,r){return new ym(e,t,r)},schemaValidation(e,t,r){return new fc(e,t,r)},browserConfig(e,t,r,a){return new vm(e,t,r,a)},plugin(e,t,r){return new bm(e,t,r)}},kv={replace:"replace",concat:"concat",smart:"smart"},Iv=/^https?:\/\//,Kn=new Wd("bunfig",{showTags:!0}),ki=new Pm,Ev=Sn(ys.cwd(),"config"),Rv=Sn(ys.cwd(),"src/generated")});function lA(e,t={}){let r=Ld.cwd();while(r.includes("storage"))r=jy(r,"..");let a=jy(r,e||"");if(t?.relative)return GE(Ld.cwd(),a);return a}var uA=Ld.env.CLARITY_LOG_DIR||JE(lA(),"logs"),Av={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:uA,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},Jd={...Av},NN=(async()=>{try{let{loadConfig:e}=await dA().then(()=>dv),t=await e({name:"clarity",alias:"logging",defaultConfig:Av,cwd:Ld.cwd()});if(t)Object.assign(Jd,t)}catch{}return Jd})();function Cr(){if(wi.env.NODE_ENV==="test"||wi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function pA(){if(wi.env.NODE_ENV==="test"||wi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof wi<"u"){let e=wi.type;if(e==="renderer"||e==="worker")return!1;return!!(wi.versions&&(wi.versions.node||wi.versions.bun))}return!1}class Cv{async format(e){let t=await pA(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:$a.pid,hostname:t(),environment:$a.env.NODE_ENV||"development",platform:$a.platform,version:$a.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:$a.env.NODE_ENV||$a.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var xr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},jt=xr,{red:jN,green:mA,yellow:MN,blue:gA,magenta:BN,cyan:LN,white:ev,gray:FN,bgRed:fA,bgYellow:hA,bgGray:zN,bold:tv,dim:UN,italic:qN,underline:VN,strikethrough:WN,reset:HN}=xr,am={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},yA={debug:"\uD83D\uDD0D",info:gA("ℹ"),success:mA("✓"),warning:hA(ev(tv(" WARN "))),error:fA(ev(tv(" ERROR ")))};class vu{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...Jd},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Cv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??zt.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let m=this.generateKeyId(),f=this.generateKey();this.currentKeyId=m,this.keys.set(m,f),this.encryptionKeys.set(m,{key:f,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...am,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...am};return{...am,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:Jd.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!Cr()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let m,f=0,v=3,w=1000;while(f<v)try{try{try{await eR(this.config.logDirectory,Fy.F_OK|Fy.W_OK)}catch(S){if(S instanceof Error&&"code"in S)if(S.code==="ENOENT")await tR(this.config.logDirectory,{recursive:!0,mode:493});else if(S.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw S;else throw S}}catch(S){throw console.error("Debug: [writeToFile] Failed to create log directory:",S),S}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:hi.from(e);try{if(!fd(this.currentLogFile))await rm(this.currentLogFile,"",{mode:420});if(m=Ly(this.currentLogFile,"a",420),XE(m,k,{flag:"a"}),By(m),m!==void 0)tm(m),m=void 0;if((await xa(this.currentLogFile)).size===0){if(await rm(this.currentLogFile,k,{flag:"w",mode:420}),(await xa(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(S){let A=S;if(A.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(A.code)){if(f<v-1){let x=typeof A.message==="string"?A.message:"Unknown error";console.error(`Network error during write attempt ${f+1}/${v}:`,x);let F=w*2**f;await new Promise((U)=>setTimeout(U,F)),f++;continue}}if(A?.code&&["ENOSPC","EDQUOT"].includes(A.code))throw Error(`Disk quota exceeded or no space left on device: ${A.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",A),A}finally{if(m!==void 0)try{tm(m)}catch(S){console.error("Debug: [writeToFile] Error closing file descriptor:",S)}}}catch(k){if(f===v-1){let A=k,x=typeof A.message==="string"?A.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",x),k}f++;let S=w*2**(f-1);await new Promise((A)=>setTimeout(A,S))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(m){throw console.error("Debug: [writeToFile] Error in operation:",m),m}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Oa(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Oa(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Oa(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Cr())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((m)=>{console.error("Error rotating keys:",m)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let m=Array.from(this.encryptionKeys.entries()).sort(([,w],[,k])=>k.createdAt.getTime()-w.createdAt.getTime()),f=typeof t.maxKeys==="number"?t.maxKeys:1,v=Math.max(1,f);if(m.length>v)for(let[w]of m.slice(v))this.encryptionKeys.delete(w),this.keys.delete(w)}generateKeyId(){return em(16).toString("hex")}generateKey(){return em(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=em(16),a=QE("aes-256-gcm",t,r),m=hi.isBuffer(e)?e:hi.from(e,"utf8"),f=a.update(m),v=a.final(),w=f.length+v.length,k=a.getAuthTag(),S=hi.allocUnsafe(16+w+16);return r.copy(S,0),f.copy(S,16),v.copy(S,16+f.length),k.copy(S,16+w),{encrypted:S,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=Uy(),m=[];a.on("data",(f)=>m.push(f)),a.on("end",()=>t(hi.from(hi.concat(m)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Cr())return;if(!this.shouldWriteToFile())return;let e=await xa(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let m=await hd(this.config.logDirectory),f=m.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,S)=>{let A=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(S.match(/\.log\.(\d+)$/)?.[1]||"0")-A}),v=f.length>0?Number.parseInt(f[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,w=`${r}.${v}`;if(await xa(r).catch(()=>null))try{if(await zy(r,w),t.compress)try{let k=`${w}.gz`;await this.compressLogFile(w,k),await vd(w)}catch(k){console.error("Error compressing rotated file:",k)}if(f.length===0&&!m.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await rm(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let m=new Date().toISOString().replace(/[:.]/g,"-"),f=r.replace(/\.log$/,`-${m}.log`);if(await xa(r).catch(()=>null))await zy(r,f)}if(this.currentLogFile=a,t.maxFiles){let f=(await hd(this.config.logDirectory)).filter((v)=>v.startsWith(this.name)).sort((v,w)=>w.localeCompare(v));for(let v of f.slice(t.maxFiles))await vd(Oa(this.config.logDirectory,v))}}}async compressLogFile(e,t){let r=My(e),a=ZE(t),m=Uy();await iR(r,m,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),fd(this.currentLogFile))try{let e=Ly(this.currentLogFile,"r+");By(e),tm(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Cr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await hd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await vd(Oa(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?jt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Cr())return!1;let e=typeof zt.env.NO_COLOR<"u",t=zt.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof zt.stderr<"u"&&zt.stderr.isTTY||typeof zt.stdout<"u"&&zt.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:m,level:f,showTimestamp:v=!0}=e,w=(U)=>U.replace(this.ANSI_PATTERN,"");if(!this.fancy){let U=[];if(v)U.push(t);if(f==="warning")U.push("WARN");else if(f==="error")U.push("ERROR");else if(r)U.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)U.push(a.replace(/[[\]]/g,""));return U.push(m),U.join(" ")}let k=zt.stdout.columns||120,S="";if(f==="warning"||f==="error")S=`${r} ${m}`;else if(f==="info"||f==="success")S=`${r} ${a} ${m}`;else S=`${r} ${a} ${jt.cyan(m)}`;if(!v)return S.trim();let A=w(S).trim().length,x=w(t).length,F=Math.max(1,k-2-A-x);return`${S.trim()}${" ".repeat(F)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(f,v)=>{let w=Number.parseInt(v,10);return w<t[0].length?String(t[0][w]):f});let r=/%([sdijfo%])/g,a=0,m=e.replace(r,(f,v)=>{if(v==="%")return"%";if(a>=t.length)return f;let w=t[a++];switch(v){case"s":return String(w);case"d":case"i":return Number(w).toString();case"j":case"o":return JSON.stringify(w,null,2);default:return f}});if(a<t.length)m+=` ${t.slice(a).map((f)=>typeof f==="object"?JSON.stringify(f,null,2):String(f)).join(" ")}`;return m}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,m)=>{let f=jt.underline(jt.blue(a)),v=this.toAbsoluteFilePath(m);if(v&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let w=`file://${encodeURI(v)}`,k="\x1B]8;;",S="\x1B\\";return`\x1B]8;;${w}\x1B\\${f}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${m}\x1B\\${f}\x1B]8;;\x1B\\`;return f}),t=t.replace(/`([^`]+)`/g,(r,a)=>jt.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>jt.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>jt.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>jt.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>jt.strikethrough(a)),t}supportsHyperlinks(){if(Cr())return!1;let e=zt.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=zt.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(rR(t)||t.startsWith("./")||t.startsWith("../"))t=nR(t);else return null;return fd(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){if(!this.shouldLog(e))return;let a=new Date,m=this.formatConsoleTimestamp(a),f=this.formatFileTimestamp(a),v,w;if(t instanceof Error)v=t.message,w=t.stack;else v=this.formatMessage(t,r);let{consoleText:k,fileText:S}=this.buildOutputTexts(v);if(this.shouldStyleConsole()){let x=this.options.showIcons===!1?"":yA[e],F=this.options.showTags!==!1&&this.name?jt.gray(this.formatTag(this.name)):"",U;switch(e){case"debug":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:jt.gray(k),level:e}),console.error(U);break;case"info":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:k,level:e}),console.warn(U);break;case"success":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:jt.green(k),level:e}),console.error(U);break;case"warning":U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:k,level:e}),console.warn(U);break;case"error":if(U=this.formatConsoleMessage({timestamp:m,icon:x,tag:F,message:k,level:e}),console.error(U),w){let H=w.split(`
-`);for(let K of H)if(K.trim()&&!K.includes(v))console.error(this.formatConsoleMessage({timestamp:m,message:jt.gray(`  ${K}`),level:e,showTimestamp:!1}))}break}}else if(!Cr()){if(console.error(`${f} ${this.environment}.${e.toUpperCase()}: ${v}`),w)console.error(w)}let A=`${f} ${this.environment}.${e.toUpperCase()}: ${S}
-`;if(w)A+=`${w}
-`;if(A=A.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(A)}progress(e,t=""){let r={update:(w,k)=>{},finish:(w)=>{},interrupt:(w,k)=>{}};if(!this.enabled)return r;let a=30;if(this.activeProgressBar={total:Math.max(1,e||1),current:0,message:t||"",barLength:a,lastRenderedLine:""},this.shouldStyleConsole()&&!Cr()&&zt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(w,k)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,w),this.activeProgressBar.total),k!==void 0)this.activeProgressBar.message=k;if(this.shouldStyleConsole()&&!Cr()&&zt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(w)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,w)},interrupt:(w,k="info")=>{if(!Cr()&&zt.stdout.isTTY)zt.stdout.write(`
-`);if(this[k==="warning"?"warn":k](w),this.activeProgressBar&&this.shouldStyleConsole()&&!Cr()&&zt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)}}}time(e){let t=performance.now();if(this.shouldStyleConsole()){let r=this.options.showTags!==!1&&this.name?jt.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:this.options.showIcons===!1?"":jt.blue("◐"),tag:r,message:`${jt.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),m=Math.round(a-t),f=`${e} completed in ${m}ms`,v=new Date,w=this.formatConsoleTimestamp(v),S=`${this.formatFileTimestamp(v)} ${this.environment}.INFO: ${f}`;if(r)S+=` ${JSON.stringify(r)}`;if(S+=`
-`,S=S.replace(this.ANSI_PATTERN,""),this.shouldStyleConsole()){let A=this.options.showTags!==!1&&this.name?jt.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:w,icon:this.options.showIcons===!1?"":jt.green("✓"),tag:A,message:`${f}${r?` ${JSON.stringify(r)}`:""}`}))}else if(!Cr())console.error(S.trim());if(this.shouldWriteToFile())await this.writeToFile(S)}}async debug(e,...t){await this.log("debug",e,...t)}async info(e,...t){await this.log("info",e,...t)}async success(e,...t){await this.log("success",e,...t)}async warn(e,...t){await this.log("warning",e,...t)}async error(e,...t){await this.log("error",e,...t)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let e=this.config.rotation,{encrypt:t}=e;return!!t}async only(e){if(!this.enabled)return;return await e()}isEnabled(){return this.enabled}setEnabled(e){this.enabled=e}extend(e){let t=`${this.name}:${e}`,r=new vu(t,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(r),r}createReadStream(){if(Cr())throw Error("createReadStream is not supported in browser environments");if(!fd(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return My(this.currentLogFile,{encoding:"utf8"})}async decrypt(e){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let t=this.config.rotation;if(!t.encrypt||typeof t.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let r=this.keys.get(this.currentKeyId);try{let a=hi.isBuffer(e)?e:hi.from(e,"base64"),m=a.subarray(0,16),f=a.subarray(a.length-16),v=a.subarray(16,a.length-16),w=YE("aes-256-gcm",r,m);w.setAuthTag(f);let k=w.update(v),S=w.final(),A=k.length+S.length,x=hi.allocUnsafe(A);return k.copy(x,0),S.copy(x,k.length),x.toString("utf8")}catch(a){throw Error(`Decryption failed: ${a instanceof Error?a.message:String(a)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return Cr()}isServerMode(){return!Cr()}setTestEncryptionKey(e,t){this.currentKeyId=e,this.keys.set(e,t)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(e){if(!this.enabled)return;let t=new Date,r=this.formatConsoleTimestamp(t),a=this.formatFileTimestamp(t),{consoleText:m,fileText:f}=this.buildOutputTexts(e);if(this.shouldStyleConsole()){let w=m.split(`
-`),k=Math.max(...w.map((F)=>F.length))+2,S=`┌${"─".repeat(k)}┐`,A=`└${"─".repeat(k)}┘`,x=w.map((F)=>this.formatConsoleMessage({timestamp:r,message:jt.cyan(F),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:r,message:jt.cyan(S),showTimestamp:!1})),x.forEach((F)=>console.error(F)),console.error(this.formatConsoleMessage({timestamp:r,message:jt.cyan(A),showTimestamp:!1}))}else if(!Cr())console.error(`${a} ${this.environment}.INFO: [BOX] ${f}`);let v=`${a} ${this.environment}.INFO: [BOX] ${f}
-`.replace(this.ANSI_PATTERN,"");if(this.shouldWriteToFile())await this.writeToFile(v)}async prompt(e){if(Cr())return Promise.resolve(!0);return new Promise((t)=>{console.error(`${jt.cyan("?")} ${e} (y/n) `);let r=(a)=>{let m=a.toString().trim().toLowerCase();zt.stdin.removeListener("data",r);try{if(typeof zt.stdin.setRawMode==="function")zt.stdin.setRawMode(!1)}catch{}zt.stdin.pause(),console.error(""),t(m==="y"||m==="yes")};try{if(typeof zt.stdin.setRawMode==="function")zt.stdin.setRawMode(!0)}catch{}zt.stdin.resume(),zt.stdin.once("data",r)})}setFancy(e){this.fancy=e}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(e,...t){if(!this.enabled)return;let r=e;if(t&&t.length>0){let k=/%([sdijfo%])/g,S=0;if(r=e.replace(k,(A,x)=>{if(x==="%")return"%";if(S>=t.length)return A;let F=t[S++];switch(x){case"s":return String(F);case"d":case"i":return Number(F).toString();case"j":case"o":return JSON.stringify(F,null,2);default:return A}}),S<t.length)r+=` ${t.slice(S).map((A)=>typeof A==="object"?JSON.stringify(A,null,2):String(A)).join(" ")}`}let{consoleText:a,fileText:m}=this.buildOutputTexts(r);if(this.shouldStyleConsole()){let k=this.options.showTags!==!1&&this.name?jt.gray(this.formatTag(this.name)):"",S=this.options.showIcons===!1?"":`${jt.blue("◐")} `;console.error(`${S}${k} ${jt.cyan(a)}`)}let w=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${m}
-`.replace(this.ANSI_PATTERN,"");if(this.shouldWriteToFile())await this.writeToFile(w)}renderProgressBar(e,t=!1){if(!this.enabled||!this.shouldStyleConsole()||!zt.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(e.current/e.total*100))),a=Math.round(e.barLength*r/100),m=e.barLength-a,f=jt.green("━".repeat(a)),v=jt.gray("━".repeat(m)),w=`[${f}${v}]`,k=`${r}%`.padStart(4),S=e.message?` ${e.message}`:"",A=this.options.showIcons===!1?"":t||r===100?jt.green("✓"):jt.blue("▶"),x=this.options.showTags!==!1&&this.name?` ${jt.gray(this.formatTag(this.name))}`:"",F=`\r${A}${x} ${w} ${k}${S}`,U=zt.stdout.columns||80,H=" ".repeat(Math.max(0,U-F.replace(this.ANSI_PATTERN,"").length));if(e.lastRenderedLine=`${F}${H}`,zt.stdout.write(e.lastRenderedLine),t)zt.stdout.write(`
-`)}finishProgressBar(e,t){if(!this.enabled||!this.fancy||Cr()||!zt.stdout.isTTY){this.activeProgressBar=null;return}if(e.current<e.total)e.current=e.total;if(t)e.message=t;this.renderProgressBar(e,!0),this.activeProgressBar=null}async clear(e={}){if(Cr()){console.warn("Log clearing is not supported in browser environments.");return}try{console.warn("Clearing logs...",this.config.logDirectory);let t=await hd(this.config.logDirectory),r=[];for(let a of t){if(!(e.name?new RegExp(e.name.replace("*",".*")).test(a):a.startsWith(this.name))||!a.endsWith(".log"))continue;let f=Oa(this.config.logDirectory,a);if(e.before)try{if((await xa(f)).mtime>=e.before)continue}catch(v){console.error(`Failed to get stats for file ${f}:`,v);continue}r.push(f)}if(r.length===0){console.warn("No log files matched the criteria for clearing.");return}console.warn(`Preparing to delete ${r.length} log file(s)...`);for(let a of r)try{await vd(a),console.warn(`Deleted log file: ${a}`)}catch(m){console.error(`Failed to delete log file ${a}:`,m)}console.warn("Log clearing process finished.")}catch(t){console.error("Error during log clearing process:",t)}}}var KN=new vu("stacks");class Jn extends Error{timestamp;context;constructor(e,t={}){super(e);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=t,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let e=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([t,r])=>`${t}: ${r}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${e}`}}class Pv extends Jn{code="CONFIG_NOT_FOUND";constructor(e,t,r){let a=r===void 0?[]:Array.isArray(r)?r.filter(Boolean):[r],m="";if(a.length===1)m=` or alias "${a[0]}"`;else if(a.length>1)m=` or aliases ${a.map((f)=>`"${f}"`).join(", ")}`;super(`Configuration "${e}"${m} not found`,{configName:e,alias:r,searchPaths:t,searchPathCount:t.length})}}class Gd extends Jn{code="CONFIG_LOAD_ERROR";constructor(e,t,r){super(`Failed to load configuration from "${e}": ${t.message}`,{configPath:e,configName:r,originalError:t.name,originalMessage:t.message});this.cause=t}}class _v extends Jn{code="CONFIG_VALIDATION_ERROR";constructor(e,t,r){super(`Configuration validation failed for "${e}"`,{configPath:e,configName:r,validationErrors:t,errorCount:t.length})}}class Tv extends Jn{code="CONFIG_MERGE_ERROR";constructor(e,t,r,a){super(`Failed to merge configuration from "${e}" with "${t}": ${r.message}`,{sourcePath:e,targetPath:t,configName:a,originalError:r.name,originalMessage:r.message});this.cause=r}}class _m extends Jn{code="ENV_VAR_ERROR";constructor(e,t,r,a){super(`Failed to parse environment variable "${e}" with value "${t}" as ${r}`,{envKey:e,envValue:t,expectedType:r,configName:a})}}class xv extends Jn{code="FILE_SYSTEM_ERROR";constructor(e,t,r){super(`File system ${e} failed for "${t}": ${r.message}`,{operation:e,path:t,originalError:r.name,originalMessage:r.message});this.cause=r}}class Dv extends Jn{code="TYPE_GENERATION_ERROR";constructor(e,t,r){super(`Failed to generate types from "${e}" to "${t}": ${r.message}`,{configDir:e,outputPath:t,originalError:r.name,originalMessage:r.message});this.cause=r}}class Qd extends Jn{code="SCHEMA_VALIDATION_ERROR";constructor(e,t,r){super(`Schema validation failed${r?` for config "${r}"`:""}`,{schemaPath:e,configName:r,validationErrors:t,errorCount:t.length})}}class Ov extends Jn{code="BROWSER_CONFIG_ERROR";constructor(e,t,r,a){super(`Failed to fetch configuration from "${e}": ${t} ${r}`,{endpoint:e,status:t,statusText:r,configName:a})}}class $v extends Jn{code="PLUGIN_ERROR";constructor(e,t,r){super(`Plugin "${e}" failed during ${t}: ${r.message}`,{pluginName:e,operation:t,originalError:r.name,originalMessage:r.message});this.cause=r}}var hs={configNotFound(e,t,r){return new Pv(e,t,r)},configLoad(e,t,r){return new Gd(e,t,r)},configValidation(e,t,r){return new _v(e,t,r)},configMerge(e,t,r,a){return new Tv(e,t,r,a)},envVar(e,t,r,a){return new _m(e,t,r,a)},fileSystem(e,t,r){return new xv(e,t,r)},typeGeneration(e,t,r){return new Dv(e,t,r)},schemaValidation(e,t,r){return new Qd(e,t,r)},browserConfig(e,t,r,a){return new Ov(e,t,r,a)},plugin(e,t,r){return new $v(e,t,r)}};async function vA(e,t={}){let{maxRetries:r=3,retryDelay:a=1000,isRetryable:m=()=>!0,fallback:f}=t,v=Error("Unknown error occurred");for(let w=0;w<=r;w++)try{return await e()}catch(k){if(v=k instanceof Error?k:Error(String(k)),w===r||!m(v))break;if(a>0)await new Promise((S)=>setTimeout(S,a))}if(f!==void 0)return f;throw v instanceof Error?v:Error(`Unknown error: ${String(v)}`)}class Tm{defaultParsers;constructor(){this.defaultParsers=[{name:"boolean",canParse:(e,t)=>t==="boolean"||["true","false","1","0","yes","no"].includes(e.toLowerCase()),parse:(e)=>{let t=e.toLowerCase();return["true","1","yes"].includes(t)}},{name:"number",canParse:(e,t)=>t==="number"||!Number.isNaN(Number(e))&&!Number.isNaN(Number.parseFloat(e)),parse:(e)=>{let t=Number(e);if(Number.isNaN(t))throw TypeError(`Cannot parse "${e}" as number`);return t}},{name:"array",canParse:(e,t)=>t==="array"||e.startsWith("[")||e.includes(","),parse:(e)=>{try{let t=JSON.parse(e);if(Array.isArray(t))return t}catch{}return e.split(",").map((t)=>t.trim())}},{name:"json",canParse:(e,t)=>t==="object"||(e.startsWith("{")&&e.endsWith("}")||e.startsWith("[")&&e.endsWith("]")),parse:(e)=>{try{return JSON.parse(e)}catch(t){throw Error(`Cannot parse "${e}" as JSON: ${t}`)}}}]}async applyEnvironmentVariables(e,t,r={}){let{prefix:a,useCamelCase:m=!0,useBackwardCompatibility:f=!0,customParsers:v={},verbose:w=!1,trackPerformance:k=!0}=r,S=async()=>{if(!e)return{config:t,source:{type:"environment",priority:50,timestamp:new Date}};let A=a||this.generateEnvPrefix(e),x={...t};return this.processObject(x,[],A,{useCamelCase:m,useBackwardCompatibility:f,customParsers:v,verbose:w,configName:e}),{config:x,source:{type:"environment",priority:50,timestamp:new Date}}};if(k)return wm.track("applyEnvironmentVariables",S,{configName:e});return S()}generateEnvPrefix(e){return e.toUpperCase().replace(/-/g,"_")}formatEnvKey(e,t){if(!t)return e.toUpperCase();return e.replace(/([A-Z])/g,"_$1").toUpperCase()}processObject(e,t,r,a){for(let[m,f]of Object.entries(e)){let v=[...t,m],w=v.map((A)=>this.formatEnvKey(A,a.useCamelCase)),k=`${r}_${w.join("_")}`,S=a.useBackwardCompatibility?`${r}_${v.map((A)=>A.toUpperCase()).join("_")}`:null;if(a.verbose);if(typeof f==="object"&&f!==null&&!Array.isArray(f))this.processObject(f,v,r,a);else{let A=wd.env[k]||(S?wd.env[S]:void 0);if(A!==void 0){if(a.verbose){let x=wd.env[k]?k:S}try{e[m]=this.parseEnvironmentValue(A,typeof f,k,a.customParsers,a.configName)}catch(x){if(x instanceof _m)throw x;throw hs.envVar(k,A,typeof f,a.configName)}}}}}parseEnvironmentValue(e,t,r,a,m){for(let[f,v]of Object.entries(a))try{return v(e)}catch{continue}for(let f of this.defaultParsers)if(f.canParse(e,t))try{return f.parse(e)}catch{throw hs.envVar(r,e,`${t} (via ${f.name} parser)`,m)}return e}getEnvironmentVariables(e){let t={},r=e.toUpperCase();for(let[a,m]of Object.entries(wd.env))if(a.startsWith(r)&&m!==void 0)t[a]=m;return t}validateEnvironmentVariable(e,t,r){let a=[];if(!/^[A-Z_][A-Z0-9_]*$/.test(e))a.push(`Environment variable key "${e}" should only contain uppercase letters, numbers, and underscores`);if(r)try{this.parseEnvironmentValue(e,t,r,{})}catch(m){a.push(`Cannot parse value "${t}" as ${r}: ${m}`)}return{isValid:a.length===0,errors:a}}generateEnvVarDocs(e,t,r={}){let{prefix:a,format:m="text"}=r,f=a||this.generateEnvPrefix(e),v=[];switch(this.extractEnvVarInfo(t,[],f,v),m){case"markdown":return this.formatAsMarkdown(v,e);case"json":return JSON.stringify(v,null,2);default:return this.formatAsText(v,e)}}extractEnvVarInfo(e,t,r,a){for(let[m,f]of Object.entries(e)){let v=[...t,m],w=`${r}_${v.map((k)=>this.formatEnvKey(k,!0)).join("_")}`;if(typeof f==="object"&&f!==null&&!Array.isArray(f))this.extractEnvVarInfo(f,v,r,a);else a.push({key:w,type:Array.isArray(f)?"array":typeof f,description:`Configuration for ${v.join(".")}`,example:this.generateExample(f)})}}generateExample(e){if(Array.isArray(e))return JSON.stringify(e);if(typeof e==="object"&&e!==null)return JSON.stringify(e);return String(e)}formatAsText(e,t){let r=`Environment Variables for ${t}:
-
-`;for(let a of e)r+=`${a.key}
-`,r+=`  Type: ${a.type}
-`,r+=`  Description: ${a.description}
-`,r+=`  Example: ${a.example}
-
-`;return r}formatAsMarkdown(e,t){let r=`# Environment Variables for ${t}
-
-`;r+=`| Variable | Type | Description | Example |
-`,r+=`|----------|------|-------------|----------|
-`;for(let a of e)r+=`| \`${a.key}\` | ${a.type} | ${a.description} | \`${a.example}\` |
-`;return r}}function bA(e,t,r={}){return Nv(e,t,r,new WeakMap)}function Nv(e,t,r,a){let{arrayMergeMode:m="replace",skipNullish:f=!1,customMerger:v}=r;if(t===null||t===void 0)return f?e:t;if(v){let w=v(e,t);if(w!==void 0)return w}if(Array.isArray(t)||Array.isArray(e))return jv(e,t,m,a);if(!Bn(t)||!Bn(e))return t;return IA(e,t,r,a)}function jv(e,t,r,a){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return SA(e,t);case"smart":return wA(e,t,a);default:return t}return t}function SA(e,t){let r=[...t];for(let a of e)if(!r.some((m)=>Sm(m,a)))r.push(a);return r}function wA(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(Bn(t[0])&&Bn(e[0]))return kA(e,t,r);if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let m of e)if(!a.includes(m))a.push(m);return a}return t}function kA(e,t,r){let a=[...t];for(let m of e){if(!Bn(m)){a.push(m);continue}let f=["id","name","key","path","type"],v=!1;for(let w of f)if(w in m){if(a.find((S)=>Bn(S)&&(w in S)&&S[w]===m[w])){v=!0;break}}if(!v)a.push(m)}return a}function IA(e,t,r,a){let m=t;if(Bn(m)&&a.has(m))return a.get(m);let f={...e};if(Bn(m))a.set(m,f);for(let v in m){if(!Object.prototype.hasOwnProperty.call(m,v))continue;let w=m[v],k=f[v];if(r.skipNullish&&(w===null||w===void 0))continue;if(w===null||w===void 0){f[v]=w;continue}if(Bn(w)&&Bn(k))f[v]=Nv(k,w,r,a);else if(Array.isArray(w)||Array.isArray(k))f[v]=jv(k,w,r.arrayMergeMode||"smart",a);else f[v]=w}return f}function Mv(e,t,r="replace"){return bA(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function Sm(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!Sm(e[r],t[r]))return!1;return!0}if(Bn(e)&&Bn(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let m of r){if(!Object.prototype.hasOwnProperty.call(t,m))return!1;if(!Sm(e[m],t[m]))return!1}return!0}return!1}function Bn(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class Bv{extensions=ov;async loadFromPath(e,t,r={}){let{arrayStrategy:a="replace",useCache:m=!0,cacheTtl:f,trackPerformance:v=!0,verbose:w=!1}=r;if(m){let S=Pd.getWithFileCheck("file",e);if(S){if(w)console.log(`Configuration loaded from cache: ${e}`);return S}}let k=async()=>{if(!kd(e))return null;try{let S=`?t=${Date.now()}`,A=await import(e+S),x=A.default||A,F="default"in A,U=Object.keys(A).length>0;if(!F&&!U)throw new Gd(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof x!=="object"||x===null||Array.isArray(x))throw new Gd(e,Error("Configuration must export a valid object"),"unknown");let X={config:Mv(t,x,a),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(m)Pd.setWithFileCheck("file",X,e,f);return X}catch(S){throw S instanceof Error?hs.configLoad(e,S):hs.configLoad(e,Error(String(S)))}};if(v)return wm.track("loadFromPath",k,{path:e});return k()}async tryLoadFromPaths(e,t,r={}){for(let a of e)try{let m=await this.loadFromPath(a,t,r);if(m)return m}catch(m){if(m instanceof Error&&m.name==="ConfigLoadError")throw m;if(r.verbose)console.warn(`Failed to load config from ${a}:`,m)}return null}generateConfigPaths(e,t,r){return yE({name:e,directory:t,alias:r})}generateNamePatterns(e,t){return sv({name:e,alias:t})}checkFileAccess(e){return vA(async()=>kd(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let a=[];if(!kd(e))return a;if(t||r){let m=this.generateNamePatterns(t||"",r);for(let f of m)for(let v of this.extensions){let w=rv(e,`${f}${v}`);if(await this.checkFileAccess(w))a.push(w)}}else try{let{readdirSync:m}=await import("fs"),f=m(e);for(let v of f)if(this.looksLikeConfigFile(v)){let w=rv(e,v);if(await this.checkFileAccess(w))a.push(w)}}catch{return[]}return a}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!kd(e))return t.push("Configuration file does not exist"),t;let r=await import(e),a=r.default||r;if(a===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof a!=="object"||a===null)t.push("Configuration must be an object");else if(Array.isArray(a))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:m}=await import("fs"),f=m(e,"utf8");JSON.parse(f)}catch(m){t.push(`Invalid JSON syntax: ${m}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(a)=>{try{let m=await this.loadFromPath(a,{},t);if(m)r.set(a,m.config)}catch(m){if(t.verbose)console.warn(`Failed to preload ${a}:`,m)}})),r}}var RA=/^https?:\/\//;class Lv{async validateConfiguration(e,t,r={}){let{stopOnFirstError:a=!1,validateRequired:m=!0,validateTypes:f=!0,customRules:v=[],trackPerformance:w=!0,verbose:k=!1}=r,S=async()=>{let A=[],x=[],F={stopOnFirstError:a,validateRequired:m,validateTypes:f,customRules:v,trackPerformance:w,verbose:k};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,F);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...v],F);else return this.validateWithJSONSchema(e,t,F)}catch(U){return A.push({path:"",message:`Validation failed: ${U}`,rule:"system"}),{isValid:!1,errors:A,warnings:x}}};if(w)return await wm.track("validateConfiguration",S);return S()}async validateWithSchemaFile(e,t,r){try{if(!EA(t))throw new Qd(t,[{path:"",message:"Schema file does not exist"}]);let a=await import(t),m=a.default||a;if(Array.isArray(m))return this.validateWithRules(e,m,r);else return this.validateWithJSONSchema(e,m,r)}catch(a){throw new Qd(t,[{path:"",message:`Failed to load schema: ${a}`}])}}validateWithJSONSchema(e,t,r){let a=[],m=[];return this.validateObjectAgainstSchema(e,t,"",a,m,r),{isValid:a.length===0,errors:a,warnings:m}}validateObjectAgainstSchema(e,t,r,a,m,f){if(f.validateTypes&&t.type){let v=Array.isArray(e)?"array":typeof e,w=Array.isArray(t.type)?t.type:[t.type];if(!w.includes(v)){if(a.push({path:r,message:`Expected type ${w.join(" or ")}, got ${v}`,expected:w.join(" or "),actual:v,rule:"type"}),f.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(a.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),f.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)a.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)a.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))a.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)a.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)a.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let v=0;v<e.length;v++){let w=r?`${r}[${v}]`:`[${v}]`;if(this.validateObjectAgainstSchema(e[v],t.items,w,a,m,f),f.stopOnFirstError&&a.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let v=e;if(f.validateRequired&&t.required){for(let w of t.required)if(!(w in v)){if(a.push({path:r?`${r}.${w}`:w,message:`Missing required property '${w}'`,expected:"required",rule:"required"}),f.stopOnFirstError)return}}if(t.properties){for(let[w,k]of Object.entries(t.properties))if(w in v){let S=r?`${r}.${w}`:w;if(this.validateObjectAgainstSchema(v[w],k,S,a,m,f),f.stopOnFirstError&&a.length>0)return}}if(t.additionalProperties===!1){let w=new Set(Object.keys(t.properties||{}));for(let k of Object.keys(v))if(!w.has(k))m.push({path:r?`${r}.${k}`:k,message:`Additional property '${k}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let a=[],m=[];for(let f of t)try{let v=this.getValueByPath(e,f.path),w=this.validateWithRule(v,f,f.path);if(a.push(...w),r.stopOnFirstError&&a.length>0)break}catch(v){a.push({path:f.path,message:`Rule validation failed: ${v}`,rule:"system"})}return{isValid:a.length===0,errors:a,warnings:m}}validateWithRule(e,t,r){let a=[];if(t.required&&(e===void 0||e===null))return a.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),a;if(e===void 0||e===null)return a;if(t.type){let m=Array.isArray(e)?"array":typeof e;if(m!==t.type)a.push({path:r,message:t.message||`Expected type ${t.type}, got ${m}`,expected:t.type,actual:m,rule:"type"})}if(t.min!==void 0){let m=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(m<t.min)a.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:m,rule:"min"})}if(t.max!==void 0){let m=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(m>t.max)a.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:m,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))a.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))a.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let m=t.validator(e);if(m)a.push({path:r,message:t.message||m,rule:"custom"})}return a}getValueByPath(e,t){if(!t)return e;let r=t.split("."),a=e;for(let m of r)if(a&&typeof a==="object"&&m in a)a=a[m];else return;return a}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let a of r){let[,m,f,v]=a;t.push({path:m,required:!f,type:this.mapTypeScriptType(v)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:RA},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var Hn=new vu("bunfig",{showTags:!0});function AA(e){if(!e)return"";let t=Array.isArray(e)?e.filter(Boolean):[e];if(t.length===0)return"";if(t.length===1)return` or alias "${t[0]}"`;return` or aliases ${t.map((r)=>`"${r}"`).join(", ")}`}class Fv{fileLoader=new Bv;envProcessor=new Tm;validator=new Lv;async loadConfig(e){let t=Date.now(),{cache:r,performance:a,schema:m,validate:f,...v}=e;try{if(r?.enabled){let k=this.checkCache(v.name||"",v);if(k)return k}let w;try{w=await this.loadConfigurationStrategies(v,!0,r)}catch(k){if(v.configFile)throw k;let S=v.__strictErrorHandling;if(k instanceof Error&&k.name==="ConfigNotFoundError"){if(S)throw k;w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:[`No configuration file found for "${v.name||"config"}", using defaults with environment variables`]}}else if(k instanceof Error&&k.name==="ConfigLoadError"){let A=k.message.includes("EACCES")||k.message.includes("EPERM")||k.message.includes("permission denied"),x=!A&&(k.message.includes("syntax")||k.message.includes("Expected")||k.message.includes("Unexpected")||k.message.includes("BuildMessage")||k.message.includes("errors building")),F=k.message.includes("Configuration must export a valid object")||k.message.includes("Configuration file is empty and exports nothing");if(S&&(F||A))throw k;if(x&&(!S||!F))w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!S)w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:[`Configuration loading error, using defaults: ${k.message}`]};else throw k}else w={...await this.applyEnvironmentVariables(v.name||"",v.defaultConfig,v.checkEnv!==!1,v.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${k instanceof Error?k.message:String(k)}`]}}if(m||f)await this.validateConfiguration(w.config,m,f,v.name);if(r?.enabled&&w)this.cacheResult(v.name||"",w,r,v);if(a?.enabled){let k={operation:"loadConfig",duration:Date.now()-t,configName:v.name,timestamp:new Date};if(a.onMetrics)a.onMetrics(k);if(a.slowThreshold&&k.duration>a.slowThreshold)Hn.warn(`Slow configuration loading detected: ${k.duration}ms for ${v.name}`);w.metrics=k}return w}catch(w){if(w instanceof Error&&w.name==="ConfigNotFoundError")throw w;let k=Date.now()-t;throw Hn.error(`Configuration loading failed after ${k}ms:`,[w instanceof Error?w:Error(String(w))]),w}}async loadConfigurationStrategies(e,t=!1,r){let{name:a="",alias:m,configFile:f,cwd:v,configDir:w,defaultConfig:k,checkEnv:S=!0,arrayStrategy:A="replace",verbose:x=!1}=e,F=v||Yd.cwd(),U=[];if(f){let pe=ri(F,f);U.push(pe);let ee=S?lc(a,k,x):k,ce=await this.fileLoader.tryLoadFromPaths([pe],ee,{arrayStrategy:A,verbose:x,cacheTtl:r?.ttl,useCache:!r?.ttl||r.ttl>100});if(!ce)throw hs.configNotFound(a||f,U,m);if(x)Hn.success(`Configuration loaded from explicit path: ${pe}`);return this.finalizeResult(ce,U,S,a,x)}let H=await this.loadLocalConfiguration(a,m,F,w,k,A,x,S,r);if(H)return U.push(...this.getLocalSearchPaths(a,m,F,w)),this.finalizeResult(H,U,S,a,x);let K=await this.loadHomeConfiguration(a,m,k,A,x,S);if(K)return U.push(...this.getHomeSearchPaths(a,m)),this.finalizeResult(K,U,S,a,x);let X=await this.loadPackageJsonConfiguration(a,m,F,k,A,x,S);if(X)return U.push(ri(F,"package.json")),this.finalizeResult(X,U,S,a,x);if(U.push(...this.getAllSearchPaths(a,m,F,w)),t)throw hs.configNotFound(a,U,m);return{...await this.applyEnvironmentVariables(a,k,S,x),warnings:[`No configuration file found for "${a}"${AA(m)}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,a,m,f,v,w,k){let S=w?lc(e,m,v):m,A=this.getLocalDirectories(r,a);for(let x of A){if(v)Hn.info(`Searching for configuration in: ${x}`);let F=this.fileLoader.generateConfigPaths(e,x,t),U=await this.fileLoader.tryLoadFromPaths(F,S,{arrayStrategy:f,verbose:v,cacheTtl:k?.ttl,useCache:!k?.ttl||k.ttl>100});if(U){if(v)Hn.success(`Configuration loaded from: ${U.source.path}`);return U}}return null}async loadHomeConfiguration(e,t,r,a,m,f){if(!e)return null;let v=f?lc(e,r,m):r,w=[ri(Vs(),".config",e),ri(Vs(),".config"),Vs()];for(let k of w){if(m)Hn.info(`Checking home directory: ${k}`);let S=this.fileLoader.generateConfigPaths(e,k,t),A=await this.fileLoader.tryLoadFromPaths(S,v,{arrayStrategy:a,verbose:m});if(A){if(m)Hn.success(`Configuration loaded from home directory: ${A.source.path}`);return A}}return null}async loadPackageJsonConfiguration(e,t,r,a,m,f,v){let w=v?lc(e,a,f):a;try{let k=ri(r,"package.json");if(!bE(k))return null;let S={};try{S=JSON.parse(SE(k,"utf8"))}catch(F){if(f)Hn.warn("Failed to parse package.json:",[F instanceof Error?F:Error(String(F))]);return null}let A=S[e],x=e;if(!A&&t){let F=Array.isArray(t)?t:[t];for(let U of F){if(!U)continue;if(S[U]){A=S[U],x=U;break}}}if(A&&typeof A==="object"&&!Array.isArray(A)){if(f)Hn.success(`Configuration loaded from package.json: ${x}`);return{config:Mv(w,A,m),source:{type:"package.json",path:k,priority:30,timestamp:new Date}}}}catch(k){if(f)Hn.warn("Failed to load package.json:",[k instanceof Error?k:Error(String(k))])}return null}async applyEnvironmentVariables(e,t,r,a){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:lc(e,t,a),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,a,m){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,a){let m=[];if(r){let f=r(e);if(f)m.push(...f)}if(t){let f=await this.validator.validateConfiguration(e,t);if(!f.isValid)m.push(...f.errors.map((v)=>v.path?`${v.path}: ${v.message}`:v.message))}if(m.length>0)throw hs.configValidation(a||"unknown",m,a)}checkCache(e,t){let r=this.generateCacheKey(e,t);return Pd.get(r)||null}cacheResult(e,t,r,a){let m=this.generateCacheKey(e,a);Pd.set(m,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias){let a=Array.isArray(t.alias)?t.alias.join(","):t.alias;r.push(`alias:${a}`)}if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configFile)r.push(`configFile:${t.configFile}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return vE({cwd:e,configDir:t})}getAllSearchPaths(e,t,r,a){let m=[];return m.push(...this.getLocalSearchPaths(e,t,r,a)),m.push(...this.getHomeSearchPaths(e,t)),m.push(ri(r,"package.json")),m}getLocalSearchPaths(e,t,r,a){let m=this.getLocalDirectories(r,a),f=[];for(let v of m)f.push(...this.fileLoader.generateConfigPaths(e,v,t));return f}getHomeSearchPaths(e,t){if(!e)return[];let r=[ri(Vs(),".config",e),ri(Vs(),".config"),Vs()],a=[];for(let m of r)a.push(...this.fileLoader.generateConfigPaths(e,m,t));return a}async loadConfigWithResult(e){return this.loadConfig(e)}}var cm=new Fv;async function zv(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let a;if(r)a=await cm.loadConfig(e);else a=await cm.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return a?.config??t}catch(a){if(e.configFile)throw a;let m=a instanceof Error?a.name:"UnknownError",f=a instanceof Error?a.message:String(a);if(!(m==="ConfigNotFoundError"||m==="ConfigLoadError"||m==="ConfigValidationError"||f.includes("config"))&&e.verbose)Hn.warn("Unexpected error loading config, using defaults:",[a instanceof Error?a:Error(String(a))]);let w=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await cm.applyEnvironmentVariables(w.name||"",t,!0,w.verbose||!1))?.config??t;return t}}function lc(e,t,r=!1){let a=new Tm,m=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function f(v,w=[]){let k={...v};for(let[S,A]of Object.entries(v)){let x=[...w,S],F=[`${m}_${x.join("_").toUpperCase()}`,`${m}_${x.map((K)=>K.toUpperCase()).join("")}`,`${m}_${x.map((K)=>K.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],U,H;for(let K of F)if(U=Yd.env[K],U!==void 0){H=K;break}if(U!==void 0&&H)if(typeof A==="boolean")k[S]=["true","1","yes"].includes(U.toLowerCase());else if(typeof A==="number"){let K=Number(U);if(!Number.isNaN(K))k[S]=K}else if(Array.isArray(A))try{k[S]=JSON.parse(U)}catch{k[S]=U.split(",").map((K)=>K.trim())}else k[S]=U;else if(A&&typeof A==="object"&&!Array.isArray(A))k[S]=f(A,x)}return k}return f(t)}var ZN=ri(Yd.cwd(),"config"),XN=ri(Yd.cwd(),"src/generated");var Po={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},vs=null;function _A(e){return e.project?.slug===Po.project?.slug&&Object.keys(e.environments??{}).length===1&&!!e.environments?.production}async function TA(){let e=[Uv(process.cwd(),"config","cloud.ts"),Uv(process.cwd(),"config","cloud.js")];for(let t of e){if(!CA(t))continue;let r=await import(`${PA(t).href}?t=${Date.now()}`),a=r.tsCloud??r.default?.tsCloud??r.default??r.cloud??r.config;if(a)return a}return null}async function Fm(){if(!vs){if(vs=await zv({name:"cloud",defaultConfig:Po}),_A(vs))vs=await TA()??vs;yd(vs.stateDir)}return vs}var el=Fm,ly=Po;var So=(e)=>e==null?void 0:String(e),Dm=(e)=>Number(e)===1,Vv=(e,t)=>{try{return e==null?t:JSON.parse(String(e))}catch{return t}};function xm(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:So(e.environment_id),resourceId:So(e.resource_id),previewId:So(e.preview_id)},key:String(e.key),kind:String(e.kind),value:So(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:So(e.secret_ref),backend:String(e.backend),backendVersion:So(e.backend_version),origin:String(e.origin),required:Dm(e.required),metadata:Vv(e.metadata,{}),lastUsedAt:So(e.last_used_at),rotatedAt:So(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qv(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:Dm(e.required),requiresRedeploy:Dm(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Da{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}get(e){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return t?xm(t):void 0}find(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,t.type,t.id,r);return a?xm(a):void 0}list(e){let t=["project_id=?"],r=[e.projectId];if(e.scope)t.push("scope_type=?","scope_id=?"),r.push(e.scope.type,e.scope.id);if(e.kind)t.push("kind=?"),r.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${t.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...r).map(xm)}create(e){this.validateScope(e),this.validateEntry(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,r,r]),this.get(t)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Configuration entry was not found.");if(this.validateEntry({...a,...r}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[r.value??null,r.valueFingerprint,r.secretRef??null,r.backend,r.backendVersion??null,r.required?1:0,JSON.stringify(r.metadata),r.rotatedAt??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,t){let r=this.get(e);if(!r)throw Error("Configuration entry was not found.");if(r.version!==t)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,t]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return r}setDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,t,t]),this.dependencies(e.entryId).find((r)=>r.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(qv)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(qv)}mutation(e){let t=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return t?{requestHash:t.request_hash,result:Vv(t.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let r=e.scope;if(r.type==="project"){if(r.id!==e.projectId||r.environmentId||r.resourceId||r.previewId)throw Error("Project configuration scope must reference only its project.");return}if(r.type==="environment"){let m=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(r.id);if(!m||m.project_id!==e.projectId||r.environmentId&&r.environmentId!==r.id||r.resourceId||r.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(r.type==="service"||r.type==="function"){let m=this.controlPlane.getResource(r.id);if(!m||m.projectId!==e.projectId||r.type==="function"&&m.kind!=="function"||r.resourceId&&r.resourceId!==r.id||r.environmentId&&m.environmentId!==r.environmentId||r.previewId)throw Error(`${r.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let a=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(r.id);if(!a||a.project_id!==e.projectId||r.previewId&&r.previewId!==r.id||r.environmentId&&r.environmentId!==a.base_environment_id||r.resourceId&&r.resourceId!==a.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var Wv=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function xA(e){let t={n:`
-`,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(r,a)=>t[a])}function hu(e){let t={},r=[],a=e.replace(/\r\n?/g,`
-`).split(`
-`);for(let m=0;m<a.length;m++){let f=m+1,v=a[m];if(!v.trim()||v.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(v))v=v.replace(/^\s*export\s+/,"");let w=v.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!w){r.push({line:f,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let k=w[1],S=w[2];if(!Wv.test(k)){r.push({line:f,key:k,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${k}`});continue}let A=S;if(S.startsWith('"')||S.startsWith("'")){let x=S[0],F=[S.slice(1)],U=!1;while(!0){let H=F[F.length-1],K=!1,X=-1;for(let oe=0;oe<H.length;oe++){if(x==='"'&&H[oe]==="\\"&&!K){K=!0;continue}if(H[oe]===x&&!K){X=oe;break}K=!1}if(X>=0){F[F.length-1]=H.slice(0,X),U=!0;break}if(++m>=a.length)break;F.push(a[m])}if(!U){r.push({line:f,key:k,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${k}.`});continue}if(A=F.join(`
-`),x==='"')A=xA(A)}else A=S.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(t,k)){let x=t[k]!==A;if(r.push({line:f,key:k,severity:x?"error":"warning",code:x?"conflict":"duplicate",message:x?`${k} has conflicting values.`:`${k} is duplicated with the same value.`}),x)continue}t[k]=A}return{values:t,diagnostics:r,valid:!r.some((m)=>m.severity==="error")}}function fu(e){return Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>{if(!Wv.test(t))throw Error(`Invalid environment variable name: ${t}`);return`${t}=${JSON.stringify(r)}`}).join(`
-`)+(Object.keys(e).length?`
-`:"")}import{createCipheriv as DA,createDecipheriv as OA,createHash as Hv,randomBytes as $A}from"node:crypto";class ln{controlPlane;now;kind="local_encrypted";key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Configuration encryption key is required.");this.key=Hv("sha256").update(`ts-cloud:configuration:${t}`).digest()}encrypt(e){let t=$A(12),r=DA("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,m]=e.split(".");if(t!=="v1"||!r||!a||!m)throw Error("Encrypted configuration secret is unavailable.");try{let f=OA("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return f.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([f.update(Buffer.from(m,"base64url")),f.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let t=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(t))throw Error("Invalid local configuration secret reference.");let a=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(t)?.version??0)+1,m=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[t,this.encrypt(e.value),Hv("sha256").update(e.value).digest("hex"),a,m,m]),{reference:t,version:String(a)}}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!t)throw Error("Configuration secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class Pa{client;region;kind="aws_secrets_manager";constructor(e,t){this.client=e;this.region=t}async put(e){if(e.reference){let r=this.id(e.reference),a=await this.client.putSecretValue({SecretId:r,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:a.VersionId??e.idempotencyKey}}let t=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(t.ARN??t.Name??e.name)}`,version:t.VersionId??e.idempotencyKey}}async resolve(e){let t=await this.client.getSecretValue({SecretId:this.id(e)});if(t.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return t.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let t=new URL(e);if(t.protocol!=="aws-sm:"||t.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(t.pathname.slice(1))}}class Na{client;region;kind="aws_ssm";constructor(e,t){this.client=e;this.region=t}async put(e){let t=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,r=await this.client.putParameter({Name:t,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${t}`,version:String(r.Version??1)}}async resolve(e){let t=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(t.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return t.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let t=new URL(e);if(t.protocol!=="aws-ssm:"||t.hostname!==this.region||!t.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return t.pathname}}class ka{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as NA}from"node:crypto";var jA=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,MA=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function Cn(e){return[...new Set(e)].sort()}function Kv(e,t={}){let r=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!t.inherited,overridden:!!t.overridden,required:e.required,backend:!r||t.canReadSecretMetadata?e.backend:void 0,backendVersion:!r||t.canReadSecretMetadata?e.backendVersion:void 0,reference:r&&t.canReadSecretMetadata?e.secretRef:void 0,value:!r?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class Ba{store;backends=new Map;fingerprintKey;now;constructor(e,t){if(this.store=e,this.fingerprintKey=t.fingerprintKey??t.encryptionKey,this.now=t.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let r=t.backends??[new ln(e.controlPlane,t.encryptionKey,this.now)];for(let a of r)this.backends.set(a.kind,a)}list(e){let t=e.search?.toLowerCase();return this.store.list(e).filter((r)=>!t||r.key.toLowerCase().includes(t)).map((r)=>Kv(r,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let t=this.store.list({projectId:e.projectId,scope:e.scope}),r=new Map(t.map((k)=>[k.key,k])),a=[],m=[],f=[],v=[];for(let[k,S]of Object.entries(e.values)){a.push(...this.warnings(k,S));let A=r.get(k);if(!A)m.push(k);else if(A.valueFingerprint!==this.fingerprint(S))f.push(k);else v.push(k)}let w=e.removeMissing?t.filter((k)=>!Object.hasOwn(e.values,k.key)).map((k)=>k.key):[];return{added:Cn(m),changed:Cn(f),removed:Cn(w),unchanged:Cn(v),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...m,...f,...w]),warnings:a}}async set(e){let t=this.requestHash(e),r=e.idempotencyKey;if(r){let H=this.store.mutation(r);if(H){if(H.requestHash!==t)throw Error("Idempotency key was already used for a different configuration mutation.");let K=this.store.get(String(H.result.entryId??""));if(!K)throw Error("Idempotent configuration result is no longer available.");return{entry:K,mutation:H.result.mutation,warnings:[]}}}if(e.value!=null&&jA.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let a=this.store.find(e.projectId,e.scope,e.key),m=this.fingerprint(e.value??e.reference??"");if(a&&e.expectedVersion!=null&&a.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(a&&a.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let f=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!a&&(a.valueFingerprint!==m||a.backend!==f||a.required!==!!e.required)&&(this.isProduction(a)||this.store.dependencies(a.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let w=e.reference,k;if(e.kind==="secret"){let H=this.backend(f);if(e.reference&&e.value==null){if(!await H.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");k=a?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let K=await H.put({reference:a?.backend===f?a.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:r??crypto.randomUUID()});w=K.reference,k=K.version}}let S=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&S==null)throw Error("A variable value is required.");let A=!a||a.valueFingerprint!==m||a.backend!==f||a.secretRef!==w||a.backendVersion!==k||a.required!==!!e.required,x=a?A?this.store.update(a.id,a.version,{value:S,valueFingerprint:m,secretRef:w,backend:f,backendVersion:k,required:!!e.required,metadata:s(e.metadata??a.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():a.rotatedAt}):a:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:S,valueFingerprint:m,secretRef:w,backend:f,backendVersion:k,origin:e.origin??"managed",required:!!e.required,metadata:s(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),F=this.affectedResources(e.projectId,e.scope,[e.key]),U={added:a?[]:[e.key],changed:a&&A?[e.key]:[],removed:[],unchanged:a&&!A?[e.key]:[],affectedResourceIds:F,versions:{[e.key]:x.version}};if(r)this.store.recordMutation({projectId:e.projectId,idempotencyKey:r,requestHash:t,actorId:e.actorId,result:{entryId:x.id,mutation:U}});return this.audit(e.projectId,e.actorId,a&&A?"configuration.updated":a?"configuration.unchanged":"configuration.created",x,F),{entry:x,mutation:U,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let t=hu(e.source);if(!t.valid)return{document:t,warnings:[]};let r=new Set(e.secretKeys??[]),a={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},m=[];for(let[f,v]of Object.entries(t.values)){let w=await this.set({...e,source:void 0,key:f,value:v,kind:r.has(f)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${f}`:void 0});a.added.push(...w.mutation.added),a.changed.push(...w.mutation.changed),a.unchanged.push(...w.mutation.unchanged),a.affectedResourceIds.push(...w.mutation.affectedResourceIds),Object.assign(a.versions,w.mutation.versions),m.push(...w.warnings)}return a.added=Cn(a.added),a.changed=Cn(a.changed),a.unchanged=Cn(a.unchanged),a.affectedResourceIds=Cn(a.affectedResourceIds),{document:t,mutation:a,warnings:m}}exportVariables(e){return fu(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((t)=>[t.key,t.value??""])))}async transfer(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");if(t.scope.type===e.targetScope.type&&t.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let r=t.kind==="variable"?t.value:t.backend==="external"?void 0:await this.backend(t.backend).resolve(t.secretRef),a=t.kind==="secret"?t.backend:void 0,m=await this.set({organizationId:t.organizationId,projectId:t.projectId,scope:e.targetScope,key:t.key,kind:t.kind,value:r,reference:t.backend==="external"?t.secretRef:void 0,backend:a,required:t.required,metadata:t.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:t.origin});if(e.mode==="move")await this.remove({entryId:t.id,expectedVersion:t.version,confirmed:e.confirmed,actorId:e.actorId});let f={added:m.mutation.added,changed:m.mutation.changed,removed:e.mode==="move"?[t.key]:[],unchanged:m.mutation.unchanged,affectedResourceIds:Cn([...m.mutation.affectedResourceIds,...this.affectedResources(t.projectId,t.scope,[t.key])]),versions:m.mutation.versions};return{entry:m.entry,mutation:f}}async resolve(e){let t=this.store.list({projectId:e.projectId}),r=t.filter((S)=>this.applies(S,e)).sort((S,A)=>this.rank(S.scope.type)-this.rank(A.scope.type)),a=new Map,m=new Set;for(let S of r){if(a.has(S.key))m.add(S.key);a.set(S.key,S)}let f={},v={},w=[],k=new Set(e.allowedPreviewSecrets??[]);for(let[S,A]of a){if(e.previewId&&A.kind==="secret"&&A.scope.type!=="preview"&&(!e.trustedPreview||!k.has(S)))continue;if(A.kind==="variable")f[S]=A.value??"";else if(e.nativeReferences)f[S]=A.secretRef;else{let x=this.backend(A.backend);if(!await x.validate(A.secretRef)){if(w.push({key:S,code:"stale_reference",message:`${S} points to an unavailable secret.`}),A.required)w.push({key:S,code:"missing_required",message:`${S} is required but unavailable.`});continue}f[S]=await x.resolve(A.secretRef)}v[S]=Kv(A,{inherited:A.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:m.has(S),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),A.id])}return{values:f,entries:v,warnings:w,configurationHash:this.fingerprint([...a.values()].map((S)=>`${S.key}:${S.valueFingerprint}:${S.version}`).sort().join(`
