@stacksjs/ts-cloud 0.16.24 → 0.16.25

package/dist/bin/{chunk-hjv1k8s9.js → chunk-n5zwm2z4.js}

@@ -1,4 +1,4 @@
-import{te,h}from"./chunk-257sygzm.js";import{Zi}from"./chunk-wsedynyb.js";var Gu=["edge.requests","edge.egress_gb","function.invocations","function.gb_seconds","build.minutes","compute.instance_hours","storage.gb_hours","object.egress_gb","object.requests","database.gb_hours","database.io_requests","telemetry.ingest_gb","image.transformations"],Xr={"edge.requests":{key:"edge.requests",unit:"requests",label:"Edge requests",precision:0},"edge.egress_gb":{key:"edge.egress_gb",unit:"gb",label:"Edge egress",precision:3},"function.invocations":{key:"function.invocations",unit:"invocations",label:"Function invocations",precision:0},"function.gb_seconds":{key:"function.gb_seconds",unit:"gb_seconds",label:"Function compute",precision:2},"build.minutes":{key:"build.minutes",unit:"minutes",label:"Build minutes",precision:2},"compute.instance_hours":{key:"compute.instance_hours",unit:"hours",label:"Instance hours",precision:2},"storage.gb_hours":{key:"storage.gb_hours",unit:"gb_hours",label:"Block storage",precision:2},"object.egress_gb":{key:"object.egress_gb",unit:"gb",label:"Object storage egress",precision:3},"object.requests":{key:"object.requests",unit:"requests",label:"Object storage requests",precision:0},"database.gb_hours":{key:"database.gb_hours",unit:"gb_hours",label:"Database storage",precision:2},"database.io_requests":{key:"database.io_requests",unit:"requests",label:"Database I/O",precision:0},"telemetry.ingest_gb":{key:"telemetry.ingest_gb",unit:"gb",label:"Telemetry ingest",precision:3},"image.transformations":{key:"image.transformations",unit:"count",label:"Image transformations",precision:0}},Hi=["notify","block_builds","block_deployments","throttle_requests","suspend_functions","serve_static","suspend_project"],oe={notify:0,block_builds:1,block_deployments:2,throttle_requests:3,suspend_functions:4,serve_static:5,suspend_project:6};var Ku=1e6;function tr(e){if(e.tiers&&e.tiers.length>0)return e.tiers;return[{upToQuantity:null,microCentsPerUnit:e.microCentsPerUnit??0}]}function Fa(e,t){if(!(e>0))return 0;let r=[...t].sort((s,a)=>{if(s.upToQuantity===null)return 1;if(a.upToQuantity===null)return-1;return s.upToQuantity-a.upToQuantity}),n=e,o=0,i=0;for(let s of r){if(n<=0)break;let d=(s.upToQuantity===null?1/0:s.upToQuantity)-o;if(d<=0)continue;let c=Math.min(n,d);i+=c*s.microCentsPerUnit,n-=c,o+=c}if(n>0){let s=r.reduce((a,d)=>Math.max(a,d.microCentsPerUnit),0);i+=n*s}return i}function nd(e,t,r,n){let o=e.entries.filter((a)=>a.meter===t);if(o.length===0)return;let i=o.filter((a)=>a.provider===r),s=i.length>0?i:o.filter((a)=>a.provider==="*");return s.find((a)=>a.region===n)??s.find((a)=>a.region==null)}function ns(e,t,r=0){let n=nd(e,t.meter,t.provider,t.region),o=Math.max(0,t.quantity);if(!n)return{meter:t.meter,provider:t.provider??"unknown",region:t.region,quantity:o,includedQuantity:0,billableQuantity:o,costCents:0,unpriced:!0};let i=Math.max(0,n.includedQuantity??0),s=Math.max(0,r-i),a=Math.max(0,i-Math.max(0,r)),d=Math.min(o,a),c=o-d,u=tr(n),p=Fa(s+c,u)-Fa(s,u);return{meter:t.meter,provider:n.provider,region:n.region??t.region,quantity:o,includedQuantity:d,billableQuantity:c,costCents:p/1e6,unpriced:!1}}function Ju(e,t){let r=new Map,n=[];for(let o of t){let i=`${o.meter}\x00${o.provider??""}\x00${o.region??""}`,s=r.get(i)??0,a=ns(e,o,s);r.set(i,s+a.quantity),n.push(a)}return{currency:e.currency,totalCents:n.reduce((o,i)=>o+i.costCents,0),lines:n,unpricedMeters:[...new Set(n.filter((o)=>o.unpriced).map((o)=>String(o.meter)))]}}function Xu(e){return Math.round(e*100)/100}function Qu(e,...t){let r=new Map,n=(i)=>`${i.meter}\x00${i.provider}\x00${i.region??""}`;for(let i of e.entries)r.set(n(i),i);let o=e.currency;for(let i of t){o=i.currency||o;for(let s of i.entries)r.set(n(s),s)}return{currency:o,entries:[...r.values()]}}var V=(e)=>Math.round(e*1e6),N=(e)=>Math.round(e*1e6),ja={currency:"USD",entries:[{meter:"edge.requests",provider:"aws",microCentsPerUnit:N(0.00075)},{meter:"edge.egress_gb",provider:"aws",includedQuantity:100,tiers:[{upToQuantity:10240,microCentsPerUnit:V(8.5)},{upToQuantity:51200,microCentsPerUnit:V(8)},{upToQuantity:null,microCentsPerUnit:V(6)}]},{meter:"function.invocations",provider:"aws",includedQuantity:1e6,microCentsPerUnit:N(0.002)},{meter:"function.gb_seconds",provider:"aws",includedQuantity:400000,microCentsPerUnit:N(0.00166667)},{meter:"storage.gb_hours",provider:"aws",microCentsPerUnit:N(0.010958904109589041)},{meter:"object.egress_gb",provider:"aws",includedQuantity:100,microCentsPerUnit:V(9)},{meter:"object.requests",provider:"aws",microCentsPerUnit:N(0.000039999999999999996)},{meter:"database.gb_hours",provider:"aws",microCentsPerUnit:N(0.015753424657534248)},{meter:"compute.instance_hours",provider:"aws",microCentsPerUnit:N(4.16)},{meter:"edge.egress_gb",provider:"hetzner",includedQuantity:20480,microCentsPerUnit:V(0.108)},{meter:"object.egress_gb",provider:"hetzner",includedQuantity:1024,microCentsPerUnit:V(0.108)},{meter:"compute.instance_hours",provider:"hetzner",microCentsPerUnit:N(0.95)},{meter:"storage.gb_hours",provider:"hetzner",microCentsPerUnit:N(0.006027397260273972)},{meter:"edge.requests",provider:"hetzner",microCentsPerUnit:0},{meter:"edge.requests",provider:"local",microCentsPerUnit:0},{meter:"edge.egress_gb",provider:"local",microCentsPerUnit:0},{meter:"function.invocations",provider:"local",microCentsPerUnit:0},{meter:"function.gb_seconds",provider:"local",microCentsPerUnit:0},{meter:"build.minutes",provider:"*",includedQuantity:6000,microCentsPerUnit:N(0.8)},{meter:"telemetry.ingest_gb",provider:"*",includedQuantity:5,microCentsPerUnit:V(50)},{meter:"image.transformations",provider:"*",includedQuantity:5000,microCentsPerUnit:N(0.05)}]};var tt=new Map;function rt(e){let t=tt.get(e);if(!t)t=new Intl.DateTimeFormat("en-US",{timeZone:e,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short",hourCycle:"h23"}),tt.set(e,t);return t}var rr={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6};function qi(e){try{return rt(e),!0}catch{return!1}}function is(e,t){let r=rt(t).formatToParts(e),n=(o)=>r.find((i)=>i.type===o)?.value??"0";return{year:Number(n("year")),month:Number(n("month")),day:Number(n("day")),hour:Number(n("hour")),minute:Number(n("minute")),second:Number(n("second")),weekday:rr[n("weekday")]??0}}function Va(e,t){let r=is(e,t);return Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second)-Math.floor(e.getTime()/1000)*1000}function Qr(e,t,r,n,o=0){let i=Date.UTC(t,r-1,n,o),s=new Date(i-Va(new Date(i),e));return new Date(i-Va(s,e))}function nr(e,t){return new Date(Date.UTC(e,t-1,1)).toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"})}function gr(e,t,r=new Date){let n=qi(t)?t:"UTC",o=is(r,n),i,s,a;if(e==="daily")i=Qr(n,o.year,o.month,o.day),s=Qr(n,o.year,o.month,o.day+1),a=`${o.year}-${String(o.month).padStart(2,"0")}-${String(o.day).padStart(2,"0")}`;else if(e==="weekly"){let u=(o.weekday+6)%7;i=Qr(n,o.year,o.month,o.day-u),s=Qr(n,o.year,o.month,o.day-u+7);let p=is(i,n);a=`week of ${p.year}-${String(p.month).padStart(2,"0")}-${String(p.day).padStart(2,"0")}`}else i=Qr(n,o.year,o.month,1),s=Qr(n,o.year,o.month+1,1),a=nr(o.year,o.month);let d=s.getTime()-i.getTime(),c=Math.max(0,Math.min(d,r.getTime()-i.getTime()));return{start:i.toISOString(),end:s.toISOString(),elapsedMs:c,totalMs:d,label:a}}function Yu(e,t,r=new Date){let n=gr(e,t,r),o=new Date(new Date(n.start).getTime()-1),i=gr(e,t,o);return{...i,elapsedMs:i.totalMs}}function ti(e){let r=(typeof e==="string"?new Date(e):e).getTime();if(!Number.isFinite(r))throw Error("hourBucket requires a valid date");return new Date(Math.floor(r/3600000)*3600000).toISOString()}function Zu(e,t,r=9600){let n=Math.floor(new Date(e).getTime()/3600000)*3600000,o=new Date(t).getTime();if(!Number.isFinite(n)||!Number.isFinite(o))throw Error("hourBucketsBetween requires valid dates");let i=[];for(let s=n;s<o&&i.length<r;s+=3600000)i.push(new Date(s).toISOString());return i}import{createHash as or}from"node:crypto";var le=1073741824,za=[{match:"request.count",meter:"edge.requests"},{match:"traffic.requests",meter:"edge.requests"},{match:"http.request",meter:"edge.requests",field:"count"},{match:"traffic.bytes_out",meter:"edge.egress_gb",scale:1/le},{match:"storage.egress.day",meter:"object.egress_gb",scale:1/le},{match:"storage.egress.month",meter:"object.egress_gb",scale:1/le,cumulative:!0},{match:"storage.egress.day_downloads",meter:"object.requests"},{match:"function.invocation",meter:"function.invocations",field:"count"},{match:"function.duration_ms",meter:"function.gb_seconds",scale:0.001},{match:"build.duration_ms",meter:"build.minutes",scale:0.000016666666666666667},{match:"telemetry.ingest_bytes",meter:"telemetry.ingest_gb",scale:1/le},{match:"image.transform",meter:"image.transformations",field:"count"}];function ir(e,t){return e.match.endsWith("*")?t.startsWith(e.match.slice(0,-1)):e.match===t}function id(e,t=za){return t.find((r)=>!r.match.endsWith("*")&&r.match===e)??t.find((r)=>ir(r,e))}function sr(e,t){let r=t.field??"value",n=r==="count"?1:r==="bytesOut"?e.bytesOut:r==="bytesIn"?e.bytesIn:r==="durationMs"?e.durationMs:e.value;if(n==null||!Number.isFinite(n))return;return n*(t.scale??1)}function od(e,t){return or("sha256").update([t,e.meter,e.organizationId,e.projectId??"",e.environmentId??"",e.resourceId??"",e.timestamp].join("\x00")).digest("hex").slice(0,32)}class os{resetToleranceRatio;last=new Map;constructor(e=0.999){this.resetToleranceRatio=e}delta(e,t,r=new Date){if(!Number.isFinite(t)||t<0)return;let n=new Date(r).getTime(),o=this.last.get(e);if(!o)return this.last.set(e,{value:t,at:n}),t>0?t:void 0;if(n<o.at)return;if(t<o.value&&t>=o.value*this.resetToleranceRatio)return;if(this.last.set(e,{value:t,at:n}),t>=o.value){let i=t-o.value;return i>0?i:void 0}return t>0?t:void 0}prune(e){let t=e.getTime(),r=0;for(let[n,o]of this.last)if(o.at<t)this.last.delete(n),r++;return r}get size(){return this.last.size}}function nt(e,t){let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function Ha(e,t,r={}){let n=r.mappings??za,o=r.counters,i=[];for(let s of t){let a=id(s.name,n);if(!a)continue;let d=sr(s,a);if(d==null)continue;if(a.cumulative){if(!o)continue;let u=[s.projectId,s.environmentId??"",s.resourceId??"",s.name,s.source].join("\x00"),p=o.delta(u,d,s.timestamp);if(p==null)continue;d=p}if(!