-`))}}async reveal(e){let t=this.store.get(e.entryId);if(!t||t.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let r=await this.backend(t.backend).resolve(t.secretRef);return this.audit(t.projectId,e.actorId,"configuration.secret.revealed",t,[]),r}async remove(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");let r=this.store.dependencies(t.id);if(((t.scope.environmentId?this.store.controlPlane.listEnvironments(t.projectId).some((v)=>v.id===t.scope.environmentId&&v.kind==="production"):t.scope.type==="project")||r.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(t.kind==="secret"&&t.backend!=="external")await this.backend(t.backend).remove(t.secretRef);this.store.remove(t.id,e.expectedVersion);let m=Cn(r.map((v)=>v.resourceId)),f={added:[],changed:[],removed:[t.key],unchanged:[],affectedResourceIds:m,versions:{}};return this.audit(t.projectId,e.actorId,"configuration.deleted",t,m),f}applies(e,t){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===t.environmentId;if(e.scope.type==="service")return e.scope.id===t.resourceId;if(e.scope.type==="function")return e.scope.id===t.functionId;return e.scope.id===t.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${NA("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let t=this.backends.get(e);if(!t)throw Error(`Configuration secret backend is not configured: ${e}`);return t}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((t)=>t.id===e.scope.environmentId&&t.kind==="production")}warnings(e,t){let r=[];if(MA.test(e))r.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(t)>65536)r.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return r}affectedResources(e,t,r){let a=this.store.list({projectId:e,scope:t}).filter((m)=>r.includes(m.key)).flatMap((m)=>this.store.dependencies(m.id).map((f)=>f.resourceId));if(t.type==="service"||t.type==="function")return Cn([...a,t.id]);if(t.type==="environment")return Cn([...a,...this.store.controlPlane.listResources(e,t.id).map((m)=>m.id)]);if(t.type==="preview"){let m=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(t.id);return Cn([...a,...m?[m.resource_id]:[]])}return Cn([...a,...this.store.controlPlane.listResources(e).map((m)=>m.id)])}audit(e,t,r,a,m){this.store.controlPlane.appendEvent({projectId:e,actorId:t,type:r,payload:{entryId:a.id,key:a.key,kind:a.kind,scopeType:a.scope.type,scopeId:a.scope.id,backend:a.backend,version:a.version,affectedResourceIds:m}})}}async function Au(e,t,r,a){let m={added:0,changed:0,removed:0,overridden:0},f=async(v,w)=>{let k=e.store.list({projectId:t.project.id,scope:v,kind:"variable"}),S=new Set(Object.keys(w));for(let A of k.filter((x)=>x.origin==="config"&&!S.has(x.key)))await e.remove({entryId:A.id,expectedVersion:A.version,confirmed:!0,actorId:a}),m.removed++;for(let[A,x]of Object.entries(w)){let F=e.store.find(t.project.id,v,A);if(F?.origin!=="config"){if(F)m.overridden++;else await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:v,key:A,kind:"variable",value:String(x),origin:"config",confirmed:!0,actorId:a}),m.added++;continue}if(F.value===String(x))continue;await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:v,key:A,kind:"variable",value:String(x),origin:"config",confirmed:!0,actorId:a,expectedVersion:F.version}),m.changed++}};for(let[v,w]of Object.entries(r.environments??{})){let k=t.environments.get(v);if(!k)continue;let S=w,A={...S.variables??{},...S.app?.env??{}};await f({type:"environment",id:k.id,environmentId:k.id},A);for(let[x,F]of Object.entries(r.sites??{})){let U=t.store.listResources(t.project.id,k.id).find((H)=>H.kind==="application"&&H.slug===x);if(U)await f({type:"service",id:U.id,environmentId:k.id,resourceId:U.id},{...F.env??{}})}for(let[x,F]of Object.entries(r.infrastructure?.functions??{})){let U=t.store.listResources(t.project.id,k.id).find((H)=>H.kind==="function"&&H.slug===x);if(U)await f({type:"function",id:U.id,environmentId:k.id,resourceId:U.id},{...F.environment??{}})}}return m}var BA=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,a,m]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:a,stderr:m}};class Fl{async scan(e,t){return qn(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return BA(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var LA=ot,FA=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class rn{provider;transport;discoverer;constructor(e,t=new Fl,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:LA(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,FA);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Ul(e,t){return{"fleet.bootstrap":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},m=e.get(String(a.serverId??""));if(!m)throw Error("Queued fleet server was not found.");let f=t.find((k)=>k.provider===m.provider);if(!f)throw Error(`No ${m.provider} fleet driver is configured.`);let v=Array.isArray(a.steps)?a.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),m.trustState!=="pinned"||!m.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let w=await f.bootstrap(m,v);return e.update(m.id,{bootstrapVersion:w.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:m.id,bootstrapVersion:w.version,steps:v.length}}}}var ni=(e)=>e==null?void 0:String(e),bs=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Om=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:ni(e.provider_id),region:ni(e.region),zone:ni(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:ni(e.host_key_algorithm),hostKeyFingerprint:ni(e.host_key_fingerprint),pendingHostKey:ni(e.pending_host_key),roles:bs(e.roles,[]),labels:bs(e.labels,{}),taints:bs(e.taints,[]),capacity:bs(e.capacity,{}),usage:bs(e.usage,{}),capabilities:bs(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:bs(e.validation,void 0),bootstrapVersion:ni(e.bootstrap_version),heartbeatAt:ni(e.heartbeat_at),lastSeenAt:ni(e.last_seen_at),archivedAt:ni(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class aa{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?Om(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(Om).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let a=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return a?Om(a):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let a={...r,...t},m=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[a.name,a.providerId??null,a.region??null,a.zone??null,a.endpoint,a.sshUser,a.sshPort,a.credentialRef,a.hostKeyAlgorithm??null,a.hostKeyFingerprint??null,a.pendingHostKey??null,JSON.stringify(a.roles),JSON.stringify(a.labels),JSON.stringify(a.taints),JSON.stringify(a.capacity),JSON.stringify(a.usage),JSON.stringify(a.capabilities),a.status,a.trustState,JSON.stringify(a.validation??{}),a.bootstrapVersion??null,a.heartbeatAt??null,a.lastSeenAt??null,a.archivedAt??null,m,e]),this.get(e)}}var zA=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class ca{store;drivers;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.drivers=t;this.now=a;this.queue=r??new c(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!zA.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),a=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:a.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),a=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))a.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let v of["curl","tar"])if(!r.tools?.[v])a.push({code:`tool.${v}`,severity:"error",message:`${v} is missing.`,remediation:`Install ${v} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)a.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)a.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let m={valid:!a.some((v)=>v.severity==="error"),facts:r,findings:a,validatedAt:this.now().toISOString(),validatorVersion:"1"},f={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:m,capacity:f,status:m.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let a=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:a};let m=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:a},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:a,operation:m}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let a=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:a,lastSeenAt:a,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as $m,createPublicKey as Qv,verify as UA}from"node:crypto";function nn(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(nn).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${nn(e[t])}`).join(",")}}`}var Gl=(e)=>$m("sha256").update(nn(e)).digest("hex"),zi=(e)=>$m("sha256").update(nn(e)).digest("hex"),ql=(e)=>$m("sha256").update(Qv(e).export({type:"spki",format:"der"})).digest("hex");function Vl(e,t,r){try{return UA(null,Buffer.from(nn(e)),Qv(r),Buffer.from(t,"base64"))}catch{return!1}}var Jv=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),Gv=(e,t)=>{let r=Jv(e),a=Jv(t);for(let m=0;m<3;m++){let f=(r[m]??0)-(a[m]??0);if(f)return f}return 0};function jl(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&Gv(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(Gv(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((a)=>a.platform===t.platform&&a.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var Ri=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},qr=(e)=>e==null?void 0:String(e),qA=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:qr(e.revoked_at),createdAt:String(e.created_at)}),Yv=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:Ri(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:Ri(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),Zv=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:Ri(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Xv=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:qr(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:Ri(e.health_gate,{}),status:String(e.status),currentStage:qr(e.current_stage),backupId:qr(e.backup_id),approvedBy:qr(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Nm=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:qr(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:Ri(e.evidence,{}),error:qr(e.error),startedAt:qr(e.started_at),finishedAt:qr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),eb=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:Ri(e.criteria,{}),candidates:Ri(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:qr(e.confirmation),expiresAt:String(e.expires_at),result:Ri(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),tb=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:qr(e.backup_policy_id),recoveryPointId:qr(e.recovery_point_id),topologyId:qr(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:qr(e.operation_id),evidence:Ri(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:qr(e.error),startedAt:qr(e.started_at),finishedAt:qr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ma{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),a=ql(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,a,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?qA(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Vl(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=jl(e.document,e.current),a=Gl(e.document),m=this.id(),f=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[m,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,a,JSON.stringify(e.document),e.signature,JSON.stringify(r),f]),this.manifest(m)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Yv(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Yv)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?Zv(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map(Zv)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),a=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,a,a]),e.targets.forEach((m,f)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,m.serverId??null,m.target,e.strategy==="canary"?f===0?0:1+Math.floor((f-1)/e.batchSize):Math.floor(f/e.batchSize),m.previousVersion,a,a])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Xv(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Xv)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map(Nm)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[a.status,a.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let a={...Nm(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.evidence),a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),Nm(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((v,w)=>v.id.localeCompare(w.id)),r=zi(t),a=this.id(),m=this.now().toISOString(),f=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[a,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((v,w)=>v+w.bytes,0),f,m,m]),this.cleanup(a)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?eb(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(eb)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let a={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[a.status,a.confirmation??null,JSON.stringify(a.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?tb(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(tb)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let a={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,JSON.stringify(a.evidence),a.measuredRpoMinutes??null,a.measuredRtoMinutes??null,a.cleanupVerified?1:0,a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function ch(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let a=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!a)return!1;let m=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),f=Number(m.find((w)=>w.type==="hour")?.value)*60+Number(m.find((w)=>w.type==="minute")?.value),v=Number(a[1])*60+Number(a[2]);return f>=v&&f<v+e.durationMinutes}class ha{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new c(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a=r.windowId?this.store.window(r.windowId):void 0;if(a&&!a.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(a&&!t.overrideWindow&&!ch(a,this.now()))throw Error("Upgrade is outside its maintenance window.");if(a?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let m=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:m}}async previewCleanup(e,t){let r=t.find((a)=>a.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let a=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==a)throw Error(`Exact confirmation ${a} is required.`);let m=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:m}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var Mm=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function zl(e){return{"maintenance.upgrade":async(m)=>{let f=e.store.campaign(String(Mm(m.operation.input).campaignId??""));if(!f||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let v=e.store.manifest(f.manifestId);if(!v?.compatibility.compatible||v.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let w=v.document.artifacts.find((S)=>S.platform===process.platform&&S.architecture===process.arch)??v.document.artifacts[0];if(!w)throw Error("No update artifact matches this platform.");e.store.updateCampaign(f.id,{status:"running",currentStage:"preflight"});let k=[];try{for(let S of[...new Set(e.store.targets(f.id).map((A)=>A.cohort))].sort((A,x)=>A-x)){e.store.updateCampaign(f.id,{currentStage:`cohort:${S}`});for(let A of e.store.targets(f.id).filter((x)=>x.cohort===S)){m.throwIfCancellationRequested(),m.checkpoint(`download:${A.target}`,"Downloading signed platform artifact."),e.store.updateTarget(A.id,{status:"downloading",startedAt:new Date().toISOString()});let x=await e.platform.download({target:A,artifact:w,signal:m.signal});if(x.sha256!==w.sha256)throw Error(`Artifact checksum mismatch for ${A.target}.`);m.checkpoint(`install:${A.target}`,"Installing verified artifact."),e.store.updateTarget(A.id,{status:"installing"}),await e.platform.install({target:A,path:x.path,version:v.version,signal:m.signal}),k.push(A);let F=await e.platform.health({target:A,gate:f.healthGate});if(!F.healthy)throw Error(`Upgrade health gate failed for ${A.target}.`);e.store.updateTarget(A.id,{status:"healthy",evidence:F.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(f.id,{status:"succeeded",currentStage:void 0}),{campaignId:f.id,version:v.version,targets:k.length}}catch(S){e.store.updateCampaign(f.id,{status:"rolling_back",currentStage:"rollback"});for(let A of k.reverse())e.store.updateTarget(A.id,{status:"rolling_back"}),await e.platform.rollback({target:A,version:A.previousVersion,signal:m.signal}),e.store.updateTarget(A.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(f.id,{status:"rolled_back",currentStage:void 0}),S}},"maintenance.cleanup":async(m)=>{let f=e.store.cleanup(String(Mm(m.operation.input).planId??""));if(!f||f.status!=="approved")throw Error("Approved cleanup plan was not found.");if(zi([...f.candidates].sort((A,x)=>A.id.localeCompare(x.id)))!==f.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let v=e.cleanup?.find((A)=>A.kind===f.kind);if(!v)throw Error(`No ${f.kind} cleanup driver is configured.`);e.store.updateCleanup(f.id,{status:"running"});let w=[],k=[];for(let A of f.candidates){m.throwIfCancellationRequested();try{await v.remove(A),w.push(A.id)}catch(x){k.push({id:A.id,error:x instanceof Error?x.message:String(x)})}}let S=k.length?w.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(f.id,{status:S,result:{removed:w,failed:k,reclaimedBytes:f.candidates.filter((A)=>w.includes(A.id)).reduce((A,x)=>A+x.bytes,0)}}),k.length)throw Error(`Cleanup failed for ${k.length} candidate(s).`);return{planId:f.id,removed:w.length,reclaimedBytes:f.estimatedBytes}},"maintenance.drill":async(m)=>{let f=e.store.drill(String(Mm(m.operation.input).drillId??""));if(!f)throw Error("DR drill was not found.");let v=e.recovery?.find((x)=>x.scenario===f.scenario);if(!v)throw Error(`No ${f.scenario} recovery driver is configured.`);let w=new Date;e.store.updateDrill(f.id,{status:"restoring",startedAt:w.toISOString()});let k=f.isolatedTarget,S={},A={};try{m.checkpoint("restore","Restoring into isolated drill target.");let x=await v.restore({drill:f,signal:m.signal});if(!x.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");k=x.target,S=x.evidence;let F=(w.getTime()-new Date(x.recoveryPointAt).getTime())/60000;e.store.updateDrill(f.id,{status:"verifying",measuredRpoMinutes:F,evidence:{restore:S}}),m.checkpoint("verify","Running recovery health checks without production traffic.");let U=await v.verify({drill:f,target:k});A=U.evidence;let H=(Date.now()-w.getTime())/60000;if(!U.healthy||F>f.expectedRpoMinutes||H>f.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(f.id,{measuredRpoMinutes:F,measuredRtoMinutes:H,evidence:{restore:S,verify:A}})}catch(x){throw e.store.updateDrill(f.id,{status:"failed",error:x instanceof Error?x.message:String(x),evidence:{restore:S,verify:A}}),x}finally{e.store.updateDrill(f.id,{status:"cleaning"});try{await v.cleanup({drill:f,target:k});let x=e.store.drill(f.id);e.store.updateDrill(f.id,{status:x.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(x){e.store.updateDrill(f.id,{status:"cleanup_required",cleanupVerified:!1,error:x instanceof Error?x.message:String(x),finishedAt:new Date().toISOString()})}}return{drillId:f.id,status:e.store.drill(f.id).status}}}}class dh{transport;constructor(e){this.transport=e}download(e){return this.transport.download({target:e.target.target,url:e.artifact.url,signal:e.signal})}install(e){return this.transport.install({target:e.target.target,path:e.path,version:e.version,signal:e.signal})}health(e){return this.transport.health({target:e.target.target,gate:e.gate})}rollback(e){return this.transport.rollback({target:e.target.target,version:e.version,signal:e.signal})}}var rb={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class fa{kind;control;projectId;organizationId;constructor(e,t,r,a){this.kind=e;this.control=t;this.projectId=r;this.organizationId=a}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),a=rb[this.kind],m=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(a.select).all(m,r).map((v)=>({id:String(v.id),kind:this.kind,label:`${this.kind}:${String(v.id)}`,bytes:Number(v.bytes??0),metadata:{createdAt:String(v.created_at)}}))}async remove(e){if(this.control.database.run(rb[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}class lh{scenario;transport;constructor(e,t){this.scenario=e;this.transport=t}restore(e){return this.transport.restore({scenario:this.scenario,...e})}verify(e){return this.transport.verify({scenario:this.scenario,...e})}cleanup(e){return this.transport.cleanup({scenario:this.scenario,...e})}}var Gn=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Pn=(e)=>e==null?void 0:String(e),Ql=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),Zt=(e={})=>({...Ql(),...e});function nb(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:Pn(e.region),architecture:Pn(e.architecture),labels:Gn(e.labels,{}),requiredServerLabels:Gn(e.required_server_labels,{}),toleratedTaints:Gn(e.tolerated_taints,[]),capacity:Zt(Gn(e.capacity,{})),reserved:Gn(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:Pn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function ib(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Pn(e.environment_id),resourceId:String(e.resource_id),releaseId:Pn(e.release_id),poolId:String(e.pool_id),serverId:Pn(e.server_id),purpose:String(e.purpose),requirements:Gn(e.requirements,{}),decision:Gn(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function VA(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:Pn(e.resource_id),poolId:String(e.pool_id),placementId:Pn(e.placement_id),operationId:Pn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:Gn(e.build_spec,{}),credentialPolicy:Gn(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Pn(e.workspace),cacheKey:Pn(e.cache_key),artifactUri:Pn(e.artifact_uri),artifactDigest:Pn(e.artifact_digest),status:String(e.status),cleanupAt:Pn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class da{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(Zt(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?nb(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(nb)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a={...r,...t},m=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.reserved),JSON.stringify(a.capacity),a.concurrency,m,e]),this.getPool(e)}addMember(e,t,r={}){let a=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),a,a])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:Gn(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(ib);return t?.length?r.filter((a)=>t.includes(a.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?ib(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),a=t?r.filter((m)=>String(m.server_id)===t):r;return{resources:a.reduce((m,f)=>{let v=Zt(Gn(f.resources,{}));for(let w of Object.keys(m))m[w]+=v[w];return m},Ql()),count:a.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),a=this.now().toISOString(),m=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,a,a]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(Zt(e.requirements.resources)),m,a,a]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let a=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,a,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[a,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?VA(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let a={...r,...t},m=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[a.operationId??null,a.workspace??null,a.cacheKey??null,a.artifactUri??null,a.artifactDigest??null,a.status,a.cleanupAt??null,m,e]),this.getBuild(e)}}var bu=["cpu","memoryBytes","diskBytes","gpu"],ob=(e,t={})=>Object.entries(t).every(([r,a])=>e[r]===a),WA=(e,t,r)=>Object.fromEntries(bu.map((a)=>[a,Math.max(0,e[a]-t[a]-(r[a]??0))])),HA=(e,t)=>bu.every((r)=>e[r]>=(t[r]??0)),KA=(e,t)=>bu.reduce((r,a)=>r+(t[a]??0)/(e[a]||1),0);class la{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let a=[];for(let m of this.store.listPools(e)){if(m.id===r)continue;let f=[];if(m.status!=="active")f.push(`pool is ${m.status}`);if(m.purpose!==t.purpose)f.push(`purpose is ${m.purpose}`);if(t.region&&m.region!==t.region)f.push(`region is ${m.region??"unset"}`);if(t.architecture&&m.architecture!==t.architecture)f.push(`architecture is ${m.architecture??"unset"}`);if(!ob(m.labels,t.labels))f.push("pool labels do not match");if(m.backend==="server"){let v=this.store.members(m.id);if(!v.length)a.push(this.decision(m,void 0,t,[...f,"pool has no servers"]));for(let w of v){let k=this.fleet.get(w.serverId),S=[...f];if(!k)S.push("server is missing");else this.serverReasons(m,k,w.status,t,S);a.push(this.decision(m,k,t,S,w.capacityOverride))}}else a.push(this.decision(m,void 0,t,f))}return a.sort((m,f)=>Number(f.eligible)-Number(m.eligible)||m.score.cost-f.score.cost||m.score.spread-f.score.spread||m.score.fit-f.score.fit||m.poolName.localeCompare(f.poolName)||(m.serverId??"").localeCompare(f.serverId??""))}serverReasons(e,t,r,a,m){if(r!=="active")m.push(`member is ${r}`);if(t.status!=="ready")m.push(`server is ${t.status}`);if(!t.roles.includes(a.purpose==="build"?"build":a.purpose))m.push(`server lacks ${a.purpose} role`);if(!ob(t.labels,e.requiredServerLabels))m.push("server labels do not match pool selector");for(let f of t.taints)if(!e.toleratedTaints.includes(f))m.push(`taint ${f} is not tolerated`)}decision(e,t,r,a,m={}){let f=Zt({...t?.capacity,...m}),v=t?Object.fromEntries(bu.map((S)=>[S,Math.min(e.capacity[S],f[S])])):e.capacity,w=this.store.activeUsage(e.id,t?.id),k=WA(v,w.resources,e.reserved);if(w.count>=e.maxWorkloads)a.push("workload limit reached");if(r.purpose==="build"&&w.count>=e.concurrency)a.push("build concurrency reached");if(!HA(k,r.resources))a.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:a.length===0,reasons:a,available:k,score:{fit:KA(k,r.resources),spread:w.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],a=[];for(let m of this.store.listPlacements(t.projectId,["reserved","active"]).filter((f)=>f.poolId===e)){if(m.stateful){a.push(this.store.transitionPlacement(m.id,"blocked"));continue}this.store.transitionPlacement(m.id,"moving");let f=this.place({projectId:m.projectId,environmentId:m.environmentId,resourceId:m.resourceId,releaseId:m.releaseId,requirements:m.requirements});r.push(this.activate(f.id)),this.store.transitionPlacement(m.id,"released")}return{pool:t,moved:r,blocked:a}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a=[],m=[];for(let f of this.store.listPlacements(r.projectId,["reserved","active"]).filter((v)=>v.poolId===e&&v.serverId===t)){if(f.stateful){m.push(this.store.transitionPlacement(f.id,"blocked"));continue}this.store.transitionPlacement(f.id,"moving");let v=this.poolCandidates(f.projectId,f.requirements).find((k)=>k.eligible);if(!v){m.push(this.store.transitionPlacement(f.id,"blocked"));continue}let w=this.store.reserve({projectId:f.projectId,environmentId:f.environmentId,resourceId:f.resourceId,releaseId:f.releaseId,requirements:f.requirements,decision:v});a.push(this.activate(w.id)),this.store.transitionPlacement(f.id,"released")}return{moved:a,blocked:m}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],a=[];for(let m of this.store.listPlacements(t.projectId,["active"]).filter((f)=>f.serverId===e)){if(m.stateful||!m.autoReschedule){a.push(this.store.transitionPlacement(m.id,"blocked"));continue}this.store.transitionPlacement(m.id,"failed");let f=this.place({projectId:m.projectId,environmentId:m.environmentId,resourceId:m.resourceId,releaseId:m.releaseId,requirements:m.requirements});r.push(this.activate(f.id))}return{rescheduled:r,blocked:a}}}class oh{store;placement;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.placement=t;this.now=a;this.queue=r??new c(e.control)}enqueue(e){if(!/^[a-f0-9]{7,64}$/i.test(e.sourceSha))throw Error("A pinned source commit SHA is required.");let t={purpose:"build",resources:{cpu:1,memoryBytes:1073741824,diskBytes:5368709120},leaseSeconds:3600,...e.requirements},r=this.placement.place({projectId:e.projectId,resourceId:e.resourceId,requirements:t}),a=new Date(this.now().getTime()+900000).toISOString(),m=this.store.createBuild({projectId:e.projectId,resourceId:e.resourceId,poolId:r.poolId,placementId:r.id,sourceSha:e.sourceSha,buildSpec:e.buildSpec,tokenExpiresAt:a}),f=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"build.remote",input:{buildId:m.id},lockKey:`build:${m.id}`,providerKey:`pool:${r.poolId}`,buildSlot:!0,timeoutSeconds:3600,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return m=this.store.updateBuild(m.id,{operationId:f.id}),m}cancel(e){let t=this.store.getBuild(e);if(!t)throw Error("Remote build was not found.");if(t.operationId)this.queue.requestCancellation(t.operationId);return this.store.updateBuild(e,{status:"cancelled"})}}var JA=/^sha256:[a-f0-9]{64}$/,GA=/^(?:s3|https|oci):\/\//;function fy(e,t){return{"build.remote":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},m=e.getBuild(String(a.buildId??""));if(!m)throw Error("Queued remote build was not found.");let f=e.getPool(m.poolId);if(!f||f.purpose!=="build"||f.status!=="active")throw Error("The selected build pool is unavailable.");if(!f.ephemeralWorkspaces)throw Error("Remote builds require an ephemeral workspace pool.");if(m.credentialPolicy.productionSecrets||f.allowProductionSecrets)throw Error("Production secrets are forbidden in remote build workers.");if(new Date(m.credentialPolicy.shortLivedTokenExpiresAt)<=new Date)throw Error("The short-lived build credential has expired.");let v=t.find((k)=>k.backend===f.backend);if(!v)throw Error(`No ${f.backend} remote build driver is configured.`);let w=`build://${f.id}/${m.id}`;e.updateBuild(m.id,{status:"running",workspace:w}),r.checkpoint("checkout",`Preparing isolated workspace for ${m.sourceSha}.`);try{r.throwIfCancellationRequested(),r.checkpoint("build","Executing resource-limited build.");let k=await v.run({build:e.getBuild(m.id),pool:f,signal:r.signal,log:(S)=>r.log(S,{stream:"stdout"})});if(r.throwIfCancellationRequested(),!JA.test(k.artifactDigest)||!GA.test(k.artifactUri))throw Error("Builder returned an unverified artifact reference.");return e.updateBuild(m.id,{status:"uploading",cacheKey:k.cacheKey,artifactUri:k.artifactUri,artifactDigest:k.artifactDigest}),r.checkpoint("verify","Verified content-addressed artifact upload."),await v.cleanup({build:e.getBuild(m.id),pool:f}),e.updateBuild(m.id,{status:"succeeded",workspace:void 0,cleanupAt:new Date().toISOString()}),{buildId:m.id,artifactUri:k.artifactUri,artifactDigest:k.artifactDigest,cacheKey:k.cacheKey??null}}catch(k){try{await v.cleanup({build:e.getBuild(m.id),pool:f}),e.updateBuild(m.id,{status:r.cancellationRequested()?"cancelled":"failed",workspace:void 0,cleanupAt:new Date().toISOString()})}catch{e.updateBuild(m.id,{status:"cleanup_required"})}throw k}}}}class ji{backend;transport;handles=new Map;constructor(e,t){this.backend=e;this.transport=t}async run({build:e,pool:t,signal:r,log:a}){let m=await this.transport.provision({backend:this.backend,pool:t,build:e,tokenExpiresAt:e.credentialPolicy.shortLivedTokenExpiresAt});return this.handles.set(e.id,m.handle),a(`${this.backend} builder provisioned`),await this.transport.execute({handle:m.handle,spec:e.buildSpec,sourceSha:e.sourceSha,signal:r,onLog:a}),this.transport.publish({handle:m.handle,sourceSha:e.sourceSha})}async cleanup({build:e}){let t=this.handles.get(e.id);if(!t)return;await this.transport.destroy({handle:t}),this.handles.delete(e.id)}}var Ay=(e)=>new ji("server",e),yy=(e)=>new ji("ecs",e),Iy=(e)=>new ji("asg",e);var Ai=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Ln=(e)=>e==null?void 0:String(e),sb=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Ln(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:Ai(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:Ai(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:Ln(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bm=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:Ln(e.stack_id),stackRevision:Ln(e.stack_revision),status:String(e.status),health:Ai(e.health,{}),lastHealthyAt:Ln(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Lm=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:Ai(e.config,{}),status:String(e.status),checkpoint:Ln(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:Ln(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),eg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:Ai(e.weights,{}),desiredWeights:Ai(e.desired_weights,{}),status:String(e.status),providerState:Ai(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),ab=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:Ln(e.operation_id),kind:String(e.kind),requestedRegion:Ln(e.requested_region),revision:Ln(e.revision),plan:Ai(e.plan,[]),currentStep:Ln(e.current_step),completedSteps:Ai(e.completed_steps,[]),status:String(e.status),error:Ln(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ua{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((f)=>f.region)).size!==e.regions.length||e.regions.filter((f)=>f.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((f)=>f.role==="primary"),r=this.id(),a=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,a,a]);for(let f of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,f.region,f.role,f.provider,a,a]);for(let f of e.dataPolicy.replicate)for(let v of e.regions)for(let w of e.regions.filter((k)=>k.region!==v.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,f,v.region,w.region,"{}",a,a]);let m=Object.fromEntries(e.regions.map((f)=>[f.region,f.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(m),JSON.stringify(m),a,a]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?sb(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(sb)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(Bm)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(Lm)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?eg(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let a={...r,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[a.status,a.activeRegion,a.revision??null,JSON.stringify(a.regions),m,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let a=Bm(r),m={...a,...t},f=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[m.role,m.stackId??null,m.stackRevision??null,m.status,JSON.stringify(m.health),m.lastHealthyAt??null,f,e]),Bm(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let a=Lm(r),m={...a,...t},f=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[m.status,m.checkpoint??null,m.lagSeconds??null,m.lastVerifiedAt??null,f,e]),Lm(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let a=eg(r),m={...a,...t},f=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(m.weights),JSON.stringify(m.desiredWeights),m.status,JSON.stringify(m.providerState),f,e]),eg(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?ab(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(ab)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let a={...r,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[a.operationId??null,a.currentStep??null,JSON.stringify(a.completedSteps),a.status,a.error??null,m,e]),this.execution(e)}}class pa{store;queue;constructor(e,t){this.store=e;this.queue=t??new c(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let m=this.store.targets(e),f=this.store.channels(e);if(t==="rollout")return[...m.filter((v)=>v.role==="secondary").map((v)=>`apply:${v.region}`),...m.filter((v)=>v.role==="primary").map((v)=>`apply:${v.region}`),...f.map((v)=>`replicate:${v.kind}:${v.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...m.filter((v)=>v.role==="secondary").map((v)=>`delete:${v.region}`),...m.filter((v)=>v.role==="primary").map((v)=>`delete:${v.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((f)=>f.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),a=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),m=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:a.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(a.id,{operationId:m.id}),{execution:this.store.execution(a.id),operation:m}}}var QA=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function Hl(e,t){let r=(S)=>{let A=t.find((x)=>x.provider===S.provider);if(!A)throw Error(`No ${S.provider} regional driver is configured.`);return A},a=(S,A,x)=>{S.throwIfCancellationRequested(),S.checkpoint(x,x),e.updateExecution(A.id,{status:"running",currentStep:x,completedSteps:[...e.execution(A.id).completedSteps,x]})},m=async(S,A)=>{let x=e.route(S.id);if(!x)throw Error("Regional traffic route was not found.");let F=e.targets(S.id).find((H)=>H.region===S.activeRegion)??e.targets(S.id)[0];if(!F)throw Error("Regional traffic target was not found.");e.updateRoute(x.id,{status:"applying",desiredWeights:A});let U=await r(F).applyTraffic({route:e.route(S.id),topology:S,weights:A});e.updateRoute(x.id,{status:Object.values(A).every((H)=>H===0)?"drained":"in_sync",weights:A,providerState:U.providerState})},f=async(S,A,x,F)=>{e.updateTopology(x.id,{status:"provisioning"});let U=A.revision,H=F.manifest??{},K=e.targets(x.id).sort((oe,pe)=>Number(oe.role==="primary")-Number(pe.role==="primary"));for(let oe of K){a(S,A,`apply:${oe.region}`),e.updateTarget(oe.id,{status:"provisioning"});let pe=await r(oe).applyStack({target:oe,revision:U,manifest:H,signal:S.signal}),ee=await r(oe).health({target:e.updateTarget(oe.id,{stackId:pe.stackId,stackRevision:U})});if(!ee.healthy)throw Error(`Regional health gate failed in ${oe.region}.`);e.updateTarget(oe.id,{status:"ready",health:ee.evidence,lastHealthyAt:new Date().toISOString()})}for(let oe of e.channels(x.id)){a(S,A,`replicate:${oe.kind}:${oe.targetRegion}`),e.updateChannel(oe.id,{status:"configuring"});let pe=K.find((Ee)=>Ee.region===oe.sourceRegion),ee=await r(pe).configureReplication({channel:oe,topology:x}),ce=await r(pe).verifyReplication({channel:e.updateChannel(oe.id,{checkpoint:ee.checkpoint,lagSeconds:ee.lagSeconds}),topology:x});if(!ce.healthy||ce.lagSeconds>x.dataPolicy.maxLagSeconds)throw Error(`${oe.kind} replication to ${oe.targetRegion} exceeds the RPO.`);e.updateChannel(oe.id,{status:"in_sync",checkpoint:ce.checkpoint,lagSeconds:ce.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(S,A,"traffic:activate");let X=Object.fromEntries(x.regions.map((oe)=>[oe.region,oe.region===x.activeRegion?100:0]));return await m(x,X),e.updateTopology(x.id,{status:"ready",revision:U}),{revision:U,activeRegion:x.activeRegion}},v=async(S,A,x)=>{let F=A.requestedRegion,U=e.targets(x.id).find((X)=>X.region===F);if(!U)throw Error("Requested regional target was not found.");e.updateTopology(x.id,{status:A.kind==="failover"?"failing_over":"failing_back"}),a(S,A,`health:${F}`);let H=await r(U).health({target:U});if(!H.healthy)throw Error(`Target region ${F} is unhealthy.`);e.updateTarget(U.id,{status:"ready",health:H.evidence,lastHealthyAt:new Date().toISOString()}),a(S,A,`replication:${F}`);for(let X of e.channels(x.id).filter((oe)=>oe.targetRegion===F)){let oe=await r(U).verifyReplication({channel:X,topology:x});if(!oe.healthy||oe.lagSeconds>x.dataPolicy.maxLagSeconds)throw Error(`${X.kind} replication is outside the failover RPO.`);e.updateChannel(X.id,{status:"in_sync",checkpoint:oe.checkpoint,lagSeconds:oe.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(S,A,`traffic:${F}`),await m(x,Object.fromEntries(x.regions.map((X)=>[X.region,X.region===F?100:0]))),a(S,A,`roles:${F}`);let K=x.regions.map((X)=>({...X,role:X.region===F?"primary":"secondary"}));for(let X of e.targets(x.id))e.updateTarget(X.id,{role:X.region===F?"primary":"secondary"});return e.updateTopology(x.id,{status:A.kind==="failover"?"failed_over":"ready",activeRegion:F,regions:K}),{activeRegion:F}},w=async(S,A,x,F)=>{e.updateTopology(x.id,{status:"destroying"}),a(S,A,"traffic:drain"),await m(x,Object.fromEntries(x.regions.map((H)=>[H.region,0])));let U=F.deleteData!==!0;for(let H of e.targets(x.id).sort((K,X)=>Number(K.role==="primary")-Number(X.role==="primary")))a(S,A,`delete:${H.region}`),e.updateTarget(H.id,{status:"deleting"}),await r(H).deleteStack({target:H,retainData:U,signal:S.signal}),e.updateTarget(H.id,{status:"deleted"});return a(S,A,"complete"),e.updateTopology(x.id,{status:"destroyed"}),{destroyed:!0,dataRetained:U}},k=async(S)=>{let A=QA(S.operation.input),x=e.execution(String(A.executionId??""));if(!x)throw Error("Regional execution was not found.");let F=e.get(x.topologyId);if(!F)throw Error("Regional topology was not found.");try{let U;if(x.kind==="rollout")U=await f(S,x,F,A);else if(x.kind==="failover"||x.kind==="failback")U=await v(S,x,F);else if(x.kind==="destroy")U=await w(S,x,F,A);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(x.id,{status:"succeeded",currentStep:void 0}),{executionId:x.id,...U}}catch(U){if(e.updateExecution(x.id,{status:S.cancellationRequested()?"cancelled":"failed",error:U instanceof Error?U.message:String(U)}),e.get(F.id)?.status!=="destroyed")e.updateTopology(F.id,{status:"failed"});throw U}};return{"region.rollout":k,"region.failover":k,"region.failback":k,"region.destroy":k,"region.reconcile":k}}class ah{transport;provider="aws";constructor(e){this.transport=e}async applyStack({target:e,revision:t,manifest:r}){return this.transport.applyCloudFormation({region:e.region,stackId:e.stackId,revision:t,manifest:r})}async deleteStack({target:e,retainData:t}){if(!e.stackId)return;await this.transport.deleteCloudFormation({region:e.region,stackId:e.stackId,retainData:t})}async health({target:e}){if(!e.stackId)return{healthy:!1,evidence:{reason:"stack is not provisioned"}};return this.transport.stackHealth({region:e.region,stackId:e.stackId})}async configureReplication({channel:e}){let t={sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,config:e.config};if(e.kind==="s3")return this.transport.configureS3Replication(t);if(e.kind==="dynamodb")return this.transport.configureDynamoGlobalTable(t);return this.transport.replicateSecrets(t)}async verifyReplication({channel:e}){return this.transport.verifyReplication({kind:e.kind,sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,checkpoint:e.checkpoint})}async applyTraffic({route:e,weights:t}){return this.transport.applyEdge({hostname:e.hostname,weights:t,route53:e.dnsProvider==="route53",cloudFront:e.cdnEnabled,waf:e.wafEnabled})}}class ga{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function ge(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function Wm(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function yt(e,t,r=["exec","files"]){let a=Wm(t);for(let m of e)a[m]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(m),requiresRecentAuth:r.includes(m)};return a}var YA=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function Pe(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function Ne(e){if(Array.isArray(e))return e.map((r)=>Ne(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=YA.test(r)?"[REDACTED]":Ne(a);return t}function It(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function Rl(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function ZA(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function Dl(e,t={},r={}){let a=t.now??new Date,m=Math.max(100,r.timeoutMs??1e4),f=Math.max(1,r.staleAfterSeconds??60),v=await Promise.all(e.map(async(k)=>{try{let S=await Promise.race([k.discover({...t,now:a}),new Promise((A,x)=>setTimeout(()=>x(Error(`Runtime source ${k.id} timed out after ${m}ms`)),m))]);return{workloads:S,source:{id:k.id,provider:k.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:f,itemCount:S.length}}}catch(S){return{workloads:[],source:{id:k.id,provider:k.provider,status:ZA(S),discoveredAt:a.toISOString(),staleAfterSeconds:f,itemCount:0,message:String(S?.message??S).slice(0,500)}}}})),w=v.map((k)=>k.source);return{generatedAt:a.toISOString(),workloads:v.flatMap((k)=>k.workloads).sort((k,S)=>k.name.localeCompare(S.name)||k.id.localeCompare(S.id)),sources:w,degraded:w.some((k)=>k.status!=="fresh")}}function Ma(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function Pl(e,t,r,a="ecs:aws",m=[]){let f=r.now??new Date;return e.map((v)=>{let w=v.serviceName??Ma(v.serviceArn),k=t.filter((oe)=>!v.clusterArn||oe.clusterArn===v.clusterArn),S=k.some((oe)=>!!oe.group)?k.filter((oe)=>oe.group===`service:${w}`):k,A=v.status==="ACTIVE"?(v.runningCount??0)<(v.desiredCount??0)?"degraded":"running":Pe(v.status),x=m.find((oe)=>oe.taskDefinitionArn===v.taskDefinition),F=Array.isArray(x?.containerDefinitions)?x.containerDefinitions:[],U=[...new Set(F.map((oe)=>oe.logConfiguration?.options?.["awslogs-group"]).filter((oe)=>typeof oe==="string"))],H=F.flatMap((oe)=>(oe.mountPoints??[]).map((pe)=>({source:pe.sourceVolume,target:pe.containerPath,type:"volume",readOnly:!!pe.readOnly}))),K=F.flatMap((oe)=>(oe.portMappings??[]).map((pe,ee)=>({id:`${oe.name??"container"}:${ee}`,name:oe.name,mode:x?.networkMode,ports:[{container:pe.containerPort,host:pe.hostPort,protocol:pe.protocol}]}))),X=r.project&&r.environment&&w.startsWith(`${r.project}-${r.environment}-`)?w.slice(`${r.project}-${r.environment}-`.length):w;return{id:ge("ecs",a,v.serviceArn??w),provider:"ecs",kind:"service",name:w,status:A,rawStatus:v.status,health:A==="running"?"healthy":A==="failed"||A==="degraded"?"unhealthy":"unknown",desiredReplicas:v.desiredCount,runningReplicas:v.runningCount,image:F[0]?.image,runtime:v.launchType??"ECS",version:Ma(v.taskDefinition),ageSeconds:It(v.deployments?.[0]?.createdAt,f),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:X,release:Ma(v.taskDefinition),providerId:v.serviceArn},replicas:S.map((oe)=>{let pe=Pe(oe.lastStatus);return{id:ge("ecs",a,oe.taskArn??Ma(oe.taskArn)),name:Ma(oe.taskArn),status:pe,rawStatus:oe.lastStatus,createdAt:oe.createdAt,startedAt:oe.startedAt,stoppedAt:oe.stoppedAt,host:oe.containerInstanceArn,containers:(oe.containers??[]).map((ee)=>({id:ee.containerArn??ee.name??"container",name:ee.name??"container",image:F.find((ce)=>ce.name===ee.name)?.image,imageDigest:ee.imageDigest,status:Pe(ee.lastStatus),rawStatus:ee.lastStatus,exitCode:ee.exitCode,reason:ee.reason,runtime:"ecs"}))}}),networks:K,mounts:H,capabilities:yt(["start","stop","restart","redeploy","scale","inspect",...U.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:Ne({clusterArn:v.clusterArn,taskDefinition:v.taskDefinition,launchType:v.launchType,pendingCount:v.pendingCount,deployments:v.deployments,logGroups:U,executionRoleArn:x?.executionRoleArn,taskRoleArn:x?.taskRoleArn,cpu:x?.cpu,memory:x?.memory}),discoveredAt:f.toISOString(),sourceId:a}})}function Nl(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((m)=>{let f=m.FunctionName??Ma(m.FunctionArn),v=m.State==="Active"?"running":Pe(m.State);return{id:ge("lambda",r,m.FunctionArn??f),provider:"lambda",kind:"function",name:f,status:v,rawStatus:m.State,health:v==="running"?"healthy":v==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:m.Runtime,version:m.Version,architecture:m.Architectures?.join(", "),ageSeconds:It(m.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:f,providerId:m.FunctionArn},resources:{memoryLimitBytes:m.MemorySize==null?void 0:m.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:yt(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:Ne({handler:m.Handler,timeout:m.Timeout,codeSize:m.CodeSize,stateReason:m.StateReason,environmentKeys:Object.keys(m.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function Jm(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function XA(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[m,f]=r.split("/");return(a??[]).map((v)=>({container:Number(m)||void 0,host:Number(v.HostPort)||void 0,protocol:f,address:v.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function eC(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function Xm(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((m)=>{let f=m.State?.OOMKilled?"oomkilled":m.State?.Restarting?"starting":m.State?.Status,v=Pe(f),w=(m.Name??m.Id.slice(0,12)).replace(/^\//,""),k=m.Config?.Labels??{},S=eC(m),A=XA(m),x={id:m.Id,name:w,image:m.Config?.Image,imageDigest:m.Image,runtime:"docker",status:v,rawStatus:f,exitCode:m.State?.ExitCode,reason:m.State?.Error,resources:{memoryLimitBytes:m.HostConfig?.Memory||void 0},networks:A,mounts:S};return{id:ge("docker",r,m.Id),provider:"docker",kind:"container",name:w,status:v,rawStatus:f,health:v==="running"?"healthy":v==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:v==="running"?1:0,image:m.Config?.Image,runtime:"docker",ageSeconds:It(m.State?.StartedAt,a),restartCount:m.RestartCount??0,tags:k,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:k["com.docker.compose.service"]??k["ts-cloud.service"]??w,release:k["ts-cloud.release"],providerId:m.Id},resources:x.resources,replicas:[{id:ge("docker",r,`${m.Id}:0`),name:w,status:v,rawStatus:f,startedAt:m.State?.StartedAt,stoppedAt:m.State?.FinishedAt,restartCount:m.RestartCount,containers:[x],resources:x.resources}],networks:A,mounts:S,capabilities:yt(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:Ne({image:m.Config?.Image,labels:k,environmentKeys:(m.Config?.Env??[]).map((F)=>F.split("=",1)[0]),networkMode:m.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class Vo{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return Xm(Jm(await this.inspect(e)),e,this.id)}}function Ym(e){let t=[];for(let r of e.split(`
-`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,m,f,v,w,k,S,A,x,F,U,H,K]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:m,active:f,sub:v,description:w,enabled:k,pid:Number(S)||void 0,memoryBytes:Rl(A),restartCount:Number(x)||0,activeSince:F||void 0,fragmentPath:U||void 0,workingDirectory:H?.startsWith("/")?H:void 0,user:K||void 0})}return t}function Zm(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((m)=>{let f=Pe(m.active==="active"?m.sub||m.active:m.active),v=m.unit.replace(/\.service$/,""),w=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(m.description??"")?.[1]??(t.project&&v.startsWith(`${t.project}-`)?v.slice(t.project.length+1).split("@",1)[0]:void 0),k=v.includes("@")?v.slice(v.indexOf("@")+1):void 0,S=m.workingDirectory?[{target:m.workingDirectory,type:"working-directory"}]:[],A=["start","stop","restart","logs","exec","inspect",...S.length?["files"]:[]];return{id:ge("systemd",r,m.unit),provider:"systemd",kind:"service",name:v,displayName:m.description||v,status:f,rawStatus:[m.load,m.active,m.sub].filter(Boolean).join("/"),health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:f==="running"?1:0,ageSeconds:It(m.activeSince,a),restartCount:m.restartCount,tags:{enabled:m.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:w,release:k,providerId:m.unit},resources:{memoryBytes:m.memoryBytes},replicas:[{id:ge("systemd",r,`${m.unit}:main`),name:"main",status:f,pid:m.pid,startedAt:m.activeSince,restartCount:m.restartCount,resources:{memoryBytes:m.memoryBytes}}],networks:[],mounts:S,capabilities:yt(A,S.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:Ne({fragmentPath:m.fragmentPath,workingDirectory:m.workingDirectory,user:m.user,environment:m.environment,enabled:m.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class jo{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return Zm(Ym(await this.read(e)),e,this.id)}}function tC(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function rC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function nC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function cb(e,t,r,a,m){let f=`${e}:${r.id}`,v=async()=>tC(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?rC():nC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:m,Role:"app"}}),f);return e==="systemd"?new jo(v,f):new Vo(v,f)}async function Su(e,t=100){let r=[],a;for(let m=0;m<t;m++){let f=await e(a);if(r.push(...f.items),!f.nextToken)return r;a=f.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class kl{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await Su(async(f)=>{let v=await this.client.listClusters({nextToken:f,maxResults:100});return{items:v.clusterArns??[],nextToken:v.nextToken}}),r=[],a=[],m=[];for(let f of t){let v=(await Su(async(w)=>{let k=await this.client.listServices(f,{nextToken:w,maxResults:100});return{items:k.serviceArns??[],nextToken:k.nextToken}})).filter((w)=>w.split("/").at(-1)?.startsWith(this.prefix));for(let w=0;w<v.length;w+=10){let k=await this.client.describeServices({cluster:f,services:v.slice(w,w+10)});r.push(...k.services??[])}for(let w of r.filter((k)=>k.clusterArn===f||!k.clusterArn)){let k=await Su(async(S)=>{let A=await this.client.listTasks(f,w.serviceName,{nextToken:S,maxResults:100});return{items:A.taskArns??[],nextToken:A.nextToken}});for(let S=0;S<k.length;S+=100){let A=await this.client.describeTasks(f,k.slice(S,S+100));a.push(...A.tasks??[])}}}if(this.client.describeTaskDefinition)for(let f of[...new Set(r.map((v)=>v.taskDefinition).filter((v)=>!!v))]){let v=await this.client.describeTaskDefinition(f);if(v.taskDefinition)m.push(v.taskDefinition)}return Pl(r,a,e,this.id,m)}}class Bl{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await Su(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return Nl(t,e,this.id)}}async function eh(e,t,r={}){let a=[],m=L(e),f=ue(e),v=e.aws?.profile,w=e.aws?.region??e.project.region??"us-east-1",k=`${e.project.slug}-${t}`;if(m!=="serverless"){let S=r.driver??B({config:e}),A=await S.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let x of A)a.push(cb("systemd",S,x,e,t)),a.push(cb("docker",S,x,e,t))}if(f==="aws")a.push(new kl(r.ecs??new Ze(w,v),k)),a.push(new Bl(r.lambda??new E(w,v),k));return a}async function ne(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await Dl(await eh(e,t,r),a)}catch(m){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:ue(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(m?.message??m).slice(0,500)}],degraded:!0}}}var db=65536,yc=49152,Eu=/^[A-Za-z0-9_.@:-]+\.service$/,Ru=/^[a-fA-F0-9]{12,128}$/,iC=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function La(e){let t=Buffer.from(e);return t.byteLength<=db?e:`${t.subarray(0,db-24).toString("utf8")}
-[output truncated]`}function wu(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function Fn(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function oC(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function sC(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,a=e.links.providerId||e.name;return r&&a?{cluster:r,service:a}:void 0}function aC(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function cC(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!Eu.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!Ru.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function th(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let w of t.split("/")){if(!w||w===".")continue;if(w===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(w)}let a=`/${r.join("/")}`;if(iC.some((w)=>a===w||a.startsWith(`${w}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let m=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),f=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...m&&f?[`/var/www/${m}/${f}`,`/srv/${m}/${f}`]:[],...e.mounts.map((w)=>w.target).filter((w)=>w.startsWith("/"))].some((w)=>a===w||a.startsWith(`${w.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:a}}function dC(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),a=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&a?[`/var/www/${r}/${a}`,`/srv/${r}/${a}`]:[],...e.mounts.map((m)=>m.target).filter((m)=>m.startsWith("/"))].sort((m,f)=>f.length-m.length).find((m)=>t===m||t.startsWith(`${m.replace(/\/$/,"")}/`))}var _l={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class me{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??ne(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,a){let m=this.dependencies.driver??B({config:this.config}),f=await m.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),v=aC(f,e);if(!v)throw Error("The workload server is no longer reachable in this scope.");return m.runRemoteDeploy({targets:[v],commands:t,timeoutSeconds:r,comment:a,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let a=t.capabilities[e.action];if(!a.supported)return{...r,ok:!1,error:a.reason??`${e.action} is unsupported for ${t.provider}.`};if(a.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(a.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let m=cC(t,e.action);if(!m)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let f=await this.remote(t,["set -uo pipefail",...m],60,`ts-cloud runtime:${e.action}`).catch(wu);return{...r,ok:f.success,command:m[0],stdout:La(f.perInstance?.[0]?.output??""),stderr:La(f.perInstance?.[0]?.error??f.error??""),error:f.success?void 0:f.error??"Runtime operation failed."}}if(t.provider==="ecs"){let m=sC(t);if(!m)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let f=this.dependencies.ecs??new Ze(this.region,this.profile);if(e.action==="scale"){let v=oC(e.replicas,t.desiredReplicas??1);return await f.scaleService(m.cluster,m.service,v),{...r,ok:!0,command:`ecs scale ${t.name} ${v}`}}if(e.action==="start"||e.action==="stop"){let v=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await f.scaleService(m.cluster,m.service,v),{...r,ok:!0,command:`ecs scale ${t.name} ${v}`}}if(e.action==="restart"||e.action==="redeploy")return await f.forceNewDeployment(m.cluster,m.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let a=e.preset&&_l[e.preset];if(!a&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let m=r.links.providerId??"",f;if(r.provider==="docker"&&Ru.test(m)){let w=e.command?.trim()||a.map(Fn).join(" ");f=`docker exec ${m} sh -lc ${Fn(w)}`}else if(r.provider==="systemd"&&Eu.test(m)&&e.preset)f=e.preset==="process"?`systemctl status ${m} --no-pager --full`:_l[e.preset].map(Fn).join(" ");if(!f)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let v=await this.remote(r,["set -uo pipefail",f],60,"ts-cloud runtime:exec").catch(wu);return{...t,ok:v.success,command:f,stdout:La(v.perInstance?.[0]?.output??""),stderr:La(v.perInstance?.[0]?.error??v.error??""),error:v.success?void 0:v.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:a,path:m,root:f,providerId:v}=r,k=`sh -c ${Fn('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${Fn(m)} ${yc} ${Fn(f)}`,S=a.provider==="docker"?`docker exec ${v} ${k}`:k,A=await this.remote(a,[S],30,"ts-cloud runtime:file-read").catch(wu);if(!A.success)return{...t,ok:!1,error:A.error??A.perInstance?.[0]?.error??"File read failed."};let x=A.perInstance?.[0]?.output??"",F=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(x);if(!F)return{...t,ok:!1,error:"The remote file response was invalid."};let U=Number(F[1]),H=x.slice((F.index??0)+F[0].length).replace(/\s+/g,"");if(Buffer.from(H,"base64").byteLength>yc)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:H,size:U,truncated:U>yc}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let a=Buffer.from(e.contentBase64,"base64");if(a.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(a.byteLength>yc)return{...t,ok:!1,error:`File uploads are limited to ${yc} bytes.`};let{workload:m,path:f,root:v,providerId:w}=r,S=`sh -c ${Fn('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${Fn(f)} ${Fn(v)}`,A=m.provider==="docker"?`printf %s ${Fn(e.contentBase64)} | docker exec -i ${w} ${S}`:`printf %s ${Fn(e.contentBase64)} | ${S}`,x=await this.remote(m,[A],30,"ts-cloud runtime:file-write").catch(wu);return{...t,ok:x.success,size:a.byteLength,truncated:!1,error:x.success?void 0:x.error??x.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=th(t,e.path);if(!r.ok)return{error:r.error};let a=dC(t,r.path),m=t.links.providerId??"";if(!a||t.provider==="systemd"&&!Eu.test(m)||t.provider==="docker"&&!Ru.test(m))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:a,providerId:m}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let a=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let A=this.dependencies.logs??new fe(this.region,this.profile),x=r.config.logGroups,F=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(x)&&typeof x[0]==="string"?x[0]:void 0;if(!F)throw Error("The ECS task definition does not declare an awslogs group.");let U=await A.filterLogEvents({logGroupName:F,startTime:t.since?.getTime(),limit:a}),H=(U.events??[]).slice(0,a).map((K)=>({timestamp:K.timestamp==null?void 0:new Date(K.timestamp).toISOString(),message:La(String(K.message??""))}));return{workloadId:e,provider:r.provider,lines:H,nextCursor:U.nextToken,truncated:(U.events?.length??0)>=a}}let m=r.links.providerId??"",f=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,v=r.provider==="systemd"&&Eu.test(m)?`journalctl -u ${m} --no-pager -n ${a} -o short-iso${f?` --since ${Fn(f.toISOString())}`:""}`:r.provider==="docker"&&Ru.test(m)?`docker logs --timestamps --tail ${a}${f?` --since ${Math.floor(f.getTime()/1000)}`:""} ${m} 2>&1`:void 0;if(!v)throw Error("Log target identity is invalid.");let w=await this.remote(r,[v],30,"ts-cloud runtime:logs");if(!w.success)throw Error(w.error??w.perInstance?.[0]?.error??"Log read failed.");let k=La(w.perInstance?.[0]?.output??""),S=k.split(`
-`).filter(Boolean).slice(-a).map((A)=>{let x=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(A);return{timestamp:x?.[1],message:x?.[2]??A}});return{workloadId:e,provider:r.provider,lines:S,truncated:k.includes("[output truncated]")||S.length>=a}}}import{randomUUID as lC}from"node:crypto";class zo{records=new Map;maxBufferBytes;ttlMs;now;constructor(e={}){this.maxBufferBytes=Math.max(1024,e.maxBufferBytes??262144),this.ttlMs=Math.max(1000,e.ttlMs??900000),this.now=e.now??(()=>new Date)}create(e,t){this.sweep();let r=this.now().toISOString(),a={id:lC(),workloadId:t,kind:e,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:r,updatedAt:r,abort:new AbortController,listeners:new Set};return this.records.set(a.id,a),this.snapshot(a,0)}signal(e){return this.records.get(e)?.abort.signal}append(e,t,r="stdout"){let a=this.records.get(e);if(!a||a.state!=="open"||!t)return a?this.snapshot(a,a.cursor):void 0;let m=Buffer.from(t),f=m.byteLength>this.maxBufferBytes?m.subarray(m.byteLength-this.maxBufferBytes).toString("utf8"):t,v={cursor:++a.cursor,stream:r,data:f,at:this.now().toISOString()};a.chunks.push(v),a.bufferedBytes+=Buffer.byteLength(f),a.updatedAt=v.at;while(a.bufferedBytes>this.maxBufferBytes&&a.chunks.length>1){let w=a.chunks.shift(),k=Buffer.byteLength(w.data);a.bufferedBytes-=k,a.droppedBytes+=k}return this.publish(a),this.snapshot(a,v.cursor-1)}read(e,t,r=0){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.updatedAt=this.now().toISOString(),this.snapshot(a,Math.max(0,Math.floor(r)))}close(e,t="complete",r){let a=this.records.get(e);if(!a||a.state!=="open")return a?this.snapshot(a,a.cursor):void 0;if(a.state=t,a.error=r,a.updatedAt=this.now().toISOString(),t==="cancelled")a.abort.abort();return this.publish(a),this.snapshot(a,a.cursor)}cancel(e,t){let r=this.records.get(e);if(!r||r.workloadId!==t)return;return this.close(e,"cancelled")}subscribe(e,t,r){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.listeners.add(r),()=>a.listeners.delete(r)}sweep(){let e=this.now().getTime()-this.ttlMs,t=0;for(let[r,a]of this.records){if(new Date(a.updatedAt).getTime()>e)continue;a.abort.abort(),this.records.delete(r),t++}return t}clear(){for(let e of this.records.values())e.abort.abort();this.records.clear()}snapshot(e,t){let r=e.chunks[0]?.cursor??e.cursor+1,a=t>0&&t<r-1;return{id:e.id,workloadId:e.workloadId,kind:e.kind,state:e.state,chunks:e.chunks.filter((m)=>a||m.cursor>t),cursor:e.cursor,reset:a,droppedBytes:e.droppedBytes,createdAt:e.createdAt,updatedAt:e.updatedAt,error:e.error}}publish(e){let t=this.snapshot(e,0);for(let r of e.listeners)r(t)}}import{createHash as uC}from"node:crypto";var ig={info:0,low:1,medium:2,high:3,critical:4},og={record:0,warn:1,block:2},lb=new Set(["skipped","unavailable","unsupported","stale"]);function hr(e){return typeof e==="string"?e:void 0}function wo(e,t){try{return JSON.parse(String(e))}catch{return t}}function Qn(e){return JSON.stringify(s(e))}function pC(e){if(!e)return;return String(s(e,2000))}function tg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:hr(e.project_id),environmentId:hr(e.environment_id),resourceId:hr(e.resource_id),releaseId:hr(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:hr(e.error),metadata:wo(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function ub(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:hr(e.project_id),environmentId:hr(e.environment_id),resourceId:hr(e.resource_id),releaseId:hr(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:wo(e.evidence,{}),remediation:hr(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:hr(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:hr(e.resolved_at),updatedAt:String(e.updated_at)}}function rg(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:hr(e.environment_id),name:String(e.name),rules:wo(e.rules,[]),requiredScanners:wo(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:hr(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function pb(e,t){let r=hr(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:hr(e.policy_id),reason:String(e.reason),referenceUrl:hr(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:a,revokedAt:r,state:r?"revoked":a<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function ng(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:hr(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:wo(e.summary,{}),content:hr(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function mb(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:hr(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:wo(e.scanner_versions,{}),findingIds:wo(e.finding_ids,[]),waiverIds:wo(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function mC(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return uC("sha256").update(r).digest("hex")}function gb(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function fb(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in ig))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in og))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class Xr{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,a=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),m=e.findings??[],f=this.idFn(),v=new Set,w=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
-        (id, organization_id, project_id, environment_id, resource_id, release_id, scanner_id, scanner_version, status, error, metadata, findings_count, started_at, completed_at, duration_ms)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[f,e.organizationId,e.projectId??null,e.environmentId??null,e.resourceId??null,e.releaseId??null,e.scannerId.trim(),e.scannerVersion.trim(),e.status,pC(e.error)??null,Qn(e.metadata??{}),m.length,r,t,Math.max(0,Math.floor(a))]);for(let k of m){let S={...k,organizationId:e.organizationId,projectId:k.projectId??e.projectId,environmentId:k.environmentId??e.environmentId,resourceId:k.resourceId??e.resourceId,releaseId:k.releaseId??e.releaseId},A=S.fingerprint?.trim()||mC(e.scannerId,S);v.add(A);let x=this.controlPlane.database.query("SELECT * FROM security_findings WHERE fingerprint = ?").get(A),F=x?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? AND revoked_at IS NULL AND expires_at > ? ORDER BY expires_at DESC LIMIT 1").get(String(x.id),t):void 0;if(x){let U=String(x.status)==="resolved"?Number(x.recurrence_count)+1:Number(x.recurrence_count),H=F?"waived":String(x.status)==="acknowledged"?"acknowledged":"open";this.run(`UPDATE security_findings SET scan_run_id = ?, scanner_version = ?, severity = ?, title = ?, description = ?, evidence = ?, remediation = ?,
-            status = ?, recurrence_count = ?, last_seen_at = ?, resolved_at = NULL, updated_at = ? WHERE id = ?`,[f,e.scannerVersion,S.severity,S.title.trim(),S.description.trim(),Qn(S.evidence??{}),S.remediation?.trim()||null,H,U,t,t,String(x.id)]),w.push(this.getFinding(String(x.id)))}else{let U=this.idFn();this.run(`INSERT INTO security_findings
-            (id, fingerprint, organization_id, project_id, environment_id, resource_id, release_id, scan_run_id, scanner_id, scanner_version, rule_id,
-            severity, title, description, evidence, remediation, subject, status, first_seen_at, last_seen_at, updated_at)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'open', ?, ?, ?)`,[U,A,S.organizationId,S.projectId??null,S.environmentId??null,S.resourceId??null,S.releaseId??null,f,e.scannerId,e.scannerVersion,S.ruleId.trim(),S.severity,S.title.trim(),S.description.trim(),Qn(S.evidence??{}),S.remediation?.trim()||null,S.subject.trim(),t,t,t]),w.push(this.getFinding(U))}}if(e.status==="passed"||e.status==="failed"){let k=this.controlPlane.database.query(`SELECT * FROM security_findings WHERE organization_id = ? AND scanner_id = ?
-          AND project_id IS ? AND environment_id IS ? AND resource_id IS ? AND release_id IS ? AND status != 'resolved'`).all(e.organizationId,e.scannerId,e.projectId??null,e.environmentId??null,e.resourceId??null,e.releaseId??null);for(let S of k){if(v.has(String(S.fingerprint)))continue;this.run("UPDATE security_findings SET status = 'resolved', resolved_at = ?, updated_at = ? WHERE id = ?",[t,t,String(S.id)]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,resourceId:e.resourceId,type:"security.finding.resolved",payload:{findingId:String(S.id),scannerId:e.scannerId,reason:"not-observed"}})}}this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,resourceId:e.resourceId,type:"security.scan.completed",level:e.status==="failed"||lb.has(e.status)?"warning":"info",payload:{scanRunId:f,scannerId:e.scannerId,scannerVersion:e.scannerVersion,status:e.status,findingsCount:m.length,durationMs:a}})}),{run:this.getScanRun(f),findings:w.map((k)=>this.getFinding(k.id))}}getScanRun(e){let t=this.controlPlane.database.query("SELECT * FROM security_scan_runs WHERE id = ?").get(e);return t?tg(t):void 0}listScanRuns(e){return this.controlPlane.database.query("SELECT * FROM security_scan_runs WHERE organization_id = ? AND project_id IS ? AND environment_id IS ? ORDER BY completed_at DESC, id DESC LIMIT ?").all(e.organizationId,e.projectId??null,e.environmentId??null,Math.min(500,Math.max(1,e.limit??100))).map(tg)}getFinding(e){let t=this.controlPlane.database.query("SELECT * FROM security_findings WHERE id = ?").get(e);return t?ub(t):void 0}listFindings(e){this.expireWaivers();let t=["organization_id = ?"],r=[e.organizationId];if(e.projectId)t.push("project_id = ?"),r.push(e.projectId);if(e.environmentId)t.push("environment_id = ?"),r.push(e.environmentId);if(e.status)t.push("status = ?"),r.push(e.status);if(e.severity)t.push("severity = ?"),r.push(e.severity);return r.push(Math.min(1000,Math.max(1,e.limit??250))),this.controlPlane.database.query(`SELECT * FROM security_findings WHERE ${t.join(" AND ")} ORDER BY CASE severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 WHEN 'low' THEN 1 ELSE 0 END DESC, last_seen_at DESC LIMIT ?`).all(...r).map(ub)}assignFinding(e,t,r){let a=this.getFinding(e);if(!a)throw Error("Security finding was not found");if(t&&!this.controlPlane.getActor(t))throw Error("Finding owner was not found");return this.run("UPDATE security_findings SET owner_actor_id = ?, updated_at = ? WHERE id = ?",[t??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,resourceId:a.resourceId,actorId:r,type:"security.finding.assigned",payload:{findingId:e,ownerActorId:t??null}}),this.getFinding(e)}acknowledgeFinding(e,t){let r=this.getFinding(e);if(!r)throw Error("Security finding was not found");if(r.status==="resolved")throw Error("A resolved finding cannot be acknowledged");return this.run("UPDATE security_findings SET status = 'acknowledged', updated_at = ? WHERE id = ?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,projectId:r.projectId,resourceId:r.resourceId,actorId:t,type:"security.finding.acknowledged",payload:{findingId:e}}),this.getFinding(e)}addComment(e){let t=this.getFinding(e.findingId);if(!t)throw Error("Security finding was not found");let r=e.body.trim();if(r.length<2||r.length>4000)throw Error("Finding comments must contain 2-4,000 characters");let a=gb(e.referenceUrl),m=this.idFn(),f=this.now();return this.run("INSERT INTO security_finding_comments (id, finding_id, actor_id, body, reference_url, created_at) VALUES (?, ?, ?, ?, ?, ?)",[m,e.findingId,e.actorId,r,a??null,f]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:t.projectId,resourceId:t.resourceId,actorId:e.actorId,type:"security.finding.commented",payload:{findingId:e.findingId,commentId:m,referenceUrl:a??null}}),{id:m,findingId:e.findingId,actorId:e.actorId,body:r,referenceUrl:a,createdAt:f}}listComments(e){return this.controlPlane.database.query("SELECT * FROM security_finding_comments WHERE finding_id = ? ORDER BY created_at, id").all(e).map((t)=>({id:String(t.id),findingId:String(t.finding_id),actorId:String(t.actor_id),body:String(t.body),referenceUrl:hr(t.reference_url),createdAt:String(t.created_at)}))}createWaiver(e){let t=this.getFinding(e.findingId);if(!t)throw Error("Security finding was not found");let r=e.reason.trim();if(r.length<8||r.length>1000)throw Error("A waiver reason must contain 8-1,000 characters");let a=this.now(),m=new Date(e.expiresAt);if(!Number.isFinite(m.getTime())||m.toISOString()<=a)throw Error("A waiver must have a future expiry");if(m.getTime()-new Date(a).getTime()>31536000000)throw Error("A waiver cannot last longer than one year");let f=e.policyId?this.getPolicy(e.policyId):void 0;if(e.policyId&&(!f||f.organizationId!==t.organizationId))throw Error("Waiver policy does not match the finding organization");let v=this.idFn(),w=gb(e.referenceUrl);return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_waivers (id, finding_id, policy_id, reason, reference_url, created_by_actor_id, expires_at, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[v,t.id,e.policyId??null,r,w??null,e.actorId,m.toISOString(),a,a]),this.run("UPDATE security_findings SET status = 'waived', updated_at = ? WHERE id = ?",[a,t.id]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:t.projectId,resourceId:t.resourceId,actorId:e.actorId,type:"security.waiver.created",level:"warning",payload:{waiverId:v,findingId:t.id,policyId:e.policyId??null,reason:r,expiresAt:m.toISOString(),referenceUrl:w??null}})}),this.getWaiver(v)}revokeWaiver(e,t){let r=this.getWaiver(e);if(!r)throw Error("Security waiver was not found");if(r.revokedAt)return r;let a=this.getFinding(r.findingId),m=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE security_waivers SET revoked_at = ?, updated_at = ? WHERE id = ?",[m,m,e]),this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ? AND status = 'waived'",[m,r.findingId]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,resourceId:a.resourceId,actorId:t,type:"security.waiver.revoked",level:"warning",payload:{waiverId:e,findingId:r.findingId}})}),this.getWaiver(e)}getWaiver(e){let t=this.controlPlane.database.query("SELECT * FROM security_waivers WHERE id = ?").get(e);return t?pb(t,this.now()):void 0}listWaivers(e){return(e?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? ORDER BY created_at DESC").all(e):this.controlPlane.database.query("SELECT * FROM security_waivers ORDER BY created_at DESC").all()).map((r)=>pb(r,this.now()))}expireWaivers(){let e=this.now(),t=this.controlPlane.database.query(`SELECT w.id AS waiver_id, f.* FROM security_waivers w JOIN security_findings f ON f.id = w.finding_id
-      WHERE w.revoked_at IS NULL AND w.expires_at <= ? AND f.status = 'waived'`).all(e);for(let r of t)this.run("UPDATE security_findings SET status = 'open', updated_at = ? WHERE id = ?",[e,String(r.id)]),this.controlPlane.appendEvent({organizationId:String(r.organization_id),projectId:hr(r.project_id),resourceId:hr(r.resource_id),type:"security.waiver.expired",level:"warning",payload:{waiverId:String(r.waiver_id),findingId:String(r.id)}});return t.length}createPolicy(e){let t=e.name.trim();if(!t)throw Error("Security policy name is required");let r=fb(e.rules),a=this.idFn(),m=this.now(),f=[...new Set((e.requiredScanners??[]).map((v)=>v.trim()).filter(Boolean))].sort();return this.run(`INSERT INTO security_policies (id, organization_id, environment_id, name, rules, required_scanners, scanner_fail_mode, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.organizationId,e.environmentId??null,t,Qn(r),Qn(f),e.scannerFailMode,e.actorId??null,m,m]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"security.policy.created",payload:{policyId:a,environmentId:e.environmentId??null,scannerFailMode:e.scannerFailMode,requiredScanners:f,rules:s(r)}}),this.getPolicy(a)}updatePolicy(e,t,r){let a=this.getPolicy(e);if(!a||a.version!==t)throw Error(`Security policy ${e} changed since version ${t}`);let m=r.rules?fb(r.rules):a.rules,f=r.requiredScanners?[...new Set(r.requiredScanners.map((k)=>k.trim()).filter(Boolean))].sort():a.requiredScanners,v=this.now();if(this.controlPlane.database.run("UPDATE security_policies SET name = ?, rules = ?, required_scanners = ?, scanner_fail_mode = ?, enabled = ?, version = version + 1, updated_at = ? WHERE id = ? AND version = ?",[r.name?.trim()||a.name,Qn(m),Qn(f),r.scannerFailMode??a.scannerFailMode,r.enabled??a.enabled?1:0,v,e,t]).changes!==1)throw Error(`Security policy ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"security.policy.updated",payload:{policyId:e,fromVersion:t,toVersion:t+1}}),this.getPolicy(e)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM security_policies WHERE id = ?").get(e);return t?rg(t):void 0}listPolicies(e){return this.controlPlane.database.query("SELECT * FROM security_policies WHERE organization_id = ? ORDER BY environment_id, name").all(e).map(rg)}evaluateGate(e){this.expireWaivers();let t=e.policyId?this.getPolicy(e.policyId):this.controlPlane.database.query(`SELECT * FROM security_policies WHERE organization_id = ? AND enabled = 1 AND (environment_id = ? OR environment_id IS NULL)
-          ORDER BY CASE WHEN environment_id = ? THEN 0 ELSE 1 END, updated_at DESC LIMIT 1`).get(e.organizationId,e.environmentId,e.environmentId),r=t&&"rules"in t&&Array.isArray(t.rules)?t:t?rg(t):void 0;if(!r||!r.enabled)throw Error("No enabled security policy applies to this environment");let a=this.listFindings({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,limit:1000}).filter((Re)=>Re.status!=="resolved"),m=new Map;for(let Re of a){let de=this.listWaivers(Re.id).find((je)=>je.state==="active"&&(!je.policyId||je.policyId===r.id));if(de)m.set(Re.id,de)}let f=(Re)=>r.rules.filter((de)=>(!de.scannerId||de.scannerId===Re.scannerId)&&ig[Re.severity]>=ig[de.minimumSeverity]).reduce((de,je)=>og[je.action]>og[de]?je.action:de,"record"),v=a.filter((Re)=>!m.has(Re.id)&&f(Re)==="block"),w=a.filter((Re)=>!m.has(Re.id)&&f(Re)==="warn"),k=this.controlPlane.database.query(`SELECT run.* FROM security_scan_runs run
-      WHERE run.organization_id = ? AND run.project_id = ? AND run.environment_id = ?
-      AND run.id = (SELECT candidate.id FROM security_scan_runs candidate
-        WHERE candidate.organization_id = run.organization_id AND candidate.project_id = run.project_id
-        AND candidate.environment_id = run.environment_id AND candidate.scanner_id = run.scanner_id
-        ORDER BY candidate.completed_at DESC, candidate.rowid DESC LIMIT 1)`).all(e.organizationId,e.projectId,e.environmentId),S=e.staleAfterMs??86400000,A=this.nowFn().getTime(),x=k.map(tg).map((Re)=>A-new Date(Re.completedAt).getTime()>S?{...Re,status:"stale"}:Re),F=new Set(x.map((Re)=>Re.scannerId)),U=r.requiredScanners.filter((Re)=>!F.has(Re)).map((Re)=>({id:`missing:${Re}`,organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,scannerId:Re,scannerVersion:"unavailable",status:"unavailable",metadata:{},findingsCount:0,startedAt:this.now(),completedAt:this.now(),durationMs:0})),H=[...x,...U],K=H.filter((Re)=>r.requiredScanners.includes(Re.scannerId)&&lb.has(Re.status)),X=Object.fromEntries(H.map((Re)=>[Re.scannerId,Re.scannerVersion])),oe=r.scannerFailMode==="closed"&&K.length>0,pe=v.length||oe?"block":w.length||K.length?"warn":"allow",ee=[];if(v.length)ee.push(`${v.length} finding${v.length===1?"":"s"} blocked by policy`);if(w.length)ee.push(`${w.length} warning${w.length===1?"":"s"} require review`);if(K.length)ee.push(`${K.length} scanner${K.length===1?"":"s"} ${r.scannerFailMode==="closed"?"failed closed":"failed open"}`);if(m.size)ee.push(`${m.size} active time-limited waiver${m.size===1?"":"s"}`);if(!ee.length)ee.push("All recorded checks satisfy policy");let ce=this.idFn(),Ee=this.now();return this.run(`INSERT INTO security_deploy_decisions
-      (id, organization_id, project_id, environment_id, operation_id, policy_id, policy_version, outcome, scanner_versions, finding_ids, waiver_ids, explanation, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[ce,e.organizationId,e.projectId,e.environmentId,e.operationId??null,r.id,r.version,pe,Qn(X),Qn([...v,...w].map((Re)=>Re.id)),Qn([...m.values()].map((Re)=>Re.id)),ee.join("; "),Ee]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,operationId:e.operationId,type:"security.deploy.decision",level:pe==="block"?"error":pe==="warn"?"warning":"info",payload:{decisionId:ce,outcome:pe,policyId:r.id,policyVersion:r.version,scannerVersions:X,blockerIds:v.map((Re)=>Re.id),waiverIds:[...m.values()].map((Re)=>Re.id),explanation:ee.join("; ")}}),this.getDecision(ce)}getDecision(e){let t=this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE id = ?").get(e);return t?mb(t):void 0}listDecisions(e,t=100){return this.controlPlane.database.query("SELECT * FROM security_deploy_decisions WHERE environment_id = ? ORDER BY created_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(mb)}addReleaseArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? AND kind = ? AND digest = ?").get(e.releaseId,e.kind,e.digest);if(t)return ng(t);let r=this.idFn(),a=this.now();return this.run(`INSERT INTO release_security_artifacts
-      (id, organization_id, project_id, environment_id, release_id, kind, format, digest, summary, content, sensitive, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.organizationId,e.projectId,e.environmentId??null,e.releaseId,e.kind,e.format,e.digest,Qn(e.summary),e.content??null,e.sensitive?1:0,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,type:"security.release_artifact.created",payload:{artifactId:r,releaseId:e.releaseId,kind:e.kind,format:e.format,digest:e.digest,sensitive:e.sensitive}}),ng(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(r))}listReleaseArtifacts(e,t=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(e).map(ng).map((r)=>r.sensitive&&!t?{...r,content:void 0}:r)}summary(e,t,r){let a=this.listFindings({organizationId:e,projectId:t,environmentId:r,limit:1000}),m=this.listScanRuns({organizationId:e,projectId:t,environmentId:r,limit:1000}),f={info:0,low:0,medium:0,high:0,critical:0};for(let w of a)if(w.status==="open"||w.status==="acknowledged")f[w.severity]++;let v={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let w of m)v[w.status]++;return{open:f,waived:a.filter((w)=>w.status==="waived").length,resolved:a.filter((w)=>w.status==="resolved").length,checks:v,lastScannedAt:m[0]?.completedAt}}exportPosture(e){let t=this.controlPlane.listProjects().filter((r)=>r.organizationId===e);return s({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:e,policies:this.listPolicies(e),findings:this.listFindings({organizationId:e,limit:1000}),waivers:this.listWaivers().filter((r)=>this.getFinding(r.findingId)?.organizationId===e),scans:t.flatMap((r)=>this.listScanRuns({organizationId:e,projectId:r.id,limit:1000})),decisions:t.flatMap((r)=>this.controlPlane.listEnvironments(r.id).flatMap((a)=>this.listDecisions(a.id,1000)))})}}import{existsSync as gC,readdirSync as fC,readFileSync as hC,statSync as yC}from"node:fs";import{extname as vC,join as bC,relative as hb,sep as SC}from"node:path";var Sl=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],wC=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],kC=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci",".claude/worktrees"],IC=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class Yr{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(e){this.patterns=[...Sl,...e?.customPatterns||[]],this.excludeDirs=[...kC,...e?.excludeDirs||[]],this.excludeFiles=[...IC,...e?.excludeFiles||[]],this.maxFileSize=e?.maxFileSize||1048576}async scan(e){let t=Date.now(),r=[],a=0,{directory:m,exclude:f=[],include:v,skipPatterns:w=[]}=e,k=e.failOnSeverity||"critical";if(!gC(m))throw Error(`Directory not found: ${m}`);let S=this.getFilesToScan(m,[...this.excludeDirs,...f],v);for(let H of S){let K=hb(m,H);if(this.shouldExcludeFile(K))continue;try{if(yC(H).size>this.maxFileSize)continue;let oe=hC(H,"utf-8"),pe=this.scanContent(oe,K,w);r.push(...pe),a++}catch{continue}}let A={critical:r.filter((H)=>H.pattern.severity==="critical").length,high:r.filter((H)=>H.pattern.severity==="high").length,medium:r.filter((H)=>H.pattern.severity==="medium").length,low:r.filter((H)=>H.pattern.severity==="low").length},x=["low","medium","high","critical"],F=x.indexOf(k),U=!0;for(let H=F;H<x.length;H++)if(A[x[H]]>0){U=!1;break}return{passed:U,findings:r,scannedFiles:a,duration:Date.now()-t,summary:A}}scanContent(e,t,r){let a=[],m=e.split(`
-`);for(let f of this.patterns){if(r.includes(f.name))continue;f.pattern.lastIndex=0;let v;while((v=f.pattern.exec(e))!==null){let w=e.substring(0,v.index),k=w.split(`
-`).length,S=w.lastIndexOf(`
-`),A=v.index-S,x=m[k-1]||"";if(this.isLikelyPlaceholder(v[0],x))continue;let F=v[1]||v[0];if(f.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(F))continue;if(f.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(F))continue;if(f.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(F))continue;if(this.isLowEntropy(F))continue;a.push({file:t,line:k,column:A,match:this.maskSecret(v[0]),pattern:f,context:this.maskSecret(x.trim())})}}return a}isLikelyPlaceholder(e,t){let r=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],a=e.toLowerCase(),m=t.toLowerCase();for(let v of r)if(a.includes(v.toLowerCase())||m.includes(v.toLowerCase()))return!0;let f=t.trim();if(f.startsWith("//")||f.startsWith("#")||f.startsWith("*")||f.startsWith("/*")){if(m.includes("example")||m.includes("format:")||m.includes("e.g."))return!0}return!1}isLowEntropy(e){if(e.length<8)return!1;if(new Set(e).size<8)return!0;if(/(.)\1{3,}/.test(e))return!0;return!1}hasSecretCharacterDiversity(e){let t=/[\d+=]/.test(e),r=[/[a-z]/.test(e),/[A-Z]/.test(e),/\d/.test(e),/[/+=]/.test(e)];return t&&r.filter(Boolean).length>=3}maskSecret(e){if(e.length<=8)return"*".repeat(e.length);let t=Math.min(4,Math.floor(e.length*0.2));return e.substring(0,t)+"*".repeat(e.length-t*2)+e.substring(e.length-t)}getFilesToScan(e,t,r){let a=[],m=r||wC,f=t.filter((k)=>!k.includes("/")),v=t.filter((k)=>k.includes("/")).map((k)=>k.replace(/^\.\//,"").replace(/\/+$/,"")),w=(k)=>{let S=fC(k,{withFileTypes:!0});for(let A of S){let x=bC(k,A.name);if(A.isDirectory()){let F=hb(e,x).split(SC).join("/");if(!f.includes(A.name)&&!v.includes(F))w(x)}else if(A.isFile()){let F=vC(A.name).toLowerCase();if(m.includes(F)||A.name.startsWith(".env")||A.name.endsWith(".config"))a.push(x)}}};return w(e),a}shouldExcludeFile(e){let t=e.split("/").pop()||"";for(let r of this.excludeFiles)if(r.startsWith("*")){let a=r.substring(1);if(t.endsWith(a))return!0}else if(r.endsWith("*")){let a=r.substring(0,r.length-1);if(t.startsWith(a))return!0}else if(t===r)return!0;return!1}addPattern(e){this.patterns.push(e)}getPatterns(){return[...this.patterns]}}async function jm(e){return new Yr().scan(e)}function zm(e){let t=[];if(t.push(`
-Security Scan Results`),t.push("=".repeat(50)),t.push(`Files scanned: ${e.scannedFiles}`),t.push(`Duration: ${e.duration}ms`),t.push(""),t.push("Summary:"),t.push(`  Critical: ${e.summary.critical}`),t.push(`  High: ${e.summary.high}`),t.push(`  Medium: ${e.summary.medium}`),t.push(`  Low: ${e.summary.low}`),t.push(""),e.findings.length>0){t.push("Findings:"),t.push("-".repeat(50));for(let r of e.findings)t.push(`
-[${r.pattern.severity.toUpperCase()}] ${r.pattern.name}`),t.push(`  File: ${r.file}:${r.line}:${r.column}`),t.push(`  Match: ${r.match}`),t.push(`  Context: ${r.context}`),t.push(`  Description: ${r.pattern.description}`)}return t.push(""),t.push(e.passed?"✓ Security scan passed":"✗ Security scan failed"),t.join(`
-`)}function EC(e,t){return{status:"unavailable",findings:[],error:`${e.id} exceeded its ${t}ms timeout`,metadata:{timeoutMs:t}}}class At{posture;defaultTimeoutMs;nowFn;constructor(e,t={}){this.posture=e;this.defaultTimeoutMs=t.defaultTimeoutMs??60000,this.nowFn=t.now??(()=>new Date)}async run(e,t){let r=this.nowFn(),a=Math.max(100,e.timeoutMs??this.defaultTimeoutMs),m=new AbortController,f,v=new Promise((A)=>{f=setTimeout(()=>{m.abort(),A(EC(e,a))},a)}),w;try{w=await Promise.race([e.scan({...t,signal:m.signal}),v])}catch(A){w={status:"unavailable",findings:[],error:A instanceof Error?A.message:String(A)}}finally{if(f)clearTimeout(f)}let k=this.nowFn(),S={...t,scannerId:e.id,scannerVersion:e.version,status:w.status,findings:w.findings,metadata:w.metadata,error:w.error,startedAt:r.toISOString(),completedAt:k.toISOString(),durationMs:Math.max(0,k.getTime()-r.getTime())};return this.posture.recordScan(S)}async runAll(e,t){return Promise.all(e.map((r)=>this.run(r,t)))}}class Zr{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(e=new Yr){this.scanner=e}async scan(e){if(!e.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let t=await this.scanner.scan({directory:e.artifactRoot,failOnSeverity:"critical"});return{status:t.passed?"passed":"failed",findings:t.findings.map((r)=>({...e,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:t.scannedFiles,summary:t.summary}}}}function RC(e){let t=e?.toLowerCase();return t==="critical"||t==="high"||t==="medium"||t==="low"?t:"info"}class Go{id="trivy-image";version;timeoutMs;constructor(e={}){this.version=e.version??"local",this.timeoutMs=e.timeoutMs??120000,this.executable=e.executable??"trivy"}executable;async scan(e){if(!e.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let t;try{t=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",e.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(k){return{status:"unsupported",findings:[],error:k instanceof Error?k.message:String(k)}}let r=()=>t.kill();e.signal.addEventListener("abort",r,{once:!0});let[a,m,f]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);if(e.signal.removeEventListener("abort",r),a!==0)return{status:/not found|enoent/i.test(f)?"unsupported":"unavailable",findings:[],error:f.slice(0,2000)||`Trivy exited with ${a}`};let v=JSON.parse(m),w=[];for(let k of v.Results??[])for(let S of k.Vulnerabilities??[]){let A=S.VulnerabilityID??"unknown-vulnerability";w.push({...e,ruleId:A,severity:RC(S.Severity),title:S.Title||A,description:S.Description||`${A} affects ${S.PkgName??"an image package"}.`,subject:`${e.imageRef}:${S.PkgName??"unknown"}:${S.InstalledVersion??"unknown"}`,evidence:{image:e.imageRef,target:k.Target??"",cve:A,package:S.PkgName??"",installedVersion:S.InstalledVersion??"",fixedVersion:S.FixedVersion??"",reference:S.PrimaryURL??""},remediation:S.FixedVersion?`Upgrade ${S.PkgName} to ${S.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:w.length?"failed":"passed",findings:w,metadata:{imageRef:e.imageRef,vulnerabilityCount:w.length,localOnly:!0}}}}class Km{actions;id="aws-iam-capabilities";version="1.0.0";timeoutMs=30000;client;constructor(e,t={}){this.actions=e;if(this.resourceArns=t.resourceArns??["*"],t.client)this.client=t.client;else{let r=new he(t.region),a=new Ae(t.region);this.client={getCallerIdentity:()=>r.getCallerIdentity(),simulatePrincipalPolicy:(m)=>a.simulatePrincipalPolicy(m)}}}resourceArns;async scan(e){let t=await this.client.getCallerIdentity();if(!t.Arn)return{status:"unavailable",findings:[],error:"AWS returned no caller ARN"};let r=t.Arn;if(r.includes(":assumed-role/"))return{status:"unsupported",findings:[],error:"AWS policy simulation requires the underlying IAM role ARN; use an IAM role/user ARN or provider-native access analysis.",metadata:{account:t.Account??"",principalType:"assumed-role"}};let f=(await this.client.simulatePrincipalPolicy({PolicySourceArn:r,ActionNames:this.actions,ResourceArns:this.resourceArns})).EvaluationResults.filter((v)=>v.EvalDecision!=="allowed").map((v)=>({...e,ruleId:`iam-${v.EvalActionName.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:"high",title:`Missing AWS capability: ${v.EvalActionName}`,description:`The active AWS principal is ${v.EvalDecision||"not allowed"} for this deployment action.`,subject:`${r}:${v.EvalActionName}`,evidence:{account:t.Account??"",principalArn:r,action:v.EvalActionName,decision:v.EvalDecision,missingContext:v.MissingContextValues??[]},remediation:"Grant the deployment principal the least-privilege action on the required resources, then rerun the capability check."}));return{status:f.length?"failed":"passed",findings:f,metadata:{account:t.Account??"",principalArn:r,evaluatedActions:this.actions.length}}}}import{createHash as AC,createVerify as CC}from"node:crypto";import{existsSync as PC,readFileSync as _C}from"node:fs";import{basename as TC,join as xC,resolve as yb}from"node:path";function Fa(e){return AC("sha256").update(e).digest("hex")}function DC(e){let t=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],r=new Map;for(let[a,m]of t){let f=e[a];if(!f||typeof f!=="object"||Array.isArray(f))continue;for(let[v,w]of Object.entries(f)){let k=String(w).replace(/^[~^]/,""),S=`${v}@${k}`;if(!r.has(S))r.set(S,{type:"library",name:v,version:k,purl:`pkg:npm/${encodeURIComponent(v)}@${encodeURIComponent(k)}`,scope:m})}}return[...r.values()].sort((a,m)=>`${a.name}@${a.version}`.localeCompare(`${m.name}@${m.version}`))}function Cl(e,t={}){let r=xC(yb(e),"package.json");if(!PC(r))throw Error(`Cannot generate an SBOM: ${r} was not found`);let a=_C(r,"utf8"),m=JSON.parse(a),f=String(m.name??TC(yb(e))),v=String(m.version??"0.0.0"),w=Fa(a);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:t.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(t.now??new Date).toISOString(),component:{type:"application",name:f,version:v,purl:`pkg:npm/${encodeURIComponent(f)}@${encodeURIComponent(v)}`,hashes:[{alg:"SHA-256",content:w}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:DC(m)}}async function El(e,t={}){let r=Bun.spawn([t.executable??"syft",e,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),a=()=>r.kill();t.signal?.addEventListener("abort",a,{once:!0});let[m,f,v]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);if(t.signal?.removeEventListener("abort",a),m!==0)throw Error(v.slice(0,2000)||`Syft exited with ${m}`);return JSON.parse(f)}function qo(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"sbom",format:`cyclonedx-${r.specVersion}+json`,digest:`sha256:${Fa(a)}`,summary:{component:r.metadata.component.name,version:r.metadata.component.version,components:r.components.length},content:a,sensitive:!0})}function bl(e,t,r){let a={total:r.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let f of r){a[f.severity]++;let v=f.evidence;if(typeof v.fixedVersion==="string"&&v.fixedVersion)a.fixable++}let m=JSON.stringify({releaseId:t.releaseId,generatedAt:new Date().toISOString(),findings:r.map((f)=>({id:f.id,ruleId:f.ruleId,severity:f.severity,subject:f.subject,remediation:f.remediation}))});return e.addReleaseArtifact({...t,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${Fa(m)}`,summary:a,content:m,sensitive:!0})}function vl(e){if(!e.artifact&&!e.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:e.artifactName,digest:{sha256:e.artifactSha256?.replace(/^sha256:/,"")??Fa(e.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:e.externalParameters??{},internalParameters:{},resolvedDependencies:e.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:e.invocationId,startedOn:e.startedAt,finishedOn:e.completedAt}}}}}function Tl(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${Fa(a)}`,summary:{subjects:r.subject.length,builder:r.predicate.runDetails.builder.id,buildType:r.predicate.buildDefinition.buildType},content:a,sensitive:!0})}function uy(e){let t=e.expectedSha256.replace(/^sha256:/,"").toLowerCase(),r=Fa(e.artifact)===t;if(!e.signature||!e.publicKey)return{digestValid:r,signature:"not_configured"};try{let a=CC("SHA256");return a.update(e.artifact),a.end(),{digestValid:r,signature:a.verify(e.publicKey,Buffer.from(e.signature,"base64"))?"verified":"invalid"}}catch{return{digestValid:r,signature:"invalid"}}}function re(e,t){let r=e.environments.get(t);if(!r)throw Error(`Security scope for environment '${t}' was not found`);return{organizationId:e.organization.id,projectId:e.project.id,environmentId:r.id}}function wl(e,t){let r=new Xr(e.store),a=r.listPolicies(e.organization.id);for(let[m,f]of e.environments){if(a.some((w)=>w.environmentId===f.id))continue;let v=m==="production"||f.kind==="production";a.push(r.createPolicy({organizationId:e.organization.id,environmentId:f.id,name:v?"Production baseline":"Environment baseline",scannerFailMode:v?"closed":"open",requiredScanners:["source-secrets"],rules:v?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:t}))}return a}function py(e,t,r,a={}){let m=r.findings.map((f)=>({...t,ruleId:f.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:f.pattern.severity,title:f.pattern.name,description:f.pattern.description,subject:`${f.file}:${f.line}`,evidence:{file:f.file,line:f.line,column:f.column,match:f.match,context:f.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:a.scannerVersion??"1.0.0",status:a.skipped?"skipped":r.passed?"passed":"failed",findings:a.skipped?[]:m,metadata:{scannedFiles:r.scannedFiles,durationMs:r.duration,summary:r.summary},durationMs:r.duration,error:a.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function gy(e,t,r="The operator explicitly skipped source-secret scanning."){return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:r})}function OC(e,t){let r=[],a=t.security;if(a?.firewall&&!["active","configured","ok"].includes(String(a.firewall.status)))r.push({...e,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(a.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(a.firewall.status??"unknown"),rules:Array.isArray(a.firewall.rules)?a.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let m of a?.ports??[]){let f=String(m.listen??""),v=Number(f.match(/:(\d+)$/)?.[1]);if(m.exposure==="public"&&Number.isFinite(v)&&![22,80,443].includes(v))r.push({...e,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${v}`,description:`${String(m.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${v}`,evidence:{protocol:String(m.proto??""),listen:f,process:String(m.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let m of a?.tlsCertificates??[]){let f=Number(m.daysRemaining);if(Number.isFinite(f)&&f<30)r.push({...e,ruleId:"tls-certificate-expiry",severity:f<14?"high":"medium",title:`TLS certificate expires in ${f} days`,description:`${String(m.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(m.domain??"unknown")}`,evidence:{domain:String(m.domain??""),daysRemaining:f,expires:String(m.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let m of t.diagnostics??[]){if(m.status==="pass"||m.status==="ok")continue;r.push({...e,ruleId:`diagnostic-${String(m.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:m.status==="fail"?"high":"medium",title:String(m.name??"Host security check"),description:String(m.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(m.name??"unknown")}`,evidence:{status:String(m.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function Hi(e,t,r){let a=!!r.security||Array.isArray(r.diagnostics),m=a?OC(t,r):[];return e.recordScan({...t,scannerId:"host-posture",scannerVersion:"1.0.0",status:!a?"unavailable":m.length?"failed":"passed",findings:m,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:a?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function Gi(e,t){let r=e.evaluateGate({...t.scope,operationId:t.operationId}),a=e.listFindings({...t.scope,limit:1000}).filter((m)=>m.status!=="resolved");return{decision:r,summary:{desiredConfigHash:t.desiredConfigHash??null,securityImpact:{critical:a.filter((m)=>m.severity==="critical").length,high:a.filter((m)=>m.severity==="high").length,waived:a.filter((m)=>m.status==="waived").length,assigned:a.filter((m)=>!!m.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}async function my(e,t){let r=t.scanner??new Go({timeoutMs:t.scannerTimeoutMs}),m=await new At(e,{defaultTimeoutMs:t.scannerTimeoutMs??120000}).run(r,{...t.scope,releaseId:t.releaseId,imageRef:t.imageRef}),f={...t.scope,releaseId:t.releaseId};bl(e,f,m.findings);let v=t.generateImageSbom??El,w=new AbortController,k=Math.max(100,t.sbomTimeoutMs??120000),S,A=new Promise((U,H)=>{S=setTimeout(()=>{w.abort(),H(Error(`syft-sbom exceeded its ${k}ms timeout`))},k)}),x="unavailable";try{let U=await Promise.race([v(t.imageRef,{signal:w.signal}),A]);qo(e,f,U),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:t.imageRef,format:`cyclonedx-${U.specVersion}+json`,components:U.components.length,localOnly:!0}}),x="image"}catch(U){let H=U instanceof Error?U.message:String(U);try{let K=Cl(t.artifactRoot);qo(e,f,K),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${H}`,metadata:{imageRef:t.imageRef,fallback:"package-manifest",components:K.components.length,localOnly:!0}}),x="manifest"}catch(K){e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${H}; ${K instanceof Error?K.message:String(K)}`,metadata:{imageRef:t.imageRef,localOnly:!0}})}}finally{if(S)clearTimeout(S)}let F=vl({artifactName:t.imageRef,artifact:t.imageSha256?void 0:t.imageRef,artifactSha256:t.imageSha256,invocationId:t.invocationId,startedAt:t.startedAt,completedAt:t.completedAt??new Date().toISOString(),externalParameters:t.externalParameters??{imageRef:t.imageRef}});return Tl(e,f,F),{scan:m,sbomSource:x}}import{randomBytes as vb,scryptSync as bb,timingSafeEqual as $C}from"node:crypto";function dg(e,t){if(e.role==="admin")return[...t];return t.filter((r)=>!!e.sites?.[r])}var sg=32768,ag=8,cg=1,NC=32,jC=16;function Io(e){let t=vb(jC),r=bb(e,t,NC,{N:sg,r:ag,p:cg,maxmem:268435456});return`scrypt$${sg}$${ag}$${cg}$${t.toString("base64url")}$${r.toString("base64url")}`}function Yn(e,t){try{let r=t.split("$");if(r.length!==6||r[0]!=="scrypt")return!1;let[,a,m,f,v,w]=r,k=Number(a),S=Number(m),A=Number(f);if(!Number.isFinite(k)||!Number.isFinite(S)||!Number.isFinite(A))return!1;let x=Buffer.from(v,"base64url"),F=Buffer.from(w,"base64url");if(x.length===0||F.length===0)return!1;let U=bb(e,x,F.length,{N:k,r:S,p:A,maxmem:268435456});return $C(U,F)}catch{return!1}}function Sb(e){let[t,r,a,m]=e.split("$");return t!=="scrypt"||Number(r)!==sg||Number(a)!==ag||Number(m)!==cg}function lg(){return vb(18).toString("base64url")}import{existsSync as VC,readFileSync as WC}from"node:fs";import{createHash as MC}from"node:crypto";function kb(e){let t=ug(e.name),r=pg(e.publicKey),a=LC([...e.existingKeys??[],{name:t,publicKey:r}]);return Eb(e.configText,a)}function Ib(e){let t=ug(e.name),r=(e.existingKeys??[]).filter((a)=>a.name!==t);if((e.existingKeys??[]).length===r.length)throw Error(`SSH key '${t}' does not exist in compute.sshKeys`);return Eb(e.configText,r)}function Eo(e=[]){return e.map((t)=>({name:t.name,publicKey:t.publicKey,type:FC(t.publicKey),fingerprint:zC(t.publicKey),added:"configured"}))}function Eb(e,t){let r=UC(e,"compute"),a=BC(t),m=qC(e,r.start,r.end,"sshKeys");if(m){let k=m.propertyStart;while(k>0&&e[k-1]!==`
-`&&/\s/.test(e[k-1]))k--;return`${e.slice(0,k)}${a}${e.slice(m.end+1)}`}let f=e.slice(0,r.end).trimEnd(),v=e.slice(r.end),w=f.endsWith(",")||f.endsWith("{")?"":",";return`${f}${w}
-${a},
-    ${v}`}function BC(e){if(e.length===0)return"      sshKeys: []";return`      sshKeys: [
-${e.map((r)=>["        {",`          name: '${wb(r.name)}',`,`          publicKey: '${wb(pg(r.publicKey))}',`,"        },"].join(`
-`)).join(`
-`)}
-      ]`}function LC(e){let t=new Map;for(let r of e){let a=ug(r.name);if(t.has(a))throw Error(`SSH key '${a}' already exists in compute.sshKeys`);t.set(a,{name:a,publicKey:pg(r.publicKey)})}return[...t.values()]}function ug(e){let t=e.trim();if(!/^[\w@.+-]{2,80}$/.test(t))throw Error("SSH key name must be 2-80 characters and use letters, numbers, @, ., +, _, or -.");return t}function pg(e){let t=e.trim().replace(/\s+/g," "),[r,a]=t.split(" ");if(!/^(?:ssh-(?:ed25519|rsa)|ecdsa-sha2-nistp(?:256|384|521))$/.test(r??"")||!a)throw Error("Public key must be an OpenSSH public key, e.g. ssh-ed25519 AAAA... name@host.");return t}function FC(e){return e.trim().split(/\s+/)[0]||"ssh"}function zC(e){let t=e.trim().split(/\s+/)[1];if(!t)return"-";try{return`SHA256:${MC("sha256").update(Buffer.from(t,"base64")).digest("base64").replace(/=+$/,"")}`}catch{return"-"}}function wb(e){return e.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'")}function UC(e,t){let r=new RegExp(`\\b${t}\\s*:\\s*{`,"g").exec(e);if(!r)throw Error(`Could not find ${t}: { ... } in cloud config.`);let a=e.indexOf("{",r.index);return{propertyStart:r.index,start:a,end:vc(e,a,"{","}")}}function qC(e,t,r,a){let m=e.slice(t+1,r),f=new RegExp(`\\b${a}\\s*:\\s*\\[`,"g").exec(m);if(!f)return null;let v=t+1+f.index,w=e.indexOf("[",v);return{propertyStart:v,start:w,end:vc(e,w,"[","]")}}function vc(e,t,r,a){let m=0,f,v=!1,w=!1,k=!1;for(let S=t;S<e.length;S++){let A=e[S],x=e[S+1];if(w){if(A===`
-`)w=!1;continue}if(k){if(A==="*"&&x==="/")k=!1,S++;continue}if(f){if(v){v=!1;continue}if(A==="\\"){v=!0;continue}if(A===f)f=void 0;continue}if(A==="/"&&x==="/"){w=!0,S++;continue}if(A==="/"&&x==="*"){k=!0,S++;continue}if(A==='"'||A==="'"||A==="`"){f=A;continue}if(A===r)m++;if(A===a){if(m--,m===0)return S}}throw Error(`Could not find matching ${a} in cloud config.`)}var HC=["rpx-gateway","nginx","php8.3-fpm","php8.2-fpm","mysql","mariadb","postgresql","redis","redis-server","meilisearch"],wn="-";function KC(e){let t=String.raw`
-import { X509Certificate } from 'node:crypto'
-import { existsSync, readdirSync, readFileSync, readlinkSync, statSync } from 'node:fs'
-import { basename, join } from 'node:path'
-
-const fragmentsRoot = '/etc/rpx/sites.d'
-const certsRoot = '/etc/rpx/certs'
-const projectFilter = ${JSON.stringify(e??"")}
-const configuredRoutes = []
-if (existsSync(fragmentsRoot)) {
-  for (const file of readdirSync(fragmentsRoot).filter(name => name.endsWith('.json')).sort()) {
-    try {
-      const fragment = JSON.parse(readFileSync(join(fragmentsRoot, file), 'utf8'))
-      const project = String(fragment.slug || basename(file, '.json'))
-      if (projectFilter && project !== projectFilter) continue
-      for (const route of Array.isArray(fragment.proxies) ? fragment.proxies : []) {
-        if (!route || !route.to) continue
-        const path = route.path || '/'
-        const staticRoot = typeof route.static === 'string' ? route.static : route.static?.dir
-        const kind = route.redirect ? 'redirect' : staticRoot ? 'static' : 'app'
-        const install = staticRoot || ''
-        const installName = install.match(/^\/var\/www\/(.+?)\/current(?:\/|$)/)?.[1]
-        const siteName = installName?.startsWith(project + '-') ? installName.slice(project.length + 1) : String(route.id || route.to)
-        const href = 'https://' + route.to + (path === '/' ? '' : path)
-        configuredRoutes.push({
-          name: siteName,
-          project,
-          route: path === '/' ? route.to : route.to + path,
-          href,
-          domain: route.to,
-          path,
-          kind,
-          runtime: kind === 'app' ? 'service' : kind,
-          deploy: kind === 'app' ? 'service' : kind === 'static' ? 'server static' : 'redirect',
-          tls: 'https',
-          root: install || (Array.isArray(route.from) ? route.from.join(', ') : route.from || 'gateway'),
-          branch: kind === 'static' ? 'build artifact' : 'main',
-          install,
-        })
-      }
-    }
-    catch {}
-  }
-}
-
-async function mapWithConcurrency(values, limit, mapper) {
-  const results = new Array(values.length)
-  let next = 0
-  const workers = Array.from({ length: Math.min(limit, values.length) }, async () => {
-    while (next < values.length) {
-      const index = next++
-      results[index] = await mapper(values[index])
-    }
-  })
-  await Promise.all(workers)
-  return results
-}
-
-const routes = await mapWithConcurrency(configuredRoutes, 8, async route => {
-  const started = performance.now()
-  let httpStatus = 0
-  const probe = async (href) => {
-    const response = await fetch(href, {
-      method: 'GET',
-      redirect: 'manual',
-      headers: { 'user-agent': 'ts-cloud-monitor/1.0' },
-      signal: AbortSignal.timeout(6000),
-    })
-    const status = response.status
-    await response.arrayBuffer()
-    return status
-  }
-  try {
-    httpStatus = await probe(route.href)
-    if (httpStatus === 404 && route.kind === 'app') {
-      const healthHref = route.href.replace(/\/$/, '') + '/health'
-      httpStatus = await probe(healthHref)
-    }
-  }
-  catch {}
-  const responseMs = Math.max(0, Math.round(performance.now() - started))
-  let tlsDaysRemaining
-  const cert = join(certsRoot, route.domain + '.crt')
-  if (existsSync(cert)) {
-    try {
-      const expiresAt = Date.parse(new X509Certificate(readFileSync(cert)).validTo)
-      if (Number.isFinite(expiresAt)) tlsDaysRemaining = Math.floor((expiresAt - Date.now()) / 86400000)
-    }
-    catch {}
-  }
-  let release
-  let deployedAt
-  if (route.install) {
-    try {
-      release = basename(readlinkSync(route.install))
-      deployedAt = statSync(route.install).mtime.toISOString()
-    }
-    catch {}
-  }
-  const status = httpStatus === 0 || httpStatus >= 500 ? 'failed' : httpStatus === 404 ? 'degraded' : 'live'
-  const { install, ...site } = route
-  return {
-    ...site,
-    status,
-    httpStatus,
-    responseMs,
-    tlsDaysRemaining,
-    checkedAt: new Date().toISOString(),
-    release,
-    deployedAt,
-  }
-})
-for (const route of routes) console.log('DISCOVERED_SITE=' + Buffer.from(JSON.stringify(route)).toString('base64'))
-
-const serviceOutput = Bun.spawnSync([
-  'systemctl', 'list-units', '--type=service', '--state=running', '--no-legend', '--plain',
-]).stdout.toString()
-const runningUnits = serviceOutput
-  .split('\n')
-  .map(line => line.trim().split(/\s+/)[0])
-  .filter(Boolean)
-if (runningUnits.length > 0) {
-  const propertiesOutput = Bun.spawnSync([
-    'systemctl',
-    'show',
-    ...runningUnits,
-    '--property=Id,WorkingDirectory,ExecStart,MemoryCurrent,UnitFileState,ActiveEnterTimestamp',
-  ]).stdout.toString()
-  for (const properties of propertiesOutput.split(/\n\n+/)) {
-    const values = Object.fromEntries(properties.split('\n').filter(Boolean).map(value => {
-      const separator = value.indexOf('=')
-      return separator < 0 ? [value, ''] : [value.slice(0, separator), value.slice(separator + 1)]
-    }))
-    const unit = values.Id
-    if (!unit) continue
-    if (!/^\/var\/www\/|^\/opt\/ts-cloud\//.test(values.WorkingDirectory || '') && !/\/var\/www\/|\/opt\/ts-cloud\//.test(values.ExecStart || '')) continue
-    console.log([
-      'SVC',
-      unit,
-      'active',
-      values.MemoryCurrent || '0',
-      values.UnitFileState || '-',
-      values.ActiveEnterTimestamp || '-',
-    ].join('='))
-  }
-}
-`;return`echo '${Buffer.from(t).toString("base64")}' | base64 -d | bun -`}function JC(e={}){let t=["set +e",'echo "CPUS=$(nproc 2>/dev/null || echo 1)"',`read TS_TOTAL_1 TS_IDLE_1 <<EOF
-$(awk '/^cpu /{idle=$5+$6; total=0; for(i=2;i<=NF;i++) total+=$i; print total, idle; exit}' /proc/stat 2>/dev/null)
-EOF`,"sleep 0.2",`read TS_TOTAL_2 TS_IDLE_2 <<EOF
-$(awk '/^cpu /{idle=$5+$6; total=0; for(i=2;i<=NF;i++) total+=$i; print total, idle; exit}' /proc/stat 2>/dev/null)
-EOF`,`echo "CPUUSED=$(awk -v t1="$TS_TOTAL_1" -v i1="$TS_IDLE_1" -v t2="$TS_TOTAL_2" -v i2="$TS_IDLE_2" 'BEGIN { dt=t2-t1; di=i2-i1; if (dt>0) printf "%.1f", 100*(dt-di)/dt; else print 0 }')"`,`echo "LOAD=$(cut -d' ' -f1 /proc/loadavg 2>/dev/null || echo 0)"`,`echo "LOAD5=$(cut -d' ' -f2 /proc/loadavg 2>/dev/null || echo 0)"`,`echo "LOAD15=$(cut -d' ' -f3 /proc/loadavg 2>/dev/null || echo 0)"`,`read MEMTOTAL MEMUSED MEMAVAILABLE MEMCACHE SWAPTOTAL SWAPUSED <<EOF
-$(free -m 2>/dev/null | awk '/^Mem:/{total=$2; used=$3; available=$7; cache=$6} /^Swap:/{print total, used, available, cache, $2, $3}')
-EOF`,'echo "MEMTOTAL=${MEMTOTAL:-0}"','echo "MEMUSED=${MEMUSED:-0}"','echo "MEMAVAILABLE=${MEMAVAILABLE:-0}"','echo "MEMCACHE=${MEMCACHE:-0}"','echo "SWAPTOTAL=${SWAPTOTAL:-0}"','echo "SWAPUSED=${SWAPUSED:-0}"',`read DISKTOTG DISKUSEDG DISKPCT <<EOF
-$(df -BG -P / 2>/dev/null | awk 'NR==2{gsub("G","",$2); gsub("G","",$3); gsub("%","",$5); print $2, $3, $5}')
-EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DISKTOTG=${DISKTOTG:-0}"',`echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,`echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,`echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,". /var/lib/ts-cloud/bandwidth-state 2>/dev/null || true",'echo "NETRXRATE=${RX_RATE:-0}"','echo "NETTXRATE=${TX_RATE:-0}"','echo "NETRXTODAY=${DAY_RX:-0}"','echo "NETTXTODAY=${DAY_TX:-0}"','echo "NETRXMONTH=${MONTH_RX:-0}"','echo "NETTXMONTH=${MONTH_TX:-0}"','echo "NETMONTHKEY=${MONTH_KEY:-}"',`echo "PROCESSES=$(ps -e --no-headers 2>/dev/null | awk 'END{print NR+0}')"`,`echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,`echo "UPTIME_SECONDS=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo 0)"`,'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"'];if(e.includeServices!==!1)t.push(`for s in ${HC.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`);if(e.includeSites!==!1)t.push(KC(e.projectFilter));return t.push("true"),t}function GC(e){let t={services:[],discoveredSites:[]};for(let r of e.split(`
-`)){let a=r.trim();if(a.startsWith("DISCOVERED_SITE="))try{let m=JSON.parse(Buffer.from(a.slice(16),"base64").toString("utf8"));if(m?.domain&&m?.route)t.discoveredSites.push(m)}catch{}else if(a.startsWith("SVC=")){let[,m,f,v,w,k]=/^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(a)??[];if(m)t.services.push({name:m,status:f,memBytes:Number(v||0),enabled:w||wn,since:k||wn})}else{let m=a.indexOf("=");if(m>0)t[a.slice(0,m)]=a.slice(m+1)}}return t}function Ab(e){let t=e.infrastructure?.compute,r=[];if(t?.webServer==="rpx"||t?.proxy?.engine==="rpx")r.push({name:"rpx-gateway",status:"configured"});else if(t?.webServer==="nginx"||t?.webServer==null)r.push({name:"ts-cloud-nginx",status:"configured"});let a=t?.php?.versions??(t?.runtime==="php"?["8.3"]:[]);for(let v of a)r.push({name:`php${v}-fpm`,status:"configured"});let m=t?.managedServices??{},f=[["mysql","mysql"],["mariadb","mariadb"],["postgres","postgresql"],["redis","redis"],["memcached","memcached"],["meilisearch","meilisearch"]];for(let[v,w]of f)if(m[v])r.push({name:w,status:"configured"});return r}function QC(e){let t=e.infrastructure?.compute?.backups,r=!!t?.enabled,a=t?.schedule??"0 2 * * *";return{enabled:r,schedule:a,destination:r?t?.bucket??"local":"off",retention:r?t?.retentionCount??5:0,last:r?"pending first run":"not configured",size:r?wn:"0 MB"}}function Cb(e){return e.infrastructure?.compute?.provider??e.cloud?.provider??e.provider??"aws"}function YC(e){if(Cb(e)==="hetzner")return dc(e);return e.project.region??"us-east-1"}function ZC(e){let t=e.infrastructure?.compute?.monitoring,r=Number(typeof t==="object"?t?.alerts?.bandwidthTb??0:0);return Number.isFinite(r)&&r>0?Math.round(r*1000000000000):0}function XC(e,t){let r=Me(g(e,t));if(!VC(r))return null;try{return JSON.parse(WC(r,"utf8"))}catch{return null}}function eP(e){let t=e.sites??{},r=[];for(let[a,m]of Object.entries(t)){let f=m.queues??m.workers;if(Array.isArray(f)){for(let v of f)if(typeof v==="string")r.push({name:`${a}:${v}`,site:a,processes:1,status:"configured"});else if(v?.name)r.push({name:`${a}:${v.name}`,site:a,processes:v.processes??1,status:"configured"})}}return r}function Pb(e){if(!e||e==="")return"/";return e.startsWith("/")?e:`/${e}`}function tP(e){let t=Pb(e.path);if(!e.domain)return{route:"internal"};return{route:t==="/"?e.domain:`${e.domain}${t}`,href:`https://${e.domain}${t==="/"?"":t}`}}function Rb(e,t){let r=u(t);if(r==="redirect")return"redirect";if(r==="proxy")return"proxy";let a=String(t.build??"").toLowerCase(),m=String(t.start??"").toLowerCase();if(e==="main"||m.includes("buddy/src/cli.ts serve"))return"stacks";if(e==="api"||m.includes("/serve/api"))return"api";if(a.includes("buildblog"))return"bunpress blog";if(a.includes("bunpress"))return"bunpress";if(a.includes("site:build")||a.includes("stx"))return"stx static";if(r==="server-static")return t.spa?"spa":"static";if(r==="server-app")return"app";if(r==="server-php")return t.type??"php";return"bucket"}function rP(e){let t=u(e);if(t==="redirect"||t==="proxy")return"—";let r=`${e.start??""} ${e.build??""}`.toLowerCase();if(t==="server-static")return r.includes("bunpress")||r.includes("bun ")||r.includes("bunx ")?"static/bun":"static";if(t==="server-app")return r.includes("bun")?"bun":"node";if(t==="server-php")return`php ${e.php??e.phpVersion??"8.3"}`;return"static"}function nP(e){let t=u(e);if(t==="redirect")return"redirect";if(t==="proxy")return"proxy";if(t==="server-app")return"service";if(t==="server-static")return"server static";if(t==="server-php")return"php release";return"bucket"}function iP(e){let t=new Map;return Object.entries(e.sites??{}).map(([r,a])=>{let m=Pb(a.path),{route:f,href:v}=tP(a),w=a.domain?`${a.domain}${m}`:"",k=w?t.get(w):void 0;if(w&&!k)t.set(w,r);return{name:r,route:f,href:v,domain:a.domain??"internal",path:m,kind:Rb(r,a),type:Rb(r,a),runtime:rP(a),deploy:nP(a),tls:a.domain?a.ssl===!1?"http":"https":"loopback",ssl:a.domain?a.ssl!==!1:!1,status:k?"shadowed":"live",shadowedBy:k,lastDeploy:wn}})}function oP(e,t,r){let a=new Map(e.map((m)=>[String(m.route),{...m,project:r,managedBy:"owner"}]));for(let m of t){let f=a.get(m.route),v=f?.name??`${m.project}:${m.name}`;a.set(m.route,{...f,...m,name:v,kind:f?.kind??m.kind,type:f?.type??m.kind,runtime:f?.runtime??m.runtime,deploy:f?.deploy??m.deploy,root:f?.root??m.root,branch:f?.branch??m.branch,managedBy:m.project===r?"owner":"attached"})}return[...a.values()].sort((m,f)=>{if(m.managedBy!==f.managedBy)return m.managedBy==="owner"?-1:1;return String(m.route).localeCompare(String(f.route))})}function mg(e){return`'${e.replaceAll("'","'\\''")}'`}function _b(e){return e.replace(/[\\&/]/g,"\\$&")}function sP(e,t){if(e.length===0)return["true"];return["set +e",...e.map((r)=>{let a=mg(`${_(t,r)}/.ts-cloud/deploy-history.log`),m=_b(r);return`TS_CLOUD_HISTORY=${a}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${m}\\t/"; } || true`}),"true"]}function Tb(e){return[...new Set(Object.values(e.sites??{}).map((t)=>t.domain).filter((t)=>typeof t==="string"&&t.length>0))]}function aP(e){return["set +e",'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi','if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi','journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',...Tb(e).map((r)=>`TS_CLOUD_DOMAIN=${mg(r)}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`),"true"]}function cP(e){let t=new Map,r=(f,v)=>{if(f&&v&&!t.has(v))t.set(v,{pattern:f,label:v})},a=e.infrastructure?.compute,m=e.project.slug;if(a?.webServer==="rpx"||a?.proxy?.engine==="rpx")r("rpx-gateway","rpx-gateway");else r("nginx","nginx");for(let f of Ab(e))r(f.name,f.name);for(let[f,v]of Object.entries(e.sites??{})){if(u(v)!=="server-app")continue;if(r(`${m}-${f}`,`${m}-${f}`),Array.isArray(v.queues??v.workers)&&(v.queues??v.workers).length)r(`${m}-${f}-queue-*`,`${m}-${f}-queues`);if(Array.isArray(v.daemons)&&v.daemons.length)r(`${m}-${f}-daemon-*`,`${m}-${f}-daemons`)}return[...t.values()]}function dP(e){let t=cP(e);if(t.length===0)return["true"];return["set +e",...t.map((r)=>{let a=mg(r.pattern),m=_b(r.label);return`journalctl -u ${a} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${m}\\t/" || true`}),'[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true',"true"]}function gg(e){let t=new Date(e);if(Number.isNaN(t.getTime()))return e||wn;let r=Math.max(0,Math.round((Date.now()-t.getTime())/1000));if(r<60)return`${r}s ago`;let a=Math.round(r/60);if(a<60)return`${a}m ago`;let m=Math.round(a/60);if(m<48)return`${m}h ago`;return`${Math.round(m/24)}d ago`}function xb(e){if(/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(e))return"error";if(/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(e))return"warn";return"info"}function lP(e){let t=[];for(let r of e.split(`
-`)){let a=r.trim();if(!a.startsWith("LOG="))continue;let m=a.indexOf("\t");if(m<0)continue;let f=a.slice(4,m),v=a.slice(m+1),w=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(v),k=w?.[1]??"",S=w?.[2]??"",A=(w?.[3]??v).trim();if(!A)continue;t.push({source:f,timestamp:k,when:k?gg(k):wn,host:S,message:A,level:xb(A)})}return t.sort((r,a)=>String(a.timestamp).localeCompare(String(r.timestamp))).slice(0,600)}function Db(e){if(/^(?:127\.|localhost:|\[?::1\]?)/.test(e))return"loopback";if(/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|\[?f[cd][0-9a-f:])/i.test(e))return"private";return"public"}function uP(e){if(Db(e)!=="public")return"ok";if(/:(?:22|80|443)$/.test(e)||/^\*:(?:22|80|443)$/.test(e))return"ok";return"warn"}function pP(e){if(e==null)return"warn";if(e<8)return"bad";if(e<30)return"warn";return"ok"}function mP(e){let t=[],r=[],a=[],m=[];for(let w of e.split(`