(d>0))continue;let c={organizationId:e,projectId:s.projectId,environmentId:s.environmentId,resourceId:s.resourceId,provider:nt(s.attributes,"provider")??r.defaultProvider,region:s.region??nt(s.attributes,"region"),meter:a.meter,quantity:d,timestamp:s.timestamp,attributes:{source:s.source,signal:s.name}};i.push({...c,key:od(c,s.id)})}return i}function qa(e){let t=new Map;for(let r of e){let n=new Date(Math.floor(new Date(r.timestamp).getTime()/3600000)*3600000).toISOString(),o=[r.organizationId,r.projectId??"",r.environmentId??"",r.resourceId??"",r.provider??"",r.region??"",r.meter,n].join("\x00"),i=t.get(o);if(i)i.quantity+=r.quantity;else t.set(o,{...r,timestamp:n})}return[...t.values()]}import{createHash as ar}from"node:crypto";var K=(e)=>{if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}},j=(e)=>typeof e==="string"&&e!==""?e:void 0,ue=(e)=>Number(e)===1,ot=(e)=>e==null?void 0:Number(e);function it(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:j(e.project_id),environmentId:j(e.environment_id),name:String(e.name),period:String(e.period),timezone:String(e.timezone),currency:String(e.currency),softLimitCents:ot(e.soft_limit_cents),hardLimitCents:ot(e.hard_limit_cents),thresholds:K(e.thresholds),meters:K(e.meters),graceSeconds:Number(e.grace_seconds),hysteresisPercent:Number(e.hysteresis_percent),dryRun:ue(e.dry_run),enabled:ue(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Ae(e){return{id:String(e.id),budgetId:String(e.budget_id),organizationId:String(e.organization_id),projectId:j(e.project_id),environmentId:j(e.environment_id),action:String(e.action),state:String(e.state),reason:String(e.reason),restore:K(e.restore),triggeredAtPercent:Number(e.triggered_at_percent),simulated:ue(e.simulated),appliedAt:j(e.applied_at),releasedAt:j(e.released_at),error:j(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function st(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:j(e.project_id),environmentId:j(e.environment_id),signal:String(e.signal),direction:String(e.direction),observed:Number(e.observed),expected:Number(e.expected),score:Number(e.score),deltaPercent:Number(e.delta_percent),severity:String(e.severity),bucketStart:String(e.bucket_start),evidence:K(e.evidence),acknowledgedAt:j(e.acknowledged_at),createdAt:String(e.created_at)}}function dr(e){return{organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),provider:String(e.provider),region:String(e.region),meter:String(e.meter),bucketStart:String(e.bucket_start),quantity:Number(e.quantity),costCents:Number(e.cost_cents),sampleCount:Number(e.sample_count),updatedAt:String(e.updated_at)}}function fr(e,t,r){return[e,t??"",r??""].join("/")}var Wi=[{atPercent:50,actions:["notify"]},{atPercent:80,actions:["notify"]},{atPercent:100,actions:["notify"],onProjection:!0},{atPercent:100,actions:["notify","block_builds","block_deployments"]},{atPercent:115,actions:["notify","block_builds","block_deployments","throttle_requests"]}];class hr{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return(this.options.now?.()??new Date).toISOString()}get priceBook(){return this.options.priceBook??ja}query(e,t=[]){return this.controlPlane.database.query(e).all(...t)}createBudget(e){let t=e.name.trim();if(!t)throw Error("Budgets require a name.");if(e.softLimitCents==null&&e.hardLimitCents==null)throw Error("A budget needs a soft limit, a hard limit, or both.");if(e.softLimitCents!=null&&e.hardLimitCents!=null&&e.softLimitCents>e.hardLimitCents)throw Error("The soft limit must not exceed the hard limit.");let r=e.timezone??"UTC";if(!qi(r))throw Error(`Unknown timezone: ${r}`);let n=(e.thresholds??[...Wi]).filter((s)=>Number.isFinite(s.atPercent)&&s.atPercent>=0);if(e.environmentId&&!e.projectId)throw Error("An environment-scoped budget must also name its project.");let o=crypto.randomUUID(),i=this.now();return this.controlPlane.database.run("INSERT INTO spend_budgets (id,organization_id,project_id,environment_id,name,period,timezone,currency,soft_limit_cents,hard_limit_cents,thresholds,meters,grace_seconds,hysteresis_percent,dry_run,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1,?,?)",[o,e.organizationId,e.projectId??null,e.environmentId??null,t,e.period,r,e.currency??"USD",e.softLimitCents??null,e.hardLimitCents??null,JSON.stringify(n),JSON.stringify(e.meters??[]),Math.max(0,Math.floor(e.graceSeconds??0)),Math.max(0,e.hysteresisPercent??5),e.dryRun?1:0,e.enabled===!1?0:1,i,i]),this.getBudget(o)}getBudget(e){let t=this.query("SELECT * FROM spend_budgets WHERE id = ?",[e])[0];return t?it(t):void 0}listBudgets(e){let t=["organization_id = ?"],r=[e.organizationId];if(e.projectId)t.push("(project_id IS NULL OR project_id = ?)"),r.push(e.projectId);if(e.enabledOnly)t.push("enabled = 1");return this.query(`SELECT * FROM spend_budgets WHERE ${t.join(" AND ")} ORDER BY created_at`,r).map(it)}budgetsForScope(e,t,r){return this.listBudgets({organizationId:e,enabledOnly:!0}).filter((n)=>{if(n.projectId&&n.projectId!==t)return!1;if(n.environmentId&&n.environmentId!==r)return!1;return!0}).sort((n,o)=>Number(!!n.projectId)-Number(!!o.projectId)||Number(!!n.environmentId)-Number(!!o.environmentId))}updateBudget(e,t,r){let n=this.getBudget(e);if(!n)throw Error("Budget was not found.");if(r!=null&&r!==n.version)throw Error(`Budget was modified concurrently (expected version ${r}, found ${n.version}).`);let o={...n,...t};if(o.softLimitCents==null&&o.hardLimitCents==null)throw Error("A budget needs a soft limit, a hard limit, or both.");if(o.softLimitCents!=null&&o.hardLimitCents!=null&&o.softLimitCents>o.hardLimitCents)throw Error("The soft limit must not exceed the hard limit.");if(t.timezone&&!qi(t.timezone))throw Error(`Unknown timezone: ${t.timezone}`);return this.controlPlane.database.run("UPDATE spend_budgets SET name=?,period=?,timezone=?,currency=?,soft_limit_cents=?,hard_limit_cents=?,thresholds=?,meters=?,grace_seconds=?,hysteresis_percent=?,dry_run=?,enabled=?,version=version+1,updated_at=? WHERE id=?",[o.name,o.period,o.timezone,o.currency??"USD",o.softLimitCents??null,o.hardLimitCents??null,JSON.stringify(o.thresholds??[]),JSON.stringify(o.meters??[]),Math.max(0,Math.floor(o.graceSeconds??0)),Math.max(0,o.hysteresisPercent??5),o.dryRun?1:0,o.enabled===!1?0:1,this.now(),e]),this.getBudget(e)}deleteBudget(e){return this.controlPlane.database.run("DELETE FROM spend_budgets WHERE id = ?",[e]).changes>0}ingestUsage(e){let t={applied:0,duplicates:0,costCents:0,unpricedMeters:[]},r=new Set,n=this.now();return this.controlPlane.database.transaction((i)=>{for(let s of i){if(!(s.quantity>0)||!Number.isFinite(s.quantity))continue;let a=s.key??this.deltaFallbackKey(s);if(this.controlPlane.database.run("INSERT OR IGNORE INTO spend_usage_receipts (key,organization_id,bucket_start,created_at) VALUES (?,?,?,?)",[a,s.organizationId,ti(s.timestamp),n]).changes===0){t.duplicates++;continue}let c={projectId:s.projectId??"",environmentId:s.environmentId??"",resourceId:s.resourceId??"",provider:s.provider??"",region:s.region??""},u=this.periodQuantity(s),p=ns(this.priceBook,{meter:s.meter,quantity:s.quantity,provider:s.provider,region:s.region},u);if(p.unpriced)r.add(String(s.meter));this.controlPlane.database.run(`INSERT INTO spend_usage (organization_id,project_id,environment_id,resource_id,provider,region,meter,bucket_start,quantity,cost_cents,sample_count,updated_at)
+import{te,h}from"./chunk-21jwbrap.js";import{Zi}from"./chunk-wsedynyb.js";var Gu=["edge.requests","edge.egress_gb","function.invocations","function.gb_seconds","build.minutes","compute.instance_hours","storage.gb_hours","object.egress_gb","object.requests","database.gb_hours","database.io_requests","telemetry.ingest_gb","image.transformations"],Xr={"edge.requests":{key:"edge.requests",unit:"requests",label:"Edge requests",precision:0},"edge.egress_gb":{key:"edge.egress_gb",unit:"gb",label:"Edge egress",precision:3},"function.invocations":{key:"function.invocations",unit:"invocations",label:"Function invocations",precision:0},"function.gb_seconds":{key:"function.gb_seconds",unit:"gb_seconds",label:"Function compute",precision:2},"build.minutes":{key:"build.minutes",unit:"minutes",label:"Build minutes",precision:2},"compute.instance_hours":{key:"compute.instance_hours",unit:"hours",label:"Instance hours",precision:2},"storage.gb_hours":{key:"storage.gb_hours",unit:"gb_hours",label:"Block storage",precision:2},"object.egress_gb":{key:"object.egress_gb",unit:"gb",label:"Object storage egress",precision:3},"object.requests":{key:"object.requests",unit:"requests",label:"Object storage requests",precision:0},"database.gb_hours":{key:"database.gb_hours",unit:"gb_hours",label:"Database storage",precision:2},"database.io_requests":{key:"database.io_requests",unit:"requests",label:"Database I/O",precision:0},"telemetry.ingest_gb":{key:"telemetry.ingest_gb",unit:"gb",label:"Telemetry ingest",precision:3},"image.transformations":{key:"image.transformations",unit:"count",label:"Image transformations",precision:0}},Hi=["notify","block_builds","block_deployments","throttle_requests","suspend_functions","serve_static","suspend_project"],oe={notify:0,block_builds:1,block_deployments:2,throttle_requests:3,suspend_functions:4,serve_static:5,suspend_project:6};var Ku=1e6;function tr(e){if(e.tiers&&e.tiers.length>0)return e.tiers;return[{upToQuantity:null,microCentsPerUnit:e.microCentsPerUnit??0}]}function Fa(e,t){if(!(e>0))return 0;let r=[...t].sort((s,a)=>{if(s.upToQuantity===null)return 1;if(a.upToQuantity===null)return-1;return s.upToQuantity-a.upToQuantity}),n=e,o=0,i=0;for(let s of r){if(n<=0)break;let d=(s.upToQuantity===null?1/0:s.upToQuantity)-o;if(d<=0)continue;let c=Math.min(n,d);i+=c*s.microCentsPerUnit,n-=c,o+=c}if(n>0){let s=r.reduce((a,d)=>Math.max(a,d.microCentsPerUnit),0);i+=n*s}return i}function nd(e,t,r,n){let o=e.entries.filter((a)=>a.meter===t);if(o.length===0)return;let i=o.filter((a)=>a.provider===r),s=i.length>0?i:o.filter((a)=>a.provider==="*");return s.find((a)=>a.region===n)??s.find((a)=>a.region==null)}function ns(e,t,r=0){let n=nd(e,t.meter,t.provider,t.region),o=Math.max(0,t.quantity);if(!n)return{meter:t.meter,provider:t.provider??"unknown",region:t.region,quantity:o,includedQuantity:0,billableQuantity:o,costCents:0,unpriced:!0};let i=Math.max(0,n.includedQuantity??0),s=Math.max(0,r-i),a=Math.max(0,i-Math.max(0,r)),d=Math.min(o,a),c=o-d,u=tr(n),p=Fa(s+c,u)-Fa(s,u);return{meter:t.meter,provider:n.provider,region:n.region??t.region,quantity:o,includedQuantity:d,billableQuantity:c,costCents:p/1e6,unpriced:!1}}function Ju(e,t){let r=new Map,n=[];for(let o of t){let i=`${o.meter}\x00${o.provider??""}\x00${o.region??""}`,s=r.get(i)??0,a=ns(e,o,s);r.set(i,s+a.quantity),n.push(a)}return{currency:e.currency,totalCents:n.reduce((o,i)=>o+i.costCents,0),lines:n,unpricedMeters:[...new Set(n.filter((o)=>o.unpriced).map((o)=>String(o.meter)))]}}function Xu(e){return Math.round(e*100)/100}function Qu(e,...t){let r=new Map,n=(i)=>`${i.meter}\x00${i.provider}\x00${i.region??""