-`)){let k=w.trim();if(k.startsWith("PORT=")){let[S="",A="",x=""]=k.slice(5).split("\t");if(S&&A)t.push({proto:S,listen:A,processName:x||wn,exposure:Db(A),tone:uP(A)})}else if(k.startsWith("FIREWALL=")){let S=k.slice(9).trim();if(S)r.push(S)}else if(k.startsWith("AUTH=")){let S=k.slice(5),A=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(S),x=(A?.[3]??S).trim();if(x)a.push({timestamp:A?.[1]??"",when:A?.[1]?gg(A[1]):wn,host:A?.[2]??"",message:x,level:xb(x)})}else if(k.startsWith("CERT=")){let[S="",A=""]=k.slice(5).split("\t");if(!S)continue;let x=new Date(A),F=Number.isNaN(x.getTime())?null:Math.ceil((x.getTime()-Date.now())/86400000);m.push({domain:S,expires:Number.isNaN(x.getTime())?A||wn:x.toISOString().slice(0,10),daysRemaining:F,status:pP(F)})}}let f=r.some((w)=>/Status:\s*active/i.test(w)),v=r.some((w)=>/unavailable/i.test(w));return{ports:t.slice(0,80),firewall:{status:f?"active":v?"unavailable":"inactive",summary:f?"ufw active":v?"ufw unavailable":"ufw inactive or not configured",rules:r.filter((w)=>w&&!/^Status:/i.test(w)).slice(0,60)},tlsCertificates:m,authEvents:a.sort((w,k)=>String(k.timestamp).localeCompare(String(w.timestamp))).slice(0,30)}}function fg(e){let r=e.infrastructure?.compute?.firewall??{},a=[...new Set([22,80,443,...r.allowedPorts??[]])],m=Tb(e);return{ports:a.map((f)=>({proto:"tcp",listen:`0.0.0.0:${f}`,processName:"configured firewall",exposure:"public",tone:[22,80,443].includes(Number(f))?"ok":"warn"})),firewall:{status:r.enabled===!1?"disabled":"configured",summary:r.enabled===!1?"host firewall disabled in config":"host firewall configured declaratively",rules:a.map((f)=>`ALLOW ${f}/tcp`)},tlsCertificates:m.map((f)=>({domain:f,expires:wn,daysRemaining:null,status:"warn"})),authEvents:[]}}function Ob(e,t){let r=t.security??fg(e),a=!!t._serverReachable&&!t.metricsUnavailable,m=t.sites??[],f=m.filter((S)=>S.status==="shadowed"),v=(t.services??[]).filter((S)=>["failed","stopped"].includes(S.status)),w=(r.tlsCertificates??[]).filter((S)=>S.status!=="ok"),k=t.sshKeys??[];return[{name:"Live server probe",status:a?"pass":"warn",detail:a?"Metrics and remote checks are coming from the compute box.":"The dashboard is rendering config/state data until the box probe succeeds."},{name:"Managed services",status:v.length?"fail":"pass",detail:v.length?`${v.length} service(s) need attention.`:`${(t.services??[]).length} service(s) reported healthy or configured.`},{name:"Route conflicts",status:f.length?"warn":"pass",detail:f.length?`${f.map((S)=>S.name).join(", ")} is shadowed by an earlier route.`:`${m.length} site route(s) are unshadowed.`},{name:"SSH access",status:k.length?"pass":"warn",detail:k.length?`${k.length} declarative authorized key(s) configured.`:"No declarative SSH keys are configured."},{name:"Firewall",status:["active","configured"].includes(r.firewall?.status)?"pass":"warn",detail:r.firewall?.summary??"Firewall status unavailable."},{name:"TLS certificates",status:w.length?"warn":"pass",detail:w.length?`${w.length} certificate(s) need renewal visibility.`:`${(r.tlsCertificates??[]).length} certificate(s) look healthy.`}]}function $b(e){let t=[];for(let r of e.serverDeploymentsDetail??e.serverDeployments??[])t.push({type:"deploy",tone:r.status==="failed"?"bad":"ok",title:`${r.site} deployed ${r.sha}`,detail:`${r.branch} · ${r.status}`,when:r.when,timestamp:r.timestamp});for(let r of e.serverLogs??[])if(r.level==="error"||r.level==="warn")t.push({type:"log",tone:r.level==="error"?"bad":"warn",title:`${r.source} ${r.level}`,detail:r.message,when:r.when,timestamp:r.timestamp});for(let r of e.sshKeys??[])t.push({type:"ssh",tone:"ok",title:`${r.name} authorized`,detail:r.fingerprint,when:r.added??wn,timestamp:""});return t.sort((r,a)=>String(a.timestamp).localeCompare(String(r.timestamp))).slice(0,80)}function gP(e,t={}){let r=[];for(let a of e.split(`
-`)){let m=a.trim();if(!m.startsWith("DEPLOY="))continue;let f=m.split("\t"),v=f[0]?.replace(/^DEPLOY=/,"")??"",[w,k,S,A,x]=f.slice(1);if(!v||!w||!k)continue;let F=t[v]??{},U=u(F),H=(S||k).slice(0,7);r.push({sha:H,release:k,commit:S||k,site:v,branch:F.branch??(U==="server-static"?"build artifact":"main"),status:A||"unknown",when:gg(w),timestamp:w,took:"-",by:"ts-cloud",rc:x?.replace(/^rc=/,"")??"",steps:U==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return r.sort((a,m)=>String(m.timestamp).localeCompare(String(a.timestamp)))}function fP(e,t){let r=XC(e,t),a=Ab(e),m=iP(e),f=Math.max(1,Number(e.infrastructure?.compute?.disk?.size??1)),v={server:{name:r?.serverName??`${e.project.slug}-${t}-app`,provider:r?.provider??Cb(e),region:YC(e),ip:r?.publicIp??wn,os:"Linux",uptime:wn,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(e.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:f,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,networkRxBytesPerSec:0,networkTxBytesPerSec:0,networkRxBytesToday:0,networkTxBytesToday:0,networkRxBytesMonth:0,networkTxBytesMonth:0,networkMonthKey:"",processes:0,uptimeSeconds:0},metricsUnavailable:!0,bandwidthBudgetBytes:ZC(e),services:a,servicesDetail:a.map((w)=>({...w,since:wn,memMb:0,auto:!0})),backup:QC(e),backupHistory:[],workers:eP(e),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:fg(e),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:m,sitesDetail:m.map((w)=>{let k=e.sites?.[w.name]??{},S=u(k);return{...w,root:S==="server-static"?_(e.project.slug,w.name):`${_(e.project.slug,w.name)}/current`,branch:S==="server-static"?"build artifact":"main",build:k.build,php:k.php??k.phpVersion,aliases:Array.isArray(k.aliases)?k.aliases:[],redirects:k.redirects&&typeof k.redirects==="object"?k.redirects:{},envKeys:Object.keys(k.env??k.environment??{})}}),siteHealth:[],sshKeys:Eo(e.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return v.diagnostics=Ob(e,v),v.activity=$b(v),v.topology=Et(v,{project:e.project.name,environment:t}),v}async function Cu(e,t,r={}){if(!e.infrastructure?.compute)return null;let a=null;try{a=B({config:e})}catch{a=null}let m=null,f=0,v=[];if(a)try{if(v=await a.findComputeTargets({slug:e.project.slug,environment:t,role:"app"}),f=v.length,v.length){let x=(await a.runRemoteDeploy({targets:[v[0]],commands:JC({includeServices:!r.telemetryOnly,includeSites:r.includeSiteHealth!==!1,projectFilter:e.cloud?.attachTo?e.project.slug:void 0}),comment:`ts-cloud dashboard:build ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output;if(x)m=GC(x)}}catch{}let w=fP(e,t),k=(A,x=0)=>{let F=Number(A);return Number.isFinite(F)?F:x};if(w.server.os=m?.OS||w.server.os,w.server.uptime=m?.UPTIME||w.server.uptime,m){if(w.server.probeStatus="live",w.metricsUnavailable=!1,w._metricsStatus="live",w.systemMetrics={load:k(m.LOAD),load5:k(m.LOAD5),load15:k(m.LOAD15),cpuUsedPct:k(m.CPUUSED),cpus:k(m.CPUS,1),memUsedMb:k(m.MEMUSED),memTotalMb:k(m.MEMTOTAL,1),memAvailableMb:k(m.MEMAVAILABLE),memCacheMb:k(m.MEMCACHE),swapUsedMb:k(m.SWAPUSED),swapTotalMb:k(m.SWAPTOTAL),diskUsedPct:k(m.DISKPCT),diskUsedGb:k(m.DISKUSEDG),diskTotalGb:k(m.DISKTOTG,1),inodeUsedPct:k(m.INODEPCT),networkRxBytes:k(m.NETRX),networkTxBytes:k(m.NETTX),networkRxBytesPerSec:k(m.NETRXRATE),networkTxBytesPerSec:k(m.NETTXRATE),networkRxBytesToday:k(m.NETRXTODAY),networkTxBytesToday:k(m.NETTXTODAY),networkRxBytesMonth:k(m.NETRXMONTH),networkTxBytesMonth:k(m.NETTXMONTH),networkMonthKey:m.NETMONTHKEY||"",processes:k(m.PROCESSES),uptimeSeconds:k(m.UPTIME_SECONDS)},m.services.length){let A=[...new Map(m.services.map((x)=>[x.name,x])).values()];w.services=A.map((x)=>({name:x.name,status:x.status==="active"?"running":x.status})),w.servicesDetail=A.map((x)=>({name:x.name,status:x.status==="active"?"running":x.status,since:x.since&&x.since!==wn?x.since:w.server.uptime,memMb:Math.max(0,Math.round(Number(x.memBytes??0)/1024/1024)),auto:x.enabled?!["disabled","static","masked"].includes(x.enabled):!0}))}if(m.discoveredSites.length)w.sitesDetail=oP(w.sitesDetail,m.discoveredSites,e.project.slug),w.sites=w.sitesDetail.map((A)=>({name:A.name,project:A.project,managedBy:A.managedBy,route:A.route,href:A.href,domain:A.domain,path:A.path,kind:A.kind,type:A.type,runtime:A.runtime,deploy:A.deploy,tls:A.tls,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt})),w.siteHealth=w.sitesDetail.map((A)=>({name:A.name,project:A.project,route:A.route,status:A.status,httpStatus:A.httpStatus,responseMs:A.responseMs,tlsDaysRemaining:A.tlsDaysRemaining,checkedAt:A.checkedAt}))}if(a&&v.length&&!r.telemetryOnly)await Promise.all([(async()=>{try{let A=Object.keys(e.sites??{}),F=(await a.runRemoteDeploy({targets:[v[0]],commands:sP(A,e.project.slug),comment:`ts-cloud dashboard:deploy-history ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",U=gP(F,e.sites);w.serverDeployments=U.slice(0,5),w.serverDeploymentsDetail=U.slice(0,50),w.deploymentsEmptyReason=U.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{w.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let x=(await a.runRemoteDeploy({targets:[v[0]],commands:dP(e),comment:`ts-cloud dashboard:server-logs ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",F=lP(x);w.serverLogs=F,w.serverLogsEmptyReason=F.length?void 0:"No recent journal entries were found for the managed server units."}catch{w.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let x=(await a.runRemoteDeploy({targets:[v[0]],commands:aP(e),comment:`ts-cloud dashboard:security ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",F=mP(x),U=fg(e);if(!F.ports.length)F.ports=U.ports;if(!F.tlsCertificates.length)F.tlsCertificates=U.tlsCertificates;w.security=F,w.securityEmptyReason=void 0}catch{w.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(a&&f===0)w.deploymentsEmptyReason="No app server target was found for this environment.";let S=e.infrastructure?.compute?.sshKeys??e.infrastructure?.ssh?.keys??e.infrastructure?.sshKeys;if(Array.isArray(S)&&S.length)w.sshKeys=Eo(S);return w._serverReachable=f>0&&!!m,w.diagnostics=Ob(e,w),w.activity=$b(w),w.topology=Et(w,{project:e.project.name,environment:t}),w}var hP=new Set(["singlestore","vitess"]);function xu(e){return hP.has(e)}var Tu={mysql:"/var/lib/pantry/mysql/mysqld.sock",mariadb:"/var/lib/pantry/mariadb/mariadbd.sock"};function Pi(e){return/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(e)}function yP(e){if(e==="postgres"||e==="pgsql")return"postgres";if(e==="mariadb")return"mariadb";if(e==="singlestore")return"singlestore";if(e==="vitess")return"vitess";return"mysql"}function ws(e){let t=e.infrastructure?.compute,r=p(e)?.engine;if(r)return yP(r);let a=t?.managedServices??{};if(a.postgres)return"postgres";if(a.mariadb)return"mariadb";return"mysql"}var hg=(e)=>e.replace(/`/g,"``"),ii=(e)=>e.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),Ss=(e)=>`"${e.replace(/"/g,'""')}"`,Pu=(e)=>`'${e.replace(/'/g,"''")}'`;function yg(e,t){return[`mysql --socket=${e==="mariadb"?Tu.mariadb:Tu.mysql} -u root <<'TS_CLOUD_SQL_EOF'`,...t,"TS_CLOUD_SQL_EOF"]}function vg(e,t){return[`${kt(t)} -tA <<'TS_CLOUD_PG_EOF'`,...e,"TS_CLOUD_PG_EOF"]}function vP(e,t){if(e==="vitess")return bP(t);if(e==="postgres")return vg(["SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;","SELECT 'USER=' || usename FROM pg_user;"],t);return yg(e,["SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');","SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"])}function za(e,t,r){let a=t?.host??"127.0.0.1",m=t?.username??"root",f=t?.password??"",v=t?.ssl===!1?"":" --ssl-mode=PREFERRED",w=(S)=>`'${String(S).replace(/'/g,"'\\''")}'`;return[`${f?`MYSQL_PWD=${w(f)} `:""}mysql -h ${w(a)} -P ${t?.port??r} -u ${w(m)}${v} --batch --skip-column-names <<'TS_CLOUD_SQL_EOF'`,...e,"TS_CLOUD_SQL_EOF"]}var Ua=15306;function bP(e){let t=za(["SHOW KEYSPACES;"],e,Ua);return t[0]=`${t[0]} | sed 's/^/DB=/'`,t}function SP(e){return za(["SHOW KEYSPACES;","SHOW VITESS_SHARDS;","SHOW VITESS_TABLETS;"],e,Ua)}function wP(e){let t=[],r=[],a=[];for(let m of e.split(`
-`)){let f=m.trim();if(!f)continue;let v=f.split("\t").map((w)=>w.trim()).filter(Boolean);if(v.length>=6){let[w,k,S,A,x,F,U]=v;a.push({cell:w??"",keyspace:k??"",shard:S??"",type:A??"",state:x??"",alias:F??"",hostname:U??""});continue}if(v.length===1){let w=v[0];if(w.includes("/")){let[k,S]=w.split("/");if(k&&S)r.push({keyspace:k,shard:S})}else t.push(w)}}return{keyspaces:[...new Set(t)].filter(Boolean).sort(),shards:r,tablets:a}}function kP(e,t,r){if(e==="postgres")return vg([`SELECT 'CREATE DATABASE ${Ss(t)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${Pu(t)})\\gexec`],r);return yg(e,[`CREATE DATABASE IF NOT EXISTS \`${hg(t)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`])}function IP(e,t,r){let{username:a,password:m,database:f,access:v}=t;if(e==="postgres"){let S=["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${Pu(a)}) THEN CREATE ROLE ${Ss(a)} LOGIN PASSWORD ${Pu(m)};`,`  ELSE ALTER ROLE ${Ss(a)} LOGIN PASSWORD ${Pu(m)}; END IF;`,"END $$;"];if(f)S.push(v==="readonly"?`GRANT CONNECT ON DATABASE ${Ss(f)} TO ${Ss(a)};`:`GRANT ALL PRIVILEGES ON DATABASE ${Ss(f)} TO ${Ss(a)};`);return vg(S,r)}let w=v==="readonly"?"SELECT":"ALL PRIVILEGES",k=[`CREATE USER IF NOT EXISTS '${ii(a)}'@'%' IDENTIFIED BY '${ii(m)}';`,`CREATE USER IF NOT EXISTS '${ii(a)}'@'localhost' IDENTIFIED BY '${ii(m)}';`,`ALTER USER '${ii(a)}'@'%' IDENTIFIED BY '${ii(m)}';`,`ALTER USER '${ii(a)}'@'localhost' IDENTIFIED BY '${ii(m)}';`];if(f)k.push(`GRANT ${w} ON \`${hg(f)}\`.* TO '${ii(a)}'@'%';`,`GRANT ${w} ON \`${hg(f)}\`.* TO '${ii(a)}'@'localhost';`);return k.push("FLUSH PRIVILEGES;"),yg(e,k)}function EP(e){let t=[],r=[];for(let a of e.split(`
-`)){let m=a.trim();if(m.startsWith("DB="))t.push(m.slice(3));else if(m.startsWith("USER="))r.push(m.slice(5))}return{databases:[...new Set(t)].filter(Boolean).sort(),users:[...new Set(r)].filter(Boolean).sort()}}async function kn(e,t,r,a){let m;try{m=B({config:e})}catch(k){return{ok:!1,error:`Could not initialize the cloud driver: ${k?.message??k}`}}let f=e.project.slug,v=await m.findComputeTargets({slug:f,environment:t,role:"app"});if(!v.length)return{ok:!1,error:"No app server target was found for this environment."};let w=await m.runRemoteDeploy({targets:[v[0]],commands:["set -uo pipefail",...r],comment:a,tags:{Project:f,Environment:t,Role:"app"}});return{ok:w.success,stdout:w.perInstance?.[0]?.output??"",stderr:w.perInstance?.[0]?.error??w.error??""}}function Du(e,t){return{ok:!1,error:`${t} is not available for ${e}: it is an external cluster, so this box has no engine to administer. ${e==="vitess"?"Create a keyspace with `vtctldclient CreateKeyspace`, and manage vtgate credentials on the cluster.":"Use the provider console or the cluster's own admin connection."}`}}async function Nb(e,t){let r=ws(e);if(xu(r)&&r!=="vitess")return{...Du(r,"Listing databases"),engine:r,databases:[],users:[]};let a=await kn(e,t,vP(r,p(e)),"ts-cloud db:list"),m=a.ok&&a.stdout?EP(a.stdout):{databases:[],users:[]};return{...a,engine:r,...m}}async function jb(e,t,r){let a=ws(e);if(xu(a))return Du(a,"Creating a database");return kn(e,t,kP(a,r,p(e)),`ts-cloud db:create ${r}`)}async function Mb(e,t,r){let a=ws(e);if(xu(a))return Du(a,"Creating a database user");return kn(e,t,IP(a,r,p(e)),`ts-cloud db:user ${r.username}`)}var bg="/var/backups/ts-cloud/databases";function RP(e,t,r=bg,a){let f=`${r}/${t}-$TS_CLOUD_BACKUP_STAMP.sql.gz`,v=`mkdir -p ${r}`;if(e==="postgres")return[v,'TS_CLOUD_BACKUP_STAMP="$(date +%Y%m%d-%H%M%S)"',`${kt(a,"pg_dump")} ${t} | gzip > "${f}"`,`echo "BACKUP=${f}"`,`ls -l "${f}"`];let w=e==="mariadb"?Tu.mariadb:Tu.mysql;return[v,'TS_CLOUD_BACKUP_STAMP="$(date +%Y%m%d-%H%M%S)"',`mysqldump --socket=${w} -u root ${t} | gzip > "${f}"`,`echo "BACKUP=${f}"`,`ls -l "${f}"`]}function AP(e=bg){return[`ls -1t ${e}/*.sql.gz 2>/dev/null | head -50 | sed 's|^|BACKUP=|' || true`]}function CP(e){let t=[];for(let r of e.split(`
-`)){let a=r.trim();if(!a.startsWith("BACKUP="))continue;let m=a.slice(7),v=(m.split("/").pop()??m).replace(/-\d{8}-\d{6}\.sql\.gz$/,"");if(m)t.push({file:m,database:v})}return t}async function Bb(e,t,r){if(!Pi(r))return{ok:!1,error:"Database name must be a valid identifier.",database:r};let a=ws(e);if(xu(a))return{...Du(a,"Backing up"),database:r};return{...await kn(e,t,RP(a,r,bg,p(e)),`ts-cloud db:backup ${r}`),database:r}}async function Lb(e,t){let r=await kn(e,t,AP(),"ts-cloud db:backups"),a=r.ok&&r.stdout?CP(r.stdout):[];return{...r,backups:a}}async function Fb(e,t){let r=ws(e),a={keyspaces:[],shards:[],tablets:[]};if(r!=="vitess")return{ok:!1,error:"The configured database engine is not Vitess.",engine:r,...a};let m=await kn(e,t,SP(p(e)),"ts-cloud vitess:topology"),f=m.ok&&m.stdout?wP(m.stdout):a;return{...m,engine:r,...f}}function zb(e){return e.filter((t)=>t.state.toUpperCase()!=="SERVING")}function Ub(e){let t=new Set(e.tablets.filter((r)=>r.type.toUpperCase()==="PRIMARY"&&r.state.toUpperCase()==="SERVING").map((r)=>`${r.keyspace}/${r.shard}`));return e.shards.filter((r)=>!t.has(`${r.keyspace}/${r.shard}`))}var Sg="/usr/local/bin/vtctldclient",PP="21.0.0";function $u(e){return`'${String(e).split("'").join("'\\''")}'`}function Nu(e){return p(e)?.vitess??{}}function qb(e){return/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(e)}function _P(e){return/^[0-9a-f]{8}(?:_[0-9a-f]{4}){3}_[0-9a-f]{12}$/i.test(e)}function TP(e=PP){let t=$u(e);return[`if ${Sg} --version 2>/dev/null | grep -q ${t}; then echo "vtctldclient ${e} already installed"; else`,"  command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)",'  if [ "$(uname -m)" != "x86_64" ]; then','    echo "vtctldclient: Vitess publishes only an x86_64 release tarball; this box is $(uname -m). Build from source or install via pantry." >&2',"    exit 1","  fi",'  tmp="$(mktemp -d)"',`  api="https://api.github.com/repos/vitessio/vitess/releases/tags/v${e}"`,`  url="$(curl -fsSL "$api" | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]+vitess-[0-9][^"]*\\.tar\\.gz"' | head -1 | sed -E 's/.*"(https[^"]+)"/\\1/')"`,'  if [ -z "$url" ]; then echo "vtctldclient: no release tarball found for v'+e+'" >&2; rm -rf "$tmp"; exit 1; fi',`  curl -fsSL "$url" | tar -xz -C "$tmp" --strip-components=2 --wildcards --occurrence=1 '*/bin/vtctldclient' || true`,'  if [ ! -s "$tmp/vtctldclient" ]; then','    echo "vtctldclient: could not extract the binary from $url" >&2','    rm -rf "$tmp"; exit 1',"  fi",`  install -m 0755 "$tmp/vtctldclient" ${Sg}`,'  rm -rf "$tmp"',`  echo "installed vtctldclient ${e}"`,"fi"]}function Vb(e){if(!e.vtctldAddr)return null;return`${Sg} --server ${$u(e.vtctldAddr)}`}function xP(e,t,r={}){let a=Vb(e);if(!a)return null;let m=r.sharded?" --sharded":"";return[`${a} CreateKeyspace${m} ${$u(t)}`]}function DP(e,t,r){let a=Vb(e);if(!a)return null;return['vschema_tmp="$(mktemp)"',`cat > "$vschema_tmp" <<'TS_CLOUD_VSCHEMA_EOF'`,r,"TS_CLOUD_VSCHEMA_EOF",`${a} ApplyVSchema --vschema-file "$vschema_tmp" ${$u(t)}`,'rm -f "$vschema_tmp"']}function OP(e,t,r="vitess"){return za([`SET @@ddl_strategy='${r}';`,t.endsWith(";")?t:`${t};`],e,Ua)}function $P(e,t){let r=t?[`USE ${t.replace(/[^A-Z0-9_]/gi,"")};`,"SHOW VITESS_MIGRATIONS;"]:["SHOW VITESS_MIGRATIONS;"],a=za(r,e,Ua);return a[0]=a[0].replace(" --skip-column-names",""),a}function NP(e){let t=e.split(`
-`).map((v)=>v.trimEnd()).filter((v)=>v.trim().length>0);if(t.length===0)return[];let r=t[0].split("\t").map((v)=>v.trim()),a=(v)=>r.indexOf(v),m={uuid:a("migration_uuid"),keyspace:a("keyspace"),shard:a("shard"),table:a("mysql_table"),status:a("migration_status"),strategy:a("strategy"),added:a("added_timestamp"),completed:a("completed_timestamp"),progress:a("progress")};if(m.uuid===-1)return[];let f=[];for(let v of t.slice(1)){let w=v.split("\t"),k=(A)=>A>=0?(w[A]??"").trim():"",S=k(m.uuid);if(!S)continue;f.push({uuid:S,keyspace:k(m.keyspace),shard:k(m.shard),table:k(m.table),status:k(m.status),strategy:k(m.strategy),added:k(m.added),completed:k(m.completed),progress:k(m.progress)})}return f}function jP(e){return e.filter((t)=>t.status.toLowerCase()==="failed")}function MP(e){return e.filter((t)=>["running","queued","ready"].includes(t.status.toLowerCase()))}function BP(e,t,r){let a=r.toUpperCase();return za([`ALTER VITESS_MIGRATION '${t}' ${a};`],e,Ua)}function qa(e){if(ws(e)!=="vitess")return{ok:!1,error:"The configured database engine is not Vitess."};return null}function Ou(e){if(!e.vtctldAddr)return{ok:!1,error:"No vtctld address is configured. Creating keyspaces and applying a VSchema are topology operations that vtgate cannot perform. Set `infrastructure.appDatabase.vitess.vtctldAddr` (for example `vtctld.internal:15999`) and redeploy."};return null}async function Wb(e,t){let r=qa(e);if(r)return r;let a=Nu(e);return kn(e,t,TP(a.clientVersion),"ts-cloud vitess:install-client")}async function Hb(e,t,r,a={}){let m=qa(e);if(m)return{...m,keyspace:r};if(!qb(r))return{ok:!1,error:"Keyspace name must be a valid identifier.",keyspace:r};let f=Nu(e),v=Ou(f);if(v)return{...v,keyspace:r};let w=xP(f,r,a);if(!w)return{...Ou({}),keyspace:r};return{...await kn(e,t,w,`ts-cloud vitess:create-keyspace ${r}`),keyspace:r}}async function Kb(e,t,r,a){let m=qa(e);if(m)return{...m,keyspace:r};if(!qb(r))return{ok:!1,error:"Keyspace name must be a valid identifier.",keyspace:r};try{let S=JSON.parse(a);if(!S||typeof S!=="object")return{ok:!1,error:"The VSchema must be a JSON object.",keyspace:r}}catch(S){return{ok:!1,error:`The VSchema is not valid JSON: ${S?.message??S}`,keyspace:r}}let f=Nu(e),v=Ou(f);if(v)return{...v,keyspace:r};let w=DP(f,r,a);if(!w)return{...Ou({}),keyspace:r};return{...await kn(e,t,w,`ts-cloud vitess:apply-vschema ${r}`),keyspace:r}}async function Jb(e,t,r){let a=qa(e);if(a)return a;if(!r.trim())return{ok:!1,error:"No SQL was provided."};let m=Nu(e);return kn(e,t,OP(p(e),r,m.ddlStrategy??"vitess"),"ts-cloud vitess:apply-schema")}async function Gb(e,t,r){let a=qa(e);if(a)return{...a,migrations:[],failed:[],running:[]};let m=await kn(e,t,$P(p(e),r),"ts-cloud vitess:migrations"),f=m.ok&&m.stdout?NP(m.stdout):[];return{...m,migrations:f,failed:jP(f),running:MP(f)}}async function Qb(e,t,r,a){let m=qa(e);if(m)return{...m,uuid:r};if(!_P(r))return{ok:!1,error:"Migration UUID is not in the expected format.",uuid:r};return{...await kn(e,t,BP(p(e),r,a),`ts-cloud vitess:migration ${a} ${r}`),uuid:r}}function LP(e){let t=e.infrastructure?.appDatabase;if(t?.engine&&t.engine!=="vitess")return`This project already declares ${t.engine} as its application database.`;let r=e.infrastructure?.compute?.managedServices,a=r?["mysql","mariadb","postgres"].find((m)=>Boolean(r[m])):void 0;if(a)return`This server already declares the ${a} database service.`;return}function FP(e,t){let r=t.keyspace.trim(),a=t.username.trim(),m=t.password,f=LP(e);if(f)throw Error(f);if(!Pi(r))throw Error("Keyspace must contain letters, numbers, or underscores and cannot start with a number.");if(!Pi(a))throw Error("Username must contain letters, numbers, or underscores and cannot start with a number.");if(m.length<16)throw Error("Password must contain at least 16 characters.");if(t.confirm!==r)throw Error(`Type "${r}" to confirm Vitess provisioning.`);let v={mode:"cluster",cell:"zone1",keyspaces:[{name:r,sharded:t.sharded===!0}],vtgatePort:15306,username:a,password:m,bindAddress:"127.0.0.1"};return{service:v,appDatabase:{engine:"vitess",name:r,username:a,host:"127.0.0.1",port:15306,ssl:!1},commands:[...gr(),...Ts(v)]}}async function Yb(e,t,r){let a=FP(e,r);return{...await kn(e,t,a.commands,`ts-cloud vitess:provision ${a.appDatabase.name}`),database:a.appDatabase,service:Object.fromEntries(Object.entries(a.service).filter(([f])=>f!=="password"))}}var zP={capability:"runtime:terminal",scope:"organization"};var UP={"GET /api/health":{capability:"project:read",anyUser:!0},"GET /api/dashboard-data":{capability:"project:read",anyUser:!0},"GET /api/config":{capability:"config:read",anyUser:!0},"GET /api/me":{capability:"project:read",anyUser:!0},"GET /api/search":{capability:"project:read",anyUser:!0},"GET /api/search/preferences":{capability:"project:read",anyUser:!0},"POST /api/search/preferences":{capability:"project:read",anyUser:!0},"DELETE /api/search/preferences":{capability:"project:read",anyUser:!0},"GET /api/auth/security":{capability:"project:read",anyUser:!0},"GET /api/auth/sessions":{capability:"project:read",anyUser:!0},"DELETE /api/auth/sessions":{capability:"project:read",anyUser:!0},"POST /api/auth/sessions/revoke-others":{capability:"project:read",anyUser:!0},"POST /api/auth/password/change":{capability:"project:read",anyUser:!0},"POST /api/auth/mfa/enroll":{capability:"project:read",anyUser:!0},"POST /api/auth/mfa/verify":{capability:"project:read",anyUser:!0},"DELETE /api/auth/mfa":{capability:"project:read",anyUser:!0},"POST /api/auth/step-up":{capability:"project:read",anyUser:!0},"GET /api/auth/oidc/providers":{capability:"users:read",scope:"organization"},"POST /api/auth/oidc/providers":{capability:"users:manage",scope:"organization"},"PATCH /api/auth/oidc/providers":{capability:"users:manage",scope:"organization"},"GET /api/automation":{capability:"users:read",scope:"organization"},"POST /api/automation/service-accounts":{capability:"users:manage",scope:"organization"},"PATCH /api/automation/service-accounts":{capability:"users:manage",scope:"organization"},"POST /api/automation/tokens":{capability:"users:manage",scope:"organization"},"POST /api/automation/tokens/rotate":{capability:"users:manage",scope:"organization"},"DELETE /api/automation/tokens":{capability:"users:manage",scope:"organization"},"GET /api/security/posture":{capability:"security:read"},"GET /api/security/export":{capability:"security:read"},"POST /api/security/scan":{capability:"security:manage"},"POST /api/security/review":{capability:"deployments:create"},"POST /api/security/policies":{capability:"security:manage"},"PATCH /api/security/policies":{capability:"security:manage"},"POST /api/security/waivers":{capability:"security:waive"},"DELETE /api/security/waivers":{capability:"security:waive"},"PATCH /api/security/findings":{capability:"security:manage"},"POST /api/security/comments":{capability:"security:manage"},"GET /api/sources":{capability:"sources:read"},"POST /api/sources/connections":{capability:"sources:manage"},"PATCH /api/sources/connections":{capability:"sources:manage"},"DELETE /api/sources/connections":{capability:"sources:manage"},"POST /api/sources/deploy-keys":{capability:"sources:manage"},"DELETE /api/sources/deploy-keys":{capability:"sources:manage"},"POST /api/sources/repositories/sync":{capability:"sources:manage"},"GET /api/sources/references":{capability:"sources:read"},"POST /api/sources/bindings":{capability:"sources:manage"},"PATCH /api/sources/bindings":{capability:"sources:manage"},"POST /api/sources/webhooks":{capability:"sources:manage"},"PATCH /api/sources/webhooks":{capability:"sources:manage"},"DELETE /api/sources/webhooks":{capability:"sources:manage"},"GET /api/onboarding":{capability:"applications:read"},"POST /api/onboarding/detect":{capability:"applications:manage"},"POST /api/onboarding/plan":{capability:"applications:manage"},"POST /api/onboarding/drafts":{capability:"applications:manage"},"PATCH /api/onboarding/drafts":{capability:"applications:manage"},"POST /api/onboarding/artifacts":{capability:"applications:manage"},"POST /api/onboarding/registries":{capability:"applications:manage"},"PATCH /api/onboarding/registries":{capability:"applications:manage"},"DELETE /api/onboarding/registries":{capability:"applications:manage"},"POST /api/onboarding/apply":{capability:"applications:manage"},"GET /api/compose":{capability:"applications:read",anyUser:!0},"POST /api/compose/preview":{capability:"applications:manage",anyUser:!0},"POST /api/compose/import":{capability:"applications:manage",anyUser:!0},"POST /api/compose/template":{capability:"applications:manage",anyUser:!0},"POST /api/compose/action":{capability:"project:read",anyUser:!0},"POST /api/compose/logs":{capability:"runtime:logs",anyUser:!0},"POST /api/compose/shell":{capability:"runtime:terminal",scope:"organization"},"GET /api/compose/import":{capability:"applications:manage"},"GET /api/compose/template":{capability:"applications:manage"},"GET /api/compose/logs":{capability:"runtime:logs"},"GET /api/compose/shell":{capability:"runtime:terminal",scope:"organization"},"GET /api/organization":{capability:"users:read",scope:"organization"},"GET /api/organization/invitations":{capability:"users:read",scope:"organization"},"POST /api/organization/invitations":{capability:"users:manage",scope:"organization"},"DELETE /api/organization/invitations":{capability:"users:manage",scope:"organization"},"POST /api/organization/invitations/resend":{capability:"users:manage",scope:"organization"},"PATCH /api/organization/memberships":{capability:"users:manage",scope:"organization"},"DELETE /api/organization/memberships":{capability:"users:manage",scope:"organization"},"POST /api/organization/grants":{capability:"users:manage",scope:"organization"},"DELETE /api/organization/grants":{capability:"users:manage",scope:"organization"},"GET /api/control-plane/operations":{capability:"deployments:read"},"GET /api/control-plane/events":{capability:"audit:read"},"GET /api/queue":{capability:"deployments:read",anyUser:!0},"GET /api/queue/logs":{capability:"deployments:read",anyUser:!0},"GET /api/queue/stream":{capability:"deployments:read",anyUser:!0},"POST /api/queue/cancel":{capability:"deployments:cancel",anyUser:!0},"POST /api/queue/retry":{capability:"deployments:create",anyUser:!0},"GET /api/queue/settings":{capability:"deployments:read"},"PATCH /api/queue/settings":{capability:"automation:manage",scope:"organization"},"DELETE /api/queue/history":{capability:"automation:manage",scope:"organization"},"GET /api/previews":{capability:"deployments:read",anyUser:!0},"GET /api/releases":{capability:"deployments:read",anyUser:!0},"POST /api/releases/action":{capability:"deployments:create",anyUser:!0},"POST /api/previews/deploy":{capability:"deployments:create",anyUser:!0},"POST /api/previews/destroy":{capability:"deployments:cancel",anyUser:!0},"POST /api/previews/extend":{capability:"deployments:create",anyUser:!0},"POST /api/previews/rebuild":{capability:"deployments:create",anyUser:!0},"POST /api/previews/definitions":{capability:"config:write",anyUser:!0},"POST /api/previews/cleanup":{capability:"automation:manage",scope:"organization"},"GET /api/tags":{capability:"project:read"},"POST /api/tags":{capability:"tags:manage"},"DELETE /api/tags":{capability:"tags:manage"},"POST /api/sites/deploy":{capability:"deployments:create",scope:"site",siteFrom:"body"},"PATCH /api/sites":{capability:"config:write",scope:"site",siteFrom:"body"},"POST /api/sites":{capability:"config:write"},"DELETE /api/sites":{capability:"config:write"},"POST /api/env":{capability:"config:write"},"GET /api/ssh-keys":{capability:"fleet:read"},"POST /api/ssh-keys":{capability:"fleet:manage"},"DELETE /api/ssh-keys":{capability:"fleet:manage"},"GET /api/firewall":{capability:"fleet:read"},"POST /api/firewall":{capability:"fleet:manage"},"DELETE /api/firewall":{capability:"fleet:manage"},"GET /api/databases":{capability:"data:read"},"POST /api/databases":{capability:"data:admin"},"GET /api/databases/vitess":{capability:"data:read"},"GET /api/databases/vitess/migrations":{capability:"data:read"},"POST /api/databases/vitess/migrations/action":{capability:"data:admin"},"POST /api/databases/vitess/provision":{capability:"runtime:terminal",scope:"organization"},"POST /api/databases/vitess/keyspaces":{capability:"data:admin"},"POST /api/databases/vitess/vschema":{capability:"data:admin"},"POST /api/databases/vitess/schema":{capability:"data:admin"},"POST /api/databases/vitess/install-client":{capability:"data:admin"},"GET /api/databases/backups":{capability:"backups:read"},"POST /api/databases/backup":{capability:"backups:create"},"POST /api/databases/users":{capability:"data:admin"},"GET /api/data-services":{capability:"data:read"},"GET /api/data-services/capabilities":{capability:"data:read"},"GET /api/data-services/connections":{capability:"data:read"},"POST /api/data-services/preview":{capability:"data:read"},"POST /api/data-services":{capability:"data:admin"},"POST /api/data-services/action":{capability:"data:admin"},"POST /api/data-services/dependencies":{capability:"data:admin"},"POST /api/data-services/management":{capability:"data:admin"},"POST /api/data-services/reveal":{capability:"data:admin"},"GET /api/backups":{capability:"backups:read"},"POST /api/backups/destinations":{capability:"backups:create"},"POST /api/backups/destinations/test":{capability:"backups:create"},"POST /api/backups/policies":{capability:"backups:create"},"POST /api/backups/run":{capability:"backups:create"},"POST /api/backups/verify":{capability:"backups:create"},"POST /api/backups/restore":{capability:"backups:restore"},"POST /api/backups/recovery-points":{capability:"backups:create"},"POST /api/backups/retention":{capability:"backups:create"},"GET /api/configuration":{capability:"config:read"},"GET /api/configuration/export":{capability:"config:read"},"POST /api/configuration/plan":{capability:"config:read"},"POST /api/configuration":{capability:"config:write"},"POST /api/configuration/import":{capability:"config:write"},"POST /api/configuration/dependencies":{capability:"config:write"},"POST /api/configuration/transfer":{capability:"config:write"},"POST /api/configuration/bulk":{capability:"config:write"},"POST /api/configuration/reveal":{capability:"secrets:read"},"DELETE /api/configuration":{capability:"config:write"},"GET /api/volumes":{capability:"data:read"},"POST /api/volumes":{capability:"data:admin"},"POST /api/volumes/attach":{capability:"data:admin"},"POST /api/volumes/detach":{capability:"data:admin"},"POST /api/volumes/resize":{capability:"data:admin"},"POST /api/volumes/snapshot":{capability:"backups:create"},"POST /api/volumes/restore":{capability:"backups:restore"},"POST /api/volumes/adopt":{capability:"data:admin"},"POST /api/volumes/discover":{capability:"data:read"},"DELETE /api/volumes":{capability:"data:admin"},"GET /api/fleet":{capability:"fleet:read"},"POST /api/fleet":{capability:"fleet:manage"},"POST /api/fleet/action":{capability:"fleet:manage"},"GET /api/capacity":{capability:"fleet:read"},"POST /api/capacity":{capability:"fleet:manage"},"POST /api/capacity/member":{capability:"fleet:manage"},"POST /api/capacity/explain":{capability:"fleet:read"},"POST /api/capacity/action":{capability:"fleet:manage"},"GET /api/regions":{capability:"config:read"},"POST /api/regions":{capability:"config:write"},"POST /api/regions/action":{capability:"config:write"},"GET /api/maintenance":{capability:"automation:read"},"POST /api/maintenance/cleanup-preview":{capability:"automation:manage"},"POST /api/maintenance/cleanup-apply":{capability:"automation:manage"},"POST /api/maintenance/drill":{capability:"automation:manage"},"POST /api/maintenance/drill-run":{capability:"automation:manage"},"GET /api/actions":{capability:"runtime:read"},"GET /api/runtime/workloads":{capability:"runtime:read"},"GET /api/runtime/logs":{capability:"runtime:logs"},"POST /api/runtime/log-sessions":{capability:"runtime:logs"},"GET /api/runtime/log-sessions":{capability:"runtime:logs"},"GET /api/runtime/log-stream":{capability:"runtime:logs"},"DELETE /api/runtime/log-sessions":{capability:"runtime:logs"},"POST /api/runtime/exec-sessions":{capability:"runtime:terminal",scope:"organization"},"GET /api/runtime/exec-sessions":{capability:"runtime:terminal",scope:"organization"},"GET /api/runtime/exec-stream":{capability:"runtime:terminal",scope:"organization"},"DELETE /api/runtime/exec-sessions":{capability:"runtime:terminal",scope:"organization"},"POST /api/runtime/files/read":{capability:"runtime:terminal",scope:"organization"},"POST /api/runtime/files/write":{capability:"runtime:terminal",scope:"organization"},"POST /api/runtime/operations":{capability:"runtime:restart"},"GET /api/telemetry/status":{capability:"runtime:read"},"GET /api/telemetry/settings":{capability:"runtime:read"},"PATCH /api/telemetry/settings":{capability:"config:write",scope:"organization"},"GET /api/telemetry/query":{capability:"runtime:logs"},"GET /api/telemetry/tail":{capability:"runtime:logs"},"GET /api/telemetry/series":{capability:"runtime:read"},"POST /api/telemetry/refresh":{capability:"runtime:logs"},"POST /api/telemetry/export":{capability:"runtime:logs"},"GET /api/telemetry/saved-queries":{capability:"runtime:logs"},"POST /api/telemetry/saved-queries":{capability:"runtime:logs"},"DELETE /api/telemetry/saved-queries":{capability:"runtime:logs"},"GET /api/health/checks":{capability:"runtime:read"},"POST /api/health/checks":{capability:"config:write"},"PATCH /api/health/checks":{capability:"config:write"},"POST /api/health/checks/test":{capability:"runtime:read"},"POST /api/health/checks/run":{capability:"runtime:restart"},"GET /api/protection":{capability:"security:read"},"POST /api/protection/attack-mode":{capability:"security:manage"},"POST /api/protection/pause":{capability:"security:manage"},"GET /api/protection/ip-rules":{capability:"security:read"},"POST /api/protection/ip-rules":{capability:"security:manage"},"DELETE /api/protection/ip-rules":{capability:"security:manage"},"GET /api/usage":{capability:"billing:read"},"GET /api/spend/budgets":{capability:"billing:read"},"POST /api/spend/budgets":{capability:"billing:manage"},"PATCH /api/spend/budgets":{capability:"billing:manage"},"DELETE /api/spend/budgets":{capability:"billing:manage"},"POST /api/spend/check":{capability:"billing:manage"},"GET /api/spend/enforcement":{capability:"billing:read"},"POST /api/spend/release":{capability:"billing:manage"},"GET /api/spend/anomalies":{capability:"billing:read"},"POST /api/spend/anomalies/acknowledge":{capability:"billing:manage"},"GET /api/alerts":{capability:"runtime:read"},"GET /api/alerts/rules":{capability:"runtime:read"},"POST /api/alerts/rules":{capability:"config:write"},"PATCH /api/alerts/rules":{capability:"config:write"},"POST /api/alerts/evaluate":{capability:"runtime:restart"},"POST /api/alerts/action":{capability:"runtime:restart"},"POST /api/alerts/silences":{capability:"config:write"},"GET /api/notifications/channels":{capability:"automation:read",scope:"organization"},"POST /api/notifications/channels":{capability:"automation:manage",scope:"organization"},"PATCH /api/notifications/channels":{capability:"automation:manage",scope:"organization"},"POST /api/notifications/channels/test":{capability:"automation:manage",scope:"organization"},"GET /api/notifications/routes":{capability:"automation:read",scope:"organization"},"POST /api/notifications/routes":{capability:"automation:manage",scope:"organization"},"PATCH /api/notifications/routes":{capability:"automation:manage",scope:"organization"},"POST /api/notifications/routes/preview":{capability:"automation:read",scope:"organization"},"GET /api/notifications/deliveries":{capability:"automation:read",scope:"organization"},"POST /api/notifications/deliveries/retry":{capability:"automation:manage",scope:"organization"},"GET /api/jobs":{capability:"automation:read"},"POST /api/jobs":{capability:"automation:manage"},"PATCH /api/jobs":{capability:"automation:manage"},"POST /api/jobs/preview":{capability:"automation:read"},"POST /api/jobs/action":{capability:"automation:manage"},"POST /api/jobs/reconcile":{capability:"automation:manage"},"GET /api/jobs/history":{capability:"automation:read"},"GET /api/workers":{capability:"automation:read"},"POST /api/workers/action":{capability:"automation:manage"},"POST /api/actions/run":{capability:"fleet:manage"},"GET /api/server/operations":{capability:"fleet:read"},"POST /api/server/operations/run":{capability:"fleet:manage"},"POST /api/server/command":{capability:"runtime:terminal",scope:"organization"},"GET /api/terminal":{capability:"runtime:terminal",scope:"organization"},"GET /api/users":{capability:"users:read",scope:"organization"},"POST /api/users":{capability:"users:manage",scope:"organization"},"DELETE /api/users":{capability:"users:manage",scope:"organization"},"GET /api/serverless/operations":{capability:"deployments:read"},"POST /api/serverless/operations/run":{capability:"deployments:create"},"POST /api/serverless/command":{capability:"runtime:terminal",scope:"organization"},"GET /api/serverless/dlq":{capability:"data:read"},"POST /api/serverless/dlq/redrive":{capability:"data:write"},"POST /api/serverless/dlq/purge":{capability:"data:admin"},"GET /api/serverless/secrets":{capability:"secrets:read"},"POST /api/serverless/secrets":{capability:"secrets:write"},"DELETE /api/serverless/secrets":{capability:"secrets:write"},"POST /api/serverless/functions/config":{capability:"config:write"},"GET /api/serverless/alarms":{capability:"runtime:read"},"POST /api/serverless/alarms":{capability:"config:write"},"DELETE /api/serverless/alarms":{capability:"config:write"},"GET /api/serverless/traces":{capability:"runtime:read"},"POST /api/serverless/scheduler":{capability:"automation:manage"}};function wg(e,t){return UP[`${e.toUpperCase()} ${t}`]??zP}import{createHmac as qP,randomBytes as VP,timingSafeEqual as WP}from"node:crypto";import{chmodSync as HP,existsSync as KP,mkdirSync as JP,readFileSync as GP,writeFileSync as QP}from"node:fs";import{dirname as YP}from"node:path";var bc="ts_cloud_session";var ZP=28800000;function Zb(e){let t=process.env.TS_CLOUD_DASHBOARD_SECRET?.trim();if(t)return t;let r=d(e,"dashboard-secret");try{if(KP(r)){let m=GP(r,"utf8").trim();if(m)return m}}catch{}let a=VP(32).toString("base64url");try{JP(YP(r),{recursive:!0}),QP(r,`${a}
-`),HP(r,384)}catch{}return a}function XP(e,t){return qP("sha256",t).update(e).digest("base64url")}function Xb(e,t){if(!e)return null;let r=e.lastIndexOf(".");if(r<=0)return null;let a=e.slice(0,r),m=e.slice(r+1),f=XP(a,t),v=Buffer.from(m),w=Buffer.from(f);if(v.length!==w.length||!WP(v,w))return null;try{let k=JSON.parse(Buffer.from(a,"base64url").toString("utf8"));if(typeof k?.u!=="string"||typeof k?.exp!=="number")return null;if(k.mv!==void 0&&(!k.mv||typeof k.mv!=="object"||Array.isArray(k.mv)||Object.values(k.mv).some((S)=>!Number.isInteger(S)||S<1)))return null;if(Date.now()>=k.exp)return null;return k}catch{return null}}function kg(e,t){if(!e)return;for(let r of e.split(";")){let a=r.indexOf("=");if(a<0)continue;if(r.slice(0,a).trim()===t)return decodeURIComponent(r.slice(a+1).trim())}return}function Va(e,t={secure:!0}){let r=Math.floor((t.maxAgeMs??ZP)/1000),a=[`${bc}=${encodeURIComponent(e)}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${r}`];if(t.secure)a.push("Secure");return a.join("; ")}function ju(e={secure:!0}){let t=[`${bc}=`,"Path=/","HttpOnly","SameSite=Lax","Max-Age=0"];if(e.secure)t.push("Secure");return t.join("; ")}import{chmodSync as e_,existsSync as t_,mkdirSync as r_,readFileSync as n_,writeFileSync as i_}from"node:fs";import{dirname as o_}from"node:path";function eS(){return O("dashboard-users.json")}function Mu(e){return/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(e)}function s_(e){if(!e||typeof e.username!=="string"||!Mu(e.username)||typeof e.passwordHash!=="string")return null;let t=e.role==="admin"?"admin":"member",r={};if(e.sites&&typeof e.sites==="object"){for(let[a,m]of Object.entries(e.sites))if(m==="owner"||m==="collaborator")r[a]=m}return{username:e.username,passwordHash:e.passwordHash,role:t,sites:r,name:typeof e.name==="string"?e.name:void 0,email:typeof e.email==="string"?e.email.trim().toLowerCase():void 0,createdAt:typeof e.createdAt==="string"?e.createdAt:void 0}}function a_(e){try{let t=JSON.parse(e);if(!Array.isArray(t?.users))return[];return t.users.map(s_).filter((r)=>r!==null)}catch{return[]}}function tS(e){return d(e,"dashboard-users.json")}function In(e){let t=tS(e);if(!t_(t))return[];try{return a_(n_(t,"utf8"))}catch{return[]}}function Bu(e,t){let r=tS(e);r_(o_(r),{recursive:!0}),i_(r,`${JSON.stringify({users:t},null,2)}
-`),e_(r,384)}function zn(e,t){let r=t.trim().toLowerCase();return e.find((a)=>a.username.toLowerCase()===r)}function rS(e,t="admin"){let r=In(e);if(r.some((v)=>v.role==="admin"))return{users:r};let a=process.env.TS_CLOUD_UI_PASSWORD?.trim()||lg(),m={username:t,passwordHash:Io(a),role:"admin",sites:{},name:"Administrator",createdAt:new Date().toISOString()},f=[...r,m];return Bu(e,f),{users:f,generated:{username:t,password:a}}}function Sc(e,t){let r=In(e),a=zn(r,t.username),m=t.password?.trim()||(a?void 0:lg()),f={username:a?.username??t.username,passwordHash:m?Io(m):a.passwordHash,role:a?.role??"member",sites:t.sites,name:t.name??a?.name,email:t.email?.trim().toLowerCase()??a?.email,createdAt:a?.createdAt??new Date().toISOString()},v=a?r.map((w)=>w.username.toLowerCase()===f.username.toLowerCase()?f:w):[...r,f];return Bu(e,v),{user:f,password:m}}function Lu(e,t,r){let a=In(e),m=zn(a,t);if(!m)throw Error("Authentication user was not found");let f={...m,passwordHash:r};return Bu(e,a.map((v)=>v.username.toLowerCase()===m.username.toLowerCase()?f:v)),f}function Ig(e,t){let r=In(e),a=zn(r,t);if(!a)return{ok:!1,error:`No such user: ${t}`};if(a.role==="admin"&&r.filter((m)=>m.role==="admin").length===1)return{ok:!1,error:"Cannot remove the last admin."};return Bu(e,r.filter((m)=>m.username.toLowerCase()!==a.username.toLowerCase())),{ok:!0}}function Wa(e){return{username:e.username,name:e.name??e.username,role:e.role,email:e.email,sites:e.sites,siteCount:Object.keys(e.sites).length,createdAt:e.createdAt}}var c_={username:"local",passwordHash:"",role:"admin",sites:{},name:"Local (auth disabled)"};function nS(e){let{cwd:t,enabled:r,secret:a,authorization:m,authentication:f}=e,v=(k)=>{if(!f)return;let S=kg(k.headers.get("cookie"),bc);return S?.startsWith("v2.")?f.verifySessionToken(S):void 0},w=(k)=>{let S=m.store.getActorByExternalId("user",`dashboard:${k.username.toLowerCase()}`),A=S?m.store.getMembershipForActor(m.organizationId,S.id):void 0;return{actor:S,membership:A}};return{enabled:r,resolveUser(k){if(!r)return c_;let S=kg(k.headers.get("cookie"),bc),A=v(k),x=A?void 0:Xb(S,a),F=A?.identity.username??x?.u;if(!F)return null;let U=zn(In(t),F);if(!U)return null;let{membership:H}=w(U);if(!H||H.status!=="active"||!A&&x?.mv?.[m.organizationId]!==H.sessionVersion)return null;if(!H.lastActiveAt||Date.now()-new Date(H.lastActiveAt).getTime()>300000)m.store.touchMembership(H.id);return U},resolveSession(k){return v(k)?.session??null},check(k,S,A,x){if(!r)return{ok:!0};if(!A)return{ok:!1,status:401,error:"Sign in to continue.",unauthenticated:!0};let F=wg(k.method,S);if(F.anyUser)return{ok:!0};if(F.siteFrom==="body"&&!x)return{ok:!1,status:400,error:"This request must name a site."};let{membership:U}=w(A);if(!U)return{ok:!1,status:401,error:"Sign in to continue.",unauthenticated:!0};let H=F.scope==="organization"?{organizationId:m.organizationId}:m.store.resolveAuthorizationTarget(m.organizationId,{type:"project",id:m.projectId});if(F.scope==="site"){let X=new URL(k.url).searchParams.get("env")??m.defaultEnvironment,oe=m.store.getEnvironmentBySlug(m.projectId,X),pe=m.store.listResources(m.projectId,oe?.id).find((ee)=>ee.kind==="application"&&ee.slug===x);H=pe?m.store.resolveAuthorizationTarget(m.organizationId,{type:"resource",id:pe.id}):void 0}if(!(H?R({membership:U,grants:m.store.listGrants(U.id),capability:F.capability,target:H}):{allowed:!1}).allowed)return{ok:!1,status:403,error:"You do not have access to this."};return{ok:!0}}}}async function iS(e,t){if(wg(e.method,t).siteFrom!=="body")return;try{let a=await e.clone().json();return String(a?.name??"").trim()||void 0}catch{return}}import{createHash as d_}from"node:crypto";function oS(e,t,r){for(let a of r){let m=C(t.store,a);if(e.getIdentityByActor(m.id))continue;e.createIdentity({actorId:m.id,username:a.username,email:a.email,emailVerified:!!a.email,passwordHash:a.passwordHash,requiresPasswordUpgrade:!0})}}function l_(e,t,r){let a=r.split("@")[0].toLowerCase().replace(/[^a-z0-9._-]/g,"-").replace(/^[^a-z0-9]+/,"").slice(0,24),m=/^[a-z0-9][a-z0-9._-]{1,31}$/.test(a)?a:"sso-user";if(!e.getIdentityByUsername(m)&&!zn(t,m))return m;let f=d_("sha256").update(r).digest("hex").slice(0,7);return`${m.slice(0,24)}-${f}`}function sS(e,t,r,a){if(a.provider.organizationId!==t.organization.id)throw Error("OIDC provider is not configured for this organization");let m=e.getOidcSubject(a.provider.id,a.subject),f=m?e.getIdentity(m.identityId):e.getIdentityByEmail(a.email);if(f?.disabledAt)throw Error("OIDC identity is disabled");if(!m&&f&&!f.emailVerifiedAt)throw Error("OIDC cannot automatically link an unverified local email address");let v=In(r),w=!1,k=f?zn(v,f.username):void 0;if(f&&!k)throw Error("OIDC identity has no dashboard user");if(!f){let x=l_(e,v,a.email);k=Sc(r,{username:x,name:a.name,email:a.email,sites:{}}).user;let U=C(t.store,k);f=e.createIdentity({actorId:U.id,username:k.username,email:a.email,emailVerified:!0,passwordHash:k.passwordHash}),w=!0}else if(f.email!==a.email)f=e.setVerifiedEmail(f.id,a.email);let S=t.store.getActor(f.actorId);if(!S)throw Error("OIDC identity actor was not found");let A=t.store.getMembershipForActor(t.organization.id,S.id);if(A?.status==="revoked")throw Error("OIDC organization membership is revoked");if(!A)t.store.createMembership({organizationId:t.organization.id,actorId:S.id,roleTemplate:a.provider.defaultRole,scope:{type:"organization"},source:"manual"});return e.linkOidcSubject(a.provider.id,f.id,a.subject,a.email),{identity:f,user:k,provisioned:w}}function aS(e,t,r){let a=t.store.getMembershipForActor(t.organization.id,r.actorId);if(!a||a.status!=="active"||a.roleTemplate==="owner"||!r.emailVerifiedAt||!r.email)return!1;let m=r.email.split("@")[1]?.toLowerCase();return e.listOidcProviders(t.organization.id).some((f)=>f.enforceSso&&!!m&&f.allowedDomains.includes(m))}function u_(e){return e.replace(/[&<>"']/g,(t)=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}function cS(e=!1,t=[]){let r=e?"/serverless":"/",a=t.map((f)=>`<a class="sso-button" href="/auth/oidc/${encodeURIComponent(f.slug)}/start?return=${encodeURIComponent(r)}">Continue with ${u_(f.name)}</a>`).join("");return`<!doctype html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>Sign in · ts-cloud</title>
-<link rel="icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect x='3' y='3' width='26' height='26' rx='8' fill='%235a8be0'/%3E%3C/svg%3E">
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
-<style>${`
-  :root {
-    --bg: #0a0e15; --bg2: #0b0f18; --panel: rgba(255,255,255,0.03); --panel-br: rgba(255,255,255,0.072);
-    --txt: #e9edf5; --txt2: #94a1b8; --txt3: #5a6577;
-    --accent: #5a8be0; --accent-ink: #061019;
-    --bad: #f0736e; --badbg: rgba(240,115,110,0.11);
-  }
-  * { box-sizing: border-box; margin: 0; padding: 0; }
-  html { background: var(--bg); min-height: 100%; }
-  body {
-    font-family: 'Inter', system-ui, sans-serif; color: var(--txt); min-height: 100vh;
-    background:
-      radial-gradient(900px 460px at 88% -8%, rgba(90,139,224,0.06), transparent 62%),
-      linear-gradient(175deg, var(--bg), var(--bg2));
-    -webkit-font-smoothing: antialiased;
-    display: grid; place-items: center; padding: 24px;
-  }
-  .card {
-    width: 100%; max-width: 380px;
-    background: var(--panel); border: 1px solid var(--panel-br); border-radius: 16px;
-    padding: 32px; backdrop-filter: blur(6px);
-    animation: rise .5s cubic-bezier(0.16, 1, 0.3, 1) both;
-  }
-  @keyframes rise { from { opacity: 0; transform: translateY(8px) } to { opacity: 1; transform: none } }
-  @media (prefers-reduced-motion: reduce) { .card { animation: none } }
-  .brand { display: flex; align-items: center; gap: 10px; font-weight: 700; font-size: 17px; letter-spacing: -0.02em; }
-  .brand .dot { width: 20px; height: 20px; border-radius: 6px; background: var(--accent); box-shadow: inset 0 1px 0 rgba(255,255,255,0.35); }
-  h1 { font-size: 21px; font-weight: 800; letter-spacing: -0.02em; margin-top: 22px; }
-  .sub { color: var(--txt2); font-size: 13.5px; margin-top: 5px; line-height: 1.5; }
-  form { margin-top: 24px; display: grid; gap: 14px; }
-  .field { display: flex; flex-direction: column; gap: 7px; }
-  label { color: var(--txt3); font-size: 11px; font-weight: 800; text-transform: uppercase; letter-spacing: 0.07em; }
-  input {
-    width: 100%; background: rgba(255,255,255,0.05); border: 1px solid var(--panel-br); border-radius: 10px;
-    padding: 10px 12px; color: var(--txt); font-family: inherit; font-size: 14px;
-  }
-  input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px rgba(90,139,224,0.12); }
-  button {
-    margin-top: 4px; background: var(--accent); color: var(--accent-ink); border: 0; border-radius: 10px;
-    padding: 11px 16px; font-weight: 700; font-size: 13.5px; cursor: pointer; font-family: inherit;
-    transition: filter .12s, transform .12s;
-  }
-  button:hover { filter: brightness(1.06); }
-  button:active { transform: translateY(1px); }
-  button[disabled] { opacity: 0.6; cursor: default; }
-  .msg {
-    display: none; margin-top: 14px; padding: 10px 12px; border-radius: 10px;
-    background: var(--badbg); border: 1px solid rgba(240,115,110,0.22); color: var(--bad);
-    font-size: 13px; line-height: 1.45;
-  }
-  .msg.shown { display: block; }
-  .hidden { display: none !important; }
-  .note { color: var(--txt3); font-size: 12px; margin-top: 20px; line-height: 1.5; }
-  .note code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--txt2); }
-  a { color: var(--accent); text-decoration: none; }
-  a:hover { text-decoration: underline; }
-  .sso { display: grid; gap: 10px; margin-top: 22px; }
-  .sso-button { display: block; border: 1px solid var(--panel-br); border-radius: 10px; padding: 11px 14px; color: var(--txt); text-align: center; font-size: 13.5px; font-weight: 700; background: rgba(255,255,255,0.04); }
-  .sso-button:hover { border-color: var(--accent); text-decoration: none; }
-  .separator { display: flex; align-items: center; gap: 10px; margin: 18px 0 -6px; color: var(--txt3); font-size: 10px; font-weight: 800; text-transform: uppercase; letter-spacing: .06em; }
-  .separator::before, .separator::after { content: ''; height: 1px; flex: 1; background: var(--panel-br); }
-`}</style>
-</head>
-<body>
-  <main class="card">
-    <div class="brand"><span class="dot"></span> ts-cloud</div>
-    <h1>Sign in</h1>
-    <p class="sub">Manage the sites you have been given access to.</p>
-
-    ${t.length>0?`<div class="sso" aria-label="Single sign-on">${a}</div><div class="separator"><span>or use local recovery</span></div>`:""}
-
-    <form id="login" autocomplete="on">
-      <div class="field">
-        <label for="username">Username</label>
-        <input id="username" name="username" autocomplete="username" required autofocus>
-      </div>
-      <div class="hidden field" id="mfa-field">
-        <label for="mfa-code">Authenticator or recovery code</label>
-        <input id="mfa-code" name="mfa-code" autocomplete="one-time-code">
-      </div>
-      <div class="field">
-        <label for="password">Password</label>
-        <input id="password" name="password" type="password" autocomplete="current-password" required>
-      </div>
-      <button type="submit" id="submit">Sign in</button>
-    </form>
-
-    <p class="msg" id="msg" role="alert" aria-live="polite"></p>
-    <p class="note"><a href="/forgot-password">Forgot your password?</a></p>
-  </main>
-
-<script>
-  const form = document.getElementById('login')
-  const msg = document.getElementById('msg')
-  const submit = document.getElementById('submit')
-  const mfaField = document.getElementById('mfa-field')
-  const mfaCode = document.getElementById('mfa-code')
-  let challengeToken = ''
-
-  if (new URLSearchParams(location.search).has('sso_error')) {
-    msg.textContent = 'Single sign-on could not be completed. Try again or use the local recovery path.'
-    msg.classList.add('shown')
-  }
-
-  form.addEventListener('submit', async (event) => {
-    event.preventDefault()
-    msg.classList.remove('shown')
-    submit.disabled = true
-    submit.textContent = 'Signing in...'
-    try {
-      const res = await fetch(challengeToken ? '/api/auth/mfa/complete' : '/api/login', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(challengeToken
-          ? { challengeToken, code: mfaCode.value }
-          : { username: document.getElementById('username').value, password: document.getElementById('password').value }),
-      })
-      const body = await res.json().catch(() => ({}))
-      if (!res.ok || !body.ok) throw new Error(body.error || 'Could not sign in.')
-      if (body.mfaRequired) {
-        challengeToken = body.challengeToken
-        mfaField.classList.remove('hidden')
-        mfaCode.required = true
-        document.getElementById('username').readOnly = true
-        document.getElementById('password').readOnly = true
-        submit.disabled = false
-        submit.textContent = 'Verify and sign in'
-        mfaCode.focus()
-        return
-      }
-      location.href = ${JSON.stringify(r)}
-    } catch (error) {
-      msg.textContent = (error && error.message) || String(error)
-      msg.classList.add('shown')
-      submit.disabled = false
-      submit.textContent = 'Sign in'
-      if (challengeToken) {
-        mfaCode.value = ''
-        mfaCode.focus()
-      }
-      else {
-        document.getElementById('password').value = ''
-        document.getElementById('password').focus()
-      }
-    }
-  })
-</script>
-</body>
-</html>`}function dS(e){let t=e==="reset";return`<!doctype html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>${t?"Choose a new password":"Recover your account"} · ts-cloud</title>
-<style>${`
-  :root {
-    --bg: #0a0e15; --bg2: #0b0f18; --panel: rgba(255,255,255,0.03); --panel-br: rgba(255,255,255,0.072);
-    --txt: #e9edf5; --txt2: #94a1b8; --txt3: #5a6577;
-    --accent: #5a8be0; --accent-ink: #061019;
-    --bad: #f0736e; --badbg: rgba(240,115,110,0.11);
-  }
-  * { box-sizing: border-box; margin: 0; padding: 0; }
-  html { background: var(--bg); min-height: 100%; }
-  body {
-    font-family: 'Inter', system-ui, sans-serif; color: var(--txt); min-height: 100vh;
-    background:
-      radial-gradient(900px 460px at 88% -8%, rgba(90,139,224,0.06), transparent 62%),
-      linear-gradient(175deg, var(--bg), var(--bg2));
-    -webkit-font-smoothing: antialiased;
-    display: grid; place-items: center; padding: 24px;
-  }
-  .card {
-    width: 100%; max-width: 380px;
-    background: var(--panel); border: 1px solid var(--panel-br); border-radius: 16px;
-    padding: 32px; backdrop-filter: blur(6px);
-    animation: rise .5s cubic-bezier(0.16, 1, 0.3, 1) both;
-  }
-  @keyframes rise { from { opacity: 0; transform: translateY(8px) } to { opacity: 1; transform: none } }
-  @media (prefers-reduced-motion: reduce) { .card { animation: none } }
-  .brand { display: flex; align-items: center; gap: 10px; font-weight: 700; font-size: 17px; letter-spacing: -0.02em; }
-  .brand .dot { width: 20px; height: 20px; border-radius: 6px; background: var(--accent); box-shadow: inset 0 1px 0 rgba(255,255,255,0.35); }
-  h1 { font-size: 21px; font-weight: 800; letter-spacing: -0.02em; margin-top: 22px; }
-  .sub { color: var(--txt2); font-size: 13.5px; margin-top: 5px; line-height: 1.5; }
-  form { margin-top: 24px; display: grid; gap: 14px; }
-  .field { display: flex; flex-direction: column; gap: 7px; }
-  label { color: var(--txt3); font-size: 11px; font-weight: 800; text-transform: uppercase; letter-spacing: 0.07em; }
-  input {
-    width: 100%; background: rgba(255,255,255,0.05); border: 1px solid var(--panel-br); border-radius: 10px;
-    padding: 10px 12px; color: var(--txt); font-family: inherit; font-size: 14px;
-  }
-  input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px rgba(90,139,224,0.12); }
-  button {
-    margin-top: 4px; background: var(--accent); color: var(--accent-ink); border: 0; border-radius: 10px;
-    padding: 11px 16px; font-weight: 700; font-size: 13.5px; cursor: pointer; font-family: inherit;
-    transition: filter .12s, transform .12s;
-  }
-  button:hover { filter: brightness(1.06); }
-  button:active { transform: translateY(1px); }
-  button[disabled] { opacity: 0.6; cursor: default; }
-  .msg {
-    display: none; margin-top: 14px; padding: 10px 12px; border-radius: 10px;
-    background: var(--badbg); border: 1px solid rgba(240,115,110,0.22); color: var(--bad);
-    font-size: 13px; line-height: 1.45;
-  }
-  .msg.shown { display: block; }
-  .hidden { display: none !important; }
-  .note { color: var(--txt3); font-size: 12px; margin-top: 20px; line-height: 1.5; }
-  .note code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; color: var(--txt2); }
-  a { color: var(--accent); text-decoration: none; }
-  a:hover { text-decoration: underline; }
-  .sso { display: grid; gap: 10px; margin-top: 22px; }
-  .sso-button { display: block; border: 1px solid var(--panel-br); border-radius: 10px; padding: 11px 14px; color: var(--txt); text-align: center; font-size: 13.5px; font-weight: 700; background: rgba(255,255,255,0.04); }
-  .sso-button:hover { border-color: var(--accent); text-decoration: none; }
-  .separator { display: flex; align-items: center; gap: 10px; margin: 18px 0 -6px; color: var(--txt3); font-size: 10px; font-weight: 800; text-transform: uppercase; letter-spacing: .06em; }
-  .separator::before, .separator::after { content: ''; height: 1px; flex: 1; background: var(--panel-br); }
-`}</style>
-</head>
-<body>
-  <main class="card">
-    <div class="brand"><span class="dot"></span> ts-cloud</div>
-    <h1>${t?"Choose a new password":"Recover your account"}</h1>
-    <p class="sub">${t?"This one-time link expires after one hour.":"Enter your username or verified email. The response is the same whether or not an account exists."}</p>
-    <form id="recovery" autocomplete="on">
-      ${t?'<div class="field"><label for="password">New password</label><input id="password" name="password" type="password" autocomplete="new-password" minlength="12" required></div><div class="field"><label for="confirmation">Confirm new password</label><input id="confirmation" name="confirmation" type="password" autocomplete="new-password" minlength="12" required></div>':'<div class="field"><label for="identifier">Username or email</label><input id="identifier" name="identifier" autocomplete="username" required autofocus></div>'}
-      <button type="submit" id="submit">${t?"Change password":"Send reset link"}</button>
-    </form>
-    <p class="msg" id="msg" role="status" aria-live="polite"></p>
-    <p class="note"><a href="/login">Return to sign in</a></p>
-  </main>
-<script>
-  const form = document.getElementById('recovery')
-  const msg = document.getElementById('msg')
-  const submit = document.getElementById('submit')
-  const reset = ${JSON.stringify(t)}
-  const token = new URLSearchParams(location.search).get('token') || ''
-  if (reset && !token) {
-    msg.textContent = 'This reset link is missing its token. Request a new link.'
-    msg.classList.add('shown')
-    submit.disabled = true
-  }
-  form.addEventListener('submit', async (event) => {
-    event.preventDefault()
-    if (reset && document.getElementById('password').value !== document.getElementById('confirmation').value) {
-      msg.textContent = 'The passwords do not match.'
-      msg.classList.add('shown')
-      return
-    }
-    submit.disabled = true
-    msg.textContent = reset ? 'Changing password…' : 'Requesting reset link…'
-    msg.classList.add('shown')
-    const response = await fetch(reset ? '/api/auth/password-reset/complete' : '/api/auth/password-reset/request', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify(reset
-        ? { token, password: document.getElementById('password').value }
-        : { identifier: document.getElementById('identifier').value }),
-    })
-    const result = await response.json().catch(() => ({}))
-    msg.textContent = result.message || result.error || 'The request could not be completed.'
-    if (!response.ok) {
-      submit.disabled = false
-      return
-    }
-    if (reset)
-      setTimeout(() => location.assign('/login'), 1200)
-  })
-</script>
-</body>
-</html>`}var lS={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function uS(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function pS(e,t){let r=e.logger||lS,a=await uS(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let m=_(e.slug,t.siteName),f=Bt(m,t.to||"unused"),v=["set -uo pipefail",..._u(f,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`}),`(cd ${b} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${f.current} && eval "$(cd ${b} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let w=await e.driver.runRemoteDeploy({targets:a,commands:v,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!w.success)r.error(`Rollback failed: ${w.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:w.success,error:w.error,perInstance:w.perInstance}}async function mS(e,t){let r=e.logger||lS;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await uS(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let m=await e.driver.runRemoteDeploy({targets:a,commands:ku(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!m.success)r.error(`Restore failed: ${m.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:m.success,error:m.error,perInstance:m.perInstance}}var p_=["restart","reload","start","stop","enable","disable"],gS=65536;function Ha(e){return e.length<=gS?e:`${e.slice(0,gS)}
-
-[output truncated]`}function m_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function Eg(e){return/^[A-Za-z0-9_-]+$/.test(e)}function g_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function Fu(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let v of a){let w=String(v?.name??"");if(!w||!m_(w))continue;for(let k of p_)r.push({id:`${k}:${w}`,label:`${g_(k)} ${w}`,group:"service",target:w,mutates:!0,confirm:w,danger:k==="stop"||k==="disable"})}for(let[v,w]of Object.entries(e.sites??{})){if(!w||!Eg(v))continue;let k=u(w);if(k==="server-app"||k==="server-php")r.push({id:`rollback:${v}`,label:`Rollback ${v}`,group:"deploy",target:v,mutates:!0,confirm:v,danger:!0})}let m=new Set;for(let v of t.workers??[]){let w=String(v?.name??"").split(":")[0];if(w&&Eg(w))m.add(w)}for(let v of m)r.push({id:`worker:restart:${v}`,label:`Restart workers (${v})`,group:"worker",target:v,mutates:!0,confirm:v});for(let[v,w]of Object.entries(e.sites??{})){if(!w||!Eg(v))continue;if(w.scheduler||w.schedule){let k=br(w)==="laravel";r.push({id:`scheduler:run:${v}`,label:`${k?"Run":"Restart"} scheduler (${v})`,group:"scheduler",target:v,mutates:!0,confirm:v})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),p(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function Rg(e,t,r){return Fu(t,r).find((a)=>a.id===e)}function f_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function h_(){return`eval "$(cd ${b} && pantry env 2>/dev/null)"`}function hS(e,t,r){let a=`${_(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${h_()} && php artisan ${r}`]}function y_(e,t,r){if(e==="laravel")return hS(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function v_(e,t,r){if(e==="laravel")return hS(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function b_(){return["set -uo pipefail",`[ -x ${mr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,mr]}function fS(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Ha(r.perInstance?.[0]?.output??""),stderr:Ha(r.perInstance?.[0]?.error??r.error??"")}}async function zu(e,t,r,a={}){let m=e.project.slug,f;try{f=B({config:e})}catch(x){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${x?.message??x}`}}let v={driver:f,slug:m,environment:t,role:"app"};if(r.group==="deploy"){let x=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,F=await pS(v,{siteName:r.target,to:x});return fS(r.id,`rollback ${r.target}${x?` → ${x}`:""}`,F)}if(r.id==="backup:restore"){let x=await mS(v,{database:p(e)});return fS(r.id,"db restore",x)}let w=await f.findComputeTargets({slug:m,environment:t,role:"app"});if(!w.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let k,S;if(r.group==="service"){let[x,...F]=r.id.split(":");k=f_(x,F.join(":")),S=`systemctl ${x} ${r.target}`}else if(r.group==="worker"){let x=br(e.sites?.[r.target]??{});k=y_(x,m,r.target),S=x==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let x=br(e.sites?.[r.target]??{});k=v_(x,m,r.target),S=x==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")k=b_(),S="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let A=await f.runRemoteDeploy({targets:[w[0]],commands:k,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:m,Environment:t,Role:"app"}});return{operation:r.id,command:S,ok:A.success,stdout:Ha(A.perInstance?.[0]?.output??""),stderr:Ha(A.perInstance?.[0]?.error??A.error??"")}}async function wc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let m;try{m=B({config:e})}catch(k){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${k?.message??k}`}}let f=e.project.slug,v=await m.findComputeTargets({slug:f,environment:t,role:"app"});if(!v.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let w=await m.runRemoteDeploy({targets:[v[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:f,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:w.success,stdout:Ha(w.perInstance?.[0]?.output??""),stderr:Ha(w.perInstance?.[0]?.error??w.error??"")}}function S_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function yS(e,t,r){return r.some((a)=>S_(t,a).includes(e))}function Ag(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let m=(e.sites??[]).map((H)=>H.name).filter(Boolean),f=dg(r,m),v=new Set(f),w=(e.sites??[]).filter((H)=>v.has(H.name)),k=(e.sitesDetail??[]).filter((H)=>v.has(H.name)),S=new Set(k.map((H)=>H.domain).filter(Boolean)),A=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((H)=>v.has(H.site)),x=(e.serverLogs??[]).filter((H)=>yS(H.source,a,f)),F=(e.security?.tlsCertificates??[]).filter((H)=>S.has(H.domain)),U=(e.activity??[]).filter((H)=>{if(H.type==="deploy")return f.some((K)=>String(H.title??"").startsWith(`${K} `));if(H.type==="log")return yS(String(H.title??"").split(" ")[0],a,f);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:w,sitesDetail:k,workers:(e.workers??[]).filter((H)=>v.has(H.site)),serverDeployments:A.slice(0,5),serverDeploymentsDetail:A.slice(0,50),deploymentsEmptyReason:A.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:x,serverLogsEmptyReason:x.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:F,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((H)=>["Route conflicts","TLS certificates"].includes(H.name)),activity:U}}function vS(e,t){if(t.role==="admin")return e;let r=new Set(dg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function bS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var w_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),SS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function kS(e){let t=Object.keys(e).filter((m)=>e[m]!==void 0),r=t.filter((m)=>(m in SS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((f)=>`${f} (${SS[f]})`).join(", ")}.`};let a=t.filter((m)=>!w_.has(m));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function Uu(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function wS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function k_(e){let t=[Uu(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(Uu));return t.filter(Boolean)}function IS({siteName:e,body:t,sites:r,ownSites:a}){let m=r[e]??{},f=new Set(a),v=new Set;if(t.domain!==void 0)v.add(Uu(t.domain));if(Array.isArray(t.aliases))for(let k of t.aliases)v.add(Uu(k));if(v.delete(""),v.size===0)return{ok:!0};let w=wS(t.path!==void 0?t.path:m.path);for(let[k,S]of Object.entries(r)){if(k===e||f.has(k))continue;let A=wS(S?.path);for(let x of k_(S)){if(!v.has(x))continue;if(A===w)return{ok:!1,error:`${x}${w==="/"?"":w} is already served by another site on this server.`}}}return{ok:!0}}class kc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),m=this.attempts.get(a),v=!m||r-m.last>this.windowMs?1:m.count+1,w={count:v,last:r};if(v>=this.maxAttempts)w.until=r+this.lockoutMs;this.attempts.set(a,w)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var RS=new Set([22,80,443]);function Ic(e){return Number.isInteger(e)&&e>=1&&e<=65535}function ks(e){return[...new Set(e.filter((t)=>Ic(t)&&!RS.has(t)))].sort((t,r)=>t-r)}function AS(e,t,r=[]){if(!Ic(t))throw Error("Port must be an integer between 1 and 65535.");if(RS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return PS({configText:e,ports:ks([...r,t])})}function CS(e,t,r=[]){return PS({configText:e,ports:ks(r.filter((a)=>a!==t))})}function ES(e,t,r,a,m){let f=e.slice(t,r),v=new RegExp(`\\b${a}\\s*:\\s*\\${m}`).exec(f);if(!v)return null;let w=t+v.index,k=e.indexOf(m,w);return{propStart:w,open:k,close:vc(e,k,m,m==="{"?"}":"]")}}function Cg(e){return`allowedPorts: [${e.join(", ")}]`}function PS(e){let{configText:t}=e,r=ks(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let m=t.indexOf("{",a.index),f=vc(t,m,"{","}"),v=ES(t,m+1,f,"firewall","{");if(v){let A=ES(t,v.open+1,v.close,"allowedPorts","[");if(A){let H=A.propStart;while(H>0&&t[H-1]!==`
-`&&/\s/.test(t[H-1]))H--;let K=t.slice(H,A.propStart);return`${t.slice(0,H)}${K}${Cg(r)}${t.slice(A.close+1)}`}let x=t.slice(0,v.close).trimEnd(),F=t.slice(v.close),U=x.endsWith(",")||x.endsWith("{")?"":",";return`${x}${U}
-        ${Cg(r)},
-      ${F}`}let w=t.slice(0,f).trimEnd(),k=t.slice(f),S=w.endsWith(",")||w.endsWith("{")?"":",";return`${w}${S}
-      firewall: {
-        enabled: true,
-        ${Cg(r)},
-      },
-    ${k}`}class Pg{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var _S=65536;function pn(e){return e.length<=_S?e:`${e.slice(0,_S)}
-
-[output truncated]`}function Tg(e,t){return e.environments?.[t]?.app}function xg(e,t,r){let a=[],m=Tg(e,t);a.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),a.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let f=r.maintenance?.enabled;if(f!==!0)a.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(f!==!1)a.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(m?.assets||r.assetsInfo)a.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(m?.database?.connection==="aurora-serverless")a.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(m.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(m.database.maxCapacity??4)}]});for(let v of r.queues??[]){let w=String(v?.name??"").trim();if(w&&/^[A-Za-z0-9_-]+$/.test(w))a.push({id:`queue:purge:${w}`,label:`Purge queue (${w})`,group:"queue",target:w,mutates:!0,confirm:w,danger:!0})}return a}function TS(e,t,r,a){return xg(t,r,a).find((m)=>m.id===e)}async function I_(e,t,r){try{let a=new h(r),{Stacks:m}=await a.describeStacks({stackName:Ht(e,t)}),f={};for(let k of m?.[0]?.Outputs??[])if(k.OutputKey)f[k.OutputKey]=k.OutputValue??"";let v=f.AssetsCdnDomain;if(!v)return null;return(await new y(r).findDistributionByDomain(v))?.Id??null}catch{return null}}async function xS(e,t,r,a={}){try{if(r.id==="redeploy")return await an(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await cn(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await tr(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await tr(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let m=Number(a.min),f=Number(a.max);if(!Number.isFinite(m)||!Number.isFinite(f)||m<=0||f<m)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await wf(e,t,m,f),{operation:r.id,command:`db:scale ${m}-${f} ACU`,ok:!0,stdout:`Scaling applied (${m}-${f} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let m=await Tr(e,t),f=await I_(e,t,m.region);if(!f)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let w=await new y(m.region).invalidateAll(f);return{operation:r.id,command:`cloudfront invalidate ${f} /*`,ok:!0,stdout:`Invalidation ${w?.Id??"created"} for ${f} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let m=r.target,f=await Tr(e,t),v=new ie(f.region),w=`${f.slug}-${t}-${m}`,{QueueUrl:k}=await v.getQueueUrl(w);return await v.purgeQueue(k),{operation:r.id,command:`sqs purge ${w}`,ok:!0,stdout:`Purged queue ${w}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(m){return{operation:r.id,ok:!1,error:pn(m?.message??String(m))}}}async function DS(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};try{let m=await Ye(e,t,a);return{operation:"command",command:a,ok:!0,stdout:pn(m||"(no output)")}}catch(m){return{operation:"command",command:a,ok:!1,error:pn(m?.message??String(m))}}}var Dg="No dead-letter queue is provisioned for this environment.";async function Og(e,t,r){try{let{QueueUrl:a}=await e.getQueueUrl(`${t}-${r}-dlq`);return a}catch{return null}}async function OS(e,t,r=10){try{let a=await Tr(e,t),m=new ie(a.region),f=await Og(m,a.slug,t);if(!f)return{ok:!1,messages:[],error:Dg};return{ok:!0,messages:((await m.receiveMessages({queueUrl:f,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((k)=>({id:k.MessageId,receiptHandle:k.ReceiptHandle,body:pn(String(k.Body??""))}))}}catch(a){return{ok:!1,messages:[],error:pn(a?.message??String(a))}}}async function $S(e,t,r={}){try{let a=await Tr(e,t),m=Tg(e,t),v=(m?Wt(m,a.slug,t):[]).map((U)=>U.name.replace(`${a.slug}-${t}-`,"")),w=r.targetQueue&&v.includes(r.targetQueue)?r.targetQueue:v[0];if(!w)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let k=new ie(a.region),S=await Og(k,a.slug,t);if(!S)return{operation:"dlq:redrive",ok:!1,error:Dg};let{QueueUrl:A}=await k.getQueueUrl(`${a.slug}-${t}-${w}`),x=Math.min(50,Math.max(1,r.max??10)),F=0;while(F<x){let H=(await k.receiveMessages({queueUrl:S,maxMessages:Math.min(10,x-F),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!H.length)break;for(let K of H)await k.sendMessage({queueUrl:A,messageBody:String(K.Body??"")}),await k.deleteMessage(S,K.ReceiptHandle),F++}return{operation:"dlq:redrive",command:`redrive → ${w}`,ok:!0,stdout:`Moved ${F} message(s) from the DLQ to ${w}.`}}catch(a){return{operation:"dlq:redrive",ok:!1,error:pn(a?.message??String(a))}}}async function NS(e,t){try{let r=await Tr(e,t),a=new ie(r.region),m=await Og(a,r.slug,t);if(!m)return{operation:"dlq:purge",ok:!1,error:Dg};return await a.purgeQueue(m),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:pn(r?.message??String(r))}}}function jS(e,t){let r=Tg(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((a)=>({key:a.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:a})):Object.entries(r.secrets).map(([a,m])=>({key:a,secretId:String(m)}))}async function MS(e,t,r,a){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let m=await Tr(e,t),f=new j(m.region);try{await f.putSecretValue({SecretId:r,SecretString:a})}catch{await f.createSecret({Name:r,SecretString:a})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(m){return{operation:"secret:set",ok:!1,error:pn(m?.message??String(m))}}}async function BS(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let a=await Tr(e,t);return await new j(a.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(a){return{operation:"secret:delete",ok:!1,error:pn(a?.message??String(a))}}}var E_=new Set(["http","queue","cli"]);async function LS(e,t,r,a){if(!E_.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let m=a.memory==null?void 0:Number(a.memory),f=a.timeout==null?void 0:Number(a.timeout);if(m!=null&&(!Number.isInteger(m)||m<128||m>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(f!=null&&(!Number.isInteger(f)||f<1||f>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(m==null&&f==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let v=await Tr(e,t),w=new E(v.region),k=`${v.slug}-${t}-${r}`;await w.updateFunctionConfiguration({FunctionName:k,...m!=null?{MemorySize:m}:{},...f!=null?{Timeout:f}:{}});let S=[m!=null?`${m} MB`:"",f!=null?`${f}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${k} (${S})`,ok:!0,stdout:`Updated ${k}: ${S}.`}}catch(v){return{operation:"function:config",ok:!1,error:pn(v?.message??String(v))}}}var _g=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function R_(e){return _g.find((t)=>t.key===e)}async function FS(e,t){try{let r=await Tr(e,t);return{ok:!0,alarms:await new di(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:_g}}catch(r){return{ok:!1,alarms:[],presets:_g,error:pn(r?.message??String(r))}}}async function zS(e,t,r,a){let m=R_(r);if(!m)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(a)||a<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let f=await Tr(e,t),v=new di(f.region),w=`${f.slug}-${t}-${m.key}`,k=m.fnMode?[{Name:"FunctionName",Value:`${f.slug}-${t}-${m.fnMode}`}]:[];return await v.putMetricAlarm({AlarmName:w,Namespace:m.namespace,MetricName:m.metricName,ComparisonOperator:m.comparison,Threshold:a,EvaluationPeriods:1,Period:300,Statistic:m.statistic,Dimensions:k,AlarmDescription:`ts-cloud: ${m.label} > ${a} ${m.unit}`}),{operation:"alarm:create",command:`alarm ${w}`,ok:!0,stdout:`Alarm ${w} armed at ${a} ${m.unit}.`}}catch(f){return{operation:"alarm:create",ok:!1,error:pn(f?.message??String(f))}}}async function US(e,t,r){try{let a=await Tr(e,t);if(!r.startsWith(`${a.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new di(a.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(a){return{operation:"alarm:delete",ok:!1,error:pn(a?.message??String(a))}}}function A_(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function qu(e,t,r=30){try{let a=await Tr(e,t),m=new Pg(a.region),f=new Date,v=new Date(f.getTime()-Math.min(360,Math.max(1,r))*60000),w=`${a.slug}-${t}-http`,k=await m.getTraceSummaries({startTime:v,endTime:f,filterExpression:`service("${w}")`});if(!k.summaries.length)k=await m.getTraceSummaries({startTime:v,endTime:f});return{ok:!0,traces:k.summaries.slice(0,100).map(A_)}}catch(a){return{ok:!1,traces:[],error:pn(a?.message??String(a))}}}async function $g(e,t,r){try{let a=await Tr(e,t),m=`${a.slug}-${t}-scheduler`;if(r==="run"){let v=await Ye(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:pn(v||"Scheduler run triggered.")}}let f=new sr(a.region);if(r==="enable")await f.enableRule({Name:m});else await f.disableRule({Name:m});return{operation:`scheduler:${r}`,command:`${r} ${m}`,ok:!0,stdout:`Scheduler rule ${m} ${r}d.`}}catch(a){return{operation:`scheduler:${r}`,ok:!1,error:pn(a?.message??String(a))}}}function qS(e,t,r){let a=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!a.length){if(t)return;let f=e.map((v)=>v.id);return f.length?f:["__no_authorized_telemetry_resources__"]}let m=a.map((f)=>e.find((v)=>v.id===f||v.slug===f)?.id).filter((f)=>!!f);if(m.length!==a.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(m)]}import{createHash as WS}from"node:crypto";class HS{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,a){let m=this.entries.get(e);if(!r&&m&&m.expiresAt>this.now())return{value:await m.promise,cached:!0};let f=a().catch((v)=>{throw this.entries.delete(e),v});return this.entries.set(e,{expiresAt:this.now()+t,promise:f}),{value:await f,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class KS{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let a=this.now(),m=this.lastRun.get(e);if(!r&&m!=null&&a-m<t)return!1;return this.lastRun.set(e,a),!0}}var JS=new HS,C_=new KS,P_=2000,__=3600000;function T_(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(WS("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function fn(...e){return`telemetry:${WS("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function Ec(e,t,r,a){if(!a)return;return e.listResources(t,r).find((m)=>m.slug===a)?.id}function x_(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function VS(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let K=JSON.parse(e.message);if(K&&typeof K==="object"&&!Array.isArray(K))r=K}catch{}let a=Object.fromEntries(Object.entries(r).filter(([K])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(K))),m=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,f=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,v=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),w=Number(r.statusCode??r.status_code??r.status),k=String(r.method??r.httpMethod??"")||void 0,S=Ci(String(r.pathTemplate??r.path??r.url??"")||void 0),A=String(r.releaseId??r.release_id??"")||void 0,x=String(r.deploymentId??r.deployment_id??"")||void 0,F={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:m,traceId:f,releaseId:A,deploymentId:x,workloadId:e.workloadId},U=Object.keys(r).length?JSON.stringify(a):e.message,H=[{...F,id:fn(e.source,e.name,t,U),kind:"log",name:e.name,level:x_(U,r.level),message:U,attributes:a}];if(k&&S&&Number.isFinite(w)){if(H.push({...F,id:fn("request",m,t,k,S,w),kind:"request",name:"http.request",method:k,pathTemplate:S,host:r.host,statusCode:w,durationMs:Number.isFinite(v)?v:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(v))H.push({...F,id:fn("request-duration",m,t),kind:"metric",name:"request.duration",value:v,unit:"ms",attributes:{method:k,pathTemplate:S,statusCode:w}});if(H.push({...F,id:fn("request-count",m,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:k,pathTemplate:S,statusCode:w}}),w>=500)H.push({...F,id:fn("request-error",m,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:k,pathTemplate:S,statusCode:w}})}return H}async function D_(e){let t=new gt(e.controlPlane),r=Qt(e.controlPlane,e.projectId),a=new Date,m=[],f=[],v={projectId:e.projectId,environmentId:e.environmentId},w=L(e.config);try{let F=(w==="serverless"?await dn(e.config,e.environment):await Cu(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(w==="serverless"){for(let H of F.functionsDetail??[]){let K=Ec(e.controlPlane,e.projectId,e.environmentId,H.key),X={...v,resourceId:K,source:"cloudwatch",timestamp:a.toISOString(),workloadId:H.name,attributes:{provider:"aws",functionName:H.name,aggregationWindow:"24h"}};for(let[oe,pe,ee]of[["snapshot.traffic.requests_24h",H.invocations,"count"],["snapshot.errors.count_24h",H.errors,"count"],["snapshot.latency.p50_24h",H.p50,"ms"],["snapshot.latency.p95_24h",H.p95,"ms"],["snapshot.latency.p99_24h",H.p99,"ms"],["snapshot.saturation.throttles_24h",H.throttles,"count"],["snapshot.memory.max_24h",H.maxMem,"MB"]])if(Number.isFinite(Number(pe)))m.push({...X,id:fn("cloudwatch",H.name,oe,a.toISOString()),kind:"metric",name:oe,value:Number(pe),unit:ee})}try{let H=await Tr(e.config,e.environment),K=new di(H.region),X=new Date(a.getTime()-3600000),oe=300;for(let pe of H.functions){let ee=[{Name:"FunctionName",Value:pe.name}],[ce,Ee,Re,de,je]=await Promise.all([K.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:ee,StartTime:X,EndTime:a,Period:300,Statistics:["Sum"]}),K.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:ee,StartTime:X,EndTime:a,Period:300,Statistics:["Sum"]}),K.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:ee,StartTime:X,EndTime:a,Period:300,ExtendedStatistics:["p50","p95","p99"]}),K.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:ee,StartTime:X,EndTime:a,Period:300,Statistics:["Sum"]}),K.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:ee,StartTime:X,EndTime:a,Period:300,Statistics:["Maximum"]})]),ae=Ec(e.controlPlane,e.projectId,e.environmentId,pe.mode),Le=(rt,mt,ir,st)=>{for(let Dt of rt){let or=Dt.Timestamp&&Number.isFinite(new Date(Dt.Timestamp).getTime())?new Date(Dt.Timestamp).toISOString():void 0,lt=ir(Dt);if(or&&lt!=null&&Number.isFinite(lt))m.push({...v,resourceId:ae,id:fn("cloudwatch-series",pe.name,mt,or),kind:"metric",source:"cloudwatch",name:mt,timestamp:or,value:lt,unit:st,workloadId:pe.name,region:H.region,attributes:{provider:"aws",functionName:pe.name,aggregationWindow:"300s"}})}};Le(ce,"traffic.requests",(rt)=>rt.Sum,"count"),Le(Ee,"errors.count",(rt)=>rt.Sum,"count"),Le(Re,"latency.p50",(rt)=>rt.Percentiles?.p50,"ms"),Le(Re,"latency.p95",(rt)=>rt.Percentiles?.p95,"ms"),Le(Re,"latency.p99",(rt)=>rt.Percentiles?.p99,"ms"),Le(de,"saturation.throttles",(rt)=>rt.Sum,"count"),Le(je,"saturation.concurrency",(rt)=>rt.Maximum,"count")}}catch(H){f.push({source:"cloudwatch:series",message:H instanceof Error?H.message:String(H)})}for(let H of(F.serverlessLogs??[]).slice(0,P_))m.push(...VS({...v,source:`cloudwatch:${H.source}`,name:`${H.source}.log`,timestamp:H.timestamp,message:String(H.message),resourceId:Ec(e.controlPlane,e.projectId,e.environmentId,H.source)}));for(let H of F.queuesDetail??[]){let K={...v,source:"cloudwatch",timestamp:a.toISOString(),attributes:{queue:H.name}};m.push({...K,id:fn("queue-depth",H.name,a.toISOString()),kind:"metric",name:"queue.depth",value:Number(H.visible??H.depth??0),unit:"count"}),m.push({...K,id:fn("queue-inflight",H.name,a.toISOString()),kind:"metric",name:"queue.inflight",value:Number(H.inFlight??0),unit:"count"})}let U=await qu(e.config,e.environment,30);if(!U.ok)f.push({source:"xray",message:U.error??"X-Ray traces are unavailable."});for(let H of U.traces)m.push({...v,id:fn("xray",H.id),kind:"trace",source:"xray",name:"http.trace",timestamp:H.timestamp??a.toISOString(),traceId:H.id,durationMs:H.durationMs,statusCode:H.httpStatus,method:H.method,pathTemplate:H.url,attributes:{status:H.status,responseMs:H.responseMs}})}else{let U=F.systemMetrics;if(F.metricsUnavailable||!U)f.push({source:"host",message:"The host metrics probe is unavailable."});else{let H=Number(U.memTotalMb)>0?Number(U.memUsedMb)/Number(U.memTotalMb)*100:0,K=Number(U.swapTotalMb)>0?Number(U.swapUsedMb)/Number(U.swapTotalMb)*100:0,X=[["host.load",Number(U.load),"load"],["host.load.5m",Number(U.load5),"load"],["host.load.15m",Number(U.load15),"load"],["host.cpu.capacity",Number(U.cpus),"count"],["host.cpu.used_percent",Number(U.cpuUsedPct),"percent"],["host.memory.used",Number(U.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(U.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(U.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(U.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",H,"percent"],["host.swap.used",Number(U.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(U.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",K,"percent"],["host.disk.used_percent",Number(U.diskUsedPct),"percent"],["host.disk.used",Number(U.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(U.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(U.inodeUsedPct),"percent"],["host.network.rx",Number(U.networkRxBytes),"bytes"],["host.network.tx",Number(U.networkTxBytes),"bytes"],["host.network.rx_rate",Number(U.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(U.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(U.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(U.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(U.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(U.networkTxBytesMonth),"bytes"],["host.processes",Number(U.processes),"count"],["host.uptime",Number(U.uptimeSeconds),"seconds"]];for(let[oe,pe,ee]of X)if(Number.isFinite(pe))m.push({...v,id:fn("host",oe,a.toISOString()),kind:"metric",source:"host",name:oe,timestamp:a.toISOString(),value:pe,unit:ee});for(let oe of F.siteHealth??[]){let pe=String(oe.project??e.config.project.slug),ee=String(oe.name),ce=ee.startsWith(`${pe}:`)?ee.slice(pe.length+1):ee,Ee=`site:${pe}:${ce}`,Re=Ec(e.controlPlane,e.projectId,e.environmentId,ee),de={...v,resourceId:Re,source:Ee,timestamp:oe.checkedAt||a.toISOString(),host:oe.route,attributes:{project:pe,site:ce,route:String(oe.route),status:String(oe.status)}},je=[["site.health.up",oe.status==="live"?1:0,"boolean"],["site.http.status",Number(oe.httpStatus),"status"],["site.response.time",Number(oe.responseMs),"ms"]];if(oe.tlsDaysRemaining!=null)je.push(["site.tls.days_remaining",Number(oe.tlsDaysRemaining),"days"]);for(let[ae,Le,rt]of je)if(Number.isFinite(Le))m.push({...de,id:fn(Ee,ae,de.timestamp),kind:"metric",name:ae,value:Le,unit:rt})}}}}catch(F){f.push({source:w==="serverless"?"aws":"host",message:F instanceof Error?F.message:String(F)})}{let F=e.config.infrastructure?.compute?.monitoring,U=typeof F==="object"?F?.egressEndpoints:void 0,H=await Ia(U,{now:a.toISOString()});f.push(...H.errors);for(let K of H.metrics)m.push({...v,id:fn(K.attributes.source,K.name,K.timestamp),kind:"metric",source:`egress:${K.attributes.source}`,name:K.name,timestamp:K.timestamp,value:K.value,unit:K.unit,attributes:K.attributes})}if(!e.lightweight)try{let F=await ne(e.config,e.environment),U=new me(e.config,e.environment,{inventory:async()=>F});for(let H of F.workloads){let K=Ec(e.controlPlane,e.projectId,e.environmentId,H.links.service),X={...v,resourceId:K,source:`runtime:${H.provider}`,timestamp:a.toISOString(),workloadId:H.id,releaseId:H.links.release,attributes:{status:H.status,provider:H.provider,service:H.links.service??""}};if(m.push({...X,id:fn(H.id,"health",a.toISOString()),kind:"metric",name:"health.up",value:H.status==="running"?1:0,unit:"boolean"}),m.push({...X,id:fn(H.id,"restarts",a.toISOString()),kind:"metric",name:"saturation.restarts",value:H.restartCount??0,unit:"count"}),H.resources?.memoryBytes!=null)m.push({...X,id:fn(H.id,"memory",a.toISOString()),kind:"metric",name:"runtime.memory.used",value:H.resources.memoryBytes,unit:"bytes"});if(!H.capabilities.logs.supported)continue;try{let oe=await U.logs(H.id,{limit:100,since:new Date(a.getTime()-300000)});for(let pe of oe.lines)m.push(...VS({...v,resourceId:K,source:`runtime:${H.provider}`,name:`${H.links.service??H.name}.log`,timestamp:pe.timestamp,message:pe.message,workloadId:H.id}))}catch(oe){f.push({source:`runtime:${H.provider}`,message:oe instanceof Error?oe.message:String(oe)})}}for(let H of F.sources.filter((K)=>K.status!=="fresh"))f.push({source:H.id,message:H.message??`Runtime source is ${H.status}.`})}catch(F){f.push({source:"runtime",message:F instanceof Error?F.message:String(F)})}if(!e.lightweight)for(let F of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let U=F.payload;m.push({...v,id:`telemetry:event:${F.id}`,resourceId:F.resourceId,kind:"event",source:"control-plane",name:F.type,timestamp:F.createdAt,level:F.level,message:F.type,deploymentId:F.operationId,releaseId:typeof U.releaseId==="string"?U.releaseId:void 0,traceId:F.correlationId,attributes:U})}let k=m.filter((F)=>T_(F,r)).map((F)=>({...F,sampled:r.samplingRate<1&&(F.kind==="log"||F.kind==="trace"||F.kind==="request"||F.name.startsWith("request."))})),S=t.appendMany(k).length;if(C_.shouldRun(e.projectId,__,!e.lightweight))t.enforceRetention(r,e.projectId);let A=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let F of f)if(!A.some((U)=>U.source===F.source))A.push({source:F.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:F.message});let x=a.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:x,errors:f,statuses:A,policy:r}),{collected:S,cached:!1,generatedAt:x,statuses:A,errors:f,policy:r}}async function Ng(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,a=L(e.config)==="serverless"?300000:60000,m=await JS.getOrCreate(r,a,!!e.force,()=>D_(e));return{...m.value,cached:m.cached}}function GS(e){JS.invalidate(`${e}:`)}function QS(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),a=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),m=new TextDecoder,f=async(v)=>{if(!v)return;let w=v.getReader();try{for(;;){let{done:k,value:S}=await w.read();if(k)break;if(S)e(m.decode(S))}}catch{}};if(f(a.stdout),f(a.stderr),t.onExit)a.exited.then((v)=>t.onExit(v)).catch(()=>{});return{write(v){try{a.stdin.write(v),a.stdin.flush()}catch{}},close(){try{a.stdin.end()}catch{}try{a.kill()}catch{}}}}var F_="127.0.0.1",z_=7676,ZS=65536,dw="ts-cloud-dashboard-",Ja=$_(L_(import.meta.url));function U_(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function q_(e=Hu(),t=U_){let r=0;for(let a of YS(e,{withFileTypes:!0})){if(!a.isDirectory()||!a.name.startsWith(dw))continue;let m=Vt(e,a.name),f=a.name.match(/^ts-cloud-dashboard-(\d+)-/);if(f){let v=Number(f[1]);if(v===process.pid||t(v))continue}else if(YS(m).length>0)continue;Rs(m,{recursive:!0,force:!0}),r+=1}return r}var V_={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function D(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function W_(e,t,r,a){let m=new TextEncoder,f=Math.max(0,Math.floor(r)),v,w,k=!1,S=new ReadableStream({start(A){let x=()=>{if(k)return;if(k=!0,v?.(),w)clearInterval(w);a.removeEventListener("abort",x);try{A.close()}catch{}},F=(H)=>{if(k)return;if(H.reset)A.enqueue(m.encode(`event: reset
-data: ${JSON.stringify({cursor:H.cursor,droppedBytes:H.droppedBytes})}
-
-`));for(let K of H.chunks.filter((X)=>X.cursor>f))f=K.cursor,A.enqueue(m.encode(`id: ${K.cursor}
-event: ${K.stream}
-data: ${JSON.stringify(K)}
-
-`));if(H.state!=="open")A.enqueue(m.encode(`event: state
-data: ${JSON.stringify({state:H.state,error:H.error,cursor:H.cursor})}
-
-`)),x()};v=e.subscribe(t.id,t.workloadId,(H)=>F(e.read(H.id,H.workloadId,f)??H));let U=e.read(t.id,t.workloadId,f);if(!U)return x();if(F(U),k)return;w=setInterval(()=>{if(!k)A.enqueue(m.encode(`event: heartbeat
-data: ${JSON.stringify({cursor:f,at:new Date().toISOString()})}
-
-`))},15000),w.unref?.(),a.addEventListener("abort",x,{once:!0})},cancel(){if(k=!0,v?.(),w)clearInterval(w)}});return new Response(S,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}var H_=new Set(["action","operation","site","name","username","database","secretId","port","key","resourceId","environmentId"]);function K_(e,t,r,a,m){let f={};if(r&&typeof r==="object"&&!Array.isArray(r))for(let[w,k]of Object.entries(r)){if(!H_.has(w)||!["string","number","boolean"].includes(typeof k))continue;f[w]=typeof k==="string"?k.slice(0,256):k}let v=String(f.resourceId||f.site||f.secretId||f.database||f.name||t);return{method:e.toUpperCase(),path:t,target:v,status:a,outcome:a<400?"succeeded":"failed",durationMs:Math.max(0,Math.round(m)),input:f}}var J_=Io("ts-cloud-dummy-password");function Ku(e,t=200){return new Response(e,{status:t,headers:{"content-type":"text/plain; charset=utf-8"}})}function G_(e,t,r=process.env){let a=r.TS_CLOUD_DASHBOARD_ORIGIN?.trim()||(r.TS_CLOUD_UI_DOMAIN?.trim()?`https://${r.TS_CLOUD_UI_DOMAIN.trim().replace(/^https?:\/\//,"")}`:""),m=["0.0.0.0","::"].includes(e)?void 0:e,f=a||(m&&["127.0.0.1","localhost","::1"].includes(m)?`http://${m.includes(":")?`[${m}]`:m}:${t}`:"");if(!f)return;try{let v=new URL(f),w=["127.0.0.1","localhost","::1"].includes(v.hostname);if(v.protocol!=="https:"&&!(v.protocol==="http:"&&w)||v.username||v.password||v.search||v.hash||v.pathname!=="/"&&v.pathname!=="")return;return v.origin}catch{return}}function Q_(e,t){if(t&&Object.hasOwn(e.environments??{},t))return t;return Object.keys(e.environments??{})[0]??"production"}function Y_(e,t,r){return r&&e.includes(r)?r:t}function XS(e,t,r){return e==null||t-e>=r}async function Z_(e){let t=[Vt(Ja,"..","..","..","..",".env"),Vt(e,".env"),Vt(e,".env.local"),Vt(e,".env.production")];for(let r of t){if(!_i(r))continue;let a=await oi(r,"utf8").catch(()=>"");for(let m of a.split(`
-`)){let f=m.trim();if(!f||f.startsWith("#")||!f.includes("="))continue;let v=f.indexOf("="),w=f.slice(0,v).trim(),k=f.slice(v+1).trim();if(!/^[A-Z_][A-Z0-9_]*$/i.test(w)||process.env[w]!=null)continue;if(k.startsWith('"')&&k.endsWith('"')||k.startsWith("'")&&k.endsWith("'"))k=k.slice(1,-1);process.env[w]=k}}}function X_(e){return[Vt(e,"config","cloud.ts"),Vt(e,"config","cloud.js"),Vt(e,"cloud.config.ts"),Vt(e,"cloud.config.js")].find((r)=>_i(r))??null}function Ga(e){return e.infrastructure?.compute?.sshKeys??[]}function ew(e,t){let r=e.infrastructure??(e.infrastructure={}),a=r.compute??(r.compute={});a.sshKeys=t}function eT(e,t,r){let a=e.sites??(e.sites={});a[t]=r}function jg(e){return ks(e.infrastructure?.compute?.firewall?.allowedPorts??[])}function tw(e,t){let r=e.infrastructure??(e.infrastructure={}),a=r.compute??(r.compute={}),m=a.firewall??(a.firewall={});m.allowedPorts=t}async function se(e){return await e.json().catch(()=>({}))}function Ka(e,t){let r=String(e.scopeType??"environment");if(!["project","environment","service","function","preview"].includes(r))throw Error("Configuration scopeType must be project, environment, service, function, or preview.");let a=String(e.scopeId??(r==="project"?t.projectId:r==="environment"?t.environmentId??"":""));if(!a)throw Error("Configuration scopeId is required.");if(r==="project")return{type:r,id:a};if(r==="environment")return{type:r,id:a,environmentId:a};if(r==="service"||r==="function")return{type:r,id:a,environmentId:String(e.environmentId??t.environmentId??"")||void 0,resourceId:a};return{type:r,id:a,environmentId:String(e.environmentId??t.environmentId??"")||void 0,resourceId:String(e.resourceId??"")||void 0,previewId:a}}function tT(e){if(["GET","HEAD","OPTIONS"].includes(e.method.toUpperCase()))return!0;let t=e.headers.get("sec-fetch-site");if(t==="cross-site")return!1;let r=e.headers.get("origin");if(!r)return!0;let a=new URL(e.url);if(r===a.origin)return!0;if(t!=="same-origin")return!1;try{let m=new URL(r),f=(e.headers.get("x-forwarded-host")??e.headers.get("host")??a.host).split(",")[0].trim(),v=e.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();if(!/^[A-Za-z0-9.-]+(?::\d{1,5})?$/.test(f)||m.host!==f)return!1;return!v||m.protocol===`${v}:`}catch{return!1}}var rT=new Set(["owner","admin","deployer","operator","viewer","auditor"]),nT=new Set(["organization","project","environment","resource"]),iT=new Set(["POST /api/organization/invitations","DELETE /api/organization/invitations","POST /api/organization/invitations/resend","PATCH /api/organization/memberships","DELETE /api/organization/memberships","POST /api/organization/grants","DELETE /api/organization/grants","POST /api/auth/oidc/providers","PATCH /api/auth/oidc/providers","POST /api/automation/service-accounts","PATCH /api/automation/service-accounts","POST /api/automation/tokens","POST /api/automation/tokens/rotate","DELETE /api/automation/tokens","POST /api/security/policies","PATCH /api/security/policies","POST /api/security/waivers","DELETE /api/security/waivers","POST /api/sources/connections","PATCH /api/sources/connections","DELETE /api/sources/connections","POST /api/sources/deploy-keys","DELETE /api/sources/deploy-keys","PATCH /api/telemetry/settings","POST /api/health/checks","PATCH /api/health/checks","POST /api/alerts/rules","PATCH /api/alerts/rules","POST /api/alerts/silences","POST /api/spend/budgets","PATCH /api/spend/budgets","DELETE /api/spend/budgets","POST /api/spend/check","POST /api/spend/release","POST /api/spend/anomalies/acknowledge","POST /api/protection/attack-mode","POST /api/protection/pause","POST /api/protection/ip-rules","DELETE /api/protection/ip-rules","POST /api/notifications/channels","PATCH /api/notifications/channels","POST /api/notifications/routes","PATCH /api/notifications/routes","POST /api/jobs","PATCH /api/jobs","POST /api/jobs/reconcile","POST /api/workers/action","POST /api/data-services","POST /api/data-services/action","POST /api/data-services/dependencies","POST /api/data-services/management","POST /api/data-services/reveal","POST /api/backups/destinations","POST /api/backups/destinations/test","POST /api/backups/policies","POST /api/backups/run","POST /api/backups/verify","POST /api/backups/restore","POST /api/backups/recovery-points","POST /api/backups/retention","POST /api/configuration/reveal","POST /api/configuration/transfer","POST /api/configuration/bulk","DELETE /api/configuration","POST /api/volumes","POST /api/volumes/attach","POST /api/volumes/detach","POST /api/volumes/resize","POST /api/volumes/snapshot","POST /api/volumes/restore","POST /api/volumes/adopt","POST /api/volumes/discover","DELETE /api/volumes","POST /api/fleet","POST /api/fleet/action","POST /api/capacity","POST /api/capacity/member","POST /api/capacity/action","POST /api/capacity/explain","POST /api/regions","POST /api/regions/action","POST /api/maintenance/cleanup-preview","POST /api/maintenance/cleanup-apply","POST /api/maintenance/drill","POST /api/maintenance/drill-run","POST /api/sources/webhooks","PATCH /api/sources/webhooks","DELETE /api/sources/webhooks","POST /api/onboarding/registries","PATCH /api/onboarding/registries","DELETE /api/onboarding/registries","POST /api/runtime/exec-sessions","POST /api/runtime/files/read","POST /api/runtime/files/write","POST /api/onboarding/apply","PATCH /api/queue/settings","DELETE /api/queue/history","POST /api/serverless/secrets","DELETE /api/serverless/secrets"]);function Vu(e){let t=String(e??"");return rT.has(t)?t:void 0}function Rc(e){let t=String(e.scopeType??"organization");if(!nT.has(t))return;if(t==="organization")return{type:"organization"};let r=String(e.scopeId??"").trim();return r?{type:t,id:r}:void 0}async function Es(e,t,r={}){let a=L(e),m={mode:a,environment:t,environments:Object.keys(e.environments??{}),project:{name:e.project.name,slug:e.project.slug,region:e.project.region}};try{return{...(a==="serverless"?await dn(e,t):await Cu(e,t,{includeSiteHealth:r.includeSiteHealth}))??{},...m}}catch{return{...m}}}function oT(e,t){if(!e)return t;let r={...t,...Array.isArray(e.sites)?{sites:e.sites}:{},...Array.isArray(e.sitesDetail)?{sitesDetail:e.sitesDetail}:{},...Array.isArray(e.siteHealth)?{siteHealth:e.siteHealth}:{}};if(r.mode!=="serverless"&&Array.isArray(r.sites))r.topology=Et(r,{project:r.project?.name,environment:r.environment});return r}function sT(e){let t=[Vt(e,"packages","ui"),Vt(Ja,"..","..","..","ui"),Vt(Ja,"..","..","ui"),Vt(Ja,"..","ui-src"),Vt(Ja,"..","..","ui-src"),Vt(Ja,"..","..","dist","ui-src")];for(let r of t)if(_i(Vt(r,"pages"))&&_i(Vt(r,"package.json")))return r;return null}async function aT(e,t){let r=sT(e);if(!r)return null;let a;try{a=Bg(Vt(Hu(),`${dw}${process.pid}-`));let m=Vt(r,"node_modules",".bin","stx"),f=_i(m)?[m,"build","--pages","pages","--out",a,"--no-sitemap","--no-cache"]:["bunx","--bun","@stacksjs/stx","build","--pages","pages","--out",a,"--no-sitemap","--no-cache"],v=Bun.spawn(f,{cwd:r,stdout:"pipe",stderr:"pipe",env:{...process.env,TSCLOUD_DASHBOARD_DATA:bS(t)}}),[w,k,S]=await Promise.all([new Response(v.stdout).text(),new Response(v.stderr).text(),v.exited]);if(S!==0){if(Rs(a,{recursive:!0,force:!0}),process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build failed; serving the pre-built UI.