}`;for(let i of e.entries)r.set(n(i),i);let o=e.currency;for(let i of t){o=i.currency||o;for(let s of i.entries)r.set(n(s),s)}return{currency:o,entries:[...r.values()]}}var V=(e)=>Math.round(e*1e6),N=(e)=>Math.round(e*1e6),ja={currency:"USD",entries:[{meter:"edge.requests",provider:"aws",microCentsPerUnit:N(0.00075)},{meter:"edge.egress_gb",provider:"aws",includedQuantity:100,tiers:[{upToQuantity:10240,microCentsPerUnit:V(8.5)},{upToQuantity:51200,microCentsPerUnit:V(8)},{upToQuantity:null,microCentsPerUnit:V(6)}]},{meter:"function.invocations",provider:"aws",includedQuantity:1e6,microCentsPerUnit:N(0.002)},{meter:"function.gb_seconds",provider:"aws",includedQuantity:400000,microCentsPerUnit:N(0.00166667)},{meter:"storage.gb_hours",provider:"aws",microCentsPerUnit:N(0.010958904109589041)},{meter:"object.egress_gb",provider:"aws",includedQuantity:100,microCentsPerUnit:V(9)},{meter:"object.requests",provider:"aws",microCentsPerUnit:N(0.000039999999999999996)},{meter:"database.gb_hours",provider:"aws",microCentsPerUnit:N(0.015753424657534248)},{meter:"compute.instance_hours",provider:"aws",microCentsPerUnit:N(4.16)},{meter:"edge.egress_gb",provider:"hetzner",includedQuantity:20480,microCentsPerUnit:V(0.108)},{meter:"object.egress_gb",provider:"hetzner",includedQuantity:1024,microCentsPerUnit:V(0.108)},{meter:"compute.instance_hours",provider:"hetzner",microCentsPerUnit:N(0.95)},{meter:"storage.gb_hours",provider:"hetzner",microCentsPerUnit:N(0.006027397260273972)},{meter:"edge.requests",provider:"hetzner",microCentsPerUnit:0},{meter:"edge.requests",provider:"local",microCentsPerUnit:0},{meter:"edge.egress_gb",provider:"local",microCentsPerUnit:0},{meter:"function.invocations",provider:"local",microCentsPerUnit:0},{meter:"function.gb_seconds",provider:"local",microCentsPerUnit:0},{meter:"build.minutes",provider:"*",includedQuantity:6000,microCentsPerUnit:N(0.8)},{meter:"telemetry.ingest_gb",provider:"*",includedQuantity:5,microCentsPerUnit:V(50)},{meter:"image.transformations",provider:"*",includedQuantity:5000,microCentsPerUnit:N(0.05)}]};var tt=new Map;function rt(e){let t=tt.get(e);if(!t)t=new Intl.DateTimeFormat("en-US",{timeZone:e,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short",hourCycle:"h23"}),tt.set(e,t);return t}var rr={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6};function qi(e){try{return rt(e),!0}catch{return!1}}function is(e,t){let r=rt(t).formatToParts(e),n=(o)=>r.find((i)=>i.type===o)?.value??"0";return{year:Number(n("year")),month:Number(n("month")),day:Number(n("day")),hour:Number(n("hour")),minute:Number(n("minute")),second:Number(n("second")),weekday:rr[n("weekday")]??0}}function Va(e,t){let r=is(e,t);return Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second)-Math.floor(e.getTime()/1000)*1000}function Qr(e,t,r,n,o=0){let i=Date.UTC(t,r-1,n,o),s=new Date(i-Va(new Date(i),e));return new Date(i-Va(s,e))}function nr(e,t){return new Date(Date.UTC(e,t-1,1)).toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"})}function gr(e,t,r=new Date){let n=qi(t)?t:"UTC",o=is(r,n),i,s,a;if(e==="daily")i=Qr(n,o.year,o.month,o.day),s=Qr(n,o.year,o.month,o.day+1),a=`${o.year}-${String(o.month).padStart(2,"0")}-${String(o.day).padStart(2,"0")}`;else if(e==="weekly"){let u=(o.weekday+6)%7;i=Qr(n,o.year,o.month,o.day-u),s=Qr(n,o.year,o.month,o.day-u+7);let p=is(i,n);a=`week of ${p.year}-${String(p.month).padStart(2,"0")}-${String(p.day).padStart(2,"0")}`}else i=Qr(n,o.year,o.month,1),s=Qr(n,o.year,o.month+1,1),a=nr(o.year,o.month);let d=s.getTime()-i.getTime(),c=Math.max(0,Math.min(d,r.getTime()-i.getTime()));return{start:i.toISOString(),end:s.toISOString(),elapsedMs:c,totalMs:d,label:a}}function Yu(e,t,r=new Date){let n=gr(e,t,r),o=new Date(new Date(n.start).getTime()-1),i=gr(e,t,o);return{...i,elapsedMs:i.totalMs}}function ti(e){let r=(typeof e==="string"?new Date(e):e).getTime();if(!Number.isFinite(r))throw Error("hourBucket requires a valid date");return new Date(Math.floor(r/3600000)*3600000).toISOString()}function Zu(e,t,r=9600){let n=Math.floor(new Date(e).getTime()/3600000)*3600000,o=new Date(t).getTime();if(!Number.isFinite(n)||!Number.isFinite(o))throw Error("hourBucketsBetween requires valid dates");let i=[];for(let s=n;s<o&&i.length<r;s+=3600000)i.push(new Date(s).toISOString());return i}import{createHash as or}from"node:crypto";var le=1073741824,za=[{match:"request.count",meter:"edge.requests"},{match:"traffic.requests",meter:"edge.requests"},{match:"http.request",meter:"edge.requests",field:"count"},{match:"traffic.bytes_out",meter:"edge.egress_gb",scale:1/le},{match:"storage.egress.day",meter:"object.egress_gb",scale:1/le},{match:"storage.egress.month",meter:"object.egress_gb",scale:1/le,cumulative:!0},{match:"storage.egress.day_downloads",meter:"object.requests"},{match:"function.invocation",meter:"function.invocations",field:"count"},{match:"function.duration_ms",meter:"function.gb_seconds",scale:0.001},{match:"build.duration_ms",meter:"build.minutes",scale:0.000016666666666666667},{match:"telemetry.ingest_bytes",meter:"telemetry.ingest_gb",scale:1/le},{match:"image.transform",meter:"image.transformations",field:"count"}];function ir(e,t){return e.match.endsWith("*")?t.startsWith(e.match.slice(0,-1)):e.match===t}function id(e,t=za){return t.find((r)=>!r.match.endsWith("*")&&r.match===e)??t.find((r)=>ir(r,e))}function sr(e,t){let r=t.field??"value",n=r==="count"?1:r==="bytesOut"?e.bytesOut:r==="bytesIn"?e.bytesIn:r==="durationMs"?e.durationMs:e.value;if(n==null||!Number.isFinite(n))return;return n*(t.scale??1)}function od(e,t){return or("sha256").update([t,e.meter,e.organizationId,e.projectId??"",e.environmentId??"",e.resourceId??"",e.timestamp].join("\x00")).digest("hex").slice(0,32)}class os{resetToleranceRatio;last=new Map;constructor(e=0.999){this.resetToleranceRatio=e}delta(e,t,r=new Date){if(!Number.isFinite(t)||t<0)return;let n=new Date(r).getTime(),o=this.last.get(e);if(!o)return this.last.set(e,{value:t,at:n}),t>0?t:void 0;if(n<o.at)return;if(t<o.value&&t>=o.value*this.resetToleranceRatio)return;if(this.last.set(e,{value:t,at:n}),t>=o.value){let i=t-o.value;return i>0?i:void 0}return t>0?t:void 0}prune(e){let t=e.getTime(),r=0;for(let[n,o]of this.last)if(o.at<t)this.last.delete(n),r++;return r}get size(){return this.last.size}}function nt(e,t){let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function Ha(e,t,r={}){let n=r.mappings??za,o=r.counters,i=[];for(let s of t){let a=id(s.name,n);if(!a)continue;let d=sr(s,a);if(d==null)continue;if(a.cumulative){if(!o)continue;let u=[s.projectId,s.environmentId??"",s.resourceId??"",s.name,s.source].join("\x00"),p=o.delta(u,d,s.timestamp);if(p==null)continue;d=p}if(!(d>0))continue;let c={organizationId:e,projectId:s.projectId,environmentId:s.environmentId,resourceId:s.resourceId,provider:nt(s.attributes,"provider")??r.defaultProvider,region:s.region??nt(s.attributes,"region"),meter:a.meter,quantity:d,timestamp:s.timestamp,attributes:{source:s.source,signal:s.name}};i.push({...c,key:od(c,s.id)})}return i}function qa(e){let t=new Map;for(let r of e){let n=new Date(Math.floor(new Date(r.timestamp).getTime()/3600000)*3600000).toISOString(),o=[r.organizationId,r.projectId??"",r.environmentId??"",r.resourceId??"",r.provider??"",r.region??"",r.meter,n].join("\x00"),i=t.get(o);if(i)i.quantity+=r.quantity;else t.set(o,{...r,timestamp:n})}return[...t.values()]}import{createHash as ar}from"node:crypto";var K=(e)=>{if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}},j=(e)=>typeof e==="string"&&e!==""?e:void 0,ue=(e)=>Number(e)===1,ot=(e)=>e==null?void 0:Number(e);function it(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:j(e.project_id),environmentId:j(e.environment_id),name:String(e.name),period:String(e.period),timezone:String(e.timezone),currency:String(e.currency),softLimitCents:ot(e.soft_limit_cents),hardLimitCents:ot(e.hard_limit_cents),thresholds:K(e.thresholds),meters:K(e.meters),graceSeconds:Number(e.grace_seconds),hysteresisPercent:Number(e.hysteresis_percent),dryRun:ue(e.dry_run),enabled:ue(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Ae(e){return{id:String(e.id),budgetId:String(e.budget_id),organizationId:String(e.organization_id),projectId:j(e.project_id),environmentId:j(e.environment_id),action:String(e.action),state:String(e.state),reason:String(e.reason),restore:K(e.restore),triggeredAtPercent:Number(e.triggered_at_percent),simulated:ue(e.simulated),appliedAt:j(e.applied_at),releasedAt:j(e.released_at),error:j(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function st(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:j(e.project_id),environmentId:j(e.environment_id),signal:String(e.signal),direction:String(e.direction),observed:Number(e.observed),expected:Number(e.expected),score:Number(e.score),deltaPercent:Number(e.delta_percent),severity:String(e.severity),bucketStart:String(e.bucket_start),evidence:K(e.evidence),acknowledgedAt:j(e.acknowledged_at),createdAt:String(e.created_at)}}function dr(e){return{organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),provider:String(e.provider),region:String(e.region),meter:String(e.meter),bucketStart:String(e.bucket_start),quantity:Number(e.quantity),costCents:Number(e.cost_cents),sampleCount:Number(e.sample_count),updatedAt:String(e.updated_at)}}function fr(e,t,r){return[e,t??"",r??""].join("/")}var Wi=[{atPercent:50,actions:["notify"]},{atPercent:80,actions:["notify"]},{atPercent:100,actions:["notify"],onProjection:!0},{atPercent:100,actions:["notify","block_builds","block_deployments"]},{atPercent:115,actions:["notify","block_builds","block_deployments","throttle_requests"]}];class hr{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return(this.options.now?.()??new Date).toISOString()}get priceBook(){return this.options.priceBook??ja}query(e,t=[]){return this.controlPlane.database.query(e).all(...t)}createBudget(e){let t=e.name.trim();if(!t)throw Error("Budgets require a name.");if(e.softLimitCents==null&&e.hardLimitCents==null)throw Error("A budget needs a soft limit, a hard limit, or both.");if(e.softLimitCents!=null&&e.hardLimitCents!=null&&e.softLimitCents>e.hardLimitCents)throw Error("The soft limit must not exceed the hard limit.");let r=e.timezone??"UTC";if(!qi(r))throw Error(`Unknown timezone: ${r}`);let n=(e.thresholds??[...Wi]).filter((s)=>Number.isFinite(s.atPercent)&&s.atPercent>=0);if(e.environmentId&&!e.projectId)throw Error("An environment-scoped budget must also name its project.");let o=crypto.randomUUID(),i=this.now();return this.controlPlane.database.run("INSERT INTO spend_budgets (id,organization_id,project_id,environment_id,name,period,timezone,currency,soft_limit_cents,hard_limit_cents,thresholds,meters,grace_seconds,hysteresis_percent,dry_run,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1,?,?)",[o,e.organizationId,e.projectId??null,e.environmentId??null,t,e.period,r,e.currency??"USD",e.softLimitCents??null,e.hardLimitCents??null,JSON.stringify(n),JSON.stringify(e.meters??