-${w}
-${k}`);return null}return a}catch(m){if(a)Rs(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${m.message}`);return null}}function Zi(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:Eo(Ga(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function un(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function es(e,t){return un(t).find((r)=>r.id===e)}function rw(e){if(e.length<=ZS)return e;return`${e.slice(0,ZS)}
-
-[output truncated]`}async function nw(e,t,r){let a=e.getReader(),m=new TextDecoder,f="";while(!0){let{done:w,value:k}=await a.read();if(w)break;let S=m.decode(k,{stream:!0});if(f+=S,S)r?.(t,S)}let v=m.decode();if(v)f+=v,r?.(t,v);return f}async function Mg(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[m,f,v]=await Promise.all([nw(r.stdout,"stdout",t.onOutput),nw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:v,ok:v===0,stdout:rw(m),stderr:rw(f)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ac(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function iw(e,t){if(t.role==="admin")return!0;let r=Ac(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let m=uT[a];return!!m&&!!t.capabilities?.includes(m)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),m=N_(r===""?"index.html":r);if(m.startsWith("..")||m.includes("/../"))return null;let f=Vt(e,m);if(_i(f)&&!cw(f).isDirectory())return f;if(!Ac(f)&&_i(`${f}.html`))return`${f}.html`;if(!Ac(f)&&_i(Vt(f,"index.html")))return Vt(f,"index.html");return null}async function ow(e,t){let r=pT(e,t);if(!r){let f=Vt(e,"404.html");if(_i(f))return new Response(await oi(f),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Ku("Not found",404)}if(cw(r).isDirectory())return Ku("Not found",404);let a=await oi(r),m=V_[Ac(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":m}})}var Wu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],sw=new WeakMap;async function aw(e){let t=sw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),m={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return sw.set(e,m),m}async function _a(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,m=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let f=e.config??await el(),v=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,w=p(f);if(v&&w&&!w.password)w.password=v;let k=f.infrastructure?.compute?.managedServices?.vitess;if(v&&k&&typeof k==="object"&&!k.password)k.password=v;let S=tu(t,f);if(S.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${S.reconciliation.failed} orphaned operation(s) as failed after restart.`);let A=Object.keys(f.environments??{}),x=Q_(f,e.environment),F=X_(t),U=await Es(f,x),H=new Map([[x,U]]),K=new Map([[x,Date.now()]]),X=new Map([[x,Date.now()]]),oe=new Map,pe=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),ee=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=L(f)!=="serverless",Ee=(M)=>{let ze=H.get(M);if(ze&&!XS(K.get(M),Date.now(),pe))return Promise.resolve(ze);let qe=oe.get(M);if(qe)return qe;let Fe=!ce||XS(X.get(M),Date.now(),ee),nt=Es(f,M,{includeSiteHealth:Fe}).then((Pt)=>{let W=H.get(M),Hr=Fe?Pt:oT(W,Pt);if(H.set(M,Hr),K.set(M,Date.now()),Fe)X.set(M,Date.now());if(W?._serverReachable!==Hr._serverReachable||W?._metricsStatus!==Hr._metricsStatus||(W?.sitesDetail?.length??0)!==(Hr.sitesDetail?.length??0))st();return Hr}).finally(()=>oe.delete(M));return oe.set(M,nt),nt},Re=_t(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!f.cloud?.attachTo)){let M=!1,ze=Date.now()+300000,qe=async()=>{if(M)return;M=!0;try{let nt=Date.now(),Pt=nt>=ze;if(Pt)ze=nt+300000;let W=S.environments.get(x);await Ng({controlPlane:S.store,projectId:S.project.id,environmentId:W?.id,config:f,environment:x,force:!0,lightweight:!0,includeSiteHealth:Pt})}catch(nt){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${nt instanceof Error?nt.message:String(nt)}`)}finally{M=!1}};qe(),setInterval(()=>void qe(),60000).unref?.()}let ae=new Map,Le=new Map,rt=new Set,mt=0;function ir(M,ze){if(M.role==="admin"&&!S.store.getActorByExternalId("user",`dashboard:${M.username.toLowerCase()}`))return M;let qe=S.store.getActorByExternalId("user",`dashboard:${M.username.toLowerCase()}`),Fe=qe?S.store.getMembershipForActor(S.organization.id,qe.id):void 0;if(!Fe||Fe.status!=="active")return{...M,role:"member",sites:{},capabilities:[]};let nt=S.store.listGrants(Fe.id),Pt=S.store.resolveAuthorizationTarget(S.organization.id,Fe.scope)??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id}),W=Lt({membership:Fe,grants:nt,target:Pt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...M,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W};let Hr=S.environments.get(ze),Sr={};for(let ct of S.store.listResources(S.project.id,Hr?.id).filter((pt)=>pt.kind==="application")){let pt=S.store.resolveAuthorizationTarget(S.organization.id,{type:"resource",id:ct.id});if(!pt||!R({membership:Fe,grants:nt,capability:"project:read",target:pt}).allowed)continue;Sr[ct.slug]=R({membership:Fe,grants:nt,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...M,role:"member",sites:Sr,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:W}}function st(){mt+=1,ae.clear();for(let M of rt)Rs(M,{recursive:!0,force:!0});rt.clear()}let Dt=(M,ze)=>`${ze}:${M.role==="admin"?"admin":`member:${Object.entries(M.sites).sort(([qe],[Fe])=>qe.localeCompare(Fe)).map(([qe,Fe])=>`${qe}=${Fe}`).join(",")}`}:${[...M.capabilities??[]].sort().join(",")}`;async function or(M,ze){let qe=ir(M,ze),Fe=Dt(qe,ze),nt=ae.get(Fe);if(nt)return nt;let Pt=Le.get(Fe);if(Pt)return Pt;let W=mt,Hr=(async()=>{let Sr=H.get(ze)??await Es(f,ze);H.set(ze,Sr);let ct={...Ag(Sr,{user:qe,slug:f.project.slug}),viewer:{role:qe.role,organizationRole:qe.organizationRole,organizationSource:qe.organizationSource,capabilities:qe.capabilities??[]}},pt=await aT(t,ct);if(pt&&W!==mt)return Rs(pt,{recursive:!0,force:!0}),Re?.uiRoot;if(pt)rt.add(pt);let $r=pt??Re?.uiRoot;if($r)ae.set(Fe,$r);return $r})();Le.set(Fe,Hr);try{return await Hr}finally{Le.delete(Fe)}}let lt=await or({username:"",passwordHash:"",role:"admin",sites:{}},x);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ye=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",we=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(we&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let De=!we,ht=Zb(t),Nt=De?rS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,$e=new Li(S.store,{encryptionKey:We(t)}),wt=new $i(S.store),ut=new Xr(S.store),et=new $o(S.store,{encryptionKey:We(t)}),Vr=new up(S.store),As=new fp(S.store,{cwd:t}),Zn=new mp(S.store,{encryptionKey:We(t)}),Kt=new c(S.store,{workerId:`dashboard:${process.pid}`}),cr=new Xo(S.store),si=new oa(S.store,We(t)),Ti=new Da(S.store),Cc=new Vi(cr,Kt,si),xi=f.project?.region??"us-east-1",Lg=We(t),En=new Ba(Ti,{encryptionKey:Lg,backends:[new ln(S.store,Lg),new Pa(new j(xi),xi),new Na(new ve(xi),xi),new ka]});await Au(En,S,f);let Ju=new z(xi),lw={aws_rds:new Yo(new na(Ju)),aws_aurora:new Zo(new ia(Ju)),aws_elasticache:new ea(new sa(new tt(xi))),server:new ta(new Yt),container:new ra(new Yt)},Fg=(M)=>lw[M.provider],wr=new Sa(S.store),Ro=new Yi(wr,Kt),zg=new Ca(si),uw={managed_database:new Ea(cr,Ju),logical_database:new va(cr,si),volume:new Ta,files:new ba(t),control_plane:new wa(S.store,t),infrastructure:new Ra(new rr(xi))},pw=(M)=>uw[M.resourceKind],mw=(M)=>M.provider==="aws_backup"?void 0:zg,Gu=new $t(S.store),Qu=[new kr,new Gs(d(t,"volumes"))],ai=new Hs(Gu,Qu,Kt),Qa=new aa(S.store),Xn=new ca(Qa,[new rn("aws"),new rn("hetzner"),new rn("ssh")],Kt),Di=new da(S.store),Ug=new la(Di,Qa),Co=new ua(S.store),qg=new pa(Co,Kt),ci=new ma(S.store),Yu=new ha(ci,Kt),Vg=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((M)=>new fa(M,S.store,S.project.id,S.organization.id)),Dr=new Ko(S.store),Wg=new Jo(Dr,{queue:Kt}),vr=new Nr(S.store),Ni=new Br(S.store),On=new ft(S.store),at=new yi(S.store,{encryptionKey:We(t)}),gw=()=>aw(S.store);for(let M of S.environments.values())Wo(Dr,f,{organization:S.organization,project:S.project,environment:M,resources:S.store.listResources(S.project.id,M.id)});let $n=new Ii(at,{emailImpl:async(M)=>{let{email:ze}=await import("./chunk-2fa9cdyf.js");return ze.send(M)}}),Hg=async(M)=>{let ze=ro(at,S.project.id,M),qe=[];for(let Fe of ze.filter((nt)=>nt.notify&&nt.alert))qe.push(...await $n.deliverAll($n.enqueue(S.organization.id,Fe.alert,Fe.transition)));return qe.push(...await $n.deliverAll($n.enqueueRemindersAndEscalations(S.organization.id,at.listAlerts(S.project.id,{environmentId:M,states:["firing"]})))),qe.push(...await $n.retryDue()),{evaluations:ze,deliveries:qe}},Zu=!1,fw=async()=>{if(Zu)return;Zu=!0;try{for(let M of S.environments.values())for(let ze of at.listHealthChecks(S.project.id,M.id).filter((qe)=>qe.enabled)){let qe=at.listHealthResults(ze.id,1)[0];if(qe&&Date.now()-new Date(qe.checkedAt).getTime()<ze.intervalSeconds*1000)continue;let Fe=await new Ge(at).runAndEvaluate(ze);for(let nt of Fe.evaluations.filter((Pt)=>Pt.notify&&Pt.alert))await $n.deliverAll($n.enqueue(S.organization.id,nt.alert,nt.transition))}}finally{Zu=!1}},Kg=setInterval(()=>{for(let M of S.environments.values())Hg(M.id).catch((ze)=>console.error("ts-cloud alert evaluation failed:",ze))},60000);Kg.unref?.();let Jg=setInterval(()=>{fw().catch((M)=>console.error("ts-cloud health check evaluation failed:",M))},30000);Jg.unref?.();let Gg=setInterval(()=>{try{Wg.tick()}catch(M){console.error("ts-cloud scheduled job evaluation failed:",M)}},30000);Gg.unref?.();let Qg=setInterval(()=>{try{Ro.enqueueDue(),Ro.enqueueRetention()}catch(M){console.error("ts-cloud backup policy evaluation failed:",M)}},30000);Qg.unref?.(),vr.cleanup();let Yg=setInterval(()=>{try{vr.cleanup()}catch(M){console.error("ts-cloud preview cleanup failed:",M)}},3600000);Yg.unref?.();let hw=e.queueWorker??!0,yw=cT(),vw=async(M,ze)=>{let Fe=(M.environmentId?S.store.listEnvironments(M.projectId).find((nt)=>nt.id===M.environmentId):void 0)?.slug??String(x);if(ze.kind==="dashboard_operation"&&ze.operationId){let nt=H.get(Fe)??U,Pt=Rg(ze.operationId,f,nt);if(!Pt||Pt.danger||!["scheduler","backup","worker"].includes(Pt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let W=await zu(f,Fe,Pt);return{ok:W.ok,stdout:W.stdout,stderr:W.stderr??W.error,retryable:/temporar|unavailable|timeout|network/i.test(W.stderr??W.error??""),output:{command:W.command??null,operation:W.operation}}}if(ze.kind==="serverless_scheduler"){let nt=await $g(f,Fe,"run");return{ok:nt.ok,stdout:nt.stdout,stderr:nt.error,retryable:/temporar|unavailable|timeout|network/i.test(nt.error??""),output:{command:nt.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${ze.kind}.`}},Pc=hw?new Us(Kt,{...Gc({store:S.store,execute:async(M,ze)=>{let qe=ze.operation.input&&typeof ze.operation.input==="object"&&!Array.isArray(ze.operation.input)?ze.operation.input:{},Fe=qe.source&&typeof qe.source==="object"?qe.source:void 0,nt=t,Pt,W,Hr;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let ct=et.getBinding(String(Fe.bindingId)),pt=et.getConnection(String(Fe.connectionId));if(!ct||!pt||ct.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let _r=(ct.repositoryId?et.getRepository(ct.repositoryId):et.listRepositories(pt.id).find((_s)=>_s.fullName.toLowerCase()===ct.repositoryFullName.toLowerCase()))?.cloneUrl;if(!_r&&pt.provider==="generic_ssh")_r=`git@${new URL(pt.host).hostname}:${ct.repositoryFullName}.git`;if(!_r)_r=new URL(`/${ct.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ce=ct.deployKeyId?et.getDeployKey(ct.deployKeyId):void 0,dr=Ce&&ct.deployKeyId?{...Ce,privateKey:et.getDeployPrivateKey(ct.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&M.target.previewId){let _s=Je(pt,et.getCredential(pt.id)),be=vr.previews.getInstance(M.target.previewId);Hr=async(Nn,Oc)=>{try{await _s.setCommitStatus(ct.repositoryFullName,String(Fe.commitSha),{state:Nn,url:be?.url,description:Oc})}catch(xs){ze.log(`Could not publish source status: ${xs instanceof Error?xs.message:String(xs)}`,{stream:"stderr"})}},await Hr("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Pt=Bg(Vt(Hu(),"ts-cloud-queued-source-")),ze.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),nt=(await Fo({remote:_r,binding:ct,destination:Vt(Pt,"checkout"),ref:String(Fe.branch??ct.defaultBranch),commitSha:String(Fe.commitSha)},{credential:et.getCredential(pt.id),deployKey:dr})).directory}if(ze.operation.kind!=="preview.destroy"){let ct=M.target.previewId?vr.previews.getInstance(M.target.previewId):void 0,pt=ct?vr.previews.getDefinition(ct.definitionId):void 0,$r=ze.operation.resourceId?S.store.getResource(ze.operation.resourceId):void 0;if(W=await En.resolve({projectId:S.project.id,environmentId:ze.operation.environmentId,resourceId:ze.operation.resourceId,functionId:$r?.kind==="function"?$r.id:void 0,previewId:ct?.id,trustedPreview:!!ct&&!ct.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),W.warnings.some((_r)=>_r.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${W.warnings.filter((_r)=>_r.code==="missing_required").map((_r)=>_r.key).join(", ")}`);if(ze.operation.resourceId)for(let _r of Object.values(W.entries))Ti.setDependency({entryId:_r.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:_r.required,requiresRedeploy:!0});ze.log(`Resolved configuration ${W.configurationHash.slice(0,18)} for ${Object.keys(W.values).length} keys.`,{stream:"system"})}let Sr=await Mg(M,{cwd:nt,cliEntry:m,signal:ze.signal,env:W?.values,onOutput:(ct,pt)=>ze.log(pt,{stream:ct,step:"execute",secrets:[...yw,...Object.entries(W?.entries??{}).filter(([,$r])=>$r.kind==="secret").map(([$r])=>W.values[$r]).filter(Boolean)]})});if(Sr.ok&&ze.operation.resourceId&&W)for(let ct of Object.values(W.entries))Ti.setDependency({entryId:ct.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:ct.required,requiresRedeploy:!1,lastDeployedVersion:ct.version});return await Hr?.(Sr.ok?"success":"failure",Sr.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),Sr}catch(Sr){throw await Hr?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),Sr}finally{if(Pt)Rs(Pt,{recursive:!0,force:!0})}}}),...Ol({store:Dr,executor:vw}),...$l({store:cr,secrets:si,resolveAdapter:Fg}),...Ul(Qa,Xn.drivers),...Hl(Co,[new ga("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...zl({store:ci,cleanup:Vg}),...qc(Gu,Qu),...pu({store:wr,queue:Kt,resolveSource:pw,resolveDestination:mw,validateHealth:async(M,ze)=>{if(!M.healthCheckId)return{healthy:!0,mode:"adapter"};let qe=at.getHealthCheck(M.healthCheckId);if(!qe||qe.projectId!==M.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new Ge(at).runAndEvaluate(qe);return{healthy:Fe.result.status==="healthy",healthCheckId:qe.id,healthResultId:Fe.result.id,target:ze}}}),...gl({store:S.store,resolveDriver:e.releaseDriver??((M)=>({name:`${S.store.getResource(M.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:M.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(M,ze)=>{let qe=at.listHealthChecks(ze.projectId,ze.environmentId).find((nt)=>nt.enabled&&nt.name===M&&(!nt.resourceId||nt.resourceId===ze.resourceId));if(!qe)return{healthy:!1,message:`Named health gate ${M} was not found for this release.`};let Fe=await new Ge(at).runAndEvaluate(qe);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:qe.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(M)=>console.error("ts-cloud deployment queue worker failed:",M)}):void 0;if(wl(S),Hi(ut,re(S,String(x)),U),Nt)Wi(S,Nt.users),oS($e,S,Nt.users);let ur=nS({cwd:t,enabled:De,secret:ht,authentication:$e,authorization:{store:S.store,organizationId:S.organization.id,projectId:S.project.id,defaultEnvironment:String(x)}}),Ir=new zo,Zg=setInterval(()=>Ir.sweep(),60000);Zg.unref?.();let _c=new kc,Xu=new kc(3,900000,900000),Tc=new kc(8,900000,900000),Xg=setInterval(()=>_c.prune(),300000),ef=setInterval(()=>Xu.prune(),300000),tf=setInterval(()=>Tc.prune(),300000);if(Xg.unref?.(),ef.unref?.(),tf.unref?.(),De){if(Nt?.generated)console.warn(`
-  ts-cloud dashboard: created the first admin.
-    username: ${Nt.generated.username}
-    password: ${Nt.generated.password}
-  Saved (hashed) to ${eS()}. This password is shown once.
-`)}else console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");let Bi=r!=="127.0.0.1"&&r!=="localhost",ep=(M)=>O_("sha256").update(`${ht}:${M}`).digest("hex").slice(0,16),bw=Ho({controlPlane:S.store,identities:wt,sources:et,applications:{drafts:Vr,artifacts:As,registries:Zn}}),rf=(M)=>M.headers.get("user-agent")?.trim().slice(0,256)||void 0,xc=(M,ze,qe,Fe="local")=>$e.createSession({identityId:M,authMethod:Fe,userAgent:rf(ze),networkHint:ep(qe)}),Ve=(M)=>{let ze=S.store.getActorByExternalId("user",`dashboard:${M.username.toLowerCase()}`),qe=ze?S.store.getMembershipForActor(S.organization.id,ze.id):void 0;return{actor:ze,membership:qe,grants:qe?S.store.listGrants(qe.id):[]}},Cs=(M,ze,qe)=>{if(M.role==="admin")return!0;let Fe=S.store.getOperation(ze),nt=Ve(M);if(!Fe||!nt.membership)return!1;let Pt=Fe.resourceId?{type:"resource",id:Fe.resourceId}:Fe.environmentId?{type:"environment",id:Fe.environmentId}:Fe.projectId?{type:"project",id:Fe.projectId}:{type:"organization"},W=S.store.resolveAuthorizationTarget(S.organization.id,Pt);return!!W&&R({membership:nt.membership,grants:nt.grants,capability:qe,target:W}).allowed},Or=(M,ze,qe)=>{if(M.role==="admin")return!0;let Fe=Ve(M);if(!Fe.membership)return!1;let nt=S.store.resolveAuthorizationTarget(S.organization.id,{type:"resource",id:ze});return!!nt&&R({membership:Fe.membership,grants:Fe.grants,capability:qe,target:nt}).allowed},Ya=(M,ze,qe)=>{if(M.role==="admin")return!0;let Fe=Ve(M);if(!Fe.membership)return!1;let nt=S.store.resolveAuthorizationTarget(S.organization.id,{type:"environment",id:ze});return!!nt&&R({membership:Fe.membership,grants:Fe.grants,capability:qe,target:nt}).allowed},Dc=(M,ze)=>{if(M.role==="admin")return!0;let qe=Ve(M);if(!qe.membership)return!1;let Fe=S.store.resolveAuthorizationTarget(S.organization.id,{type:"organization"});return!!Fe&&R({membership:qe.membership,grants:qe.grants,capability:ze,target:Fe}).allowed},Ps=Bun.serve({hostname:r,port:a,idleTimeout:30,websocket:{open(M){if(!ye){M.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
-`),M.close();return}let ze=QS((qe)=>M.send(qe),{cwd:t,onExit:()=>{try{M.close()}catch{}}});Q.set(M,ze),M.send(`Connected to ${r==="127.0.0.1"?"localhost":r} shell. This is a line-oriented shell (no full-screen apps).\r
-`)},message(M,ze){Q.get(M)?.write(typeof ze==="string"?ze:new TextDecoder().decode(ze))},close(M){Q.get(M)?.close(),Q.delete(M)}},async fetch(M,ze){let qe=Date.now(),Fe=M.clone(),nt=M.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),Pt=!["GET","HEAD","OPTIONS"].includes(M.method.toUpperCase()),W=new URL(M.url),Sr=await(async()=>{let ct=ze??Ps,pt=G_(r,ct.port??a),$r=await bw(M,ep(ct.requestIP(M)?.address??"unknown"));if($r)return $r;let _r=W.searchParams.get("env"),Ce=Y_(A,x,_r),dr=H.get(Ce);if(!dr)dr=await Ee(Ce);try{if(!tT(M))return D({ok:!1,error:"Cross-site requests are not allowed."},403);let To=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(W.pathname);if(To&&M.method==="POST"){let I=await yl({sources:et,controlPlane:S.store,endpointToken:To[1],headers:M.headers,rawBody:new Uint8Array(await M.arrayBuffer())});return D({accepted:I.accepted,duplicate:I.duplicate,status:I.status,operationIds:I.operations.map((P)=>P.id),message:I.message},I.accepted?202:404)}let _s=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(W.pathname);if(_s&&M.method==="GET"){let[,I,P]=_s;if(!pt)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(P==="start")try{let q=await _o($e,I,pt,W.searchParams.get("return")??void 0,e.oidcFetch);return new Response(null,{status:302,headers:{location:q.authorizationUrl,"cache-control":"no-store"}})}catch(q){return S.store.appendEvent({organizationId:S.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:I,reason:q instanceof Error?q.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(W.searchParams.has("error")){let Z=$e.getOidcProviderBySlug(I),G=W.searchParams.get("state");if(Z&&G)$e.consumeOidcTransaction(Z.id,G);throw Error("OIDC provider returned an authorization error")}let q=await xo($e,{providerSlug:I,state:W.searchParams.get("state")??"",code:W.searchParams.get("code")??"",origin:pt},e.oidcFetch),V=sS($e,S,t,q.identity);$e.recordLogin(V.identity.id);let J=xc(V.identity.id,M,ct.requestIP(M)?.address??"unknown","oidc");return st(),S.store.appendEvent({organizationId:S.organization.id,actorId:V.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:I,provisioned:V.provisioned}}),new Response(null,{status:302,headers:{location:q.returnPath,"cache-control":"no-store","set-cookie":Va(J.token,{secure:Bi,maxAgeMs:Ke})}})}catch(q){return S.store.appendEvent({organizationId:S.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:I,reason:q instanceof Error?q.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(W.pathname==="/api/invitations/accept"&&M.method==="POST"){let I=await se(M),P=String(I.token??"").trim(),q=String(I.username??"").trim(),V=String(I.password??"");if(!P||!Mu(q)||V.length<12)return D({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let J=S.store.inspectInvitationToken(P);if(!J||J.state!=="pending")return D({ok:!1,error:J?`Invitation is ${J.state}`:"Invitation is invalid"},J?409:404);let Z=zn(In(t),q),G=$e.getIdentityByUsername(q);if(Z&&!Yn(V,G?.passwordHash??Z.passwordHash))return D({ok:!1,error:"That username already exists; enter its current password to continue."},401);let te=$e.getIdentityByEmail(J.email);if(te&&te.id!==G?.id)return D({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let Ie=Sc(t,{username:q,password:Z?void 0:V,name:typeof I.name==="string"?I.name:void 0,email:J.email,sites:Z?.sites??{}}),Se=C(S.store,Ie.user);try{let it=S.store.acceptInvitation(P,Se.id),_e=G?$e.setVerifiedEmail(G.id,it.invitation.email):$e.createIdentity({actorId:Se.id,username:Ie.user.username,email:it.invitation.email,emailVerified:!0,passwordHash:Ie.user.passwordHash}),Qe=xc(_e.id,M,ct.requestIP(M)?.address??"unknown");return st(),D({ok:!0,user:Wa(Ie.user),organization:S.organization,membership:it.membership},200,{"set-cookie":Va(Qe.token,{secure:Bi,maxAgeMs:Ke})})}catch(it){if(!Z)Ig(t,Ie.user.username);let _e=it instanceof Error?it.message:"Invitation could not be accepted.";return D({ok:!1,error:_e},_e.includes("expired")||_e.includes("revoked")||_e.includes("accepted")?409:404)}}if(W.pathname==="/api/auth/password-reset/request"&&M.method==="POST"){let I=await se(M),P=String(I.identifier??"").trim().toLowerCase(),q=ct.requestIP(M)?.address??"unknown",V=Xu.check(P,q),J=P.includes("@")?$e.getIdentityByEmail(P):$e.getIdentityByUsername(P);if(V.allowed)Xu.recordFailure(P,q);if(V.allowed&&J?.email&&J.emailVerifiedAt&&!J.disabledAt){$e.revokeActionTokens(J.id,"password_reset");let Z=$e.createActionToken(J.id,"password_reset"),G=`${W.origin}/reset-password?token=${encodeURIComponent(Z.token)}`,te=await Kr(f,{to:J.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${G}
-
-This link expires in one hour and can be used once.`});S.store.appendEvent({organizationId:S.organization.id,actorId:J.actorId,type:"auth.password_reset.requested",payload:{delivered:te}})}return D({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(W.pathname==="/api/auth/password-reset/complete"&&M.method==="POST"){let I=await se(M),P=String(I.token??"").trim(),q=String(I.password??"");if(!P||q.length<12)return D({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let V=$e.consumeActionToken(P,"password_reset"),J=Io(q),Z=$e.updatePassword(V.identityId,J);return Lu(t,Z.username,J),S.store.appendEvent({organizationId:S.organization.id,actorId:Z.actorId,type:"auth.password_reset.completed"}),D({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":ju({secure:Bi})})}catch(V){let J=V instanceof Error?V.message:"Password reset failed.";return D({ok:!1,error:J.replace("Action token","Reset link")},J.includes("consumed")||J.includes("expired")?409:404)}}if(W.pathname==="/api/login"&&M.method==="POST"){let I=await se(M),P=String(I.username??"").trim(),q=String(I.password??""),V=ct.requestIP(M)?.address??"unknown",J=_c.check(P,V);if(!J.allowed)return D({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((J.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(J.retryAfterSeconds??60)});let Z=zn(In(t),P),G=$e.getIdentityByUsername(P),te=G?.passwordHash??Z?.passwordHash??J_;if(!(Yn(q,te)&&!!Z&&!!G&&!G.disabledAt))return _c.recordFailure(P,V),D({ok:!1,error:"Incorrect username or password."},401);if(aS($e,S,G))return D({ok:!1,error:"Single sign-on is required for this account."},403);_c.recordSuccess(P,V);let Se=G,it=Se.requiresPasswordUpgrade||Sb(Se.passwordHash);if(it){let Qe=Io(q);Se=$e.rehashPassword(Se.id,Qe),Lu(t,Se.username,Qe)}if($e.recordLogin(Se.id),$e.getMfaFactor(Se.id)?.state==="active"){let Qe=$e.createMfaChallenge(Se.id,"login");return S.store.appendEvent({organizationId:S.organization.id,actorId:Se.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),D({ok:!0,mfaRequired:!0,challengeToken:Qe.token,passwordUpgraded:it})}let _e=xc(Se.id,M,V);return S.store.appendEvent({organizationId:S.organization.id,actorId:Se.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),D({ok:!0,user:Wa(Z),passwordUpgraded:it},200,{"set-cookie":Va(_e.token,{secure:Bi,maxAgeMs:Ke})})}if(W.pathname==="/api/auth/mfa/complete"&&M.method==="POST"){let I=await se(M),P=String(I.challengeToken??"").trim(),q=String(I.code??"").trim(),V=ct.requestIP(M)?.address??"unknown",Z=$e.inspectMfaChallengeToken(P,"login")?.identityId??"unknown-mfa",G=Tc.check(Z,V);if(!G.allowed)return D({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(G.retryAfterSeconds??60)});try{let te=$e.completeMfaChallenge(P,q,"login");Tc.recordSuccess(Z,V);let Ie=new Date().toISOString(),Se=$e.createSession({identityId:te.identity.id,userAgent:rf(M),networkHint:ep(V),mfaAt:Ie,recentAuthAt:Ie});return S.store.appendEvent({organizationId:S.organization.id,actorId:te.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:te.method}}),D({ok:!0},200,{"set-cookie":Va(Se.token,{secure:Bi,maxAgeMs:Ke})})}catch{return Tc.recordFailure(Z,V),D({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(W.pathname==="/api/logout"&&M.method==="POST"){let I=ur.resolveSession(M);if(I)$e.revokeSession(I.identityId,I.id);let P=ju({secure:Bi});if(M.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":P}});return D({ok:!0},200,{"set-cookie":P})}if(W.pathname==="/login"){let I=$e.listOidcProviders(S.organization.id).map((P)=>({slug:P.slug,name:P.name}));return new Response(cS(U?.mode==="serverless",I),{headers:{"content-type":"text/html; charset=utf-8"}})}if(W.pathname==="/forgot-password"||W.pathname==="/reset-password")return new Response(dS(W.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(W.pathname==="/accept-invitation")return ow(lt,W.pathname);let be=ur.resolveUser(M);if(!be){if(!W.pathname.startsWith("/api/")&&M.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return D({ok:!1,error:"Sign in to continue."},401)}let Nn=ir(be,Ce);if(W.pathname==="/api/me"){let I=S.store.getActorByExternalId("user",`dashboard:${be.username.toLowerCase()}`),P=I?S.store.getMembershipForActor(S.organization.id,I.id):void 0,q=S.store.resolveAuthorizationTarget(S.organization.id,P?.scope??{type:"project",id:S.project.id})??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id});return D({ok:!0,user:Wa(be),authEnabled:De,organization:S.organization,membership:P,capabilities:Lt({membership:P,grants:P?S.store.listGrants(P.id):[],target:q})})}if(W.pathname.startsWith("/api/")){let I=await iS(M,W.pathname),P=ur.check(M,W.pathname,be,I);if(!P.ok)return D({ok:!1,error:P.error},P.status??403);if(De&&iT.has(`${M.method.toUpperCase()} ${W.pathname}`)){let q=ur.resolveSession(M);if(!q||!$e.isRecentlyAuthenticated(q))return D({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(W.pathname==="/api/auth/security"&&M.method==="GET"){let I=Ve(be),P=I.actor?$e.getIdentityByActor(I.actor.id):void 0,q=ur.resolveSession(M);return D({identity:P?{username:P.username,email:P.email,emailVerifiedAt:P.emailVerifiedAt,requiresPasswordUpgrade:P.requiresPasswordUpgrade,lastLoginAt:P.lastLoginAt}:void 0,currentSessionId:q?.id,sessions:P?$e.listSessions(P.id,{includeInactive:!0}):[],mfa:P?{factor:$e.getMfaFactor(P.id),recoveryCodesRemaining:$e.remainingRecoveryCodes(P.id)}:void 0})}if(W.pathname==="/api/auth/oidc/providers"&&M.method==="GET")return D({providers:$e.listOidcProviders(S.organization.id,{includeDisabled:!0}),callbackOrigin:pt,callbackPattern:pt?`${pt}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(W.pathname==="/api/auth/oidc/providers"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=P.actor?$e.getIdentityByActor(P.actor.id):void 0,V=I.enforceSso===!0;if(V&&(!q?.emailVerifiedAt||$e.remainingRecoveryCodes(q.id)<1))return D({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let J=Vu(I.defaultRole),Z=$e.upsertOidcProvider({id:typeof I.id==="string"?I.id:void 0,organizationId:S.organization.id,slug:String(I.slug??""),name:String(I.name??""),issuer:String(I.issuer??""),clientId:String(I.clientId??""),clientSecret:typeof I.clientSecret==="string"&&I.clientSecret?I.clientSecret:void 0,scopes:Array.isArray(I.scopes)?I.scopes.map(String):void 0,allowedDomains:Array.isArray(I.allowedDomains)?I.allowedDomains.map(String):[],defaultRole:J&&J!=="owner"?J:void 0,enabled:I.enabled!==!1,enforceSso:V});return S.store.appendEvent({organizationId:S.organization.id,actorId:P.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:Z.id,issuer:Z.issuer,enabled:Z.enabled,enforceSso:Z.enforceSso}}),D({ok:!0,provider:Z})}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"OIDC provider could not be saved."},422)}}if(W.pathname==="/api/auth/oidc/providers"&&M.method==="PATCH"){let I=await se(M),P=$e.getOidcProvider(String(I.id??""));if(!P||P.organizationId!==S.organization.id)return D({ok:!1,error:"OIDC provider was not found."},404);let q=Ve(be),V=$e.setOidcProviderEnabled(P.id,I.enabled===!0);return S.store.appendEvent({organizationId:S.organization.id,actorId:q.actor?.id,type:V.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:P.id}}),D({ok:!0,provider:V})}if(W.pathname==="/api/automation"&&M.method==="GET"){let I=wt.listServiceAccounts(S.organization.id,{includeDisabled:!0}).map((P)=>{let q=S.store.getMembershipForActor(S.organization.id,P.actorId),V=P.createdByActorId?S.store.getActor(P.createdByActorId):void 0,J=wt.listTokens(P.id,{includeInactive:!0}).map((Z)=>({...Z,createdBy:Z.createdByActorId?S.store.getActor(Z.createdByActorId):void 0}));return{account:P,createdBy:V,membership:q,tokens:J}});return D({accounts:I,apiBaseUrl:`${W.origin}/api/v1`,openApiUrl:`${W.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(W.pathname==="/api/automation/service-accounts"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=Vu(I.roleTemplate),V=Rc(I);if(!P.actor||!q||q==="owner"||!V)return D({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let J=wt.createServiceAccount({organizationId:S.organization.id,slug:String(I.slug??""),name:String(I.name??""),description:typeof I.description==="string"?I.description:void 0,roleTemplate:q,scope:V,createdByActorId:P.actor.id});return D({ok:!0,...J},201)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"Service account could not be created."},422)}}if(W.pathname==="/api/automation/service-accounts"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=wt.getServiceAccount(String(I.id??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Service account was not found."},404);return D({ok:!0,account:wt.disableServiceAccount(q.id,P.actor?.id)})}if(W.pathname==="/api/automation/tokens"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=wt.getServiceAccount(String(I.serviceAccountId??"")),V=Rc(I);if(!P.actor||!q||q.organizationId!==S.organization.id||!V||!Array.isArray(I.capabilities))return D({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let J=wt.createToken({serviceAccountId:q.id,name:String(I.name??"API token"),capabilities:I.capabilities.map(String),scope:V,expiresAt:typeof I.expiresAt==="string"?I.expiresAt:void 0,createdByActorId:P.actor.id});return D({ok:!0,token:J.token,secret:J.secret,revealOnce:!0},201)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"API token could not be created."},422)}}if(W.pathname==="/api/automation/tokens/rotate"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=wt.getToken(String(I.id??"")),V=q?wt.getServiceAccount(q.serviceAccountId):void 0;if(!P.actor||!q||V?.organizationId!==S.organization.id)return D({ok:!1,error:"API token was not found."},404);try{let J=wt.rotateToken(q.id,P.actor.id);return D({ok:!0,token:J.token,secret:J.secret,revealOnce:!0,overlap:!0},201)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"API token could not be rotated."},409)}}if(W.pathname==="/api/automation/tokens"&&M.method==="DELETE"){let I=await se(M),P=Ve(be),q=wt.getToken(String(I.id??"")),V=q?wt.getServiceAccount(q.serviceAccountId):void 0;if(!q||V?.organizationId!==S.organization.id)return D({ok:!1,error:"API token was not found."},404);return D({ok:!0,token:wt.revokeToken(q.id,P.actor?.id)})}if(W.pathname==="/api/onboarding"&&M.method==="GET"){let I=et.listConnections(S.organization.id);return D({drafts:Vr.list(S.project.id),artifacts:As.list(S.project.id),registries:Zn.list(S.organization.id),sourceConnections:I,repositories:I.flatMap((P)=>et.listRepositories(P.id)),project:{id:S.project.id,slug:S.project.slug,name:S.project.name},environments:[...S.environments.values()].map((P)=>({id:P.id,slug:P.slug,name:P.name,kind:P.kind,region:P.region})),resources:S.store.listResources(S.project.id).filter((P)=>P.kind==="application").map((P)=>({id:P.id,slug:P.slug,name:P.name,environmentId:P.environmentId}))})}if(W.pathname==="/api/onboarding/detect"&&M.method==="POST"){let I=await se(M);try{if(I.source?.kind==="git"){let V=et.getConnection(String(I.source.connectionId??"")),J=et.getRepository(String(I.source.repositoryId??""));if(!V||V.organizationId!==S.organization.id||!J||J.connectionId!==V.id)throw Error("Authorized Git repository was not found");let Z=typeof I.source.deployKeyId==="string"?et.getDeployKey(I.source.deployKeyId):void 0;if(Z&&Z.connectionId!==V.id)throw Error("Deploy key does not belong to this connection");let G=Bg(Vt(Hu(),"ts-cloud-onboarding-git-"));try{let te=await Fo({remote:J.cloneUrl,destination:Vt(G,"checkout"),ref:String(I.source.ref??J.defaultBranch),sparsePaths:Array.isArray(I.source.sparsePaths)?I.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:S.project.id,connectionId:V.id,repositoryId:J.id,repositoryFullName:J.fullName,defaultBranch:J.defaultBranch,monorepoRoot:String(I.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:I.source.submodules===!0,cloneDepth:1,deployKeyId:Z?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:et.getCredential(V.id),deployKey:Z?{...Z,privateKey:et.getDeployPrivateKey(Z.id)}:void 0,timeoutMs:120000});return D({ok:!0,commitSha:te.commitSha,candidates:js(cp(te.directory))})}finally{Rs(G,{recursive:!0,force:!0})}}if(Array.isArray(I.files)){if(I.files.length>1e4)throw Error("Detection file-count limit exceeded");let V=I.files.map((J)=>({path:String(J.path??""),size:Number(J.size??0),content:typeof J.content==="string"?J.content.slice(0,262144):void 0}));return D({ok:!0,candidates:js(V)})}let P=M_(t,String(I.root??".")),q=j_(t,P);if(q===".."||q.startsWith(`..${B_}`))throw Error("Detection root must stay inside the project");return D({ok:!0,candidates:js(cp(P))})}catch(P){return D({ok:!1,error:P instanceof Error?P.message:"Application detection failed."},422)}}if(W.pathname==="/api/onboarding/plan"&&M.method==="POST"){let I=await se(M);try{return D({ok:!0,plan:Vn(I.draft,Array.isArray(I.suppliedSecretNames)?I.suppliedSecretNames.map(String):[])})}catch(P){return D({ok:!1,error:P instanceof Error?P.message:"Application plan could not be generated."},422)}}if(W.pathname==="/api/onboarding/drafts"&&M.method==="POST"){let I=await se(M),P=Ve(be);try{return D({ok:!0,draft:Vr.create({organizationId:S.organization.id,projectId:S.project.id,name:String(I.name??I.draft?.name??"Application draft"),draft:{...I.draft,projectId:S.project.id},step:I.step,suppliedSecretNames:Array.isArray(I.suppliedSecretNames)?I.suppliedSecretNames.map(String):[],actorId:P.actor?.id})},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Application draft could not be saved."},422)}}if(W.pathname==="/api/onboarding/drafts"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=Vr.get(String(I.id??""));if(!q||q.projectId!==S.project.id)return D({ok:!1,error:"Application draft was not found."},404);try{return D({ok:!0,draft:Vr.update(q.id,Number(I.version),{draft:{...I.draft,projectId:S.project.id},step:I.step,suppliedSecretNames:Array.isArray(I.suppliedSecretNames)?I.suppliedSecretNames.map(String):void 0,actorId:P.actor?.id})})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Application draft could not be updated."},409)}}if(W.pathname==="/api/onboarding/artifacts"&&M.method==="POST"){let I=Ve(be);if(Number(M.headers.get("content-length")??0)>104857600)return D({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let q=new Uint8Array(await M.arrayBuffer());return D({ok:!0,artifact:As.create({organizationId:S.organization.id,projectId:S.project.id,filename:M.headers.get("x-artifact-filename")??"application.zip",bytes:q,actorId:I.actor?.id})},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Artifact could not be inspected."},422)}}if(W.pathname==="/api/onboarding/registries"&&M.method==="POST"){let I=await se(M),P=Ve(be);try{return D({ok:!0,registry:Zn.create({organizationId:S.organization.id,provider:I.provider,name:String(I.name??"Container registry"),host:String(I.host??""),credential:I.token||I.password?{username:typeof I.username==="string"?I.username:void 0,password:typeof I.password==="string"?I.password:void 0,token:typeof I.token==="string"?I.token:void 0}:void 0,credentialExpiresAt:typeof I.credentialExpiresAt==="string"?I.credentialExpiresAt:void 0,actorId:P.actor?.id})},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Registry connection could not be created."},422)}}if(W.pathname==="/api/onboarding/registries"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=Zn.get(String(I.id??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Registry connection was not found."},404);try{if(I.action==="test")return D({ok:!0,registry:await Zn.test(q.id,{image:typeof I.image==="string"?I.image:void 0})});if(I.action==="rotate")return D({ok:!0,registry:Zn.rotate(q.id,{username:typeof I.username==="string"?I.username:void 0,password:typeof I.password==="string"?I.password:void 0,token:typeof I.token==="string"?I.token:void 0},{expiresAt:typeof I.expiresAt==="string"?I.expiresAt:void 0,actorId:P.actor?.id})});return D({ok:!1,error:"Registry action must be test or rotate."},422)}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Registry connection could not be updated."},422)}}if(W.pathname==="/api/onboarding/registries"&&M.method==="DELETE"){let I=await se(M),P=Ve(be),q=Zn.get(String(I.id??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Registry connection was not found."},404);let V=Vr.list(S.project.id).filter((J)=>J.input.source.kind==="image"&&J.input.source.registryConnectionId===q.id||J.input.build.kind==="prebuilt_image"&&J.input.build.registryConnectionId===q.id);if(I.preview===!0)return D({ok:!0,preview:!0,affectedDrafts:V});return D({ok:!0,registry:Zn.disconnect(q.id,P.actor?.id),affectedDrafts:V})}if(W.pathname==="/api/onboarding/apply"&&M.method==="POST"){let I=await se(M),P=Ve(be);try{let q=Bc({controlPlane:S.store,drafts:Vr,draftId:String(I.id??""),expectedVersion:Number(I.version),confirmEnvironment:String(I.confirmEnvironment??""),actorId:P.actor?.id});return D({ok:!0,resource:q.resource,operation:q.operation,plan:q.plan},202)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Application plan could not be applied."},422)}}if(W.pathname==="/api/sources"&&M.method==="GET"){let I=et.listConnections(S.organization.id);return D({connections:I,bindings:et.listBindings({projectId:S.project.id}),repositories:I.flatMap((P)=>et.listRepositories(P.id)),deployKeys:I.flatMap((P)=>et.listDeployKeys(P.id)),webhooks:I.flatMap((P)=>et.listWebhooks(P.id)).map((P)=>({...P,deliveries:et.listDeliveries(P.id,20)})),project:{id:S.project.id,slug:S.project.slug},environment:re(S,String(Ce)),resources:S.store.listResources(S.project.id,re(S,String(Ce)).environmentId).filter((P)=>P.kind==="application").map((P)=>({id:P.id,slug:P.slug,name:P.name}))})}if(W.pathname==="/api/sources/connections"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=String(I.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(q))return D({ok:!1,error:"A supported Git provider is required."},422);try{let V=q==="github"&&(I.privateKey||I.appId)?{appId:typeof I.appId==="string"?I.appId:void 0,installationId:typeof I.installationId==="string"?I.installationId:void 0,privateKey:typeof I.privateKey==="string"?I.privateKey:void 0}:q!=="generic_ssh"&&I.token?{token:typeof I.token==="string"?I.token:void 0,username:typeof I.username==="string"?I.username:void 0}:void 0,J={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},Z,G,te;if(S.store.database.transaction(()=>{if(Z=et.createConnection({organizationId:S.organization.id,provider:q,name:String(I.name??q),host:String(I.host??J[q]??""),owner:typeof I.owner==="string"?I.owner:void 0,authKind:I.authKind,credential:V,grantedScopes:Array.isArray(I.grantedScopes)?I.grantedScopes.map(String):[],credentialExpiresAt:typeof I.credentialExpiresAt==="string"?I.credentialExpiresAt:void 0,createdByActorId:P.actor?.id}),typeof I.repositoryUrl==="string"&&typeof I.repositoryFullName==="string")G=et.upsertRepository({connectionId:Z.id,providerRepositoryId:`manual:${I.repositoryFullName}`,fullName:I.repositoryFullName,cloneUrl:I.repositoryUrl,defaultBranch:String(I.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(q==="generic_ssh")te=et.createDeployKey({connectionId:Z.id,name:String(I.deployKeyName??"Repository deploy key"),publicKey:String(I.publicKey??""),privateKey:String(I.deployPrivateKey??""),host:String(I.sshHost??""),hostKey:String(I.hostKey??""),actorId:P.actor?.id})})(),I.test===!0)Z=await Uo(et,Z.id,G?.id);return D({ok:!0,connection:Z,repository:G,deployKey:te},201)}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Source connection could not be created."},422)}}if(W.pathname==="/api/sources/connections"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=et.getConnection(String(I.id??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);try{if(I.action==="test")return D({ok:!0,connection:await Uo(et,q.id,typeof I.repositoryId==="string"?I.repositoryId:void 0)});if(I.action==="rotate")return D({ok:!0,connection:et.rotateCredential(q.id,{token:typeof I.token==="string"?I.token:void 0,username:typeof I.username==="string"?I.username:void 0,appId:typeof I.appId==="string"?I.appId:void 0,installationId:typeof I.installationId==="string"?I.installationId:void 0,privateKey:typeof I.privateKey==="string"?I.privateKey:void 0},{expiresAt:typeof I.expiresAt==="string"?I.expiresAt:void 0,actorId:P.actor?.id})});return D({ok:!1,error:"Connection action must be test or rotate."},422)}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Source connection could not be updated."},422)}}if(W.pathname==="/api/sources/connections"&&M.method==="DELETE"){let I=await se(M),P=Ve(be),q=et.getConnection(String(I.id??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);let V=et.listBindings({connectionId:q.id,status:"active"});if(I.preview===!0)return D({ok:!0,preview:!0,affectedBindings:V});return D({ok:!0,...et.disconnectConnection(q.id,P.actor?.id)})}if(W.pathname==="/api/sources/deploy-keys"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=et.getConnection(String(I.connectionId??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);try{return D({ok:!0,deployKey:et.createDeployKey({connectionId:q.id,name:String(I.name??"Repository deploy key"),publicKey:String(I.publicKey??""),privateKey:String(I.privateKey??""),host:String(I.host??""),hostKey:String(I.hostKey??""),actorId:P.actor?.id})},201)}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Deploy key could not be stored."},422)}}if(W.pathname==="/api/sources/deploy-keys"&&M.method==="DELETE"){let I=await se(M),P=Ve(be),q=et.getDeployKey(String(I.id??"")),V=q?et.getConnection(q.connectionId):void 0;if(!q||!V||V.organizationId!==S.organization.id)return D({ok:!1,error:"Deploy key was not found."},404);let J=et.listBindings({connectionId:V.id}).filter((Z)=>Z.deployKeyId===q.id);if(I.preview===!0)return D({ok:!0,preview:!0,affectedBindings:J});return D({ok:!0,...et.revokeDeployKey(q.id,P.actor?.id)})}if(W.pathname==="/api/sources/repositories/sync"&&M.method==="POST"){let I=await se(M),P=et.getConnection(String(I.connectionId??""));if(!P||P.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);try{return D({ok:!0,repositories:await Fi(et,String(I.connectionId??""),{search:typeof I.search==="string"?I.search:void 0})})}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Repositories could not be synchronized."},422)}}if(W.pathname==="/api/sources/references"&&M.method==="GET"){let I=et.getConnection(String(W.searchParams.get("connectionId")??""));if(!I||I.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);try{return D(await Ui(et,{connectionId:String(W.searchParams.get("connectionId")??""),repository:String(W.searchParams.get("repository")??""),repositoryId:W.searchParams.get("repositoryId")??void 0,deployKeyId:W.searchParams.get("deployKeyId")??void 0,type:W.searchParams.get("type")==="tags"?"tags":"branches",cursor:W.searchParams.get("cursor")??void 0}))}catch(P){return D({ok:!1,error:P instanceof Error?P.message:"References could not be listed."},422)}}if(W.pathname==="/api/sources/bindings"&&M.method==="POST"){let I=await se(M),P=Ve(be),q=re(S,String(Ce)),V=et.getConnection(String(I.connectionId??""));if(!V||V.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);try{return D({ok:!0,binding:et.createBinding({projectId:S.project.id,environmentId:q.environmentId,resourceId:typeof I.resourceId==="string"?I.resourceId:void 0,connectionId:String(I.connectionId??""),repositoryId:typeof I.repositoryId==="string"?I.repositoryId:void 0,repositoryFullName:String(I.repositoryFullName??""),defaultBranch:String(I.defaultBranch??"main"),branchRule:typeof I.branchRule==="string"?I.branchRule:void 0,tagRule:typeof I.tagRule==="string"?I.tagRule:void 0,monorepoRoot:String(I.monorepoRoot??"."),includePaths:Array.isArray(I.includePaths)?I.includePaths.map(String):[],excludePaths:Array.isArray(I.excludePaths)?I.excludePaths.map(String):[],submodules:I.submodules===!0,cloneDepth:I.cloneDepth?Number(I.cloneDepth):void 0,deployKeyId:typeof I.deployKeyId==="string"&&I.deployKeyId?I.deployKeyId:void 0,autoDeploy:I.autoDeploy!==!1,pullRequestPreviews:I.pullRequestPreviews!==!1,actorId:P.actor?.id})},201)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"Source binding could not be created."},422)}}if(W.pathname==="/api/sources/bindings"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=et.getBinding(String(I.id??""));if(!q||q.projectId!==S.project.id)return D({ok:!1,error:"Source binding was not found."},404);try{return D({ok:!0,binding:et.updateBinding(q.id,Number(I.version),{defaultBranch:I.defaultBranch,branchRule:I.branchRule,tagRule:I.tagRule,monorepoRoot:I.monorepoRoot,includePaths:I.includePaths,excludePaths:I.excludePaths,submodules:I.submodules,cloneDepth:I.cloneDepth,deployKeyId:I.deployKeyId,autoDeploy:I.autoDeploy,pullRequestPreviews:I.pullRequestPreviews,status:I.status,disabledReason:I.disabledReason,actorId:P.actor?.id})})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Source binding could not be updated."},409)}}if(W.pathname==="/api/sources/webhooks"&&M.method==="POST"){let I=await se(M),P=et.getConnection(String(I.connectionId??""));if(!P||P.organizationId!==S.organization.id)return D({ok:!1,error:"Source connection was not found."},404);try{let q=et.createWebhook({connectionId:String(I.connectionId??""),repositoryId:typeof I.repositoryId==="string"?I.repositoryId:void 0,repositoryFullName:String(I.repositoryFullName??""),events:Array.isArray(I.events)?I.events.map(String):void 0,secret:typeof I.secret==="string"?I.secret:void 0}),V=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||pt,J=V?Xt(V,q.webhook):void 0,Z=I.reconcile!==!1&&V?await Jr(et,q.webhook.id,V):q.webhook;return D({ok:!0,webhook:Z,endpoint:J,endpointRevealOnce:!0},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Source webhook could not be created."},422)}}if(W.pathname==="/api/sources/webhooks"&&M.method==="PATCH"){let I=await se(M),P=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||pt,q=et.getWebhook(String(I.id??"")),V=q?et.getConnection(q.connectionId):void 0;if(!q||!V||V.organizationId!==S.organization.id)return D({ok:!1,error:"Source webhook was not found."},404);if(!P)return D({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return D({ok:!0,webhook:await Jr(et,String(I.id??""),P)})}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"Source webhook could not be reconciled."},422)}}if(W.pathname==="/api/sources/webhooks"&&M.method==="DELETE"){let I=await se(M),P=et.getWebhook(String(I.id??"")),q=P?et.getConnection(P.connectionId):void 0;if(!P||!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Source webhook was not found."},404);try{return D({ok:!0,webhook:await Il(et,String(I.id??""))})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Source webhook could not be removed."},422)}}if(W.pathname==="/api/security/posture"&&M.method==="GET"){let I=re(S,String(Ce)),P=ut.listFindings({...I,limit:500});return D({scope:I,summary:ut.summary(I.organizationId,I.projectId,I.environmentId),findings:P,scans:ut.listScanRuns({...I,limit:100}),policies:ut.listPolicies(I.organizationId).filter((q)=>!q.environmentId||q.environmentId===I.environmentId),waivers:P.flatMap((q)=>ut.listWaivers(q.id)),decisions:ut.listDecisions(I.environmentId,50),actors:S.store.listMemberships(S.organization.id).map((q)=>S.store.getActor(q.actorId)).filter(Boolean)})}if(W.pathname==="/api/security/export"&&M.method==="GET")return D(ut.exportPosture(S.organization.id));if(W.pathname==="/api/security/scan"&&M.method==="POST"){let I=re(S,String(Ce)),P=await new At(ut).run(new Zr,{...I,artifactRoot:t}),q=Hi(ut,I,dr??{});return D({ok:!0,source:P,host:q,summary:ut.summary(I.organizationId,I.projectId,I.environmentId)})}if(W.pathname==="/api/security/review"&&M.method==="POST")try{let I=re(S,String(Ce));return D({ok:!0,...Gi(ut,{scope:I,desiredConfigHash:S.project.desiredConfigHash})})}catch(I){return D({ok:!1,error:I instanceof Error?I.message:"Security change review failed."},409)}if(W.pathname==="/api/security/policies"&&M.method==="POST"){let I=await se(M),P=Ve(be);if(!P.actor)return D({ok:!1,error:"An organization actor is required."},403);try{let q=ut.createPolicy({organizationId:S.organization.id,environmentId:I.environmentId===null?void 0:String(I.environmentId??re(S,String(Ce)).environmentId),name:String(I.name??""),scannerFailMode:I.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(I.requiredScanners)?I.requiredScanners.map(String):[],rules:Array.isArray(I.rules)?I.rules.map((V)=>({minimumSeverity:String(V.minimumSeverity),action:String(V.action),scannerId:V.scannerId?String(V.scannerId):void 0})):[],actorId:P.actor.id});return D({ok:!0,policy:q},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Security policy could not be created."},422)}}if(W.pathname==="/api/security/policies"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=ut.getPolicy(String(I.id??""));if(!P.actor||!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Security policy was not found."},404);try{return D({ok:!0,policy:ut.updatePolicy(q.id,Number(I.version),{name:typeof I.name==="string"?I.name:void 0,scannerFailMode:I.scannerFailMode==="open"||I.scannerFailMode==="closed"?I.scannerFailMode:void 0,requiredScanners:Array.isArray(I.requiredScanners)?I.requiredScanners.map(String):void 0,rules:Array.isArray(I.rules)?I.rules.map((V)=>({minimumSeverity:String(V.minimumSeverity),action:String(V.action),scannerId:V.scannerId?String(V.scannerId):void 0})):void 0,enabled:typeof I.enabled==="boolean"?I.enabled:void 0,actorId:P.actor.id})})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Security policy could not be updated."},409)}}if(W.pathname==="/api/security/waivers"&&M.method==="POST"){let I=await se(M),P=Ve(be);if(!P.actor)return D({ok:!1,error:"An organization actor is required."},403);try{return D({ok:!0,waiver:ut.createWaiver({findingId:String(I.findingId??""),policyId:typeof I.policyId==="string"?I.policyId:void 0,reason:String(I.reason??""),referenceUrl:typeof I.referenceUrl==="string"?I.referenceUrl:void 0,expiresAt:String(I.expiresAt??""),actorId:P.actor.id})},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Security waiver could not be created."},422)}}if(W.pathname==="/api/security/waivers"&&M.method==="DELETE"){let I=await se(M),P=Ve(be);if(!P.actor)return D({ok:!1,error:"An organization actor is required."},403);try{return D({ok:!0,waiver:ut.revokeWaiver(String(I.id??""),P.actor.id)})}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Security waiver could not be revoked."},404)}}if(W.pathname==="/api/security/findings"&&M.method==="PATCH"){let I=await se(M),P=Ve(be),q=ut.getFinding(String(I.id??""));if(!P.actor||!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Security finding was not found."},404);try{let V=I.action==="acknowledge"?ut.acknowledgeFinding(q.id,P.actor.id):ut.assignFinding(q.id,typeof I.ownerActorId==="string"&&I.ownerActorId?I.ownerActorId:void 0,P.actor.id);return D({ok:!0,finding:V})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Security finding could not be updated."},422)}}if(W.pathname==="/api/security/comments"&&M.method==="POST"){let I=await se(M),P=Ve(be);if(!P.actor)return D({ok:!1,error:"An organization actor is required."},403);try{return D({ok:!0,comment:ut.addComment({findingId:String(I.findingId??""),actorId:P.actor.id,body:String(I.body??""),referenceUrl:typeof I.referenceUrl==="string"?I.referenceUrl:void 0})},201)}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Comment could not be saved."},422)}}if(W.pathname==="/api/auth/sessions"&&M.method==="GET"){let I=ur.resolveSession(M);return D({currentSessionId:I?.id,sessions:I?$e.listSessions(I.identityId,{includeInactive:!0}):[]})}if(W.pathname==="/api/auth/sessions"&&M.method==="DELETE"){let I=await se(M),P=ur.resolveSession(M);if(!P)return D({ok:!1,error:"Sign in again to manage sessions."},401);let q=String(I.id??""),V=$e.revokeSession(P.identityId,q),J=q===P.id&&V?{"set-cookie":ju({secure:Bi})}:void 0;return D({ok:V,signedOut:q===P.id&&V},V?200:404,J)}if(W.pathname==="/api/auth/sessions/revoke-others"&&M.method==="POST"){let I=ur.resolveSession(M);if(!I)return D({ok:!1,error:"Sign in again to manage sessions."},401);return D({ok:!0,revoked:$e.revokeOtherSessions(I.identityId,I.id)})}if(W.pathname==="/api/auth/password/change"&&M.method==="POST"){let I=await se(M),P=String(I.currentPassword??""),q=String(I.password??""),V=Ve(be),J=V.actor?$e.getIdentityByActor(V.actor.id):void 0;if(!J||!Yn(P,J.passwordHash))return D({ok:!1,error:"Current password is incorrect."},401);if(q.length<12)return D({ok:!1,error:"New password must be at least 12 characters."},422);if(Yn(q,J.passwordHash))return D({ok:!1,error:"Choose a different password."},409);let Z=Io(q),G=$e.updatePassword(J.id,Z);Lu(t,G.username,Z);let te=xc(G.id,M,ct.requestIP(M)?.address??"unknown");return S.store.appendEvent({organizationId:S.organization.id,actorId:G.actorId,type:"auth.password.changed"}),D({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":Va(te.token,{secure:Bi,maxAgeMs:Ke})})}if(W.pathname==="/api/auth/mfa/enroll"&&M.method==="POST"){let I=await se(M),P=ur.resolveSession(M),q=Ve(be),V=q.actor?$e.getIdentityByActor(q.actor.id):void 0;if(!P||!V)return D({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Yn(String(I.password??""),V.passwordHash))return D({ok:!1,error:"Current password is incorrect."},401);try{let J=$e.beginTotpEnrollment(V.id,{issuer:S.organization.name});return S.store.appendEvent({organizationId:S.organization.id,actorId:V.actorId,type:"auth.mfa.enrollment.started"}),D({factor:J.factor,secret:J.secret,uri:J.uri})}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"MFA enrollment failed."},409)}}if(W.pathname==="/api/auth/mfa/verify"&&M.method==="POST"){let I=await se(M),P=ur.resolveSession(M),q=Ve(be),V=q.actor?$e.getIdentityByActor(q.actor.id):void 0;if(!P||!V)return D({ok:!1,error:"Sign in again before enabling MFA."},401);try{let J=$e.verifyTotpEnrollment(V.id,String(I.code??""));return $e.markSessionStepUp(P.id,!0),S.store.appendEvent({organizationId:S.organization.id,actorId:V.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:J.recoveryCodes.length}}),D(J)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"MFA enrollment failed."},422)}}if(W.pathname==="/api/auth/mfa"&&M.method==="DELETE"){let I=await se(M),P=ur.resolveSession(M),q=Ve(be),V=q.actor?$e.getIdentityByActor(q.actor.id):void 0;if(!P||!V||!Yn(String(I.password??""),V.passwordHash))return D({ok:!1,error:"Current password is incorrect."},401);let J=$e.verifyMfaCode(V.id,String(I.code??""));if(!J.valid||!J.method)return D({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return $e.disableMfa(V.id),$e.revokeOtherSessions(V.id,P.id),$e.markSessionStepUp(P.id),S.store.appendEvent({organizationId:S.organization.id,actorId:V.actorId,type:"auth.mfa.disabled",payload:{method:J.method}}),D({ok:!0})}if(W.pathname==="/api/auth/step-up"&&M.method==="POST"){let I=await se(M),P=ur.resolveSession(M),q=Ve(be),V=q.actor?$e.getIdentityByActor(q.actor.id):void 0;if(!P||!V||!Yn(String(I.password??""),V.passwordHash))return D({ok:!1,error:"Current password is incorrect."},401);let J=$e.getMfaFactor(V.id);if(J?.state==="active"){if(!$e.verifyMfaCode(V.id,String(I.code??"")).valid)return D({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let Z=$e.markSessionStepUp(P.id,J?.state==="active");return S.store.appendEvent({organizationId:S.organization.id,actorId:V.actorId,type:"auth.step_up.succeeded",payload:{mfa:J?.state==="active"}}),D({ok:!0,recentAuthAt:Z.recentAuthAt})}if(W.pathname==="/api/terminal"){if(!ye)return D({ok:!1,error:"The web terminal is disabled."},403);if(ct.upgrade(M))return;return Ku("WebSocket upgrade failed",400)}if(W.pathname==="/api/health"){let I=S.store.health();return D({ok:!0,cwd:t,environment:Ce,environments:A,uiRoot:await or(be,Ce),liveData:ae.size>0,terminal:ye,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:I.schemaVersion,supportedSchemaVersion:I.supportedSchemaVersion,integrity:I.integrity,pendingRetryableOperations:I.pendingRetryableOperations}})}if(W.pathname==="/api/control-plane/operations"){let I=W.searchParams.get("state"),P=I&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(I)?I:void 0;return D({operations:S.store.listOperations({projectId:S.project.id,state:P,kind:W.searchParams.get("kind")??void 0,limit:Number(W.searchParams.get("limit"))||100})})}if(W.pathname==="/api/queue"&&M.method==="GET"){let I=W.searchParams.get("state"),P=I&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(I)?I:void 0,q=Kt.list({projectId:S.project.id,state:P,limit:Number(W.searchParams.get("limit"))||250}).filter((V)=>Cs(be,V.operation.id,"deployments:read")).map((V)=>{let J=V.operation.resourceId?S.store.getResource(V.operation.resourceId):void 0,Z=V.operation.environmentId?S.store.listEnvironments(S.project.id).find((Ie)=>Ie.id===V.operation.environmentId):void 0,G=V.operation.actorId?S.store.getActor(V.operation.actorId):void 0,te=V.operation.input;return{...V,target:J?{id:J.id,name:J.name,slug:J.slug,kind:J.kind}:Z?{id:Z.id,name:Z.name,slug:Z.slug,kind:"environment"}:{id:S.project.id,name:S.project.name,slug:S.project.slug,kind:"project"},actor:G?{id:G.id,name:G.displayName,kind:G.kind}:void 0,commit:te.revision??te.source?.commitSha??null}});return D({operations:q,concurrency:Kt.limits})}if(W.pathname==="/api/queue/logs"&&M.method==="GET"){let I=String(W.searchParams.get("id")??"");if(!Cs(be,I,"deployments:read"))return D({ok:!1,error:"Operation was not found in this scope."},404);let P=Kt.logs(I,{after:Number(W.searchParams.get("after"))||0,limit:Number(W.searchParams.get("limit"))||500});return D({entries:P,cursor:P.at(-1)?.sequence??(Number(W.searchParams.get("after"))||0),operation:S.store.getOperation(I)})}if(W.pathname==="/api/queue/stream"&&M.method==="GET"){let I=String(W.searchParams.get("id")??"");if(!Cs(be,I,"deployments:read"))return D({ok:!1,error:"Operation was not found in this scope."},404);let P=M.headers.get("last-event-id")?.trim(),q=Number(P||W.searchParams.get("after")||0),V=new TextEncoder,J,Z=!1,G=new ReadableStream({start(te){let Ie=()=>{if(Z)return;let Se=ur.resolveUser(M);if(!Se||!Cs(Se,I,"deployments:read")){if(Z=!0,J)clearInterval(J);te.close();return}let it=Kt.logs(I,{after:q,limit:500});for(let Qe of it)q=Qe.sequence,te.enqueue(V.encode(`id: ${Qe.sequence}