[]),Math.max(0,Math.floor(e.graceSeconds??0)),Math.max(0,e.hysteresisPercent??5),e.dryRun?1:0,e.enabled===!1?0:1,i,i]),this.getBudget(o)}getBudget(e){let t=this.query("SELECT * FROM spend_budgets WHERE id = ?",[e])[0];return t?it(t):void 0}listBudgets(e){let t=["organization_id = ?"],r=[e.organizationId];if(e.projectId)t.push("(project_id IS NULL OR project_id = ?)"),r.push(e.projectId);if(e.enabledOnly)t.push("enabled = 1");return this.query(`SELECT * FROM spend_budgets WHERE ${t.join(" AND ")} ORDER BY created_at`,r).map(it)}budgetsForScope(e,t,r){return this.listBudgets({organizationId:e,enabledOnly:!0}).filter((n)=>{if(n.projectId&&n.projectId!==t)return!1;if(n.environmentId&&n.environmentId!==r)return!1;return!0}).sort((n,o)=>Number(!!n.projectId)-Number(!!o.projectId)||Number(!!n.environmentId)-Number(!!o.environmentId))}updateBudget(e,t,r){let n=this.getBudget(e);if(!n)throw Error("Budget was not found.");if(r!=null&&r!==n.version)throw Error(`Budget was modified concurrently (expected version ${r}, found ${n.version}).`);let o={...n,...t};if(o.softLimitCents==null&&o.hardLimitCents==null)throw Error("A budget needs a soft limit, a hard limit, or both.");if(o.softLimitCents!=null&&o.hardLimitCents!=null&&o.softLimitCents>o.hardLimitCents)throw Error("The soft limit must not exceed the hard limit.");if(t.timezone&&!qi(t.timezone))throw Error(`Unknown timezone: ${t.timezone}`);return this.controlPlane.database.run("UPDATE spend_budgets SET name=?,period=?,timezone=?,currency=?,soft_limit_cents=?,hard_limit_cents=?,thresholds=?,meters=?,grace_seconds=?,hysteresis_percent=?,dry_run=?,enabled=?,version=version+1,updated_at=? WHERE id=?",[o.name,o.period,o.timezone,o.currency??"USD",o.softLimitCents??null,o.hardLimitCents??null,JSON.stringify(o.thresholds??[]),JSON.stringify(o.meters??[]),Math.max(0,Math.floor(o.graceSeconds??0)),Math.max(0,o.hysteresisPercent??5),o.dryRun?1:0,o.enabled===!1?0:1,this.now(),e]),this.getBudget(e)}deleteBudget(e){return this.controlPlane.database.run("DELETE FROM spend_budgets WHERE id = ?",[e]).changes>0}ingestUsage(e){let t={applied:0,duplicates:0,costCents:0,unpricedMeters:[]},r=new Set,n=this.now();return this.controlPlane.database.transaction((i)=>{for(let s of i){if(!(s.quantity>0)||!Number.isFinite(s.quantity))continue;let a=s.key??this.deltaFallbackKey(s);if(this.controlPlane.database.run("INSERT OR IGNORE INTO spend_usage_receipts (key,organization_id,bucket_start,created_at) VALUES (?,?,?,?)",[a,s.organizationId,ti(s.timestamp),n]).changes===0){t.duplicates++;continue}let c={projectId:s.projectId??"",environmentId:s.environmentId??"",resourceId:s.resourceId??"",provider:s.provider??"",region:s.region??""},u=this.periodQuantity(s),p=ns(this.priceBook,{meter:s.meter,quantity:s.quantity,provider:s.provider,region:s.region},u);if(p.unpriced)r.add(String(s.meter));this.controlPlane.database.run(`INSERT INTO spend_usage (organization_id,project_id,environment_id,resource_id,provider,region,meter,bucket_start,quantity,cost_cents,sample_count,updated_at)
           VALUES (?,?,?,?,?,?,?,?,?,?,1,?)
           ON CONFLICT(organization_id,project_id,environment_id,resource_id,provider,region,meter,bucket_start) DO UPDATE SET
             quantity = quantity + excluded.quantity,
@@ -31,9 +31,9 @@ import{te,h}from"./chunk-257sygzm.js";import{Zi}from"./chunk-wsedynyb.js";var Gu
       WHERE ${o.join(" AND ")}
       GROUP BY path_template HAVING total >= ? ORDER BY total DESC LIMIT ?`,[...i,n,Math.max(1,Math.min(50,r))]).map((s)=>String(s.path_template))}}function us(e){let t={seasonLength:24,threshold:3.5,minHistory:3,minAbsoluteDelta:0,detectDrops:!1};if(e==="cost")return{...t,minAbsoluteDelta:25};if(e==="edge.requests"||e==="http.requests")return{...t,seasonLength:168,threshold:4,minAbsoluteDelta:1000,detectDrops:!0};if(e==="edge.egress_gb")return{...t,seasonLength:168,threshold:4,minAbsoluteDelta:5};if(e==="function.invocations")return{...t,seasonLength:168,threshold:4,minAbsoluteDelta:1000};if(e==="http.errors")return{...t,seasonLength:168,threshold:4,minAbsoluteDelta:25};if(e==="http.error_rate"||e==="http.client_error_rate")return{...t,seasonLength:168,threshold:3.5,minAbsoluteDelta:0.02};if(e==="http.latency_p95")return{...t,seasonLength:168,threshold:4,minAbsoluteDelta:100};return t}function ec(e){let t=us(e),r=t.seasonLength*(t.minHistory+1);return Math.min(960,Math.max(336,r))}var md="1.3";function _r(e){if(e.startsWith("edge.")||e.startsWith("object.egress"))return"Networking";if(e.startsWith("function.")||e.startsWith("compute.")||e.startsWith("build."))return"Compute";if(e.startsWith("storage.")||e.startsWith("object."))return"Storage";if(e.startsWith("database."))return"Databases";if(e.startsWith("telemetry."))return"Management and Governance";return"Other"}function ct(e){return Xr[e]?.label??e}function lt(e){let t=Xr[e]?.unit;if(t==="gb")return"GB";if(t==="gb_hours")return"GB-Hours";if(t==="gb_seconds")return"GB-Seconds";if(t==="hours")return"Hours";if(t==="minutes")return"Minutes";if(t==="requests")return"Requests";if(t==="invocations")return"Invocations";return"Count"}function Er(e){return`${e.slice(0,10)}T00:00:00.000Z`}function wr(e){return new Date(new Date(e).getTime()+86400000).toISOString()}function Ar(e){return new Date(new Date(e).getTime()+3600000).toISOString()}function tc(e,t){let r=t.currency??"USD",n=(t.granularity??"daily")==="daily",o=new Map;for(let i of e){let s=n?Er(i.bucketStart):i.bucketStart,a=[s,i.meter,i.provider,i.region,i.projectId,i.resourceId].join("\x00"),d=o.get(a);if(d)d.quantity+=i.quantity,d.costCents+=i.costCents;else o.set(a,{rollup:i,quantity:i.quantity,costCents:i.costCents,start:s})}return[...o.values()].sort((i,s)=>i.start.localeCompare(s.start)||String(i.rollup.meter).localeCompare(String(s.rollup.meter))).map(({rollup:i,quantity:s,costCents:a,start:d})=>{let c=Math.round(a)/100,u=i.provider||"ts-cloud";return{FocusVersion:md,ChargePeriodStart:d,ChargePeriodEnd:n?wr(d):Ar(d),BillingPeriodStart:t.billingPeriodStart,BillingPeriodEnd:t.billingPeriodEnd,BillingCurrency:r,BilledCost:c,EffectiveCost:c,ListCost:c,ChargeCategory:"Usage",ChargeDescription:`${ct(i.meter)} on ${u}`,ProviderName:u,PublisherName:u,InvoiceIssuerName:u,ServiceName:ct(i.meter),ServiceCategory:_r(String(i.meter)),SkuId:String(i.meter),PricingUnit:lt(String(i.meter)),PricingQuantity:s,ConsumedQuantity:s,ConsumedUnit:lt(String(i.meter)),RegionId:i.region||void 0,ResourceId:i.resourceId||void 0,SubAccountId:i.projectId||void 0,SubAccountName:i.projectId?t.projectNames?.[i.projectId]??i.projectId:void 0,Tags:{...i.environmentId?{environment:i.environmentId}:{},...i.projectId?{project:i.projectId}:{}}}})}function ps(e){return e.map((t)=>JSON.stringify(t)).join(`
 `)+(e.length>0?`
-`:"")}function*tp(e,t=500){for(let r=0;r<e.length;r+=t)yield ps(e.slice(r,r+t))}class ft{store;counters=new os;breaching=new Map;anomalyConfigs;signals;constructor(e){this.store=e;this.anomalyConfigs=new cs(e.controlPlane),this.signals=new ds(e.controlPlane,e)}ingestTelemetry(e,t,r){let n=Ha(e,t,{counters:this.counters,defaultProvider:r});return this.store.ingestUsage(n)}ingestUsage(e,t=!0){return this.store.ingestUsage(t?qa(e):[...e])}status(e,t=new Date){let{window:r,summary:n}=this.store.budgetSpendCents(e,t),i=this.store.listEnforcements({organizationId:e.organizationId,budgetId:e.id,activeOnly:!0}).filter((a)=>a.state==="active").map((a)=>a.action),s=Ga({budget:e,window:r,actualCents:n.totalCents,series:n.series,activeActions:i,breachingSince:this.breaching.get(e.id),now:t});return{budget:e,decision:s,summary:n,activeActions:i,timeToCap:ri(s.projection.timeToExhaustionMs)}}async runCycle(e){let t=e.now??new Date,r=this.store.budgetsForScope(e.organizationId,e.projectId,e.environmentId),n=[],o=[];for(let s of r){let a=this.status(s,t);this.trackBreach(s,a.decision,t),this.store.recordDecision(a.decision),n.push(a)}let i=Ka(n.map((s)=>s.decision));if(e.handlers){let s={environmentKind:e.environmentKind,...e.policy};for(let a of n){let d=Ja(a.decision,s);if(d.apply.length===0&&d.release.length===0&&d.withheld.length===0)continue;o.push(await Xa(this.store,a.budget,a.decision,d,e.handlers))}}return{organizationId:e.organizationId,statuses:n,level:i.level,actions:i.actions,releases:i.releases,enforcement:o,anomalies:this.detectAnomalies(e,t),evaluatedAt:t.toISOString()}}trackBreach(e,t,r){if(!t.breaches.some((o)=>o.actions.some((i)=>i!=="notify"))){this.breaching.delete(e.id);return}if(!this.breaching.has(e.id))this.breaching.set(e.id,r.toISOString())}detectAnomalies(e,t=new Date,r={}){let n=new Date(Math.floor(t.getTime()/3600000)*3600000).toISOString(),o={organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId},i=e.signals??xt.map((d)=>d.key),s=[],a;for(let d of i){let c=r.seasonLength?Math.max(336,r.seasonLength*((r.minHistory??3)+1)):ec(d),u={from:new Date(new Date(n).getTime()-c*3600000).toISOString(),to:n};if(s.push(...this.detectSignal(d,o,u,r)),!e.routes)continue;if(!ls(d)?.routeAware)continue;a??=this.signals.busiestRoutes(o,u);for(let p of a){if(this.anomalyConfigs.isSilenced(o,{signal:d,route:p}))continue;s.push(...this.detectSignal(d,{...o,route:p},u,r,p))}}return this.signals.resetCache(),s}detectSignal(e,t,r,n,o){let i=this.anomalyConfigs.optionsFor(t,e);if(!i.enabled)return[];if(!o&&this.anomalyConfigs.isSilenced(t,{signal:e}))return[];let s=this.signals.series(e,t,r);if(s.points.length===0)return[];let a=Za(s.points,{...us(e),...i.options,...n});if(!a)return[];let d=this.store.recordAnomaly({organizationId:t.organizationId,projectId:t.projectId,environmentId:t.environmentId,signal:o?`${e}@${o}`:e,direction:a.direction,observed:a.observed,expected:a.expected,score:a.score,deltaPercent:Number.isFinite(a.deltaPercent)?a.deltaPercent:0,severity:i.config?.severity??a.severity,bucketStart:a.bucketStart,evidence:{historySize:a.historySize,deviation:a.deviation,unit:s.unit,populatedBuckets:s.populated,suppressedBuckets:s.suppressed,route:o??null,lookbackFrom:r.from,lookbackTo:r.to}});return d?