-event: log
-data: ${JSON.stringify(Qe)}
-
-`));let _e=S.store.getOperation(I);if(_e&&["succeeded","failed","cancelled","timed_out"].includes(_e.state)&&Kt.logs(I,{after:q,limit:1}).length===0){if(Z=!0,J)clearInterval(J);te.enqueue(V.encode(`event: complete
-data: ${JSON.stringify({state:_e.state,cursor:q})}
-
-`)),te.close()}};if(Ie(),!Z)J=setInterval(Ie,500);M.signal.addEventListener("abort",()=>{if(Z=!0,J)clearInterval(J);try{te.close()}catch{}},{once:!0})},cancel(){if(Z=!0,J)clearInterval(J)}});return new Response(G,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(W.pathname==="/api/queue/cancel"&&M.method==="POST"){let I=await se(M),P=String(I.id??"");if(!Cs(be,P,"deployments:cancel"))return D({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let q=C(S.store,be);try{return D({ok:!0,operation:Kt.requestCancellation(P,q.id)})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Cancellation failed."},409)}}if(W.pathname==="/api/queue/retry"&&M.method==="POST"){let I=await se(M),P=String(I.id??"");if(!Cs(be,P,"deployments:create"))return D({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let q=C(S.store,be);try{return D({ok:!0,operation:Kt.retry(P,String(I.errorClass??"manual"),{delayMs:Number(I.delayMs)||0,actorId:q.id})})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Retry failed."},409)}}if(W.pathname==="/api/queue/settings"&&M.method==="GET")return D({concurrency:Kt.limits});if(W.pathname==="/api/queue/settings"&&M.method==="PATCH"){let I=await se(M);if(I.confirm!=="update queue limits")return D({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let P=C(S.store,be);return D({ok:!0,concurrency:Kt.configureConcurrency(I.concurrency??{},{organizationId:S.organization.id,actorId:P.id})})}if(W.pathname==="/api/queue/history"&&M.method==="DELETE"){let I=await se(M);if(I.confirm!=="clear completed")return D({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let P=C(S.store,be);return D({ok:!0,deleted:Kt.clearCompleted({projectId:S.project.id,before:typeof I.before==="string"?I.before:void 0,actorId:P.id})})}if(W.pathname==="/api/previews"&&M.method==="GET"){let I=vr.previews.listInstances({projectId:S.project.id}).filter((V)=>Or(be,V.resourceId,"deployments:read")),P=vr.previews.listDefinitions(S.project.id).filter((V)=>Or(be,V.resourceId,"project:read")),q=S.store.listResources(S.project.id).filter((V)=>V.kind==="application"&&Or(be,V.id,"project:read")).map((V)=>({id:V.id,slug:V.slug,name:V.name,environmentId:V.environmentId}));return D({previews:I,definitions:P,resources:q,environments:[...S.environments.values()]})}if(W.pathname==="/api/releases"&&M.method==="GET"){let I=[...S.environments.values()],P=S.store.listResources(S.project.id).filter((J)=>Or(be,J.id,"deployments:read")),q=new Set(P.map((J)=>J.id)),V=On.releases.list({projectId:S.project.id}).filter((J)=>q.has(J.resourceId)).map((J)=>{let Z=P.find((Ie)=>Ie.id===J.resourceId),G=I.find((Ie)=>Ie.id===J.environmentId),te=J.previousReleaseId?On.releases.get(J.previousReleaseId):void 0;return{...J,resource:Z?{id:Z.id,name:Z.name,slug:Z.slug,provider:Z.provider}:void 0,environment:G?{id:G.id,name:G.name,slug:G.slug,kind:G.kind}:void 0,artifact:On.releases.getArtifact(J.artifactId),transitions:On.releases.transitions(J.id),approvals:On.releases.approvals(J.id),previous:te,comparison:te?On.releases.compare(te.id,J.id):void 0,capabilities:Wr({kind:J.kind,provider:Z?.provider,hasHealthGate:!!J.healthGate,replicas:Number(J.manifest?.replicas)||1})}});return D({releases:V,resources:P.map((J)=>({id:J.id,name:J.name,slug:J.slug,environmentId:J.environmentId,provider:J.provider})),environments:I})}if(W.pathname==="/api/releases/action"&&M.method==="POST"){let I=await se(M),P=On.releases.get(String(I.id??"")),q=String(I.action??"");if(!P||!Or(be,P.resourceId,"deployments:create"))return D({ok:!1,error:"Release was not found in this scope."},404);let V=C(S.store,be);try{if(q==="activate")return D({ok:!0,operation:On.enqueueActivation(P,{actorId:V.id})});if(q==="rollback"){let J=S.store.getResource(P.resourceId);if(I.confirm!==J?.slug)return D({ok:!1,error:`Type "${J?.slug??""}" to confirm rollback.`},409);return D({ok:!0,operation:On.enqueueRollback(P,{actorId:V.id,targetReleaseId:typeof I.targetReleaseId==="string"?I.targetReleaseId:void 0})})}if(q==="approve"){let J=S.store.listEnvironments(P.projectId).find((Z)=>Z.id===P.environmentId);if(I.confirm!==J?.slug)return D({ok:!1,error:`Type "${J?.slug??""}" to confirm the environment gate.`},409);return D({ok:!0,release:On.releases.approve(P.id,{actorId:V.id,decision:I.decision==="rejected"?"rejected":"approved",comment:typeof I.comment==="string"?I.comment:void 0})})}if(q==="pin")return D({ok:!0,release:On.releases.pin(P.id,I.pinned!==!1,typeof I.reason==="string"?I.reason:void 0)});if(q==="promote"){let J=S.store.getResource(String(I.targetResourceId??"")),Z=J?S.store.listEnvironments(P.projectId).find((G)=>G.id===J.environmentId):void 0;if(!J||!Z||!Or(be,J.id,"deployments:create"))return D({ok:!1,error:"Promotion target was not found in this scope."},404);if(I.confirm!==Z.slug)return D({ok:!1,error:`Type "${Z.slug}" to confirm promotion.`},409);return D({ok:!0,release:On.releases.promote(P.id,{targetEnvironmentId:Z.id,targetResourceId:J.id,config:I.config&&typeof I.config==="object"?I.config:{},strategy:typeof I.strategy==="string"?I.strategy:void 0,actorId:V.id,approvalRequired:I.approvalRequired===!0})})}return D({ok:!1,error:"Unsupported release action."},422)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"Release action failed."},409)}}if(W.pathname==="/api/compose"&&M.method==="GET"){let I=Ni.applications.list({projectId:S.project.id}).filter((P)=>Or(be,P.resourceId,"applications:read")).map((P)=>({...P,services:Ni.applications.services(P.id)}));return D({applications:I,templates:Pr(),environments:[...S.environments.values()]})}if(W.pathname==="/api/compose/preview"&&M.method==="POST"){let I=await se(M),P=String(I.environmentId??"");if(!Ya(be,P,"applications:manage"))return D({ok:!1,error:"Environment was not found in this scope."},404);try{return D({ok:!0,result:Ni.applications.preview(String(I.source??""),{name:String(I.name??""),slug:typeof I.slug==="string"?I.slug:void 0,projectId:S.project.id,environmentId:P})})}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Compose could not be parsed."},422)}}if((W.pathname==="/api/compose/import"||W.pathname==="/api/compose/template")&&M.method==="POST"){let I=await se(M),P=String(I.environmentId??"");if(!Ya(be,P,"applications:manage"))return D({ok:!1,error:"Environment was not found in this scope."},404);let q=C(S.store,be);try{let V=W.pathname.endsWith("/template")?Ni.applications.fromTemplate(String(I.templateId??""),I.inputs&&typeof I.inputs==="object"?I.inputs:{},{name:String(I.name??""),projectId:S.project.id,environmentId:P,version:typeof I.templateVersion==="string"?I.templateVersion:void 0,createdByActorId:q.id}):Ni.applications.import(String(I.source??""),{name:String(I.name??""),slug:typeof I.slug==="string"?I.slug:void 0,projectId:S.project.id,environmentId:P,createdByActorId:q.id});return D({ok:!0,application:V.application,diagnostics:V.parsed.diagnostics})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Compose application could not be saved."},422)}}if(W.pathname==="/api/compose/action"&&M.method==="POST"){let I=await se(M),P=Ni.applications.get(String(I.id??"")),q=String(I.action??""),V=q==="delete"||q==="stop"?"deployments:cancel":"deployments:create";if(!P||!Or(be,P.resourceId,V))return D({ok:!1,error:"Compose application was not found in this scope."},404);try{let J=C(S.store,be);return D({ok:!0,operation:Ni.enqueue(P,q,{actorId:J.id,service:typeof I.service==="string"?I.service:void 0,replicas:Number.isFinite(Number(I.replicas))?Number(I.replicas):void 0,removeVolumes:I.removeVolumes===!0,confirmation:typeof I.confirm==="string"?I.confirm:void 0})})}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"Compose operation could not be queued."},409)}}if((W.pathname==="/api/compose/logs"||W.pathname==="/api/compose/shell")&&M.method==="POST"){let I=await se(M),P=Ni.applications.get(String(I.id??"")),q=W.pathname.endsWith("/shell"),V=q?"runtime:terminal":"runtime:logs";if(!P||!Or(be,P.resourceId,V))return D({ok:!1,error:"Compose service was not found in this scope."},404);let J=String(I.service??"");if(!P.manifest.spec.services[J])return D({ok:!1,error:"Compose service was not found."},404);if(q&&I.confirm!==J)return D({ok:!1,error:`Type "${J}" to run a service command.`},409);let Z=S.store.listEnvironments(P.projectId).find((te)=>te.id===P.environmentId)?.slug;if(!Z)return D({ok:!1,error:"Compose environment was not found."},404);let G=q?Hc(P.manifest,J,Array.isArray(I.command)?I.command.map(String):["sh"]):Qc(P.manifest,J,Number(I.lines)||200);return D(await wc(f,Z,G))}if(W.pathname==="/api/previews/definitions"&&M.method==="POST"){let I=await se(M),P=String(I.resourceId??"");if(!Or(be,P,"config:write"))return D({ok:!1,error:"Application was not found in this scope."},404);let q=C(S.store,be);try{return D({ok:!0,definition:vr.previews.createDefinition({...I,projectId:S.project.id,resourceId:P,baseEnvironmentId:String(I.baseEnvironmentId??""),domainPattern:String(I.domainPattern??""),createdByActorId:q.id})})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Preview policy could not be created."},409)}}if(W.pathname==="/api/previews/deploy"&&M.method==="POST"){let I=await se(M),P=vr.previews.getDefinition(String(I.definitionId??""));if(!P||!Or(be,P.resourceId,"deployments:create"))return D({ok:!1,error:"Preview policy was not found in this scope."},404);let q=C(S.store,be);try{let V=vr.previews.upsert({definitionId:P.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(I.branch??""),pullRequestNumber:Number(I.pullRequestNumber)||void 0,commitSha:String(I.commitSha??""),createdByActorId:q.id});return D({ok:!0,preview:V.preview,operation:vr.enqueueDeploy(V.preview,{created:V.created,actorId:q.id})})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Preview could not be queued."},409)}}if(W.pathname==="/api/previews/destroy"&&M.method==="POST"){let I=await se(M),P=vr.previews.getInstance(String(I.id??""));if(!P||!Or(be,P.resourceId,"deployments:cancel"))return D({ok:!1,error:"Preview was not found in this scope."},404);if(I.confirm!==P.name)return D({ok:!1,error:`Type "${P.name}" to confirm tagged teardown.`},409);let q=C(S.store,be);return D({ok:!0,operation:vr.enqueueDestroy(P,"dashboard",q.id)})}if(W.pathname==="/api/previews/extend"&&M.method==="POST"){let I=await se(M),P=vr.previews.getInstance(String(I.id??""));if(!P||!Or(be,P.resourceId,"deployments:create"))return D({ok:!1,error:"Preview was not found in this scope."},404);return D({ok:!0,preview:vr.previews.extend(P.id,Number(I.hours))})}if(W.pathname==="/api/previews/rebuild"&&M.method==="POST"){let I=await se(M),P=vr.previews.getInstance(String(I.id??""));if(!P||!Or(be,P.resourceId,"deployments:create"))return D({ok:!1,error:"Preview was not found in this scope."},404);let q=C(S.store,be);return D({ok:!0,operation:vr.enqueueDeploy(P,{actorId:q.id,reason:"manual_rebuild"})})}if(W.pathname==="/api/previews/cleanup"&&M.method==="POST"){let I=await se(M);if(!I.dryRun&&I.confirm!=="cleanup previews")return D({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let P=C(S.store,be);return D({ok:!0,...vr.cleanup({dryRun:I.dryRun===!0,maxAgeHours:Number(I.maxAgeHours)||void 0,keepCount:Number(I.keepCount)||void 0,actorId:P.id})})}if(W.pathname==="/api/control-plane/events")return D({events:S.store.listEvents({organizationId:S.organization.id,projectId:S.project.id,operationId:W.searchParams.get("operationId")??void 0,correlationId:W.searchParams.get("correlationId")??void 0,afterSequence:Number(W.searchParams.get("afterSequence"))||void 0,limit:Number(W.searchParams.get("limit"))||200})});if(W.pathname==="/api/search"){let I=String(W.searchParams.get("q")??"").trim().slice(0,128),P=Nn.role==="member"?new Set(Object.keys(Nn.sites)):void 0,q=I?$s(S.store,{projectId:S.project.id,query:I,allowedResourceSlugs:P,limit:Number(W.searchParams.get("limit"))||20}):[];return D({query:I,results:q,stale:!1})}if(W.pathname==="/api/search/preferences"&&M.method==="GET"){let I=`dashboard:${be.username.toLowerCase()}`;return D({savedFilters:S.store.listSavedFilters(I),navigation:S.store.listNavigation(I)})}if(W.pathname==="/api/search/preferences"&&M.method==="POST"){let I=`dashboard:${be.username.toLowerCase()}`,P=await se(M),q=String(P.action??"");if(q==="save-filter")return D({savedFilter:S.store.saveFilter(I,String(P.name??""),String(P.routeId??""),P.query??{})});if(q==="favorite")return D({navigation:S.store.setFavorite(I,String(P.entityType??""),String(P.entityId??""),P.favorite!==!1)});if(q==="visit")return D({navigation:S.store.recordNavigation(I,String(P.entityType??""),String(P.entityId??""))});return D({ok:!1,error:"Unknown search preference action."},422)}if(W.pathname==="/api/search/preferences"&&M.method==="DELETE"){let I=`dashboard:${be.username.toLowerCase()}`,P=await se(M);return D({ok:S.store.deleteSavedFilter(I,String(P.id??""))})}if(W.pathname==="/api/organization"&&M.method==="GET"){let I=S.store.listMemberships(S.organization.id,{includeRevoked:!0}).map((P)=>{let q=S.store.getActor(P.actorId);return{...P,actor:q?{id:q.id,displayName:q.displayName,externalId:q.externalId,disabledAt:q.disabledAt}:void 0,grants:S.store.listGrants(P.id)}});return D({organization:S.organization,project:S.project,environments:S.store.listEnvironments(S.project.id),resources:S.store.listResources(S.project.id).map((P)=>({id:P.id,environmentId:P.environmentId,kind:P.kind,slug:P.slug,name:P.name})),memberships:I,invitations:S.store.listInvitations(S.organization.id)})}if(W.pathname==="/api/organization/invitations"&&M.method==="GET")return D({invitations:S.store.listInvitations(S.organization.id)});if(W.pathname==="/api/organization/invitations"&&M.method==="POST"){let I=await se(M),P=Vu(I.roleTemplate),q=Rc(I);if(!P||!q)return D({ok:!1,error:"Choose a valid role template and resource scope."},422);let V=Ve(be);if(!V.actor||!V.membership)return D({ok:!1,error:"Your organization membership is unavailable."},403);if(P==="owner"&&(!Yn(String(I.password??""),be.passwordHash)||V.membership.roleTemplate!=="owner"))return D({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let J=S.store.createInvitation({organizationId:S.organization.id,email:String(I.email??""),roleTemplate:P,scope:q,invitedByActorId:V.actor.id,expiresInMs:Number(I.expiresInMs)||void 0}),Z=`${W.origin}/accept-invitation?token=${encodeURIComponent(J.token)}`,G=await Kr(f,{to:J.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${Z}
-
-This link expires ${J.invitation.expiresAt} and can be used once.`});return D({invitation:J.invitation,token:J.token,acceptUrl:Z,delivered:G},201)}catch(J){return D({ok:!1,error:J instanceof Error?J.message:"Invitation could not be created."},422)}}if(W.pathname==="/api/organization/invitations"&&M.method==="DELETE"){let I=await se(M),P=Ve(be);try{return D({invitation:S.store.revokeInvitation(String(I.id??""),P.actor?.id)})}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Invitation could not be revoked."},409)}}if(W.pathname==="/api/organization/invitations/resend"&&M.method==="POST"){let I=await se(M),P=Ve(be);try{let q=S.store.reissueInvitation(String(I.id??""),P.actor?.id),V=`${W.origin}/accept-invitation?token=${encodeURIComponent(q.token)}`,J=await Kr(f,{to:q.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${V}
-
-This replacement link expires ${q.invitation.expiresAt} and can be used once.`});return D({invitation:q.invitation,token:q.token,acceptUrl:V,delivered:J})}catch(q){return D({ok:!1,error:q instanceof Error?q.message:"Invitation could not be resent."},409)}}if(W.pathname==="/api/organization/memberships"&&M.method==="PATCH"){let I=await se(M),P=S.store.getMembership(String(I.id??"")),q=Vu(I.roleTemplate),V=Rc(I);if(!P||P.organizationId!==S.organization.id)return D({ok:!1,error:"Membership was not found."},404);if(!q||!V)return D({ok:!1,error:"Choose a valid role template and resource scope."},422);let J=Ve(be);if((P.roleTemplate==="owner"||q==="owner")&&(!Yn(String(I.password??""),be.passwordHash)||J.membership?.roleTemplate!=="owner"))return D({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let G=S.store.resolveAuthorizationTarget(S.organization.id,V)??S.store.resolveAuthorizationTarget(S.organization.id,{type:"project",id:S.project.id}),te=S.store.listGrants(P.id),Ie=Lt({membership:P,grants:te,target:G}),Se={...P,roleTemplate:q,scope:V},it=Lt({membership:Se,grants:te,target:G}),_e={gained:it.filter((Qe)=>!Ie.includes(Qe)),lost:Ie.filter((Qe)=>!it.includes(Qe))};if(I.preview===!0)return D({membership:P,proposed:{roleTemplate:q,scope:V},accessDiff:_e});if(String(I.confirm??"")!==P.id)return D({ok:!1,error:`Confirm this change with membership ID ${P.id}.`,accessDiff:_e},409);try{return D({membership:S.store.updateMembership({id:P.id,roleTemplate:q,scope:V,actorId:J.actor?.id}),accessDiff:_e})}catch(Qe){return D({ok:!1,error:Qe instanceof Error?Qe.message:"Membership could not be updated."},409)}}if(W.pathname==="/api/organization/memberships"&&M.method==="DELETE"){let I=await se(M),P=S.store.getMembership(String(I.id??""));if(!P||P.organizationId!==S.organization.id)return D({ok:!1,error:"Membership was not found."},404);if(String(I.confirm??"")!==P.id)return D({ok:!1,error:`Confirm removal with membership ID ${P.id}.`},409);let q=Ve(be);if(P.roleTemplate==="owner"&&(q.membership?.roleTemplate!=="owner"||!Yn(String(I.password??""),be.passwordHash)))return D({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return D({membership:S.store.revokeMembership(P.id,q.actor?.id)})}catch(V){return D({ok:!1,error:V instanceof Error?V.message:"Membership could not be removed."},409)}}if(W.pathname==="/api/organization/grants"&&M.method==="POST"){let I=await se(M),P=String(I.capability??""),q=I.effect==="deny"?"deny":I.effect==="allow"?"allow":void 0,V=Rc(I),J=Ve(be);if(!q||!V||!le.includes(P))return D({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return D({grant:S.store.upsertGrant({organizationId:S.organization.id,membershipId:String(I.membershipId??""),effect:q,capability:P,scope:V,actorId:J.actor?.id})},201)}catch(Z){return D({ok:!1,error:Z instanceof Error?Z.message:"Grant could not be created."},422)}}if(W.pathname==="/api/organization/grants"&&M.method==="DELETE"){let I=await se(M),P=Ve(be),q=S.store.getGrant(String(I.id??""));if(!q||q.organizationId!==S.organization.id)return D({ok:!1,error:"Grant was not found."},404);return D({ok:S.store.removeGrant(q.id,P.actor?.id)})}if(W.pathname==="/api/tags"&&M.method==="GET")return D({tags:S.store.listTags(S.project.id),assignments:S.store.listResourceTags(S.project.id)});if(W.pathname==="/api/tags"&&M.method==="POST"){let I=await se(M),P=S.store.upsertTag(S.project.id,String(I.name??""),String(I.color??"#5a8be0"));if(I.resourceId)S.store.assignTag(String(I.resourceId),P.id);return D({tag:P},201)}if(W.pathname==="/api/tags"&&M.method==="DELETE"){let I=await se(M);return S.store.removeTag(String(I.resourceId??""),String(I.tagId??"")),D({ok:!0})}if(W.pathname==="/"&&!iw(W.pathname,Nn))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(Ce)}`}});if(W.pathname==="/"&&dr?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(Ce)}`}});let Oc=nu(W.pathname);if(Oc)return new Response(null,{status:308,headers:{location:`${Oc}?env=${encodeURIComponent(Ce)}`}});if(W.pathname==="/api/env"&&M.method==="POST"){let I=await se(M),P=String(I.env??"");if(!A.includes(P))return D({ok:!1,error:`Unknown environment '${P}'.`,environments:A},404);return D({ok:!0,environment:P,environments:A,href:`?env=${encodeURIComponent(P)}`})}if(W.pathname==="/api/config"){let I={...Zi(f),environment:Ce,environments:A};return D(vS(I,Nn))}if(W.pathname==="/api/ssh-keys"&&M.method==="GET")return D({configPath:F,keys:Eo(Ga(f))});if(W.pathname==="/api/ssh-keys"&&M.method==="POST"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=await oi(F,"utf8"),q=Ga(f),V=kb({configText:P,name:String(I.name??""),publicKey:String(I.publicKey??""),existingKeys:q});return await Is(F,V),ew(f,[...q,{name:String(I.name??"").trim(),publicKey:String(I.publicKey??"").trim().replace(/\s+/g," ")}]),D({ok:!0,configPath:F,keys:Eo(Ga(f))})}if(W.pathname==="/api/ssh-keys"&&M.method==="DELETE"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=String(I.name??W.searchParams.get("name")??""),q=await oi(F,"utf8"),V=Ga(f),J=Ib({configText:q,name:P,existingKeys:V});return await Is(F,J),ew(f,V.filter((Z)=>Z.name!==P.trim())),D({ok:!0,configPath:F,keys:Eo(Ga(f))})}if(W.pathname==="/api/firewall"&&M.method==="GET")return D({configPath:F,alwaysOpen:[22,80,443],ports:jg(f)});if(W.pathname==="/api/firewall"&&M.method==="POST"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=Number(I.port);if(!Ic(P))return D({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let q=jg(f),V=await oi(F,"utf8");try{await Is(F,AS(V,P,q))}catch(G){return D({ok:!1,error:G?.message??String(G)},422)}let J=ks([...q,P]);tw(f,J);let Z=I.apply===!1?null:await wc(f,Ce,`ufw allow ${P}/tcp`).catch((G)=>({ok:!1,error:String(G?.message??G)}));return D({ok:!0,configPath:F,ports:J,apply:Z})}if(W.pathname==="/api/firewall"&&M.method==="DELETE"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=Number(I.port??W.searchParams.get("port"));if(!Ic(P))return D({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let q=jg(f),V=await oi(F,"utf8");await Is(F,CS(V,P,q));let J=ks(q.filter((G)=>G!==P));tw(f,J);let Z=I.apply===!1?null:await wc(f,Ce,`ufw delete allow ${P}/tcp`).catch((G)=>({ok:!1,error:String(G?.message??G)}));return D({ok:!0,configPath:F,ports:J,apply:Z})}if(W.pathname==="/api/sites"&&M.method==="POST"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=String(I.name??"").trim(),q=String(I.root??"").trim();if(!P||!q)return D({ok:!1,error:"Site name and root are required."},422);let V={deploy:I.deploy==="bucket"?"bucket":"server",root:q,path:String(I.path??"").trim()||void 0,domain:String(I.domain??"").trim()||void 0,build:String(I.build??"").trim()||void 0,start:String(I.start??"").trim()||void 0,port:I.port?Number(I.port):void 0,type:String(I.type??"").trim()||void 0};if(V.port!==void 0&&(!Number.isInteger(V.port)||V.port<1||V.port>65535))return D({ok:!1,error:"Port must be a number between 1 and 65535."},422);let J=await oi(F,"utf8"),Z=sn({configText:J,name:P,root:V.root,domain:V.domain,path:V.path,deploy:V.deploy,build:V.build,start:V.start,port:V.port,type:V.type});return await Is(F,Z),eT(f,P,Object.fromEntries(Object.entries(V).filter(([,G])=>G!==void 0))),dr=await Es(f,Ce),H.set(Ce,dr),D({ok:!0,configPath:F,site:P,data:dr})}if(W.pathname==="/api/sites"&&M.method==="DELETE"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=String(I.name??W.searchParams.get("name")??"").trim();if(!P||!f.sites?.[P])return D({ok:!1,error:`Site '${P}' was not found.`},404);let q=await oi(F,"utf8");return await Is(F,on({configText:q,name:P})),delete f.sites[P],dr=await Es(f,Ce),H.set(Ce,dr),D({ok:!0,configPath:F,site:P,data:dr})}if(W.pathname==="/api/sites"&&M.method==="PATCH"){if(!F)return D({ok:!1,error:"No cloud config file was found in this checkout."},404);let I=await se(M),P=String(I.name??"").trim(),q=f.sites?.[P];if(!P||!q)return D({ok:!1,error:`Site '${P}' was not found.`},404);if(Nn.role==="member"){let Z=kS(I);if(!Z.ok)return D({ok:!1,error:Z.error},403);let G=IS({siteName:P,body:I,sites:f.sites??{},ownSites:Object.keys(Nn.sites)});if(!G.ok)return D({ok:!1,error:G.error},409)}if(I.port!==void 0&&I.port!==null&&I.port!==""&&(!Number.isInteger(Number(I.port))||Number(I.port)<1||Number(I.port)>65535))return D({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof I.domain==="string"&&I.domain.trim()&&!Aa(I.domain.trim()))return D({ok:!1,error:`Domain '${I.domain.trim()}' is not a valid hostname.`},422);let V=await oi(F,"utf8"),J=(Z,G)=>{V=Ki({configText:V,siteName:P,key:Z,valueText:G})};if(I.ssl!==void 0)J("ssl",Wl(I.ssl)),q.ssl=I.ssl;if(I.env!==void 0&&I.env&&typeof I.env==="object")J("env",Xl(I.env)),q.env=I.env;if(I.aliases!==void 0&&Array.isArray(I.aliases)){let Z=I.aliases.map((G)=>String(G));J("aliases",Yl(Z)),q.aliases=Z.map((G)=>G.trim().toLowerCase()).filter(Boolean)}if(I.redirects!==void 0&&I.redirects&&typeof I.redirects==="object")J("redirects",Zl(I.redirects)),q.redirects=I.redirects;for(let Z of["domain","path","build","start","type","root","php"])if(typeof I[Z]==="string"&&I[Z].trim())J(Z,Jl(String(I[Z]).trim())),q[Z]=String(I[Z]).trim();if(I.port!==void 0&&I.port!==null&&I.port!=="")J("port",String(Number(I.port))),q.port=Number(I.port);return await Is(F,V),dr=await Es(f,Ce),H.set(Ce,dr),D({ok:!0,configPath:F,site:P,data:dr})}if(W.pathname==="/api/sites/deploy"&&M.method==="POST"){let I=await se(M),P=String(I.name??"").trim();if(!P||!f.sites?.[P])return D({ok:!1,error:`Site '${P}' was not found.`},404);if(I.confirm!==P)return D({ok:!1,error:`Type "${P}" to deploy this site.`},409);let q=re(S,String(Ce));await new At(ut).run(new Zr,{...q,artifactRoot:t}),Hi(ut,q,dr??{});let V=Gi(ut,{scope:q,desiredConfigHash:S.project.desiredConfigHash});if(V.decision.outcome==="block")return D({ok:!1,error:`Deployment blocked by security policy: ${V.decision.explanation}`,securityReview:V},409);let J={id:`deploy:${P}`,label:`Deploy ${P}`,description:`Deploy the ${P} site for ${Ce}.`,command:["deploy","--env",Ce,"--site",P,"--yes"],mutates:!0},Z=await ke({controlPlane:S,environment:Ce,actor:be,kind:"dashboard.site.deploy",resourceSlug:P,input:{site:P},execute:()=>Mg(J,{cwd:t,cliEntry:m})});return D({...Z.result,controlPlaneOperation:Z.operation,securityReview:V})}if(W.pathname==="/api/actions")return D(un(Ce));if(W.pathname==="/api/server/operations")return D(Fu(f,dr));if(W.pathname==="/api/runtime/workloads"&&M.method==="GET"){let I=await ne(f,Ce);return D(I)}if(W.pathname==="/api/runtime/logs"&&M.method==="GET"){let I=String(W.searchParams.get("workload")??"");if(!I)return D({ok:!1,error:"A workload query parameter is required."},422);let P=Math.min(1000,Math.max(1,Number(W.searchParams.get("limit"))||200));try{return D(await new me(f,Ce).logs(I,{limit:P}))}catch(q){return D({ok:!1,error:String(q?.message??q)},404)}}if(W.pathname==="/api/runtime/log-sessions"&&M.method==="POST"){let I=await se(M),P=String(I.workloadId??"");if(!P)return D({ok:!1,error:"A workloadId is required."},422);let q=await ne(f,Ce),V=q.workloads.find((G)=>G.id===P);if(!V)return D({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!V.capabilities.logs.supported)return D({ok:!1,error:V.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let J=new me(f,Ce,{inventory:async()=>q}),Z=Ir.create("logs",P);return(async()=>{let G=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(I.sinceMs)||60000)));try{for(let te=0;te<200&&!Ir.signal(Z.id)?.aborted;te++){let Ie=await J.logs(P,{limit:Math.min(500,Math.max(1,Number(I.limit)||200)),since:G});for(let Se of Ie.lines)if(Ir.append(Z.id,`${Se.timestamp?`${Se.timestamp} `:""}${Se.message}
-`),Se.timestamp)G=new Date(Math.max(G.getTime(),new Date(Se.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Ir.signal(Z.id)?.aborted)Ir.close(Z.id,"complete")}catch(te){Ir.append(Z.id,te instanceof Error?te.message:String(te),"stderr"),Ir.close(Z.id,"failed",te instanceof Error?te.message:String(te))}})(),D({ok:!0,session:Z,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(Z.id)}&workload=${encodeURIComponent(P)}`},201)}if((W.pathname==="/api/runtime/log-stream"||W.pathname==="/api/runtime/exec-stream")&&M.method==="GET"){let I=String(W.searchParams.get("id")??""),P=String(W.searchParams.get("workload")??""),q=Number(M.headers.get("last-event-id")??W.searchParams.get("after")??0)||0,V=Ir.read(I,P,q),J=W.pathname.includes("exec")?"exec":"logs";if(!V||V.kind!==J)return D({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return W_(Ir,V,q,M.signal)}if((W.pathname==="/api/runtime/log-sessions"||W.pathname==="/api/runtime/exec-sessions")&&M.method==="DELETE"){let I=await se(M),P=Ir.cancel(String(I.id??""),String(I.workloadId??""));if(!P)return D({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return D({ok:!0,session:P})}if(W.pathname==="/api/runtime/exec-sessions"&&M.method==="POST"){let I=await se(M),P=String(I.workloadId??""),q=await ne(f,Ce),V=q.workloads.find((te)=>te.id===P);if(!V)return D({ok:!1,error:"Workload was not found in the current project and environment."},404);let J=ur.resolveSession(M),Z=new me(f,Ce,{inventory:async()=>q}),G=Ir.create("exec",P);return ke({controlPlane:S,environment:Ce,actor:be,kind:"runtime.exec",resourceSlug:V.links.service,input:{workloadId:P,provider:V.provider,preset:I.preset?String(I.preset):null,freeForm:!!String(I.command??"").trim()},execute:()=>Z.exec({workloadId:P,preset:["process","sockets","filesystem"].includes(String(I.preset))?String(I.preset):void 0,command:typeof I.command==="string"?I.command:void 0,confirm:String(I.confirm??""),recentAuth:!De||!!J&&$e.isRecentlyAuthenticated(J)})}).then(({result:te,operation:Ie})=>{if(Ir.append(G.id,`operation ${Ie.id}
-`,"system"),te.stdout)Ir.append(G.id,te.stdout,"stdout");if(te.stderr)Ir.append(G.id,te.stderr,"stderr");Ir.close(G.id,te.ok?"complete":"failed",te.error)}).catch((te)=>{let Ie=te instanceof Error?te.message:String(te);Ir.append(G.id,Ie,"stderr"),Ir.close(G.id,"failed",Ie)}),D({ok:!0,session:G,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(G.id)}&workload=${encodeURIComponent(P)}`},202)}if(W.pathname==="/api/runtime/files/read"&&M.method==="POST"){let I=await se(M),P=await ne(f,Ce),q=ur.resolveSession(M),V=await new me(f,Ce,{inventory:async()=>P}).readFile({workloadId:String(I.workloadId??""),path:String(I.path??""),confirm:String(I.confirm??""),recentAuth:!De||!!q&&$e.isRecentlyAuthenticated(q)});return D(V,V.ok?200:409)}if(W.pathname==="/api/runtime/files/write"&&M.method==="POST"){let I=await se(M),P=await ne(f,Ce),q=String(I.workloadId??""),V=P.workloads.find((te)=>te.id===q);if(!V)return D({ok:!1,error:"Workload was not found in the current project and environment."},404);let J=ur.resolveSession(M),Z=new me(f,Ce,{inventory:async()=>P}),G=await ke({controlPlane:S,environment:Ce,actor:be,kind:"runtime.file.write",resourceSlug:V.links.service,input:{workloadId:q,provider:V.provider,path:String(I.path??""),bytes:Buffer.from(String(I.contentBase64??""),"base64").byteLength},execute:()=>Z.writeFile({workloadId:q,path:String(I.path??""),contentBase64:String(I.contentBase64??""),confirm:String(I.confirm??""),recentAuth:!De||!!J&&$e.isRecentlyAuthenticated(J)})});return D({...G.result,controlPlaneOperation:G.operation},G.result.ok?200:409)}if(W.pathname==="/api/runtime/operations"&&M.method==="POST"){let I=await se(M),P=String(I.workloadId??""),q=String(I.action??"");if(!P||!["start","stop","restart","redeploy","scale","inspect"].includes(q))return D({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let V=await ne(f,Ce),J=V.workloads.find((Ie)=>Ie.id===P);if(!J)return D({ok:!1,error:"Workload was not found in the current project and environment."},404);let Z=ur.resolveSession(M),G=new me(f,Ce,{inventory:async()=>V}),te=await ke({controlPlane:S,environment:Ce,actor:be,kind:`runtime.${q}`,resourceSlug:J.links.service,input:{workloadId:P,provider:J.provider,action:q,replicas:I.replicas==null?null:Number(I.replicas)},execute:()=>G.run({workloadId:P,action:q,replicas:I.replicas==null?void 0:Number(I.replicas),confirm:String(I.confirm??""),recentAuth:!De||!!Z&&$e.isRecentlyAuthenticated(Z)})});return D({...te.result,controlPlaneOperation:te.operation},te.result.ok?200:409)}if(W.pathname.startsWith("/api/protection")){let I=be.role==="admin"||Dc(be,"security:read"),P=be.role==="admin"||Dc(be,"security:manage");if(!I)return D({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:q,describePosture:V}=await import("./protection/index.js"),J=new q(S.store),Z=()=>{if(!P)throw Error("Changing protection controls requires security:manage.")};if(W.pathname==="/api/protection"&&M.method==="GET"){let G=J.current();return D({ok:!0,posture:V(G),controls:G,raw:J.raw()})}if(W.pathname==="/api/protection/attack-mode"&&M.method==="POST"){Z();let G=await se(M);if(G.enabled===!1)return D({ok:!0,disabled:J.disableAttackMode()});return D({ok:!0,control:J.enableAttackMode({hours:G.hours==null?void 0:Number(G.hours),reason:String(G.reason??"Enabled from the dashboard."),actorId:Ve(be).actor?.id})})}if(W.pathname==="/api/protection/pause"&&M.method==="POST"){Z();let G=await se(M);if(G.enabled===!1)return D({ok:!0,resumed:J.resumeMitigations()});return D({ok:!0,control:J.pauseMitigations({hours:G.hours==null?void 0:Number(G.hours),reason:String(G.reason??""),actorId:Ve(be).actor?.id})})}if(W.pathname==="/api/protection/ip-rules"&&M.method==="GET")return D({ok:!0,ipRules:J.current().ipRules});if(W.pathname==="/api/protection/ip-rules"&&(M.method==="POST"||M.method==="DELETE")){Z();let G=await se(M),te=G.list==="allow"?"allow":"block",Ie=M.method==="POST"?J.addIpRule(te,String(G.cidr??"")):J.removeIpRule(te,String(G.cidr??""));return D({ok:!0,ipRules:Ie})}return D({ok:!1,error:"Protection endpoint was not found."},404)}if(W.pathname.startsWith("/api/spend/")||W.pathname==="/api/usage"){let I=await gw(),{store:P,service:q,gate:V}=I,J=be.role==="admin"||Dc(be,"billing:read"),Z=be.role==="admin"||Dc(be,"billing:manage");if(!J)return D({ok:!1,error:"Spend data requires the billing:read capability."},403);let G=S.environments.get(Ce),te={organizationId:S.organization.id,projectId:S.project.id,environmentId:G?.id},Ie=()=>{if(!Z)throw Error("Changing a budget requires the billing:manage capability.")};if(W.pathname==="/api/usage"&&M.method==="GET")return D({ok:!0,...q.usageReport({organizationId:te.organizationId,projectId:te.projectId,period:W.searchParams.get("period")??"monthly",timezone:W.searchParams.get("timezone")??void 0})});if(W.pathname==="/api/spend/budgets"&&M.method==="GET")return D({ok:!0,budgets:P.listBudgets({organizationId:te.organizationId,projectId:te.projectId}).map((Se)=>({...Se,status:q.status(Se)}))});if(W.pathname==="/api/spend/budgets"&&M.method==="POST"){Ie();let Se=await se(M),it=String(Se.scope??"project"),_e=P.createBudget({organizationId:te.organizationId,projectId:it==="organization"?void 0:te.projectId,environmentId:it==="environment"?te.environmentId:void 0,name:String(Se.name??"").trim(),period:Se.period??"monthly",timezone:Se.timezone?String(Se.timezone):void 0,softLimitCents:Se.softLimitCents==null?void 0:Math.round(Number(Se.softLimitCents)),hardLimitCents:Se.hardLimitCents==null?void 0:Math.round(Number(Se.hardLimitCents)),graceSeconds:Se.graceSeconds==null?void 0:Number(Se.graceSeconds),dryRun:Se.dryRun!==!1});return D({ok:!0,budget:_e})}if(W.pathname==="/api/spend/budgets"&&M.method==="PATCH"){Ie();let Se=await se(M),it=String(Se.id??""),_e=P.getBudget(it);if(!_e||_e.organizationId!==te.organizationId)return D({ok:!1,error:"Budget was not found."},404);return D({ok:!0,budget:P.updateBudget(it,{softLimitCents:Se.softLimitCents==null?_e.softLimitCents:Math.round(Number(Se.softLimitCents)),hardLimitCents:Se.hardLimitCents==null?_e.hardLimitCents:Math.round(Number(Se.hardLimitCents)),enabled:Se.enabled==null?_e.enabled:Se.enabled===!0,dryRun:Se.dryRun==null?_e.dryRun:Se.dryRun===!0},Se.expectedVersion==null?void 0:Number(Se.expectedVersion))})}if(W.pathname==="/api/spend/budgets"&&M.method==="DELETE"){Ie();let Se=await se(M),it=String(Se.id??""),_e=P.getBudget(it);if(!_e||_e.organizationId!==te.organizationId)return D({ok:!1,error:"Budget was not found."},404);let Qe=V.closeBudget(it);return P.deleteBudget(it),D({ok:!0,deleted:!0,lifted:Qe})}if(W.pathname==="/api/spend/check"&&M.method==="POST"){Ie();let Se=await se(M),{SpendRunner:it}=await import("./spend/index.js"),_e=new it({controlPlane:S.store,store:P,alerts:at});if(Se.apply!==!0){let Te=P.budgetsForScope(te.organizationId,te.projectId,te.environmentId);return D({ok:!0,applied:!1,preview:Te.map((Ue)=>q.status(Ue))})}let Qe=await _e.run({...te,environmentKind:G?.kind});return D({ok:!0,applied:!0,result:Qe})}if(W.pathname==="/api/spend/enforcement"&&M.method==="GET")return D({ok:!0,enforcement:V.listUnder({organizationId:te.organizationId})});if(W.pathname==="/api/spend/release"&&M.method==="POST"){Ie();let Se=await se(M),it=V.close(String(Se.budgetId??""),Se.action);return D({ok:it,released:it,note:it?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(W.pathname==="/api/spend/anomalies"&&M.method==="GET")return D({ok:!0,anomalies:P.listAnomalies({organizationId:te.organizationId,projectId:te.projectId,unacknowledgedOnly:W.searchParams.get("unacknowledged")==="true"})});if(W.pathname==="/api/spend/anomalies/acknowledge"&&M.method==="POST"){Ie();let Se=await se(M);return D({ok:!0,acknowledged:P.acknowledgeAnomaly(String(Se.id??""))})}return D({ok:!1,error:"Spend endpoint was not found."},404)}if(W.pathname.startsWith("/api/health/")||W.pathname.startsWith("/api/alerts")||W.pathname.startsWith("/api/notifications/")){let I=S.environments.get(Ce),P=S.store.listResources(S.project.id,I?.id),q=be.role==="admin"||!!I&&Ya(be,I.id,"runtime:read")?P:P.filter((G)=>Or(be,G.id,"runtime:read")),V=(G)=>!G||q.some((te)=>te.id===G),J=(G)=>{if(!G)return;let te=P.find((Ie)=>Ie.id===G||Ie.slug===G);if(!te)throw Error("Alert resource was not found.");if(!V(te.id))throw Error("Alert resource is outside your authorized scope.");return te.id},Z=Ve(be).actor;if(W.pathname==="/api/health/checks"&&M.method==="GET")return D({ok:!0,checks:at.listHealthChecks(S.project.id,I?.id).filter((G)=>V(G.resourceId)).map((G)=>({...G,results:at.listHealthResults(G.id,20)}))});if(W.pathname==="/api/health/checks"&&M.method==="POST"){let G=await se(M),te=String(G.kind??"http");if(te==="command"&&be.role!=="admin")return D({ok:!1,error:"Command health checks require an administrator."},403);let Ie={method:String(G.config?.method??"GET").toUpperCase().slice(0,10),path:G.config?.path?String(G.config.path).slice(0,500):void 0,port:G.config?.port==null?void 0:Number(G.config.port),command:Array.isArray(G.config?.command)?G.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(G.config?.expectedStatuses)?G.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:G.config?.expectedBody?String(G.config.expectedBody).slice(0,500):void 0};return D({ok:!0,check:at.createHealthCheck({projectId:S.project.id,environmentId:I?.id,resourceId:J(G.resourceId??G.resource),name:String(G.name??""),kind:te,target:String(G.target??""),config:Ie,intervalSeconds:Number(G.intervalSeconds)||60,timeoutSeconds:Number(G.timeoutSeconds)||10,failureThreshold:Number(G.failureThreshold)||3,recoveryThreshold:Number(G.recoveryThreshold)||2,regions:Array.isArray(G.regions)?G.regions.map(String):["local"],enabled:G.enabled!==!1})},201)}if(W.pathname==="/api/health/checks"&&M.method==="PATCH"){let G=await se(M),te=at.getHealthCheck(String(G.id??""));if(!te||!V(te.resourceId))return D({ok:!1,error:"Health check was not found."},404);return D({ok:!0,check:at.setHealthCheckEnabled(te.id,G.enabled!==!1)})}if(W.pathname==="/api/health/checks/test"&&M.method==="POST"){let G=await se(M),te=at.getHealthCheck(String(G.id??""));if(!te||!V(te.resourceId))return D({ok:!1,error:"Health check was not found."},404);return D({ok:!0,productionIncidentCreated:!1,result:await new Ge(at).probe(te)})}if(W.pathname==="/api/health/checks/run"&&M.method==="POST"){let G=await se(M),te=at.getHealthCheck(String(G.id??""));if(!te||!V(te.resourceId))return D({ok:!1,error:"Health check was not found."},404);let Ie=await new Ge(at).runAndEvaluate(te),Se=[];for(let it of Ie.evaluations.filter((_e)=>_e.notify&&_e.alert)){let _e=$n.enqueue(S.organization.id,it.alert,it.transition);Se.push(...await $n.deliverAll(_e))}return D({ok:!0,...Ie,deliveries:Se})}if(W.pathname==="/api/alerts/rules"&&M.method==="GET")return D({ok:!0,rules:at.listRules(S.project.id,I?.id).filter((G)=>V(G.resourceId))});if(W.pathname==="/api/alerts/rules"&&M.method==="POST"){let G=await se(M),te=G.healthCheckId?at.getHealthCheck(String(G.healthCheckId)):void 0;if(G.healthCheckId&&(!te||!V(te.resourceId)))return D({ok:!1,error:"Health check was not found."},404);return D({ok:!0,rule:at.createRule({projectId:S.project.id,environmentId:I?.id,resourceId:J(G.resourceId??G.resource)??te?.resourceId,healthCheckId:te?.id,name:String(G.name??""),signal:String(G.signal??(te?"health":"")),operator:String(G.operator??(te?"unhealthy":"gt")),threshold:G.threshold==null?void 0:Number(G.threshold),recoveryThreshold:G.recoveryThreshold==null?void 0:Number(G.recoveryThreshold),windowMs:Number(G.windowMs)||300000,consecutive:Number(G.consecutive)||te?.failureThreshold||3,recoveryConsecutive:Number(G.recoveryConsecutive)||te?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(G.noDataPolicy))?G.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(G.severity))?G.severity:"warning",groupBy:Array.isArray(G.groupBy)?G.groupBy.map(String):[],labels:G.labels&&typeof G.labels==="object"?G.labels:{},enabled:G.enabled!==!1})},201)}if(W.pathname==="/api/alerts/rules"&&M.method==="PATCH"){let G=await se(M),te=at.getRule(String(G.id??""));if(!te||!V(te.resourceId))return D({ok:!1,error:"Alert rule was not found."},404);return D({ok:!0,rule:at.setRuleEnabled(te.id,G.enabled!==!1)})}if(W.pathname==="/api/alerts/evaluate"&&M.method==="POST")return D({ok:!0,...await Hg(I?.id)});if(W.pathname==="/api/alerts"&&M.method==="GET")return D({ok:!0,alerts:at.listAlerts(S.project.id,{environmentId:I?.id,states:W.searchParams.getAll("state").length?W.searchParams.getAll("state"):void 0,limit:Number(W.searchParams.get("limit"))||200}).filter((G)=>V(G.resourceId)).map((G)=>({...G,deliveries:at.listDeliveries({alertId:G.id,limit:50})}))});if(W.pathname==="/api/alerts/action"&&M.method==="POST"){let G=await se(M),te=at.getAlert(String(G.id??""));if(!te||!V(te.resourceId))return D({ok:!1,error:"Alert was not found."},404);let Ie=String(G.action??"");if(Ie==="acknowledge")return D({ok:!0,alert:at.acknowledge(te.id,Z?.id??"")});if(Ie==="assign")return D({ok:!0,alert:at.assign(te.id,G.ownerActorId==="me"?Z?.id:G.ownerActorId?String(G.ownerActorId):void 0,Z?.id)});if(Ie==="silence"){if(be.role!=="admin")return D({ok:!1,error:"Silencing production alerts requires an administrator."},403);let Se=ur.resolveSession(M);if(De&&(!Se||!$e.isRecentlyAuthenticated(Se)))return D({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return D({ok:!0,alert:at.silenceAlert(te.id,String(G.until??""),Z?.id)})}return D({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(W.pathname==="/api/alerts/silences"&&M.method==="POST"){let G=await se(M);return D({ok:!0,id:at.createSilence({projectId:S.project.id,environmentId:I?.id,resourceId:J(G.resourceId??G.resource),matcher:G.matcher,reason:String(G.reason??""),startsAt:String(G.startsAt??new Date().toISOString()),endsAt:String(G.endsAt??""),timezone:String(G.timezone??"UTC"),actorId:Z?.id})},201)}if(W.pathname==="/api/notifications/channels"&&M.method==="GET")return D({ok:!0,channels:at.listChannels(S.organization.id)});if(W.pathname==="/api/notifications/channels"&&M.method==="POST"){let G=await se(M),te=String(G.kind??""),Ie=te==="email"?{to:G.config?.to,from:G.config?.from}:te==="telegram"?{chatId:String(G.config?.chatId??"")}:{};return D({ok:!0,channel:at.createChannel({organizationId:S.organization.id,name:String(G.name??""),kind:te,config:Ie,credential:G.credential?String(G.credential):void 0,actorId:Z?.id})},201)}if(W.pathname==="/api/notifications/channels"&&M.method==="PATCH"){let G=await se(M),te=String(G.id??"");if(G.credential)return D({ok:!0,channel:at.rotateChannel(te,String(G.credential))});let Ie=String(G.status??"paused");if(!["active","paused","disabled"].includes(Ie))return D({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return D({ok:!0,channel:at.setChannelStatus(te,Ie)})}if(W.pathname==="/api/notifications/channels/test"&&M.method==="POST"){let G=await se(M);return D({ok:!0,productionIncidentCreated:!1,result:await $n.testChannel(String(G.id??""))})}if(W.pathname==="/api/notifications/routes"&&M.method==="GET")return D({ok:!0,routes:at.listRoutes(S.organization.id)});if(W.pathname==="/api/notifications/routes"&&M.method==="POST"){let G=await se(M),te=Array.isArray(G.channelIds)?G.channelIds.map(String):[];if(te.some((Ie)=>at.getChannel(Ie)?.organizationId!==S.organization.id))return D({ok:!1,error:"Route contains an unavailable channel."},422);return D({ok:!0,route:at.createRoute({organizationId:S.organization.id,name:String(G.name??""),priority:Number(G.priority)||0,matcher:G.matcher&&typeof G.matcher==="object"?G.matcher:{},channelIds:te,quietHours:G.quietHours,groupWaitSeconds:Number(G.groupWaitSeconds)||30,reminderSeconds:G.reminderSeconds==null?void 0:Number(G.reminderSeconds),escalation:Array.isArray(G.escalation)?G.escalation:[],template:G.template?String(G.template):void 0,rateLimitPerMinute:Number(G.rateLimitPerMinute)||60,enabled:G.enabled!==!1})},201)}if(W.pathname==="/api/notifications/routes"&&M.method==="PATCH"){let G=await se(M),te=at.getRoute(String(G.id??""));if(!te||te.organizationId!==S.organization.id)return D({ok:!1,error:"Notification route was not found."},404);return D({ok:!0,route:at.setRouteEnabled(te.id,G.enabled!==!1)})}if(W.pathname==="/api/notifications/routes/preview"&&M.method==="POST"){let G=await se(M),Ie=(G.alertId?at.getAlert(String(G.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:S.project.id,environmentId:I?.id,resourceId:J(G.resourceId??G.resource),dedupKey:"preview",groupKey:String(G.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(G.severity))?G.severity:"warning",title:String(G.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return D({ok:!0,productionIncidentCreated:!1,matches:$n.preview(S.organization.id,Ie,String(G.eventType??"firing")).map((Se)=>({route:Se.route,channels:Se.channels,quiet:Se.quiet}))})}if(W.pathname==="/api/notifications/deliveries"&&M.method==="GET")return D({ok:!0,deliveries:at.listDeliveries({alertId:W.searchParams.get("alertId")??void 0,states:W.searchParams.getAll("state"),limit:Number(W.searchParams.get("limit"))||200})});if(W.pathname==="/api/notifications/deliveries/retry"&&M.method==="POST"){let G=await se(M),te=at.getDelivery(String(G.id??""));if(!te)return D({ok:!1,error:"Delivery was not found."},404);return at.updateDelivery(te.id,{state:"retrying",attempt:Math.max(0,te.attempt-1),nextAttemptAt:new Date().toISOString()}),D({ok:!0,delivery:await $n.deliver(te.id)})}}if(W.pathname.startsWith("/api/jobs")||W.pathname.startsWith("/api/workers")){let I=S.environments.get(Ce),P=S.store.listResources(S.project.id,I?.id),V=be.role==="admin"||!!I&&Ya(be,I.id,"automation:read")?P:P.filter((Te)=>Or(be,Te.id,"automation:read")),J=(Te)=>!Te||V.some((Ue)=>Ue.id===Te),Z=Ve(be).actor,G=H.get(Ce)??U,te=Fu(f,G),Ie=te.filter((Te)=>!Te.danger&&["scheduler","backup","worker"].includes(Te.group)),Se=L(f),it=()=>{let Te=ur.resolveSession(M);return!De||!!Te&&$e.isRecentlyAuthenticated(Te)},_e=(Te)=>{if(!Te||typeof Te!=="object"||Array.isArray(Te))return{};let Ue=Object.entries(Te).slice(0,50);if(Ue.some(([,dt])=>typeof dt!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(dt)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ue)},Qe=(Te,Ue,dt)=>S.store.appendEvent({organizationId:S.organization.id,projectId:S.project.id,resourceId:dt,actorId:Z?.id,type:`job.${Te}`,payload:Ue});if(W.pathname==="/api/jobs/preview"&&M.method==="POST"){let Te=await se(M);try{return D({ok:!0,productionExecutionCreated:!1,preview:Ct(String(Te.expression??""),String(Te.timezone??"UTC"),new Date(Te.from?String(Te.from):Date.now()),Number(Te.count)||5)})}catch(Ue){return D({ok:!1,error:Ue instanceof Error?Ue.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(W.pathname==="/api/jobs"&&M.method==="GET")return D({ok:!0,jobs:Dr.list(S.project.id,{environmentId:I?.id}).filter((Te)=>J(Te.resourceId)).map((Te)=>({...Te,preview:Ct(Te.normalizedExpression,Te.timezone,new Date,5),capability:en(Te),lastExecution:Dr.listExecutions(Te.id,1)[0]}))});if(W.pathname==="/api/jobs"&&M.method==="POST"){let Te=await se(M),Ue=String(Te.provider??(Se==="serverless"?"eventbridge":"server")),dt=Se==="serverless"?"eventbridge":"server";if(Ue!==dt)return D({ok:!1,error:`${Se} environments accept ${dt} schedules through this adapter.`},422);let vt=Te.operationId?String(Te.operationId):void 0;if(Ue==="server"&&(!vt||!Ie.some((Er)=>Er.id===vt)))return D({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Mt=en({provider:Ue,expression:String(Te.expression??""),flexibleMinutes:Number(Te.flexibleMinutes)||0,missedRunPolicy:Te.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Te.overlapPolicy))?Te.overlapPolicy:"forbid"});if(!Mt.supported)return D({ok:!1,error:Mt.notes.join(" ")},422);let _n=Te.resourceId?P.find((Er)=>Er.id===Te.resourceId||Er.slug===Te.resourceId):void 0;if(Te.resourceId&&(!_n||!J(_n.id)))return D({ok:!1,error:"Job resource was not found."},404);try{let Er=Ue==="server"?{kind:"dashboard_operation",operationId:vt}:{kind:"serverless_scheduler",action:"run"},eo=Dr.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:I?.id,resourceId:_n?.id,name:String(Te.name??""),provider:Ue,expression:String(Te.expression??""),timezone:String(Te.timezone??"UTC"),startsAt:Te.startsAt?String(Te.startsAt):void 0,endsAt:Te.endsAt?String(Te.endsAt):void 0,flexibleMinutes:Number(Te.flexibleMinutes)||0,target:Er,payloadRefs:_e(Te.payloadRefs),missedRunPolicy:Te.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Te.overlapPolicy))?Te.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Te.maxAttempts)||3,backoffSeconds:Number(Te.backoffSeconds)||30,deadLetterRef:Te.deadLetterRef?String(Te.deadLetterRef):void 0},timeoutSeconds:Number(Te.timeoutSeconds)||900,enabled:Te.enabled!==!1,origin:"managed",ownerActorId:Z?.id,observedState:{},reconciliationStatus:"pending"});return Qe("created",{jobId:eo.id,provider:eo.provider,expression:eo.normalizedExpression},eo.resourceId),D({ok:!0,job:eo,capability:Mt},201)}catch(Er){return D({ok:!1,error:Er instanceof Error?Er.message:"Scheduled job could not be created."},422)}}if(W.pathname==="/api/jobs"&&M.method==="PATCH"){let Te=await se(M),Ue=Dr.get(String(Te.id??""));if(!Ue||!J(Ue.resourceId))return D({ok:!1,error:"Scheduled job was not found."},404);if(Ue.origin==="config")return D({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let dt=Te.missedRunPolicy==null?void 0:String(Te.missedRunPolicy),vt=Te.overlapPolicy==null?void 0:String(Te.overlapPolicy);if(dt&&!["skip","catch_up"].includes(dt))return D({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(vt&&!["allow","forbid","replace"].includes(vt))return D({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Mt=Dr.updateSchedule(Ue.id,{expression:Te.expression?String(Te.expression):void 0,timezone:Te.timezone?String(Te.timezone):void 0,missedRunPolicy:dt,overlapPolicy:vt,timeoutSeconds:Te.timeoutSeconds==null?void 0:Number(Te.timeoutSeconds)});return Qe("updated",{jobId:Mt.id,expression:Mt.normalizedExpression,version:Mt.version},Mt.resourceId),D({ok:!0,job:Mt})}catch(Mt){return D({ok:!1,error:Mt instanceof Error?Mt.message:"Scheduled job could not be updated."},422)}}if(W.pathname==="/api/jobs/action"&&M.method==="POST"){let Te=await se(M),Ue=Dr.get(String(Te.id??""));if(!Ue||!J(Ue.resourceId))return D({ok:!1,error:"Scheduled job was not found."},404);let dt=String(Te.action??"");if(dt==="run"){let vt=Wg.enqueue(Ue,{trigger:"manual",actorId:Z?.id});return Qe("run_queued",{jobId:Ue.id,executionId:vt.id},Ue.resourceId),D({ok:!0,execution:vt},202)}if(["disable","delete"].includes(dt)&&I?.kind==="production"){if(String(Te.confirm??"")!==dt)return D({ok:!1,error:`Type "${dt}" to confirm this production change.`},409);if(!it())return D({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(dt==="enable"||dt==="disable"){let vt=Dr.setEnabled(Ue.id,dt==="enable");return Qe(dt==="enable"?"enabled":"disabled",{jobId:Ue.id},Ue.resourceId),D({ok:!0,job:vt})}if(dt==="delete")try{return Dr.remove(Ue.id),Qe("deleted",{jobId:Ue.id,name:Ue.name},Ue.resourceId),D({ok:!0,deleted:Ue.id})}catch(vt){return D({ok:!1,error:vt instanceof Error?vt.message:"Scheduled job could not be deleted."},409)}return D({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(W.pathname==="/api/jobs/history"&&M.method==="GET"){let Te=Dr.get(String(W.searchParams.get("jobId")??""));if(!Te||!J(Te.resourceId))return D({ok:!1,error:"Scheduled job was not found."},404);return D({ok:!0,executions:Dr.listExecutions(Te.id,Number(W.searchParams.get("limit"))||100).map((Ue)=>({...Ue,logs:Ue.operationId?Kt.logs(Ue.operationId,{limit:500}):[]}))})}if(W.pathname==="/api/jobs/reconcile"&&M.method==="POST"){if(!I)return D({ok:!1,error:"Environment was not found."},404);let Te=Wo(Dr,f,{organization:S.organization,project:S.project,environment:I,resources:P});return Qe("reconciled",Te),D({ok:!0,reconciliation:Te})}if(W.pathname==="/api/workers"&&M.method==="GET"){let Te=Array.isArray(G.workersDetail??G.workers)?G.workersDetail??G.workers:[];return D({ok:!0,workers:Dr.listWorkers(S.project.id,I?.id).filter((Ue)=>J(Ue.resourceId)).map((Ue)=>{let dt=Te.find((vt)=>vt.name===Ue.name||vt.site===Ue.target.site);return dt?{...Ue,observedState:{...Ue.observedState,status:dt.status??"configured",currentJob:dt.currentJob??null,failures:Number(dt.failed??dt.failures)||0,processed:Number(dt.processed)||0}}:Ue})})}if(W.pathname==="/api/workers/action"&&M.method==="POST"){let Te=await se(M),Ue=Dr.getWorker(String(Te.id??""));if(!Ue||!J(Ue.resourceId))return D({ok:!1,error:"Worker was not found."},404);let dt=String(Te.action??"");if(dt==="restart"){if(String(Te.confirm??"")!==Ue.name)return D({ok:!1,error:`Type "${Ue.name}" to restart this worker.`},409);let vt=te.find((Er)=>Er.id===Ue.target.operationId);if(!vt)return D({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Mt=await zu(f,Ce,vt),_n=Dr.reconcileWorker(Ue.id,Mt.ok?"in_sync":"unavailable",{...Ue.observedState,lastRestartAt:new Date().toISOString(),command:Mt.command??null,error:Mt.error??Mt.stderr??null});return Qe("worker_restarted",{workerId:Ue.id,ok:Mt.ok},Ue.resourceId),D({...Mt,worker:_n},Mt.ok?200:409)}if(dt==="scale")return D({ok:!1,error:Ue.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return D({ok:!1,error:"Action must be restart or scale."},422)}}if(W.pathname.startsWith("/api/telemetry/")){let I=S.environments.get(Ce),P=new gt(S.store),q=S.store.listResources(S.project.id,I?.id),V=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(W.pathname)?"runtime:logs":"runtime:read",J=be.role==="admin"||!!I&&Ya(be,I.id,V),Z=J?q:q.filter((_e)=>Or(be,_e.id,V)),G=(_e)=>qS(Z,J,_e),te=(_e)=>{let Qe=new Date,Te={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ue=String(_e.to??Qe.toISOString()),dt=String(_e.from??new Date(new Date(Ue).getTime()-(Te[String(_e.range??"1h")]??Te["1h"])).toISOString()),vt=(_n)=>{let Er=(Array.isArray(_n)?_n:String(_n??"").split(",")).map(String).filter(Boolean);return Er.length?Er:void 0},Mt=vt(_e.kinds)?.filter((_n)=>["metric","log","trace","request","event"].includes(_n));return{projectId:S.project.id,environmentId:I?.id,resourceIds:G(_e.resources),kinds:Mt,names:vt(_e.names),sources:vt(_e.sources),levels:vt(_e.levels),from:dt,to:Ue,text:String(_e.text??"")||void 0,traceId:String(_e.traceId??"")||void 0,requestId:String(_e.requestId??"")||void 0,deploymentId:String(_e.deploymentId??"")||void 0,releaseId:String(_e.releaseId??"")||void 0,workloadId:String(_e.workloadId??"")||void 0,cursor:String(_e.cursor??"")||void 0,limit:Number(_e.limit)||void 0}},Ie=Object.fromEntries(W.searchParams.entries()),Se=(_e=!1)=>Ng({controlPlane:S.store,projectId:S.project.id,environmentId:I?.id,config:f,environment:Ce,force:_e,lightweight:!_e}),it=()=>{let _e=S.store.getSetting(`telemetry.collection:${S.project.id}:${I?.id??"all"}`)??{};return{generatedAt:String(_e.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(_e.statuses)?_e.statuses:[],errors:Array.isArray(_e.errors)?_e.errors:[],policy:_e.policy??Qt(S.store,S.project.id)}};if(W.pathname==="/api/telemetry/status"&&M.method==="GET"){Se(!1);let _e=it(),Qe=J?_e.statuses:P.status(S.project.id,I?.id,_e.policy.rawDays,_e.policy.samplingRate,Z.map((Ue)=>Ue.id)),Te=Qe.reduce((Ue,dt)=>Ue+dt.estimatedDailyBytes*30,0);return D({ok:!0,generatedAt:_e.generatedAt,cached:_e.cached,sources:Qe,errors:J?_e.errors:[],policy:_e.policy,retention:{rawDays:_e.policy.rawDays,downsampleAfterDays:_e.policy.downsampleAfterDays,downsampleBucketMs:_e.policy.downsampleBucketMs,maxRecords:_e.policy.maxRecords},estimatedMonthlyBytes:Te,estimatedMonthlyCostUsd:pd(Te,_e.policy),costEstimateConfigured:_e.policy.estimatedStorageUsdPerGbMonth>0})}if(W.pathname==="/api/telemetry/settings"&&M.method==="GET")return D({ok:!0,policy:Qt(S.store,S.project.id)});if(W.pathname==="/api/telemetry/settings"&&M.method==="PATCH"){let _e=ud(S.store,S.project.id,await se(M));return GS(S.project.id),D({ok:!0,policy:_e})}if(W.pathname==="/api/telemetry/query"&&M.method==="GET"){Se(!1);let _e=it();return D({ok:!0,collection:{generatedAt:_e.generatedAt,cached:_e.cached},...P.query(te(Ie))})}if(W.pathname==="/api/telemetry/tail"&&M.method==="GET"){Se(!1);let _e=new TextEncoder,Qe=new Date,Te=te({...Ie,kinds:Ie.kinds||"log,request,event,trace",from:Ie.from||new Date(Qe.getTime()-120000).toISOString(),to:Qe.toISOString(),limit:Math.min(1000,Number(Ie.limit)||200),cursor:void 0}),Ue=M.headers.get("last-event-id")||String(Ie.cursor??"")||void 0,dt,vt=!1,Mt=!1,_n=new ReadableStream({start(Er){let eo=()=>{if(vt)return;if(vt=!0,dt)clearInterval(dt);M.signal.removeEventListener("abort",eo);try{Er.close()}catch{}},of=async()=>{if(vt||Mt)return;Mt=!0;try{let Do=P.tail({...Te,to:new Date(Date.now()+1000).toISOString()},Ue);for(let sf of Do.records)Ue=Ei(sf)??Ue,Er.enqueue(_e.encode(`id: ${Ue??""}
-event: record
-data: ${JSON.stringify(sf)}
-
-`));if(Do.cursor)Ue=Do.cursor}catch(Do){Er.enqueue(_e.encode(`event: error
-data: ${JSON.stringify({message:Do instanceof Error?Do.message:String(Do)})}
-
-`))}finally{Mt=!1}};of(),dt=setInterval(()=>{if(of(),!vt)Er.enqueue(_e.encode(`event: heartbeat
-data: ${JSON.stringify({cursor:Ue,at:new Date().toISOString()})}
-
-`))},5000),dt.unref?.(),M.signal.addEventListener("abort",eo,{once:!0})},cancel(){if(vt=!0,dt)clearInterval(dt)}});return new Response(_n,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(W.pathname==="/api/telemetry/series"&&M.method==="GET"){Se(!1);let _e=it(),Qe=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(Ie.aggregation))?Ie.aggregation:"avg",Te=te({...Ie,kinds:"metric",limit:5000}),Ue=P.series({...Te,bucketMs:Number(Ie.bucketMs)||60000,aggregation:Qe,timezone:String(Ie.timezone??"UTC"),compareFrom:Ie.compareFrom,compareTo:Ie.compareTo});return D({ok:!0,collection:{generatedAt:_e.generatedAt,cached:_e.cached},query:{aggregation:Qe,bucketMs:Number(Ie.bucketMs)||60000,timezone:String(Ie.timezone??"UTC")},series:Ue})}if(W.pathname==="/api/telemetry/refresh"&&M.method==="POST")return D({ok:!0,...await Se(!0)});if(W.pathname==="/api/telemetry/export"&&M.method==="POST"){let _e=await se(M);await Se(!1);let Qe=P.query({...te(_e),limit:Math.min(5000,Number(_e.limit)||5000),cursor:void 0});if((_e.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:te(_e),...Qe},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let Ue=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],dt=[Ue.join(","),...Qe.records.map((vt)=>Ue.map((Mt)=>`"${String(vt[Mt]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(dt,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(W.pathname==="/api/telemetry/saved-queries"&&M.method==="GET"){let _e=Ve(be);return D({ok:!0,queries:P.listSavedQueries(S.project.id,_e.actor?.id)})}if(W.pathname==="/api/telemetry/saved-queries"&&M.method==="POST"){let _e=await se(M),Qe=Ve(be);return D({ok:!0,query:P.saveQuery(S.project.id,Qe.actor?.id,String(_e.name??""),te(_e.query??_e))},201)}if(W.pathname==="/api/telemetry/saved-queries"&&M.method==="DELETE"){let _e=await se(M),Qe=Ve(be),Te=P.deleteSavedQuery(S.project.id,Qe.actor?.id,String(_e.id??""));return D({ok:Te},Te?200:404)}}if(W.pathname.startsWith("/api/configuration")){let I=S.environments.get(Ce),P=be.role==="admin"||!!Nn.capabilities?.includes("secrets:read"),q=be.role==="admin"||!!Nn.capabilities?.includes("secrets:write"),V={projectId:S.project.id,environmentId:I?.id},J={"cache-control":"no-store"};if(W.pathname==="/api/configuration"&&M.method==="GET"){let Z=Object.fromEntries(W.searchParams),G=Z.scopeType||Z.scopeId?Ka(Z,V):void 0,te=["variable","secret"].includes(String(Z.kind))?Z.kind:void 0,Ie=G?.type==="preview"?vr.previews.getInstance(G.id):void 0,Se=Ie?vr.previews.getDefinition(Ie.definitionId):void 0,it=G?await En.resolve({projectId:S.project.id,environmentId:G.environmentId,resourceId:G.resourceId,functionId:G.type==="function"?G.id:void 0,previewId:G.previewId,trustedPreview:!!Ie&&!Ie.fork,allowedPreviewSecrets:Se?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:P}):void 0,_e=S.store.listResources(S.project.id);return D({ok:!0,entries:En.list({projectId:S.project.id,scope:G,kind:te,search:Z.search,canReadSecretMetadata:P}),effectiveEntries:it?Object.values(it.entries).filter((Qe)=>!te||Qe.kind===te).filter((Qe)=>!Z.search||Qe.key.toLowerCase().includes(String(Z.search).toLowerCase())):[],configurationHash:it?.configurationHash,warnings:it?.warnings??[],scopes:{project:S.project,environments:S.store.listEnvironments(S.project.id),resources:_e.filter((Qe)=>Qe.kind!=="function"),functions:_e.filter((Qe)=>Qe.kind==="function"),previews:vr.previews.listInstances({projectId:S.project.id}).filter((Qe)=>Qe.status!=="destroyed").map((Qe)=>({id:Qe.id,name:Qe.name,environmentId:Qe.baseEnvironmentId,resourceId:Qe.resourceId,fork:Qe.fork,status:Qe.status}))}},200,J)}if(W.pathname==="/api/configuration/export"&&M.method==="GET"){let Z=Ka(Object.fromEntries(W.searchParams),V);return new Response(En.exportVariables({projectId:S.project.id,scope:Z}),{headers:{...J,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(W.pathname==="/api/configuration/plan"&&M.method==="POST"){let Z=await se(M),G=Ka(Z,V),te=Z.values&&typeof Z.values==="object"&&!Array.isArray(Z.values)?Object.fromEntries(Object.entries(Z.values).map(([Ie,Se])=>[Ie,String(Se)])):{};return D({ok:!0,plan:En.plan({projectId:S.project.id,scope:G,values:te,removeMissing:Z.removeMissing===!0})},200,J)}if(W.pathname==="/api/configuration"&&M.method==="POST"){let Z=await se(M),G=Ka(Z,V),te=Z.kind==="secret"?"secret":"variable",Ie=String(Z.key??"");if(te==="secret"&&!q)return D({ok:!1,error:"Secret write permission is required."},403,J);try{let Se=await En.set({organizationId:S.organization.id,projectId:S.project.id,scope:G,key:Ie,kind:te,value:Z.value==null?void 0:String(Z.value),reference:Z.reference==null?void 0:String(Z.reference),backend:Z.backend,required:Z.required===!0,expectedVersion:Z.expectedVersion==null?void 0:Number(Z.expectedVersion),confirmed:String(Z.confirm??"")===Ie,idempotencyKey:M.headers.get("idempotency-key")??Z.idempotencyKey,actorId:Ve(be).actor?.id});return D({ok:!0,entry:En.list({projectId:S.project.id,scope:G,canReadSecretMetadata:P}).find((it)=>it.id===Se.entry.id),mutation:Se.mutation,warnings:Se.warnings},Se.mutation.added.length?201:200,J)}catch(Se){return D({ok:!1,error:Se instanceof Error?Se.message:String(Se)},409,J)}}if(W.pathname==="/api/configuration/import"&&M.method==="POST"){let Z=await se(M),G=Ka(Z,V),te=Array.isArray(Z.secretKeys)?Z.secretKeys.map(String):[];if(te.length&&!q)return D({ok:!1,error:"Secret write permission is required."},403,J);try{let Ie=await En.importDotenv({organizationId:S.organization.id,projectId:S.project.id,scope:G,source:String(Z.source??""),secretKeys:te,backend:Z.backend,confirmed:Z.confirm==="import",idempotencyKey:M.headers.get("idempotency-key")??Z.idempotencyKey,actorId:Ve(be).actor?.id});return D({ok:Ie.document.valid,diagnostics:Ie.document.diagnostics,mutation:Ie.mutation,warnings:Ie.warnings},Ie.document.valid?200:422,J)}catch(Ie){return D({ok:!1,error:Ie instanceof Error?Ie.message:String(Ie)},409,J)}}if(W.pathname==="/api/configuration/dependencies"&&M.method==="POST"){let Z=await se(M),G=Ti.get(String(Z.entryId??"")),te=S.store.getResource(String(Z.resourceId??""));if(!G||G.projectId!==S.project.id||!te||te.projectId!==S.project.id)return D({ok:!1,error:"Configuration entry or dependent resource was not found."},404,J);return D({ok:!0,dependency:Ti.setDependency({entryId:G.id,resourceId:te.id,injectionTarget:["native_reference","file"].includes(String(Z.injectionTarget))?Z.injectionTarget:"environment",required:Z.required!==!1,requiresRedeploy:Z.requiresRedeploy!==!1,lastDeployedVersion:Z.lastDeployedVersion==null?void 0:Number(Z.lastDeployedVersion)})},200,J)}if(W.pathname==="/api/configuration/transfer"&&M.method==="POST"){let Z=await se(M),G=Ti.get(String(Z.id??"")),te=Ka({...Z,scopeType:Z.targetScopeType,scopeId:Z.targetScopeId},V);if(!G||G.projectId!==S.project.id)return D({ok:!1,error:"Configuration entry was not found."},404,J);if(G.kind==="secret"&&!q)return D({ok:!1,error:"Secret write permission is required."},403,J);try{let Ie=await En.transfer({entryId:G.id,targetScope:te,mode:Z.mode==="move"?"move":"copy",confirmed:Z.confirm===G.key,actorId:Ve(be).actor?.id,idempotencyKey:M.headers.get("idempotency-key")??Z.idempotencyKey});return D({ok:!0,entry:En.list({projectId:S.project.id,scope:te,canReadSecretMetadata:P}).find((Se)=>Se.id===Ie.entry.id),mutation:Ie.mutation},200,J)}catch(Ie){return D({ok:!1,error:Ie instanceof Error?Ie.message:String(Ie)},409,J)}}if(W.pathname==="/api/configuration/bulk"&&M.method==="POST"){let Z=await se(M),G=Array.isArray(Z.ids)?Z.ids.map(String).slice(0,500):[],te=G.map((Se)=>Ti.get(Se)).filter((Se)=>!!Se&&Se.projectId===S.project.id);if(te.length!==G.length)return D({ok:!1,error:"One or more configuration entries were not found."},404,J);if(te.some((Se)=>Se.kind==="secret")&&!q)return D({ok:!1,error:"Secret write permission is required."},403,J);if(Z.action!=="delete"||Z.confirm!=="bulk")return D({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,J);let Ie=[];try{for(let Se of te)Ie.push(await En.remove({entryId:Se.id,expectedVersion:Se.version,confirmed:!0,actorId:Ve(be).actor?.id}));return D({ok:!0,removed:Ie.flatMap((Se)=>Se.removed),affectedResourceIds:[...new Set(Ie.flatMap((Se)=>Se.affectedResourceIds))].sort()},200,J)}catch(Se){return D({ok:!1,error:Se instanceof Error?Se.message:String(Se),partial:Ie.flatMap((it)=>it.removed)},409,J)}}if(W.pathname==="/api/configuration/reveal"&&M.method==="POST"){let Z=await se(M),G=ur.resolveSession(M);try{return D({ok:!0,value:await En.reveal({entryId:String(Z.id??""),canRevealSecrets:P,recentlyAuthenticated:!De||!!G&&$e.isRecentlyAuthenticated(G),actorId:Ve(be).actor?.id})},200,J)}catch(te){return D({ok:!1,error:te instanceof Error?te.message:String(te)},403,J)}}if(W.pathname==="/api/configuration"&&M.method==="DELETE"){let Z=await se(M),G=Ti.get(String(Z.id??""));if(G?.kind==="secret"&&!q)return D({ok:!1,error:"Secret write permission is required."},403,J);if(!G||G.projectId!==S.project.id)return D({ok:!1,error:"Configuration entry was not found."},404,J);try{return D({ok:!0,mutation:await En.remove({entryId:G.id,expectedVersion:Number(Z.expectedVersion),confirmed:String(Z.confirm??"")===G.key,actorId:Ve(be).actor?.id})},200,J)}catch(te){return D({ok:!1,error:te instanceof Error?te.message:String(te)},409,J)}}}if(W.pathname.startsWith("/api/fleet")){let I=Ve(be).actor?.id,P=(q,V=409)=>D({ok:!1,error:q instanceof Error?q.message:String(q)},V,{"cache-control":"no-store"});if(W.pathname==="/api/fleet"&&M.method==="GET")return D({ok:!0,servers:Qa.list(S.project.id),resources:S.store.listResources(S.project.id),operations:Kt.list({projectId:S.project.id,limit:200}).filter((q)=>q.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(W.pathname==="/api/fleet"&&M.method==="POST"){let q=await se(M);try{return D({ok:!0,server:Xn.enroll({organizationId:S.organization.id,projectId:S.project.id,name:String(q.name??""),provider:["aws","hetzner"].includes(String(q.provider))?q.provider:"ssh",providerId:q.providerId?String(q.providerId):void 0,region:q.region?String(q.region):void 0,zone:q.zone?String(q.zone):void 0,endpoint:String(q.endpoint??""),sshUser:String(q.sshUser??"deploy"),sshPort:q.sshPort?Number(q.sshPort):22,credentialRef:String(q.credentialRef??""),roles:Array.isArray(q.roles)?q.roles:[],labels:q.labels&&typeof q.labels==="object"?q.labels:{}})},201)}catch(V){return P(V,422)}}if(W.pathname==="/api/fleet/action"&&M.method==="POST"){let q=await se(M),V=String(q.id??""),J=String(q.action??"");try{if(J==="test")return D({ok:!0,server:await Xn.test(V)});if(J==="validate")return D({ok:!0,server:await Xn.validate(V)});if(J==="review_host_key")return D({ok:!0,server:Xn.reviewHostKey(V,String(q.fingerprint??""))});if(J==="bootstrap")return D({ok:!0,...Xn.bootstrap(V,q.confirmed===!0)},q.confirmed===!0?202:200);if(J==="heartbeat")return D({ok:!0,server:Xn.heartbeat(V,{usage:q.usage&&typeof q.usage==="object"?q.usage:{}})});if(J==="drain")return D({ok:!0,server:Xn.drain(V,q.completed===!0)});if(J==="uncordon")return D({ok:!0,server:Xn.uncordon(V)});if(J==="archive")return D({ok:!0,server:Xn.archive(V,String(q.confirmation??""))});return P("Unsupported fleet action.",422)}catch(Z){return P(Z)}}}if(W.pathname.startsWith("/api/capacity")){let I=(P,q=409)=>D({ok:!1,error:P instanceof Error?P.message:String(P)},q,{"cache-control":"no-store"});if(W.pathname==="/api/capacity"&&M.method==="GET")return D({ok:!0,pools:Di.listPools(S.project.id),placements:Di.listPlacements(S.project.id),servers:Qa.list(S.project.id)},200,{"cache-control":"no-store"});if(W.pathname==="/api/capacity"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,pool:Di.createPool({organizationId:S.organization.id,projectId:S.project.id,name:String(P.name??""),purpose:String(P.purpose??"application"),backend:String(P.backend??"server"),region:P.region?String(P.region):void 0,architecture:P.architecture?String(P.architecture):void 0,labels:P.labels&&typeof P.labels==="object"?P.labels:{},requiredServerLabels:P.requiredServerLabels&&typeof P.requiredServerLabels==="object"?P.requiredServerLabels:{},toleratedTaints:Array.isArray(P.toleratedTaints)?P.toleratedTaints.map(String):[],capacity:P.capacity&&typeof P.capacity==="object"?P.capacity:{},maxWorkloads:Number(P.maxWorkloads??10),costWeight:Number(P.costWeight??1),spreadKey:P.spreadKey?String(P.spreadKey):void 0,concurrency:Number(P.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(q){return I(q,422)}}if(W.pathname==="/api/capacity/member"&&M.method==="POST"){let P=await se(M);try{return Di.addMember(String(P.poolId??""),String(P.serverId??"")),D({ok:!0,pool:Di.getPool(String(P.poolId??""))})}catch(q){return I(q,422)}}if(W.pathname==="/api/capacity/explain"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,decisions:Ug.explain(S.project.id,{purpose:String(P.purpose??"application"),resources:P.resources&&typeof P.resources==="object"?P.resources:{},region:P.region?String(P.region):void 0,architecture:P.architecture?String(P.architecture):void 0,labels:P.labels&&typeof P.labels==="object"?P.labels:{}})})}catch(q){return I(q,422)}}if(W.pathname==="/api/capacity/action"&&M.method==="POST"){let P=await se(M);try{if(P.action==="drain")return D({ok:!0,...Ug.drainPool(String(P.poolId??""))});if(P.action==="enable")return D({ok:!0,pool:Di.updatePool(String(P.poolId??""),{status:"active"})});if(P.action==="disable")return D({ok:!0,pool:Di.updatePool(String(P.poolId??""),{status:"disabled"})});return I("Unsupported capacity action.",422)}catch(q){return I(q,422)}}}if(W.pathname.startsWith("/api/regions")){let I=(P,q=409)=>D({ok:!1,error:P instanceof Error?P.message:String(P)},q,{"cache-control":"no-store"});if(W.pathname==="/api/regions"&&M.method==="GET")return D({ok:!0,topologies:Co.list(S.project.id).map((P)=>({topology:P,targets:Co.targets(P.id),channels:Co.channels(P.id),route:Co.route(P.id),executions:Co.executions(P.id)}))},200,{"cache-control":"no-store"});if(W.pathname==="/api/regions"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,topology:qg.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:S.environments.get(Ce)?.id,name:String(P.name??""),hostname:String(P.hostname??""),regions:Array.isArray(P.regions)?P.regions:[],trafficPolicy:P.trafficPolicy==="weighted"||P.trafficPolicy==="latency"?P.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(P.replicate)?P.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(P.maxLagSeconds??30),retainOnDestroy:P.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:P.cdnEnabled===!0,wafEnabled:P.wafEnabled===!0})},201)}catch(q){return I(q,422)}}if(W.pathname==="/api/regions/action"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,...qg.enqueue({topologyId:String(P.topologyId??""),kind:String(P.action??""),targetRegion:P.targetRegion?String(P.targetRegion):void 0,revision:P.revision?String(P.revision):void 0,manifest:P.manifest&&typeof P.manifest==="object"?P.manifest:{},confirmation:P.confirmation?String(P.confirmation):void 0,deleteData:P.deleteData===!0})},202)}catch(q){return I(q,422)}}}if(W.pathname.startsWith("/api/maintenance")){let I=(P,q=409)=>D({ok:!1,error:P instanceof Error?P.message:String(P)},q,{"cache-control":"no-store"});if(W.pathname==="/api/maintenance"&&M.method==="GET")return D({ok:!0,manifests:ci.manifests(S.organization.id),windows:ci.windows(S.project.id),campaigns:ci.campaigns(S.project.id).map((P)=>({campaign:P,targets:ci.targets(P.id)})),cleanups:ci.cleanups(S.project.id),drills:ci.drills(S.project.id)},200,{"cache-control":"no-store"});if(W.pathname==="/api/maintenance/cleanup-preview"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,plan:await Yu.previewCleanup({projectId:S.project.id,kind:String(P.kind??"operations"),criteria:{olderThanDays:Number(P.olderThanDays??30)}},Vg)},201)}catch(q){return I(q,422)}}if(W.pathname==="/api/maintenance/cleanup-apply"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,...Yu.enqueueCleanup(String(P.planId??""),String(P.confirmation??""))},202)}catch(q){return I(q,422)}}if(W.pathname==="/api/maintenance/drill"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,drill:ci.createDrill({projectId:S.project.id,scenario:String(P.scenario??"control_plane"),isolatedTarget:String(P.isolatedTarget??""),expectedRpoMinutes:Number(P.expectedRpoMinutes??60),expectedRtoMinutes:Number(P.expectedRtoMinutes??30),recoveryPointId:P.recoveryPointId?String(P.recoveryPointId):void 0,topologyId:P.topologyId?String(P.topologyId):void 0})},201)}catch(q){return I(q,422)}}if(W.pathname==="/api/maintenance/drill-run"&&M.method==="POST"){let P=await se(M);try{return D({ok:!0,...Yu.enqueueDrill(String(P.drillId??""))},202)}catch(q){return I(q,422)}}}if(W.pathname.startsWith("/api/volumes")){let I=S.environments.get(Ce),P=Ve(be).actor?.id,q=(V,J=409)=>D({ok:!1,error:V instanceof Error?V.message:String(V)},J,{"cache-control":"no-store"});if(W.pathname==="/api/volumes"&&M.method==="GET"){let V=Gu.inventory(S.project.id,I?.id),J=S.store.listResources(S.project.id,I?.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind,provider:Z.provider,providerId:Z.providerId}));return D({ok:!0,volumes:V,resources:J,operations:Kt.list({projectId:S.project.id,limit:100}).filter((Z)=>Z.operation.kind.startsWith("volume.")),recoveryPoints:wr.listRecoveryPoints(S.project.id).filter((Z)=>Z.kind==="volume"),providers:Qu.map((Z)=>({provider:Z.provider,type:Z.type,capabilities:Z.capabilities()}))},200,{"cache-control":"no-store"})}if(W.pathname==="/api/volumes"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,...ai.create({organizationId:S.organization.id,projectId:S.project.id,environmentId:I?.id,resourceId:V.resourceId?String(V.resourceId):void 0,name:String(V.name??""),provider:String(V.provider??"docker"),type:V.type==="docker"?"docker":V.type,capacityBytes:V.capacityBytes==null?void 0:Number(V.capacityBytes),filesystem:V.filesystem?String(V.filesystem):void 0,encrypted:V.encrypted===!0,desiredState:V.desiredState&&typeof V.desiredState==="object"?V.desiredState:{},actorId:P})},202,{"cache-control":"no-store"})}catch(J){return q(J,422)}}if(W.pathname==="/api/volumes/attach"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,...ai.attach(String(V.volumeId??""),{resourceId:String(V.resourceId??""),targetPath:String(V.targetPath??""),readOnly:V.readOnly===!0,uid:V.uid==null?void 0:Number(V.uid),gid:V.gid==null?void 0:Number(V.gid),mode:V.mode?String(V.mode):void 0,propagation:V.propagation,driverOptions:V.driverOptions&&typeof V.driverOptions==="object"?V.driverOptions:{},actorId:P})},202)}catch(J){return q(J,422)}}if(W.pathname==="/api/volumes/detach"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,...ai.detach(String(V.volumeId??""),String(V.attachmentId??""),{force:V.force===!0,drained:V.drained===!0,unmounted:V.unmounted===!0,confirmation:V.confirmation?String(V.confirmation):void 0,actorId:P})},202)}catch(J){return q(J)}}if(W.pathname==="/api/volumes/resize"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,...ai.resize(String(V.volumeId??""),Number(V.capacityBytes),{drained:V.drained===!0,actorId:P})},202)}catch(J){return q(J,422)}}if(W.pathname==="/api/volumes/snapshot"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,...ai.snapshot(String(V.volumeId??""),{name:V.name?String(V.name):void 0,actorId:P})},202)}catch(J){return q(J,422)}}if(W.pathname==="/api/volumes/restore"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,...ai.restore(String(V.snapshotId??""),{name:String(V.name??""),actorId:P})},202)}catch(J){return q(J,422)}}if(W.pathname==="/api/volumes/discover"&&M.method==="POST")try{return D({ok:!0,volumes:await ai.discover({organizationId:S.organization.id,projectId:S.project.id,environmentId:I?.id,actorId:P})})}catch(V){return q(V,502)}if(W.pathname==="/api/volumes/adopt"&&M.method==="POST"){let V=await se(M);try{return D({ok:!0,volume:ai.adopt(String(V.volumeId??""),{name:String(V.name??""),actorId:P})})}catch(J){return q(J,422)}}if(W.pathname==="/api/volumes"&&M.method==="DELETE"){let V=await se(M),J=ur.resolveSession(M);try{return D({ok:!0,...ai.delete(String(V.volumeId??""),{recentAuthAt:!De||J&&$e.isRecentlyAuthenticated(J)?new Date().toISOString():void 0,confirmation:V.confirmation?String(V.confirmation):void 0,backupOverride:V.backupOverride===!0,backupOverrideConfirmation:V.backupOverrideConfirmation?String(V.backupOverrideConfirmation):void 0,actorId:P})},202)}catch(Z){return q(Z)}}}if(W.pathname==="/api/backups"&&M.method==="GET"){let I=S.environments.get(Ce),P=wr.listPolicies(S.project.id,I?.id),q=new Set(P.map((te)=>te.id)),V=wr.listRecoveryPoints(S.project.id).filter((te)=>!te.policyId||q.has(te.policyId)),J=wr.listJobs(S.project.id).filter((te)=>!te.policyId||q.has(te.policyId)),Z=(te)=>({...te,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!te.credentialRef,clientEncryptionConfigured:!!te.encryptionKeyRef}),G=await Promise.all(wr.listDestinations(S.project.id).map(async(te)=>({...Z(te),credentialStatus:await uu(te,si)})));return D({ok:!0,destinations:G,policies:P,recoveryPoints:V,jobs:J,coverage:wr.coverage(S.project.id).filter((te)=>q.has(te.policy.id)),resources:I?S.store.listResources(S.project.id,I.id).map((te)=>({id:te.id,name:te.name,slug:te.slug,kind:te.kind})):[]})}if(W.pathname==="/api/backups/destinations"&&M.method==="POST"){let I=await se(M),P=String(I.name??"").trim(),q=String(I.provider??""),V=String(I.encryption??"provider"),J=`secret://data-services/backups/${S.project.id}/${P}`,Z=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(q))return D({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(V))return D({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let G,te;if(I.credentials&&typeof I.credentials==="object"&&!Array.isArray(I.credentials))G=`${J}/credentials`,await si.put(G,JSON.stringify(I.credentials)),Z.push(G);if(V!=="provider"){let Se=String(I.encryptionKey??"");if(Se.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");te=`${J}/encryption-key`,await si.put(te,Se),Z.push(te)}let Ie=wr.createDestination({organizationId:S.organization.id,projectId:S.project.id,name:P,provider:q,endpoint:I.endpoint?String(I.endpoint):void 0,endpointPolicy:I.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:I.bucket?String(I.bucket):void 0,prefix:String(I.prefix??""),region:I.region?String(I.region):xi,forcePathStyle:I.forcePathStyle===!0,credentialRef:G,encryption:V,encryptionKeyRef:te,immutability:I.immutability&&typeof I.immutability==="object"&&!Array.isArray(I.immutability)?I.immutability:{},status:"untested"});return D({ok:!0,destination:{...Ie,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!G,clientEncryptionConfigured:!!te}},201)}catch(G){for(let te of Z)await si.remove(te).catch(()=>{});return D({ok:!1,error:G instanceof Error?G.message:String(G)},422)}}if(W.pathname==="/api/backups/destinations/test"&&M.method==="POST"){let I=await se(M),P=wr.getDestination(String(I.id??""));if(!P||P.projectId!==S.project.id)return D({ok:!1,error:"Backup destination was not found."},404);if(P.provider==="aws_backup")return D({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await zg.test(P),D({ok:!0,destination:wr.recordDestinationTest(P.id,{ok:!0})})}catch(q){let V=q instanceof Error?q.message:String(q);return wr.recordDestinationTest(P.id,{ok:!1,error:V}),D({ok:!1,error:V},502)}}if(W.pathname==="/api/backups/policies"&&M.method==="POST"){let I=await se(M),P=S.environments.get(Ce),q=wr.getDestination(String(I.destinationId??"")),V=String(I.resourceKind??""),J=I.dataServiceId?String(I.dataServiceId):void 0,Z=J?cr.get(J):void 0,G=I.resourceId?String(I.resourceId):void 0,te=G?S.store.getResource(G):void 0;if(!P)return D({ok:!1,error:"Environment was not found."},404);if(!q||q.projectId!==S.project.id)return D({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(V))return D({ok:!1,error:"A supported backup resource kind is required."},422);if(J&&(!Z||Z.projectId!==S.project.id||Z.environmentId!==P.id))return D({ok:!1,error:"Data service was not found in this environment."},404);if(G&&(!te||te.projectId!==S.project.id||te.environmentId!==P.id))return D({ok:!1,error:"Resource was not found in this environment."},404);if(V==="managed_database"&&!Z)return D({ok:!1,error:"Managed database policies require a data service."},422);if(V==="logical_database"&&(!Z||!["container","server"].includes(Z.provider)))return D({ok:!1,error:"Logical database policies require an on-box data service."},422);if(V==="volume"&&(!te||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(I.volumeName??""))))return D({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let Ie=Array.isArray(I.includePatterns)?I.includePatterns.map(String).filter(Boolean):[];if(V==="files"&&(!te||!Ie.length))return D({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(V==="control_plane"&&q.encryption==="provider")return D({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(V==="infrastructure"&&(q.provider!=="aws_backup"||!Ie.some((Se)=>Se.startsWith("resource:arn:"))||!Ie.some((Se)=>Se.startsWith("role:arn:"))))return D({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let Se=wr.createPolicy({organizationId:S.organization.id,projectId:S.project.id,environmentId:P.id,resourceId:G,dataServiceId:J,destinationId:q.id,name:String(I.name??"").trim(),resourceKind:V,schedule:String(I.schedule??"daily"),timezone:String(I.timezone??"UTC"),retention:I.retention&&typeof I.retention==="object"&&!Array.isArray(I.retention)?I.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(I.compression))?I.compression:"gzip",encryption:["destination","client_side","both"].includes(String(I.encryption))?I.encryption:"destination",includePatterns:V==="volume"?[String(I.volumeName),...Ie]:Ie,excludePatterns:Array.isArray(I.excludePatterns)?I.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(I.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(I.expectedRtoMinutes)||120),healthCheckId:I.healthCheckId?String(I.healthCheckId):void 0,enabled:I.enabled!==!1});return D({ok:!0,policy:Se},201)}catch(Se){return D({ok:!1,error:Se instanceof Error?Se.message:String(Se)},422)}}if(W.pathname==="/api/backups/run"&&M.method==="POST"){let I=await se(M),P=wr.getPolicy(String(I.policyId??"")),q=S.environments.get(Ce);if(!P||P.projectId!==S.project.id||P.environmentId!==q?.id)return D({ok:!1,error:"Backup policy was not found in this environment."},404);try{let V=Ro.enqueueBackup(P,new Date().toISOString(),Ve(be).actor?.id);return D({ok:!0,job:V},202)}catch(V){return D({ok:!1,error:V instanceof Error?V.message:String(V)},409)}}if(W.pathname==="/api/backups/verify"&&M.method==="POST"){let I=await se(M),P=wr.getRecoveryPoint(String(I.recoveryPointId??""));if(!P||P.projectId!==S.project.id)return D({ok:!1,error:"Recovery point was not found."},404);return D({ok:!0,job:Ro.enqueueVerification(P)},202)}if(W.pathname==="/api/backups/restore"&&M.method==="POST"){let I=await se(M),P=wr.getRecoveryPoint(String(I.recoveryPointId??"")),q=I.mode==="in_place"?"in_place":"isolated",V=I.target&&typeof I.target==="object"&&!Array.isArray(I.target)?{...I.target,inPlace:q==="in_place"}:{inPlace:q==="in_place"},J=ur.resolveSession(M),Z={mode:q,target:V,targetName:String(I.targetName??""),confirm:I.confirm?String(I.confirm):void 0,recentAuth:!De||!!J&&$e.isRecentlyAuthenticated(J),downtimeAcknowledged:I.downtimeAcknowledged===!0,safetyBackupId:I.safetyBackupId?String(I.safetyBackupId):void 0};if(!P||P.projectId!==S.project.id)return D({ok:!1,error:"Recovery point was not found."},404);if(I.drill===!0&&q!=="isolated")return D({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let G=Ro.planRestore(P,Z);if(I.execute!==!0)return D({ok:!0,plan:G,executionCreated:!1});let te=Ro.enqueueRestore(P,{...Z,drill:I.drill===!0,actorId:Ve(be).actor?.id});return D({ok:!0,plan:G,job:te},202)}catch(G){return D({ok:!1,error:G instanceof Error?G.message:String(G)},409)}}if(W.pathname==="/api/backups/recovery-points"&&M.method==="POST"){let I=await se(M),P=wr.getRecoveryPoint(String(I.id??""));if(!P||P.projectId!==S.project.id)return D({ok:!1,error:"Recovery point was not found."},404);if(I.held==null&&I.pinned==null)return D({ok:!1,error:"held or pinned must be provided."},422);return D({ok:!0,recoveryPoint:wr.updateRecoveryPoint(P.id,{held:I.held==null?P.held:I.held===!0,pinned:I.pinned==null?P.pinned:I.pinned===!0})})}if(W.pathname==="/api/backups/retention"&&M.method==="POST")return D({ok:!0,jobs:Ro.enqueueRetention()},202);if(W.pathname==="/api/data-services/capabilities"&&M.method==="GET"){let I=String(W.searchParams.get("engine")??""),P=String(W.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(I)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(P))return D({ok:!1,error:"A supported engine and provider are required."},422);return D({ok:!0,engine:I,provider:P,capabilities:tn(I,P)})}if(W.pathname==="/api/data-services"&&M.method==="GET"){let I=S.environments.get(Ce),P=cr.list(S.project.id,I?.id).map((q)=>{let V=cr.credential(q.id);return{...q,credentialRef:void 0,credential:V?{configured:!0,username:V.username,version:V.version,rotatedAt:V.rotatedAt}:void 0,dependencies:cr.dependencies(q.id).map((J)=>({resourceId:J.resourceId,requiresRedeploy:J.requiresRedeploy}))}});return D({ok:!0,services:P})}if(W.pathname==="/api/data-services/preview"&&M.method==="POST"){let I=await se(M);if(I.id){let V=cr.get(String(I.id)),J=S.environments.get(Ce),Z=String(I.action??"");if(!V||V.projectId!==S.project.id||V.environmentId!==J?.id)return D({ok:!1,error:"Data service was not found in this environment."},404);if(!Wu.includes(Z))return D({ok:!1,error:`Action must be one of: ${Wu.join(", ")}.`},422);try{return D({ok:!0,plan:Cc.plan(V,Z,I.changes??{})})}catch(G){return D({ok:!1,error:G instanceof Error?G.message:String(G)},422)}}let P=String(I.engine??""),q=String(I.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(P)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(q))return D({ok:!1,error:"A supported engine and provider are required."},422);return D({ok:!0,capabilities:tn(P,q),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(W.pathname==="/api/data-services"&&M.method==="POST"){let I=await se(M),P=String(I.engine??""),q=String(I.provider??""),V=S.environments.get(Ce),J=Ve(be);if(!V)return D({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(P)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(q))return D({ok:!1,error:"A supported engine and provider are required."},422);let Z={organizationId:S.organization.id,projectId:S.project.id,environmentId:V.id,resourceId:I.resourceId?String(I.resourceId):void 0,name:String(I.name??"").trim(),engine:P,provider:q,placement:String(I.placement??I.name??"").trim(),engineVersion:I.engineVersion?String(I.engineVersion):void 0,plan:String(I.plan??(q==="aws_elasticache"?"cache.t4g.micro":q==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:I.storageGb==null?void 0:Number(I.storageGb),highAvailability:I.highAvailability===!0,publicExposure:I.publicExposure===!0,allowedCidrs:Array.isArray(I.allowedCidrs)?I.allowedCidrs.map(String):[],desiredState:I.desiredState&&typeof I.desiredState==="object"&&!Array.isArray(I.desiredState)?I.desiredState:{},observedState:{},origin:I.adopt===!0?"adopted":"managed",managementEnabled:I.adopt!==!0,ownerActorId:J.actor?.id,username:I.username?String(I.username):void 0};try{if(I.adopt===!0){let te=cr.create({...Z,status:"adopted",credentialRef:void 0});return D({ok:!0,service:te,readOnly:!0},201)}if(!Fg({provider:q,engine:P}))return D({ok:!1,error:`No ${q}/${P} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let G=await Cc.create(Z);return D({ok:!0,service:G.service,operationId:G.operationId,oneTimeCredential:G.credential},201)}catch(G){return D({ok:!1,error:G instanceof Error?G.message:String(G)},422)}}if(W.pathname==="/api/data-services/connections"&&M.method==="GET"){let I=cr.get(String(W.searchParams.get("id")??"")),P=S.environments.get(Ce);if(!I||I.projectId!==S.project.id||I.environmentId!==P?.id)return D({ok:!1,error:"Data service was not found in this environment."},404);let q=typeof I.observedState.endpoint==="string"?I.observedState.endpoint:void 0,V=typeof I.observedState.readerEndpoint==="string"?I.observedState.readerEndpoint:void 0,J=Number(I.observedState.port)||(I.engine==="postgres"?5432:I.engine==="redis"?6379:I.engine==="mongodb"?27017:I.engine==="libsql"?8080:3306),Z=typeof I.observedState.database==="string"?I.observedState.database:void 0,G=typeof I.observedState.tls==="boolean"?I.observedState.tls:I.provider.startsWith("aws_"),te=[...q?[{type:I.publicExposure?"external":"internal",host:q,port:J,database:Z,tls:G}]:[],...V?[{type:"internal",host:V,port:J,database:Z,tls:G}]:[],{type:"tunnel",host:q??I.placement,port:J,database:Z,tls:G}];return D({ok:!0,serviceId:I.id,guidance:Ll(I,te)})}if(W.pathname==="/api/data-services/action"&&M.method==="POST"){let I=await se(M),P=cr.get(String(I.id??"")),q=S.environments.get(Ce),V=String(I.action??"");if(!P||P.projectId!==S.project.id||P.environmentId!==q?.id)return D({ok:!1,error:"Data service was not found in this environment."},404);if(!Wu.includes(V))return D({ok:!1,error:`Action must be one of: ${Wu.join(", ")}.`},422);let J=I.changes&&typeof I.changes==="object"&&!Array.isArray(I.changes)?I.changes:{};try{let Z=Cc.plan(P,V,J);if(I.execute!==!0)return D({ok:!0,plan:Z,productionExecutionCreated:!1});let G=Cc.enqueue(P,V,J,Ve(be).actor?.id);return D({ok:!0,plan:Z,operationId:G},202)}catch(Z){return D({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409)}}if(W.pathname==="/api/data-services/dependencies"&&M.method==="POST"){let I=await se(M),P=cr.get(String(I.id??"")),q=S.environments.get(Ce),V=S.store.getResource(String(I.resourceId??""));if(!P||P.projectId!==S.project.id||P.environmentId!==q?.id)return D({ok:!1,error:"Data service was not found in this environment."},404);if(!V||V.projectId!==S.project.id||V.environmentId!==q?.id)return D({ok:!1,error:"Dependent resource was not found in this environment."},404);if(I.remove===!0)return D({ok:cr.removeDependency(P.id,V.id)});return cr.addDependency({serviceId:P.id,resourceId:V.id,secretRef:P.credentialRef??`secret://data-services/${P.projectId}/${P.name}`,requiresRedeploy:I.requiresRedeploy!==!1}),D({ok:!0,dependencies:cr.dependencies(P.id).map((J)=>({resourceId:J.resourceId,requiresRedeploy:J.requiresRedeploy}))})}if(W.pathname==="/api/data-services/management"&&M.method==="POST"){let I=await se(M),P=cr.get(String(I.id??"")),q=S.environments.get(Ce);if(!P||P.projectId!==S.project.id||P.environmentId!==q?.id)return D({ok:!1,error:"Data service was not found in this environment."},404);if(P.origin!=="adopted"||I.reviewed!==!0||I.confirm!==P.name)return D({ok:!1,error:`Enabling management requires reviewed=true and typing ${P.name}.`},409);return D({ok:!0,service:cr.update(P.id,P.version,{managementEnabled:!0})})}if(W.pathname==="/api/data-services/reveal"&&M.method==="POST"){let I=await se(M),P=cr.get(String(I.id??"")),q=S.environments.get(Ce),V=P?cr.credential(P.id):void 0;if(!P||P.projectId!==S.project.id||P.environmentId!==q?.id)return D({ok:!1,error:"Data service was not found in this environment."},404);if(!V)return D({ok:!1,error:"No managed credential is configured."},404);return D({ok:!0,credential:{username:V.username,password:await si.resolve(V.secretRef),version:V.version}},200,{"cache-control":"no-store"})}if(W.pathname==="/api/databases"&&M.method==="GET")return D(await Nb(f,Ce));if(W.pathname==="/api/databases"&&M.method==="POST"){let I=await se(M),P=String(I.name??"").trim();if(!Pi(P))return D({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return D({...await jb(f,Ce,P),name:P})}if(W.pathname==="/api/databases/vitess"&&M.method==="GET"){let I=await Fb(f,Ce);return D({...I,unhealthy:zb(I.tablets),missingPrimary:Ub(I)})}if(W.pathname==="/api/databases/vitess/provision"&&M.method==="POST"){let I=await se(M);try{return D(await Yb(f,Ce,{keyspace:String(I.keyspace??""),username:String(I.username??""),password:String(I.password??""),sharded:I.sharded===!0,confirm:String(I.confirm??"")}))}catch(P){return D({ok:!1,error:P instanceof Error?P.message:String(P)},422)}}if(W.pathname==="/api/databases/vitess/migrations"&&M.method==="GET"){let I=W.searchParams.get("keyspace")??void 0;return D(await Gb(f,Ce,I))}if(W.pathname==="/api/databases/vitess/migrations/action"&&M.method==="POST"){let I=await se(M),P=String(I.uuid??"").trim(),q=String(I.action??"");if(!["retry","cancel","cleanup","complete"].includes(q))return D({ok:!1,error:"Unknown migration action."},422);return D(await Qb(f,Ce,P,q))}if(W.pathname==="/api/databases/vitess/keyspaces"&&M.method==="POST"){let I=await se(M),P=String(I.name??"").trim(),q=I.sharded===!0;return D(await Hb(f,Ce,P,{sharded:q}))}if(W.pathname==="/api/databases/vitess/vschema"&&M.method==="POST"){let I=await se(M),P=String(I.keyspace??"").trim(),q=typeof I.vschema==="string"?I.vschema:JSON.stringify(I.vschema??null);return D(await Kb(f,Ce,P,q))}if(W.pathname==="/api/databases/vitess/schema"&&M.method==="POST"){let I=await se(M),P=String(I.sql??"");return D(await Jb(f,Ce,P))}if(W.pathname==="/api/databases/vitess/install-client"&&M.method==="POST")return D(await Wb(f,Ce));if(W.pathname==="/api/databases/backups"&&M.method==="GET")return D(await Lb(f,Ce));if(W.pathname==="/api/databases/backup"&&M.method==="POST"){let I=await se(M),P=String(I.database??"").trim();if(!Pi(P))return D({ok:!1,error:"Database name must be a valid identifier."},422);if(I.confirm!==P)return D({ok:!1,error:`Type "${P}" to back up this database.`},409);return D(await Bb(f,Ce,P))}if(W.pathname==="/api/databases/users"&&M.method==="POST"){let I=await se(M),P=String(I.username??"").trim(),q=String(I.password??""),V=String(I.database??"").trim()||void 0,J=I.access==="readonly"?"readonly":"all";if(!Pi(P))return D({ok:!1,error:"Username must be a valid identifier."},422);if(!q)return D({ok:!1,error:"Password is required."},422);if(V&&!Pi(V))return D({ok:!1,error:"Database must be a valid identifier."},422);return D({...await Mb(f,Ce,{username:P,password:q,database:V,access:J}),username:P})}if(W.pathname==="/api/dashboard-data")return dr=H.get(Ce)??await Ee(Ce),Ee(Ce),D(Ag(dr,{user:Nn,slug:f.project.slug}));if(W.pathname==="/api/users"&&M.method==="GET")return D({ok:!0,users:In(t).map(Wa)});if(W.pathname==="/api/users"&&M.method==="POST"){let I=await se(M),P=String(I.username??"").trim();if(!Mu(P))return D({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let q=I.sites&&typeof I.sites==="object"?I.sites:{},V=new Set(Object.keys(f.sites??{})),J={};for(let[te,Ie]of Object.entries(q)){if(!V.has(te))return D({ok:!1,error:`Site '${te}' was not found.`},404);if(Ie!=="owner"&&Ie!=="collaborator")return D({ok:!1,error:`Unknown site role '${Ie}'. Use 'owner' or 'collaborator'.`},422);J[te]=Ie}let Z=typeof I.password==="string"&&I.password.trim()?I.password.trim():void 0;if(Z&&Z.length<12)return D({ok:!1,error:"Password must be at least 12 characters."},422);let G=Sc(t,{username:P,password:Z,name:typeof I.name==="string"?I.name:void 0,sites:J});return Wi(S,In(t)),st(),D({ok:!0,user:Wa(G.user),password:G.password})}if(W.pathname==="/api/users"&&M.method==="DELETE"){let I=await se(M),P=String(I.username??"").trim();if(P.toLowerCase()===be.username.toLowerCase())return D({ok:!1,error:"You cannot remove your own account."},409);let q=zn(In(t),P),V=q?S.store.getActorByExternalId("user",`dashboard:${q.username.toLowerCase()}`):void 0,J=V?S.store.getMembershipForActor(S.organization.id,V.id):void 0;if(J&&J.source!=="legacy")return D({ok:!1,error:"Organization members must be removed from Organization access."},409);let Z=Ig(t,P);if(!Z.ok)return D(Z,409);return Wi(S,In(t)),ae.clear(),D({ok:!0,username:P})}if(W.pathname==="/api/actions/run"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=I.action?es(I.action,Ce):void 0;if(!P)return D({ok:!1,error:"Unknown dashboard action."},404);if(P.mutates&&I.confirm!==P.confirm)return D({ok:!1,error:`Type "${P.confirm}" to run this action.`},409);let q=await ke({controlPlane:S,environment:Ce,actor:be,kind:`dashboard.action.${P.id}`,input:{action:P.id},execute:()=>Mg(P,{cwd:t,cliEntry:m})});return D({...q.result,controlPlaneOperation:q.operation})}if(W.pathname==="/api/server/operations/run"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=I.operation?Rg(I.operation,f,dr):void 0;if(!P)return D({ok:!1,error:"Unknown or unavailable server operation."},404);if(P.mutates&&I.confirm!==P.confirm)return D({ok:!1,error:`Type "${P.confirm}" to run this operation.`},409);let q=re(S,String(Ce));await new At(ut).run(new Zr,{...q,artifactRoot:t});let V=Gi(ut,{scope:q,desiredConfigHash:S.project.desiredConfigHash});if(V.decision.outcome==="block")return D({ok:!1,error:`Operation blocked by security policy: ${V.decision.explanation}`,securityReview:V},409);let J=await ke({controlPlane:S,environment:Ce,actor:be,kind:`dashboard.server.${P.id}`,resourceSlug:P.target,input:{operation:P.id,target:P.target,to:I.to??null},execute:()=>zu(f,Ce,P,{to:I.to})});return D({...J.result,controlPlaneOperation:J.operation,securityReview:V})}if(W.pathname==="/api/server/command"&&M.method==="POST"){let I=await M.json().catch(()=>({}));if(I.confirm!=="run")return D({ok:!1,error:'Type "run" to execute this command on the server.'},409);let P=await ke({controlPlane:S,environment:Ce,actor:be,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>wc(f,Ce,String(I.command??""))});return D({...P.result,controlPlaneOperation:P.operation})}if(W.pathname==="/api/serverless/operations")return D(xg(f,Ce,dr));if(W.pathname==="/api/serverless/operations/run"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=I.operation?TS(I.operation,f,Ce,dr):void 0;if(!P)return D({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(P.mutates&&I.confirm!==P.confirm)return D({ok:!1,error:`Type "${P.confirm}" to run this operation.`},409);let q=await ke({controlPlane:S,environment:Ce,actor:be,kind:`dashboard.serverless.${P.id}`,input:{operation:P.id,min:I.min??null,max:I.max??null},execute:()=>xS(f,Ce,P,{min:I.min,max:I.max})});return dr=await Es(f,Ce),H.set(Ce,dr),D({...q.result,controlPlaneOperation:q.operation})}if(W.pathname==="/api/serverless/command"&&M.method==="POST"){let I=await M.json().catch(()=>({}));if(I.confirm!=="run")return D({ok:!1,error:'Type "run" to execute this command.'},409);return D(await DS(f,Ce,String(I.command??"")))}if(W.pathname==="/api/serverless/dlq"&&M.method==="GET"){let I=Number(W.searchParams.get("max"))||10;return D(await OS(f,Ce,I))}if(W.pathname==="/api/serverless/dlq/redrive"&&M.method==="POST"){let I=await M.json().catch(()=>({}));if(I.confirm!=="redrive")return D({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return D(await $S(f,Ce,{max:I.max,targetQueue:I.targetQueue}))}if(W.pathname==="/api/serverless/dlq/purge"&&M.method==="POST"){if((await M.json().catch(()=>({}))).confirm!=="purge")return D({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return D(await NS(f,Ce))}if(W.pathname==="/api/serverless/secrets"&&M.method==="GET")return D({secrets:jS(f,Ce)});if(W.pathname==="/api/serverless/secrets"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=String(I.secretId??"").trim();if(!P)return D({ok:!1,error:"A secret id is required."},422);if(typeof I.value!=="string"||I.value==="")return D({ok:!1,error:"A non-empty value is required."},422);return D(await MS(f,Ce,P,I.value))}if(W.pathname==="/api/serverless/secrets"&&M.method==="DELETE"){let I=await M.json().catch(()=>({})),P=String(I.secretId??"").trim();if(!P)return D({ok:!1,error:"A secret id is required."},422);if(I.confirm!==P)return D({ok:!1,error:`Type "${P}" to delete this secret.`},409);return D(await BS(f,Ce,P))}if(W.pathname==="/api/serverless/functions/config"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=String(I.mode??"").trim();if(I.confirm!==P)return D({ok:!1,error:`Type "${P}" to update this function.`},409);return D(await LS(f,Ce,P,{memory:I.memory,timeout:I.timeout}))}if(W.pathname==="/api/serverless/alarms"&&M.method==="GET")return D(await FS(f,Ce));if(W.pathname==="/api/serverless/alarms"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=String(I.preset??"").trim(),q=Number(I.threshold);if(!P)return D({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(q))return D({ok:!1,error:"A numeric threshold is required."},422);return D(await zS(f,Ce,P,q))}if(W.pathname==="/api/serverless/alarms"&&M.method==="DELETE"){let I=await M.json().catch(()=>({})),P=String(I.name??"").trim();if(!P)return D({ok:!1,error:"An alarm name is required."},422);if(I.confirm!==P)return D({ok:!1,error:`Type "${P}" to delete this alarm.`},409);return D(await US(f,Ce,P))}if(W.pathname==="/api/serverless/traces"&&M.method==="GET"){let I=Number(W.searchParams.get("minutes"))||30;return D(await qu(f,Ce,I))}if(W.pathname==="/api/serverless/scheduler"&&M.method==="POST"){let I=await M.json().catch(()=>({})),P=String(I.action??"").trim();if(P!=="enable"&&P!=="disable"&&P!=="run")return D({ok:!1,error:"Unknown scheduler action."},422);if(I.confirm!==P)return D({ok:!1,error:`Type "${P}" to ${P} the scheduler.`},409);return D(await $g(f,Ce,P))}if(!iw(W.pathname,Nn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Ce)}`}});let xs=await or(be,Ce);if(!xs)return Ku("ts-cloud dashboard UI is unavailable.",503);return ow(xs,W.pathname)}catch(To){if(e.verbose)console.error(To);return D({ok:!1,error:To?.message??String(To)},500)}})();if(!Sr)return Sr;if(Pt&&(W.pathname.startsWith("/api/")||W.pathname.startsWith("/auth/"))){let ct;if((Fe.headers.get("content-type")||"").includes("application/json"))ct=await Fe.json().catch(()=>{return});let $r=ur.resolveUser(M),_r=$r?Ve($r).actor:void 0;S.store.appendEvent({organizationId:S.organization.id,projectId:S.project.id,actorId:_r?.id,correlationId:nt,type:Sr.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Sr.status<400?"info":"warning",payload:K_(M.method,W.pathname,ct,Sr.status,Date.now()-qe)})}return Sr.headers.set("x-request-id",nt),Sr}});Pc?.start();let Sw=e.spendLoop??!0,nf;if(Sw)(async()=>{let{SpendRunner:M,SpendLoopLease:ze,startSpendLoop:qe}=await import("./spend/index.js"),{store:Fe}=await aw(S.store),nt=new M({controlPlane:S.store,store:Fe,alerts:at});nf=qe(nt,{lease:new ze(S.store,{owner:`dashboard:${process.pid}`}),onError:(Pt)=>console.error(`[ts-cloud] spend cycle failed: ${Pt instanceof Error?Pt.message:String(Pt)}`)})})();let ww=Ps.stop.bind(Ps);return Ps.stop=(M)=>{clearInterval(Xg),clearInterval(ef),clearInterval(tf),clearInterval(Zg),clearInterval(Yg),clearInterval(Kg),clearInterval(Jg),clearInterval(Gg),clearInterval(Qg),st(),Ir.clear(),Pc?.stop(),nf?.();let ze=ww(M);if(Pc)Pc.settled().finally(()=>S.store.close());else S.store.close();return ze},{server:Ps,url:`http://${r}:${Ps.port}/`}}export{Po,Fm,el,ly,Oi,tl,No,Um,Qm,zr,ko,rl,Ke,nl,il,sl,Li,Kr,Hm,We,ol,Bo,_o,xo,al,cl,dl,$i,Oo,ll,Wr,Mi,Lo,ft,Gm,ul,pl,qm,gl,$o,Jt,ml,hl,fl,Al,Je,Vm,yl,Xt,Mo,Fo,Uo,Fi,Ui,Jr,Il,Qi,Qo,Ho,Xr,Sl,Yr,jm,zm,At,Zr,Go,Km,Cl,El,qo,bl,vl,Tl,uy,re,wl,py,gy,Hi,Gi,my,ge,Wm,yt,Pe,Ne,It,Rl,Dl,Pl,Nl,Jm,Xm,Vo,Ym,Zm,jo,kl,Bl,eh,ne,th,_l,me,zo,Xe,St,Ct,en,qi,xl,hy,Ko,rh,nh,ih,sh,Wo,Jo,Ol,tn,Xo,Ll,Vi,$l,Yo,Zo,ea,ta,ra,na,ia,sa,Ml,Yt,oa,Fl,rn,Ul,aa,ca,Ql,Zt,da,la,oh,fy,ji,Ay,yy,Iy,ua,pa,Hl,ah,ga,nn,Gl,zi,ql,Vl,jl,ma,ch,ha,zl,dh,fa,lh,sn,on,Kl,Ki,Wl,Jl,Xl,Aa,Yl,Zl,uh,eu,C,tu,Wi,ke,ru,nu,Sy,iu,su,ou,au,cu,ph,Cy,Ey,by,gh,mh,vy,Ty,hh,fh,wy,Ji,er,ya,an,cn,tr,Ye,Et,Xi,Ah,dn,du,lu,Ia,yh,Sa,Ih,Sh,uu,Ca,Yi,pu,Ea,bt,Be,gu,ba,va,mu,Ta,wa,Ra,Da,hu,fu,ln,Pa,Na,ka,Ba,Au,Zi,un,es,_a};