[d]:[]}usageReport(e){let t=e.now??new Date,r=gr(e.period??"monthly",e.timezone??"UTC",t),n=this.store.summarizeUsage({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,from:r.start,to:r.end}),o=this.store.budgetsForScope(e.organizationId,e.projectId,e.environmentId).map((s)=>{let a=this.status(s,t),d=Gi(s);return{id:s.id,name:s.name,period:s.period,limitCents:d,softLimitCents:s.softLimitCents,hardLimitCents:s.hardLimitCents,spentCents:a.decision.projection.actualCents,remainingCents:d==null?null:Math.max(0,d-a.decision.projection.actualCents),usedPercent:a.decision.usedPercent,projectedCents:a.decision.projection.projectedCents,projectedPercent:a.decision.projectedPercent,projectionConfidence:a.decision.projection.confidence,level:a.decision.level,timeToCap:a.timeToCap,activeActions:a.activeActions,dryRun:s.dryRun}}),i=this.store.listEnforcements({organizationId:e.organizationId,activeOnly:!0});return{organizationId:e.organizationId,projectId:e.projectId??null,environmentId:e.environmentId??null,window:{start:r.start,end:r.end,label:r.label},currency:this.store.priceBook.currency,totalCents:n.totalCents,byMeter:n.byMeter,series:n.series,budgets:o,enforcement:{strongestAction:Qa(i)??null,active:i.map((s)=>({id:s.id,budgetId:s.budgetId,action:s.action,state:s.state,reason:s.reason,simulated:s.simulated,appliedAt:s.appliedAt}))},generatedAt:t.toISOString(),currentBucket:ti(t)}}}function rp(e,t,r,n=1440){let o=new Map(e.map((d)=>[d.bucketStart,d.value])),i=Math.floor(new Date(t).getTime()/3600000)*3600000,s=new Date(r).getTime(),a=[];for(let d=i;d<s&&a.length<n;d+=3600000){let c=new Date(d).toISOString();a.push({bucketStart:c,value:o.get(c)??0})}return a}var rc="spend.gates",Rr={build:["block_builds","suspend_project"],deploy:["block_deployments","suspend_project"],function_invoke:["suspend_functions","serve_static","suspend_project"],request:["suspend_project"]};function pe(e){return`${e.budgetId}:${e.action}`}function Cr(e,t){if(e.organizationId!==t.organizationId)return!1;if(e.projectId&&e.projectId!==t.projectId)return!1;if(e.environmentId&&e.environmentId!==t.environmentId)return!1;return!0}function Pr(e,t){if(e.organizationId!==t.organizationId)return!1;if(t.projectId&&e.projectId!==t.projectId)return!1;if(t.environmentId&&e.environmentId!==t.environmentId)return!1;return!0}function kr(e){let t={...e};for(let r of["projectId","environmentId"])if(t[r]==null)delete t[r];return t}class $t{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}read(){let e=this.controlPlane.getSetting(rc);return Array.isArray(e)?e:[]}write(e){this.controlPlane.setSetting(rc,e)}list(e){return this.read().filter((t)=>!e||Cr(t,e)).sort((t,r)=>oe[r.action]-oe[t.action])}listUnder(e){return this.read().filter((t)=>Pr(t,e)).sort((t,r)=>oe[r.action]-oe[t.action])}open(e){let t=e.appliedAt??(this.options.now?.()??new Date).toISOString(),r=kr({...e,appliedAt:t}),n=this.read().filter((o)=>pe(o)!==pe(r));return n.push(r),this.write(n),r}close(e,t){let r=this.read(),n=r.filter((o)=>pe(o)!==pe({budgetId:e,action:t}));if(n.length===r.length)return!1;return this.write(n),!0}closeBudget(e){let t=this.read(),r=t.filter((n)=>n.budgetId!==e);return this.write(r),t.length-r.length}check(e,t){let r=Rr[e]??[];for(let n of this.list(t)){if(n.simulated)continue;if(!r.includes(n.action))continue;return{allowed:!1,action:n.action,budgetId:n.budgetId,reason:`${n.reason} ${Ki[n.action]}`}}return{allowed:!0}}strongest(e){return this.list(e).find((t)=>!t.simulated)?.action}}class nc extends Error{operation;verdict;code="spend_cap_exceeded";status=402;constructor(e,t){super(t.reason??`A spend cap is blocking this ${e}.`);this.operation=e;this.verdict=t}}function np(e,t,r){let n=e.check(t,r);if(!n.allowed)throw new nc(t,n)}var ut=["notify","block_builds","block_deployments"];function ic(e){let t=e.throttleFactor??0.5;return{apply:async(o,i)=>{let{budget:s,record:a,decision:d}=i;e.gate.open({budgetId:s.id,action:o,organizationId:s.organizationId,projectId:s.projectId,environmentId:s.environmentId,reason:d.reason,simulated:a.simulated});let c={gated:!0};if(!a.simulated&&!ut.includes(o)){let u={projectId:s.projectId,environmentId:s.environmentId},p=e.transport;if(o==="throttle_requests"&&p?.throttleRequests)c={...await p.throttleRequests({...u,factor:t}),gated:!0};else if(o==="suspend_functions"&&p?.suspendFunctions)c={...await p.suspendFunctions(u),gated:!0};else if(o==="serve_static"&&p?.serveStatic)c={...await p.serveStatic(u),gated:!0};else if(o==="suspend_project"&&p?.suspendProject)c={...await p.suspendProject(u),gated:!0};else c={gated:!0,unsupported:!0}}return await e.notify?.({action:o,budgetId:s.id,reason:d.reason,simulated:a.simulated,released:!1}),c},release:async(o,i)=>{let{budget:s,record:a,restore:d}=i,c=e.transport;if(!a.simulated&&!ut.includes(o)&&d.unsupported!==!0){if(o==="throttle_requests"&&c?.restoreRequests)await c.restoreRequests(d);else if(o==="suspend_functions"&&c?.resumeFunctions)await c.resumeFunctions(d);else if(o==="serve_static"&&c?.restoreDynamic)await c.restoreDynamic(d);else if(o==="suspend_project"&&c?.resumeProject)await c.resumeProject(d)}e.gate.close(s.id,o),await e.notify?.({action:o,budgetId:s.id,reason:a.reason,simulated:a.simulated,released:!0})}}}class gd{calls=[];record(e,t){return this.calls.push({method:e,input:t}),{recorded:e}}throttleRequests(e){return this.record("throttleRequests",e)}restoreRequests(e){this.record("restoreRequests",e)}suspendFunctions(e){return this.record("suspendFunctions",e)}resumeFunctions(e){this.record("resumeFunctions",e)}serveStatic(e){return this.record("serveStatic",e)}restoreDynamic(e){this.record("restoreDynamic",e)}suspendProject(e){return this.record("suspendProject",e)}resumeProject(e){this.record("resumeProject",e)}}import{createCipheriv as Tr,createDecipheriv as Dr,createHash as Et,randomBytes as Or}from"node:crypto";var O=(e)=>{if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}},E=(e)=>typeof e==="string"?e:void 0,Te=(e)=>Number(e)===1,M=(e,t,r,n)=>{let o=Number(e);return Number.isFinite(o)?Math.min(n,Math.max(r,Math.floor(o))):t},ht=(e)=>Et("sha256").update(e).digest("hex").slice(0,16);function yt(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:E(e.environment_id),resourceId:E(e.resource_id),name:String(e.name),kind:String(e.kind),target:String(e.target),config:O(e.config),intervalSeconds:Number(e.interval_seconds),timeoutSeconds:Number(e.timeout_seconds),failureThreshold:Number(e.failure_threshold),recoveryThreshold:Number(e.recovery_threshold),regions:O(e.regions),enabled:Te(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function vt(e){return{id:String(e.id),checkId:String(e.check_id),status:String(e.status),agent:String(e.agent),region:E(e.region),statusCode:e.status_code==null?void 0:Number(e.status_code),message:E(e.message),timings:O(e.timings),checkedAt:String(e.checked_at)}}function bt(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:E(e.environment_id),resourceId:E(e.resource_id),healthCheckId:E(e.health_check_id),name:String(e.name),signal:String(e.signal),operator:String(e.operator),threshold:e.threshold==null?void 0:Number(e.threshold),recoveryThreshold:e.recovery_threshold==null?void 0:Number(e.recovery_threshold),windowMs:Number(e.window_ms),consecutive:Number(e.consecutive),recoveryConsecutive:Number(e.recovery_consecutive),noDataPolicy:String(e.no_data_policy),severity:String(e.severity),groupBy:O(e.group_by),labels:O(e.labels),enabled:Te(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Pe(e){return{id:String(e.id),ruleId:String(e.rule_id),projectId:String(e.project_id),environmentId:E(e.environment_id),resourceId:E(e.resource_id),dedupKey:String(e.dedup_key),groupKey:String(e.group_key),state:String(e.state),severity:String(e.severity),title:String(e.title),evidence:O(e.evidence),failureCount:Number(e.failure_count),recoveryCount:Number(e.recovery_count),occurrenceCount:Number(e.occurrence_count),ownerActorId:E(e.owner_actor_id),acknowledgedByActorId:E(e.acknowledged_by_actor_id),acknowledgedAt:E(e.acknowledged_at),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),firingAt:E(e.firing_at),resolvedAt:E(e.resolved_at),silencedUntil:E(e.silenced_until),updatedAt:String(e.updated_at)}}function St(e){return{id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),kind:String(e.kind),config:O(e.config),credentialFingerprint:E(e.credential_fingerprint),hasCredential:!!e.credential_ciphertext,status:String(e.status),version:Number(e.version),lastTestedAt:E(e.last_tested_at),lastError:E(e.last_error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function It(e){return{id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),priority:Number(e.priority),matcher:O(e.matcher),channelIds:O(e.channel_ids),quietHours:e.quiet_hours?O(e.quiet_hours):void 0,groupWaitSeconds:Number(e.group_wait_seconds),reminderSeconds:e.reminder_seconds==null?void 0:Number(e.reminder_seconds),escalation:O(e.escalation),template:E(e.template),rateLimitPerMinute:Number(e.rate_limit_per_minute),enabled:Te(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function ke(e){return{id:String(e.id),alertId:E(e.alert_id),channelId:String(e.channel_id),routeId:E(e.route_id),eventType:String(e.event_type),idempotencyKey:String(e.idempotency_key),state:String(e.state),attempt:Number(e.attempt),maxAttempts:Number(e.max_attempts),nextAttemptAt:E(e.next_attempt_at),responseStatus:e.response_status==null?void 0:Number(e.response_status),error:E(e.error),payload:O(e.payload),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deliveredAt:E(e.delivered_at)}}class gt{controlPlane;options;key;constructor(e,t){this.controlPlane=e;this.options=t;this.key=Et("sha256").update(t.encryptionKey).digest()}now(){return(this.options.now?.()??new Date).toISOString()}encrypt(e){let t=Or(12),r=Tr("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[,t,r,n]=e.split("."),o=Dr("aes-256-gcm",this.key,Buffer.from(t,"base64url"));return o.setAuthTag(Buffer.from(r,"base64url")),Buffer.concat([o.update(Buffer.from(n,"base64url")),o.final()]).toString("utf8")}createHealthCheck(e){if(!e.name.trim())throw Error("Health checks require a name.");if(!["http","tcp","command"].includes(e.kind))throw Error("Unsupported health check kind.");if(e.kind==="http"&&!/^https?:\/\//.test(e.target)||e.kind==="tcp"&&!/^[a-zA-Z0-9.-]+$/.test(e.target)||e.kind==="command"&&!e.config.command?.length)throw Error("Health check target is invalid.");let t=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO health_checks (id,project_id,environment_id,resource_id,name,kind,target,config,interval_seconds,timeout_seconds,failure_threshold,recovery_threshold,regions,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,100),e.kind,e.target,JSON.stringify(e.config),M(e.intervalSeconds,60,10,86400),M(e.timeoutSeconds,10,1,300),M(e.failureThreshold,3,1,100),M(e.recoveryThreshold,2,1,100),JSON.stringify(e.regions.slice(0,20)),e.enabled?1:0,1,r,r]),this.getHealthCheck(t)}getHealthCheck(e){let t=this.controlPlane.database.query("SELECT * FROM health_checks WHERE id=?").get(e);return t?yt(t):void 0}listHealthChecks(e,t){return this.controlPlane.database.query(`SELECT * FROM health_checks WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(e,...t?[t]:[]).map(yt)}setHealthCheckEnabled(e,t){this.controlPlane.database.run("UPDATE health_checks SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now(),e]);let r=this.getHealthCheck(e);if(!r)throw Error("Health check was not found.");return r}appendHealthResult(e){let t=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO health_results (id,check_id,status,agent,region,status_code,message,timings,checked_at) VALUES (?,?,?,?,?,?,?,?,?)",[t,e.checkId,e.status,e.agent.slice(0,100),e.region??null,e.statusCode??null,e.message?.slice(0,1000)??null,JSON.stringify(e.timings),e.checkedAt]),vt(this.controlPlane.database.query("SELECT * FROM health_results WHERE id=?").get(t))}listHealthResults(e,t=100){return this.controlPlane.database.query("SELECT * FROM health_results WHERE check_id=? ORDER BY checked_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(vt)}createRule(e){if(!e.name.trim())throw Error("Alert rules require a name.");if(e.operator!=="unhealthy"&&e.threshold==null)throw Error("Metric alert rules require a threshold.");let t=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO alert_rules (id,project_id,environment_id,resource_id,health_check_id,name,signal,operator,threshold,recovery_threshold,window_ms,consecutive,recovery_consecutive,no_data_policy,severity,group_by,labels,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.environmentId??null,e.resourceId??null,e.healthCheckId??null,e.name.trim().slice(0,120),e.signal,e.operator,e.threshold??null,e.recoveryThreshold??null,M(e.windowMs,300000,1e4,2678400000),M(e.consecutive,3,1,100),M(e.recoveryConsecutive,2,1,100),e.noDataPolicy,e.severity,JSON.stringify(e.groupBy.slice(0,20)),JSON.stringify(e.labels),e.enabled?1:0,1,r,r]),this.getRule(t)}getRule(e){let t=this.controlPlane.database.query("SELECT * FROM alert_rules WHERE id=?").get(e);return t?bt(t):void 0}listRules(e,t){return this.controlPlane.database.query(`SELECT * FROM alert_rules WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(e,...t?[t]:[]).map(bt)}setRuleEnabled(e,t){this.controlPlane.database.run("UPDATE alert_rules SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now(),e]);let r=this.getRule(e);if(!r)throw Error("Alert rule was not found.");return r}getAlertByDedup(e){let t=this.controlPlane.database.query("SELECT * FROM alerts WHERE dedup_key=?").get(e);return t?Pe(t):void 0}getAlert(e){let t=this.controlPlane.database.query("SELECT * FROM alerts WHERE id=?").get(e);return t?Pe(t):void 0}listAlerts(e,t={}){let r=["project_id=?"],n=[e];if(t.environmentId)r.push("environment_id=?"),n.push(t.environmentId);if(t.states?.length)r.push(`state IN (${t.states.map(()=>"?").join(",")})`),n.push(...t.states);return this.controlPlane.database.query(`SELECT * FROM alerts WHERE ${r.join(" AND ")} ORDER BY updated_at DESC LIMIT ?`).all(...n,Math.min(1000,t.limit??200)).map(Pe)}saveAlert(e,t,r){return this.controlPlane.database.run("INSERT INTO alerts (id,rule_id,project_id,environment_id,resource_id,dedup_key,group_key,state,severity,title,evidence,failure_count,recovery_count,occurrence_count,owner_actor_id,acknowledged_by_actor_id,acknowledged_at,first_seen_at,last_seen_at,firing_at,resolved_at,silenced_until,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET state=excluded.state,severity=excluded.severity,title=excluded.title,evidence=excluded.evidence,failure_count=excluded.failure_count,recovery_count=excluded.recovery_count,occurrence_count=excluded.occurrence_count,owner_actor_id=excluded.owner_actor_id,acknowledged_by_actor_id=excluded.acknowledged_by_actor_id,acknowledged_at=excluded.acknowledged_at,last_seen_at=excluded.last_seen_at,firing_at=excluded.firing_at,resolved_at=excluded.resolved_at,silenced_until=excluded.silenced_until,updated_at=excluded.updated_at",[e.id,e.ruleId,e.projectId,e.environmentId??null,e.resourceId??null,e.dedupKey,e.groupKey,e.state,e.severity,e.title,JSON.stringify(e.evidence),e.failureCount,e.recoveryCount,e.occurrenceCount,e.ownerActorId??null,e.acknowledgedByActorId??null,e.acknowledgedAt??null,e.firstSeenAt,e.lastSeenAt,e.firingAt??null,e.resolvedAt??null,e.silencedUntil??null,e.updatedAt]),this.controlPlane.database.run("INSERT INTO alert_events (id,alert_id,type,actor_id,payload,created_at) VALUES (?,?,?,?,?,?)",[crypto.randomUUID(),e.id,t,r??null,JSON.stringify({state:e.state,severity:e.severity,evidence:e.evidence}),e.updatedAt]),this.getAlert(e.id)}acknowledge(e,t){let r=this.getAlert(e);if(!r)throw Error("Alert was not found.");let n=this.now();return this.saveAlert({...r,acknowledgedByActorId:t,acknowledgedAt:n,updatedAt:n},"acknowledged",t)}assign(e,t,r){let n=this.getAlert(e);if(!n)throw Error("Alert was not found.");let o=this.now();return this.saveAlert({...n,ownerActorId:t,updatedAt:o},"assigned",r)}silenceAlert(e,t,r){let n=this.getAlert(e);if(!n)throw Error("Alert was not found.");let o=new Date(t);if(!Number.isFinite(o.getTime())||o<=new Date)throw Error("Silence end must be in the future.");let i=this.now();return this.saveAlert({...n,state:"silenced",silencedUntil:o.toISOString(),updatedAt:i},"silenced",r)}createSilence(e){let t=new Date(e.startsAt),r=new Date(e.endsAt);if(!Number.isFinite(t.getTime())||!Number.isFinite(r.getTime())||t>=r)throw Error("Silence window is invalid.");try{new Intl.DateTimeFormat("en",{timeZone:e.timezone}).format(t)}catch{throw Error("Silence timezone is invalid.")}let n=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO alert_silences (id,project_id,environment_id,resource_id,matcher,reason,starts_at,ends_at,timezone,created_by_actor_id,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[n,e.projectId,e.environmentId??null,e.resourceId??null,JSON.stringify(e.matcher??{}),e.reason.slice(0,500),t.toISOString(),r.toISOString(),e.timezone,e.actorId??null,this.now()]),n}isSilenced(e,t,r){return this.controlPlane.database.query("SELECT * FROM alert_silences WHERE project_id=? AND starts_at<=? AND ends_at>?").all(e.projectId,r,r).some((o)=>{if(o.environment_id&&o.environment_id!==e.environmentId)return!1;if(o.resource_id&&o.resource_id!==e.resourceId)return!1;let i=O(o.matcher);return Object.entries(i).every(([s,a])=>t[s]===a)})}createChannel(e){if(!e.name.trim())throw Error("Notification channels require a name.");let t=crypto.randomUUID(),r=this.now(),n=e.credential?.trim();return this.controlPlane.database.run("INSERT INTO notification_channels (id,organization_id,name,kind,config,credential_ciphertext,credential_fingerprint,status,version,created_by_actor_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.name.trim().slice(0,100),e.kind,JSON.stringify(e.config??{}),n?this.encrypt(n):null,n?ht(n):null,"active",1,e.actorId??null,r,r]),this.getChannel(t)}getChannel(e){let t=this.controlPlane.database.query("SELECT * FROM notification_channels WHERE id=?").get(e);return t?St(t):void 0}channelCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM notification_channels WHERE id=?").get(e);return t?.credential_ciphertext?this.decrypt(String(t.credential_ciphertext)):void 0}listChannels(e){return this.controlPlane.database.query("SELECT * FROM notification_channels WHERE organization_id=? ORDER BY updated_at DESC").all(e).map(St)}rotateChannel(e,t){let r=this.now();this.controlPlane.database.run("UPDATE notification_channels SET credential_ciphertext=?,credential_fingerprint=?,status='active',last_error=NULL,version=version+1,updated_at=? WHERE id=?",[this.encrypt(t),ht(t),r,e]);let n=this.getChannel(e);if(!n)throw Error("Notification channel was not found.");return n}setChannelStatus(e,t,r){this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_error=?,updated_at=? WHERE id=?",[t,r?.slice(0,1000)??null,this.now(),e]);let n=this.getChannel(e);if(!n)throw Error("Notification channel was not found.");return n}markChannelTest(e,t,r){let n=this.now();return this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_tested_at=?,last_error=?,updated_at=? WHERE id=?",[t?"active":"failing",n,r?.slice(0,1000)??null,n,e]),this.getChannel(e)}createRoute(e){let t=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO notification_routes (id,organization_id,name,priority,matcher,channel_ids,quiet_hours,group_wait_seconds,reminder_seconds,escalation,template,rate_limit_per_minute,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.name.trim().slice(0,100),e.priority,JSON.stringify(e.matcher),JSON.stringify(e.channelIds),e.quietHours?JSON.stringify(e.quietHours):null,M(e.groupWaitSeconds,30,0,86400),e.reminderSeconds??null,JSON.stringify(e.escalation),e.template?.trim().slice(0,2000)??null,M(e.rateLimitPerMinute,60,1,1e4),e.enabled?1:0,1,r,r]),this.getRoute(t)}getRoute(e){let t=this.controlPlane.database.query("SELECT * FROM notification_routes WHERE id=?").get(e);return t?It(t):void 0}listRoutes(e){return this.controlPlane.database.query("SELECT * FROM notification_routes WHERE organization_id=? ORDER BY priority DESC,created_at ASC").all(e).map(It)}countRouteDeliveries(e,t){return Number(this.controlPlane.database.query("SELECT COUNT(*) count FROM notification_deliveries WHERE route_id=? AND created_at>=?").get(e,t)?.count??0)}setRouteEnabled(e,t){this.controlPlane.database.run("UPDATE notification_routes SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now(),e]);let r=this.getRoute(e);if(!r)throw Error("Notification route was not found.");return r}createDelivery(e){let t=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return ke(t);let r=crypto.randomUUID(),n=this.now();return this.controlPlane.database.run("INSERT INTO notification_deliveries (id,alert_id,channel_id,route_id,event_type,idempotency_key,state,attempt,max_attempts,next_attempt_at,payload,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.alertId??null,e.channelId,e.routeId??null,e.eventType,e.idempotencyKey,"pending",0,M(e.maxAttempts,3,1,10),e.nextAttemptAt??null,JSON.stringify(e.payload),n,n]),this.getDelivery(r)}getDelivery(e){let t=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE id=?").get(e);return t?ke(t):void 0}listDeliveries(e={}){let t=[],r=[];if(e.alertId)t.push("alert_id=?"),r.push(e.alertId);if(e.states?.length)t.push(`state IN (${e.states.map(()=>"?").join(",")})`),r.push(...e.states);return this.controlPlane.database.query(`SELECT * FROM notification_deliveries${t.length?" WHERE "+t.join(" AND "):""} ORDER BY updated_at DESC LIMIT ?`).all(...r,Math.min(1000,e.limit??200)).map(ke)}updateDelivery(e,t){return this.controlPlane.database.run("UPDATE notification_deliveries SET state=?,attempt=?,next_attempt_at=?,response_status=?,error=?,delivered_at=?,updated_at=? WHERE id=?",[t.state,t.attempt,t.nextAttemptAt??null,t.responseStatus??null,t.error?.slice(0,1000)??null,t.deliveredAt??null,this.now(),e]),this.getDelivery(e)}}import{createHash as xr}from"node:crypto";function Nr(e,t,r){if(e==="gt")return t>r;if(e==="gte")return t>=r;if(e==="lt")return t<r;if(e==="lte")return t<=r;return t===r}function jr(e,t,r){if(t.status==="no_data"||t.status==null&&t.value==null)return;if(e.operator==="unhealthy")return t.status==="unhealthy";if(t.value==null||e.threshold==null)return;return Nr(e.operator,t.value,r&&e.recoveryThreshold!=null?e.recoveryThreshold:e.threshold)}function Mr(e,t){let r=Object.fromEntries(e.groupBy.flatMap((o)=>t.group?.[o]==null?[]:[[o,String(t.group[o])]]));return{key:Object.entries(r).sort(([o],[i])=>o.localeCompare(i)).map(([o,i])=>`${o}=${i}`).join(",")||"default",values:r}}function Lr(e,t){return xr("sha256").update(`${e}\x00${t}`).digest("hex")}class Z{store;constructor(e){this.store=e}evaluate(e,t){if(!e.enabled)return{transition:"ignored",notify:!1};let r=Mr(e,t),n=Lr(e.id,r.key),o=this.store.getAlertByDedup(n),i=o?.state==="firing"||o?.state==="silenced",s=jr(e,t,i);if(s==null&&e.noDataPolicy==="ignore")return{alert:o,transition:"ignored",notify:!1};let a=s??e.noDataPolicy==="firing",d=s==null&&e.noDataPolicy==="pending",c=new Date(t.timestamp).toISOString(),u=h({...t.evidence??{},...t.value==null?{}:{value:t.value},...t.status?{healthStatus:t.status}:{},group:r.values}),p;if(!o){let y=a||d?1:0,v=a&&y>=e.consecutive?"firing":"pending";p={id:crypto.randomUUID(),ruleId:e.id,projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,dedupKey:n,groupKey:r.key,state:v,severity:e.severity,title:e.name,evidence:u,failureCount:y,recoveryCount:0,occurrenceCount:1,firstSeenAt:c,lastSeenAt:c,firingAt:v==="firing"?c:void 0,updatedAt:c}}else if(a||d){let y=o.state==="resolved",v=(y?0:o.failureCount)+1,S=o.silencedUntil&&new Date(o.silencedUntil)>new Date(c),I=d?"pending":v>=e.consecutive?"firing":"pending";if((S||this.store.isSilenced(e,r.values,c))&&I==="firing")I="silenced";p={...o,state:I,severity:e.severity,title:e.name,evidence:u,failureCount:v,recoveryCount:0,occurrenceCount:o.occurrenceCount+1,firstSeenAt:y?c:o.firstSeenAt,lastSeenAt:c,firingAt:I==="firing"||I==="silenced"?o.firingAt??c:void 0,resolvedAt:void 0,updatedAt:c}}else{let y=o.recoveryCount+1,v=y>=e.recoveryConsecutive;p={...o,state:v?"resolved":o.state,evidence:u,failureCount:v?0:o.failureCount,recoveryCount:y,lastSeenAt:c,resolvedAt:v?c:o.resolvedAt,silencedUntil:v?void 0:o.silencedUntil,updatedAt:c}}let l=o?.state!==p.state,f=p.state==="pending"?"pending":p.state==="firing"?l?"firing":"updated":p.state==="silenced"?"silenced":l?"resolved":"updated";return{alert:this.store.saveAlert(p,l||!o?f:"observed"),transition:f,notify:f==="firing"||f==="resolved"}}}import{createHmac as qr}from"node:crypto";function $r(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,weekday:"short",hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(e).map((o)=>[o.type,o.value])),n=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{minute:Number(r.hour)*60+Number(r.minute),weekday:n.indexOf(r.weekday)}}function wt(e){let t=/^(\d{2}):(\d{2})$/.exec(e);if(!t)throw Error("Quiet hours require HH:MM times.");let r=Number(t[1])*60+Number(t[2]);if(Number(t[1])>23||Number(t[2])>59)throw Error("Quiet hours require valid HH:MM times.");return r}function xe(e,t){if(!e.quietHours)return!1;let r=$r(t,e.quietHours.timezone),n=wt(e.quietHours.start),o=wt(e.quietHours.end);if(e.quietHours.weekdays?.length&&!e.quietHours.weekdays.includes(r.weekday))return!1;return n<=o?r.minute>=n&&r.minute<o:r.minute>=n||r.minute<o}function Vr(e,t,r){let n=e.matcher;return(!n.projectIds?.length||n.projectIds.includes(t.projectId))&&(!n.environmentIds?.length||!!t.environmentId&&n.environmentIds.includes(t.environmentId))&&(!n.resourceIds?.length||!!t.resourceId&&n.resourceIds.includes(t.resourceId))&&(!n.severities?.length||n.severities.includes(t.severity))&&(!n.eventTypes?.length||n.eventTypes.includes(r))}function Br(e){if(!e)return{};try{let t=JSON.parse(e);return t&&typeof t==="object"?t:{value:e}}catch{return{value:e}}}function zr(e,t,r){let n={severity:e.severity.toUpperCase(),title:e.title,state:e.state,event:t,projectId:e.projectId,environmentId:e.environmentId??"",resourceId:e.resourceId??"",groupKey:e.groupKey};return(r?.trim()||"[{{severity}}] {{title}} · {{state}}").replace(/\{\{(severity|title|state|event|projectId|environmentId|resourceId|groupKey)\}\}/g,(o,i)=>n[i]).slice(0,2000)}function De(e,t,r){return{schemaVersion:1,event:t,notificationText:zr(e,t,r),alert:{id:e.id,state:e.state,severity:e.severity,title:e.title,projectId:e.projectId,environmentId:e.environmentId??null,resourceId:e.resourceId??null,groupKey:e.groupKey,firstSeenAt:e.firstSeenAt,lastSeenAt:e.lastSeenAt,firingAt:e.firingAt??null,resolvedAt:e.resolvedAt??null,evidence:e.evidence}}}class mr{store;options;fetchImpl;constructor(e,t={}){this.store=e;this.options=t;this.fetchImpl=t.fetchImpl??globalThis.fetch}now(){return this.options.now?.()??new Date}preview(e,t,r){let n=[];for(let o of this.store.listRoutes(e)){if(!o.enabled||!Vr(o,t,r))continue;let i=[];for(let s of o.channelIds){let a=this.store.getChannel(s);if(a?.status==="active")i.push(a)}n.push({route:o,channels:i,quiet:xe(o,this.now())})}return n}enqueue(e,t,r){let n=r==="resolved"?t.resolvedAt:r==="firing"?t.firingAt:t.updatedAt,o=[];for(let i of this.preview(e,t,r)){if(i.quiet&&r!=="resolved")continue;let s=r==="resolved"||i.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+i.route.groupWaitSeconds*1000).toISOString(),a=r==="resolved"?Number.POSITIVE_INFINITY:Math.max(0,i.route.rateLimitPerMinute-this.store.countRouteDeliveries(i.route.id,new Date(this.now().getTime()-60000).toISOString()));for(let d of i.channels){if(a<=0)break;o.push(this.store.createDelivery({alertId:t.id,channelId:d.id,routeId:i.route.id,eventType:r,idempotencyKey:`${t.id}:${r}:${n}:${d.id}`,payload:De(t,r,i.route.template),nextAttemptAt:s})),a--}}return o}enqueueRemindersAndEscalations(e,t){let r=this.now(),n=[];for(let o of t.filter((i)=>i.state==="firing"&&!i.acknowledgedAt&&i.firingAt)){let i=Math.max(0,(r.getTime()-new Date(o.firingAt).getTime())/1000);for(let s of this.preview(e,o,"reminder")){if(s.quiet)continue;if(s.route.reminderSeconds&&i>=s.route.reminderSeconds){let a=Math.floor(i/s.route.reminderSeconds);for(let d of s.channels)n.push(this.store.createDelivery({alertId:o.id,channelId:d.id,routeId:s.route.id,eventType:"reminder",idempotencyKey:`${o.id}:reminder:${s.route.id}:${a}:${d.id}`,payload:De(o,"reminder")}))}for(let[a,d]of s.route.escalation.entries())if(i>=d.afterSeconds){for(let c of d.channelIds)if(this.store.getChannel(c)?.status==="active")n.push(this.store.createDelivery({alertId:o.id,channelId:c,routeId:s.route.id,eventType:"escalation",idempotencyKey:`${o.id}:escalation:${s.route.id}:${a}:${c}`,payload:De(o,"escalation")}))}}}return n}async send(e,t){let r=Br(this.store.channelCredential(e.id)),n=typeof t.notificationText==="string"?t.notificationText:`[${String(t.alert?.severity??"info").toUpperCase()}] ${String(t.alert?.title??"ts-cloud alert")} · ${String(t.alert?.state??t.event)}`;try{if(e.kind==="email"){if(!this.options.emailImpl)return{ok:!1,error:"Email adapter is not configured."};return await this.options.emailImpl({to:e.config.to,from:e.config.from,subject:`[ts-cloud] ${String(t.alert?.title??t.event)}`,text:`${n}
+`:"")}function*tp(e,t=500){for(let r=0;r<e.length;r+=t)yield ps(e.slice(r,r+t))}class ft{store;counters=new os;breaching=new Map;anomalyConfigs;signals;constructor(e){this.store=e;this.anomalyConfigs=new cs(e.controlPlane),this.signals=new ds(e.controlPlane,e)}ingestTelemetry(e,t,r){let n=Ha(e,t,{counters:this.counters,defaultProvider:r});return this.store.ingestUsage(n)}ingestUsage(e,t=!0){return this.store.ingestUsage(t?qa(e):[...e])}status(e,t=new Date){let{window:r,summary:n}=this.store.budgetSpendCents(e,t),i=this.store.listEnforcements({organizationId:e.organizationId,budgetId:e.id,activeOnly:!0}).filter((a)=>a.state==="active").map((a)=>a.action),s=Ga({budget:e,window:r,actualCents:n.totalCents,series:n.series,activeActions:i,breachingSince:this.breaching.get(e.id),now:t});return{budget:e,decision:s,summary:n,activeActions:i,timeToCap:ri(s.projection.timeToExhaustionMs)}}async runCycle(e){let t=e.now??new Date,r=this.store.budgetsForScope(e.organizationId,e.projectId,e.environmentId),n=[],o=[];for(let s of r){let a=this.status(s,t);this.trackBreach(s,a.decision,t),this.store.recordDecision(a.decision),n.push(a)}let i=Ka(n.map((s)=>s.decision));if(e.handlers){let s={environmentKind:e.environmentKind,...e.policy};for(let a of n){let d=Ja(a.decision,s);if(d.apply.length===0&&d.release.length===0&&d.withheld.length===0)continue;o.push(await Xa(this.store,a.budget,a.decision,d,e.handlers))}}return{organizationId:e.organizationId,statuses:n,level:i.level,actions:i.actions,releases:i.releases,enforcement:o,anomalies:this.detectAnomalies(e,t),evaluatedAt:t.toISOString()}}trackBreach(e,t,r){if(!t.breaches.some((o)=>o.actions.some((i)=>i!=="notify"))){this.breaching.delete(e.id);return}if(!this.breaching.has(e.id))this.breaching.set(e.id,r.toISOString())}detectAnomalies(e,t=new Date,r={}){let n=new Date(Math.floor(t.getTime()/3600000)*3600000).toISOString(),o={organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId},i=e.signals??xt.map((d)=>d.key),s=[],a;for(let d of i){let c=r.seasonLength?Math.max(336,r.seasonLength*((r.minHistory??3)+1)):ec(d),u={from:new Date(new Date(n).getTime()-c*3600000).toISOString(),to:n};if(s.push(...this.detectSignal(d,o,u,r)),!e.routes)continue;if(!ls(d)?.routeAware)continue;a??=this.signals.busiestRoutes(o,u);for(let p of a){if(this.anomalyConfigs.isSilenced(o,{signal:d,route:p}))continue;s.push(...this.detectSignal(d,{...o,route:p},u,r,p))}}return this.signals.resetCache(),s}detectSignal(e,t,r,n,o){let i=this.anomalyConfigs.optionsFor(t,e);if(!i.enabled)return[];if(!o&&this.anomalyConfigs.isSilenced(t,{signal:e}))return[];let s=this.signals.series(e,t,r);if(s.points.length===0)return[];let a=Za(s.points,{...us(e),...i.options,...n});if(!a)return[];let d=this.store.recordAnomaly({organizationId:t.organizationId,projectId:t.projectId,environmentId:t.environmentId,signal:o?`${e}@${o}`:e,direction:a.direction,observed:a.observed,expected:a.expected,score:a.score,deltaPercent:Number.isFinite(a.deltaPercent)?a.deltaPercent:0,severity:i.config?.severity??a.severity,bucketStart:a.bucketStart,evidence:{historySize:a.historySize,deviation:a.deviation,unit:s.unit,populatedBuckets:s.populated,suppressedBuckets:s.suppressed,route:o??null,lookbackFrom:r.from,lookbackTo:r.to}});return d?[d]:[]}usageReport(e){let t=e.now??new Date,r=gr(e.period??"monthly",e.timezone??"UTC",t),n=this.store.summarizeUsage({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,from:r.start,to:r.end}),o=this.store.budgetsForScope(e.organizationId,e.projectId,e.environmentId).map((s)=>{let a=this.status(s,t),d=Gi(s);return{id:s.id,name:s.name,period:s.period,limitCents:d,softLimitCents:s.softLimitCents,hardLimitCents:s.hardLimitCents,spentCents:a.decision.projection.actualCents,remainingCents:d==null?null:Math.max(0,d-a.decision.projection.actualCents),usedPercent:a.decision.usedPercent,projectedCents:a.decision.projection.projectedCents,projectedPercent:a.decision.projectedPercent,projectionConfidence:a.decision.projection.confidence,level:a.decision.level,timeToCap:a.timeToCap,activeActions:a.activeActions,dryRun:s.dryRun}}),i=this.store.listEnforcements({organizationId:e.organizationId,activeOnly:!0});return{organizationId:e.organizationId,projectId:e.projectId??null,environmentId:e.environmentId??null,window:{start:r.start,end:r.end,label:r.label},currency:this.store.priceBook.currency,totalCents:n.totalCents,byMeter:n.byMeter,series:n.series,budgets:o,enforcement:{strongestAction:Qa(i)??null,active:i.map((s)=>({id:s.id,budgetId:s.budgetId,action:s.action,state:s.state,reason:s.reason,simulated:s.simulated,appliedAt:s.appliedAt}))},generatedAt:t.toISOString(),currentBucket:ti(t)}}}function rp(e,t,r,n=1440){let o=new Map(e.map((d)=>[d.bucketStart,d.value])),i=Math.floor(new Date(t).getTime()/3600000)*3600000,s=new Date(r).getTime(),a=[];for(let d=i;d<s&&a.length<n;d+=3600000){let c=new Date(d).toISOString();a.push({bucketStart:c,value:o.get(c)??0})}return a}var rc="spend.gates",Rr={build:["block_builds","suspend_project"],deploy:["block_deployments","suspend_project"],function_invoke:["suspend_functions","serve_static","suspend_project"],request:["suspend_project"]};function pe(e){return`${e.budgetId}:${e.action}`}function Cr(e,t){if(e.organizationId!==t.organizationId)return!1;if(e.projectId&&e.projectId!==t.projectId)return!1;if(e.environmentId&&e.environmentId!==t.environmentId)return!1;return!0}function Pr(e,t){if(e.organizationId!==t.organizationId)return!1;if(t.projectId&&e.projectId!==t.projectId)return!1;if(t.environmentId&&e.environmentId!==t.environmentId)return!1;return!0}function kr(e){let t={...e};for(let r of["projectId","environmentId"])if(t[r]==null)delete t[r];return t}class $t{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}read(){let e=this.controlPlane.getSetting(rc);return Array.isArray(e)?e:[]}write(e){this.controlPlane.setSetting(rc,e)}list(e){return this.read().filter((t)=>!e||Cr(t,e)).sort((t,r)=>oe[r.action]-oe[t.action])}listUnder(e){return this.read().filter((t)=>Pr(t,e)).sort((t,r)=>oe[r.action]-oe[t.action])}open(e){let t=e.appliedAt??(this.options.now?.()??new Date).toISOString(),r=kr({...e,appliedAt:t}),n=this.read().filter((o)=>pe(o)!==pe(r));return n.push(r),this.write(n),r}close(e,t){let r=this.read(),n=r.filter((o)=>pe(o)!==pe({budgetId:e,action:t}));if(n.length===r.length)return!1;return this.write(n),!0}closeBudget(e){let t=this.read(),r=t.filter((n)=>n.budgetId!==e);return this.write(r),t.length-r.length}check(e,t){let r=Rr[e]??[];for(let n of this.list(t)){if(n.simulated)continue;if(!r.includes(n.action))continue;return{allowed:!1,action:n.action,budgetId:n.budgetId,reason:`${n.reason} ${Ki[n.action]}`}}return{allowed:!0}}strongest(e){return this.list(e).find((t)=>!t.simulated)?.action}}class nc extends Error{operation;verdict;code="spend_cap_exceeded";status=402;constructor(e,t){super(t.reason??`A spend cap is blocking this ${e}.`);this.operation=e;this.verdict=t}}function np(e,t,r){let n=e.check(t,r);if(!n.allowed)throw new nc(t,n)}var ut=["notify","block_builds","block_deployments"];function ic(e){let t=e.throttleFactor??0.5;return{apply:async(o,i)=>{let{budget:s,record:a,decision:d}=i;e.gate.open({budgetId:s.id,action:o,organizationId:s.organizationId,projectId:s.projectId,environmentId:s.environmentId,reason:d.reason,simulated:a.simulated});let c={gated:!0};if(!a.simulated&&!ut.includes(o)){let u={projectId:s.projectId,environmentId:s.environmentId},p=e.transport;if(o==="throttle_requests"&&p?.throttleRequests)c={...await p.throttleRequests({...u,factor:t}),gated:!0};else if(o==="suspend_functions"&&p?.suspendFunctions)c={...await p.suspendFunctions(u),gated:!0};else if(o==="serve_static"&&p?.serveStatic)c={...await p.serveStatic(u),gated:!0};else if(o==="suspend_project"&&p?.suspendProject)c={...await p.suspendProject(u),gated:!0};else c={gated:!0,unsupported:!0}}return await e.notify?.({action:o,budgetId:s.id,reason:d.reason,simulated:a.simulated,released:!1}),c},release:async(o,i)=>{let{budget:s,record:a,restore:d}=i,c=e.transport;if(!a.simulated&&!ut.includes(o)&&d.unsupported!==!0){if(o==="throttle_requests"&&c?.restoreRequests)await c.restoreRequests(d);else if(o==="suspend_functions"&&c?.resumeFunctions)await c.resumeFunctions(d);else if(o==="serve_static"&&c?.restoreDynamic)await c.restoreDynamic(d);else if(o==="suspend_project"&&c?.resumeProject)await c.resumeProject(d)}e.gate.close(s.id,o),await e.notify?.({action:o,budgetId:s.id,reason:a.reason,simulated:a.simulated,released:!0})}}}class gd{calls=[];record(e,t){return this.calls.push({method:e,input:t}),{recorded:e}}throttleRequests(e){return this.record("throttleRequests",e)}restoreRequests(e){this.record("restoreRequests",e)}suspendFunctions(e){return this.record("suspendFunctions",e)}resumeFunctions(e){this.record("resumeFunctions",e)}serveStatic(e){return this.record("serveStatic",e)}restoreDynamic(e){this.record("restoreDynamic",e)}suspendProject(e){return this.record("suspendProject",e)}resumeProject(e){this.record("resumeProject",e)}}import{createCipheriv as Tr,createDecipheriv as Dr,createHash as Et,randomBytes as Or}from"node:crypto";var O=(e)=>{if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}},E=(e)=>typeof e==="string"?e:void 0,Te=(e)=>Number(e)===1,M=(e,t,r,n)=>{let o=Number(e);return Number.isFinite(o)?Math.min(n,Math.max(r,Math.floor(o))):t},ht=(e)=>Et("sha256").update(e).digest("hex").slice(0,16);function yt(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:E(e.environment_id),resourceId:E(e.resource_id),name:String(e.name),kind:String(e.kind),target:String(e.target),config:O(e.config),intervalSeconds:Number(e.interval_seconds),timeoutSeconds:Number(e.timeout_seconds),failureThreshold:Number(e.failure_threshold),recoveryThreshold:Number(e.recovery_threshold),regions:O(e.regions),enabled:Te(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function vt(e){return{id:String(e.id),checkId:String(e.check_id),status:String(e.status),agent:String(e.agent),region:E(e.region),statusCode:e.status_code==null?void 0:Number(e.status_code),message:E(e.message),timings:O(e.timings),checkedAt:String(e.checked_at)}}function bt(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:E(e.environment_id),resourceId:E(e.resource_id),healthCheckId:E(e.health_check_id),name:String(e.name),signal:String(e.signal),operator:String(e.operator),threshold:e.threshold==null?void 0:Number(e.threshold),recoveryThreshold:e.recovery_threshold==null?void 0:Number(e.recovery_threshold),windowMs:Number(e.window_ms),consecutive:Number(e.consecutive),recoveryConsecutive:Number(e.recovery_consecutive),noDataPolicy:String(e.no_data_policy),severity:String(e.severity),groupBy:O(e.group_by),labels:O(e.labels),enabled:Te(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Pe(e){return{id:String(e.id),ruleId:String(e.rule_id),projectId:String(e.project_id),environmentId:E(e.environment_id),resourceId:E(e.resource_id),dedupKey:String(e.dedup_key),groupKey:String(e.group_key),state:String(e.state),severity:String(e.severity),title:String(e.title),evidence:O(e.evidence),failureCount:Number(e.failure_count),recoveryCount:Number(e.recovery_count),occurrenceCount:Number(e.occurrence_count),ownerActorId:E(e.owner_actor_id),acknowledgedByActorId:E(e.acknowledged_by_actor_id),acknowledgedAt:E(e.acknowledged_at),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),firingAt:E(e.firing_at),resolvedAt:E(e.resolved_at),silencedUntil:E(e.silenced_until),updatedAt:String(e.updated_at)}}function St(e){return{id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),kind:String(e.kind),config:O(e.config),credentialFingerprint:E(e.credential_fingerprint),hasCredential:!!e.credential_ciphertext,status:String(e.status),version:Number(e.version),lastTestedAt:E(e.last_tested_at),lastError:E(e.last_error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function It(e){return{id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),priority:Number(e.priority),matcher:O(e.matcher),channelIds:O(e.channel_ids),quietHours:e.quiet_hours?O(e.quiet_hours):void 0,groupWaitSeconds:Number(e.group_wait_seconds),reminderSeconds:e.reminder_seconds==null?void 0:Number(e.reminder_seconds),escalation:O(e.escalation),template:E(e.template),rateLimitPerMinute:Number(e.rate_limit_per_minute),enabled:Te(e.enabled),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function ke(e){return{id:String(e.id),alertId:E(e.alert_id),channelId:String(e.channel_id),routeId:E(e.route_id),eventType:String(e.event_type),idempotencyKey:String(e.idempotency_key),state:String(e.state),attempt:Number(e.attempt),maxAttempts:Number(e.max_attempts),nextAttemptAt:E(e.next_attempt_at),responseStatus:e.response_status==null?void 0:Number(e.response_status),error:E(e.error),payload:O(e.payload),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deliveredAt:E(e.delivered_at)}}class gt{controlPlane;options;key;constructor(e,t){this.controlPlane=e;this.options=t;this.key=Et("sha256").update(t.encryptionKey).digest()}now(){return(this.options.now?.()??new Date).toISOString()}encrypt(e){let t=Or(12),r=Tr("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[,t,r,n]=e.split("."),o=Dr("aes-256-gcm",this.key,Buffer.from(t,"base64url"));return o.setAuthTag(Buffer.from(r,"base64url")),Buffer.concat([o.update(Buffer.from(n,"base64url")),o.final()]).toString("utf8")}createHealthCheck(e){if(!e.name.trim())throw Error("Health checks require a name.");if(!["http","tcp","command"].includes(e.kind))throw Error("Unsupported health check kind.");if(e.kind==="http"&&!/^https?:\/\//.test(e.target)||e.kind==="tcp"&&!/^[a-zA-Z0-9.-]+$/.test(e.target)||e.kind==="command"&&!e.config.command?.length)throw Error("Health check target is invalid.");let t=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO health_checks (id,project_id,environment_id,resource_id,name,kind,target,config,interval_seconds,timeout_seconds,failure_threshold,recovery_threshold,regions,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,100),e.kind,e.target,JSON.stringify(e.config),M(e.intervalSeconds,60,10,86400),M(e.timeoutSeconds,10,1,300),M(e.failureThreshold,3,1,100),M(e.recoveryThreshold,2,1,100),JSON.stringify(e.regions.slice(0,20)),e.enabled?1:0,1,r,r]),this.getHealthCheck(t)}getHealthCheck(e){let t=this.controlPlane.database.query("SELECT * FROM health_checks WHERE id=?").get(e);return t?yt(t):void 0}listHealthChecks(e,t){return this.controlPlane.database.query(`SELECT * FROM health_checks WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(e,...t?[t]:[]).map(yt)}setHealthCheckEnabled(e,t){this.controlPlane.database.run("UPDATE health_checks SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now(),e]);let r=this.getHealthCheck(e);if(!r)throw Error("Health check was not found.");return r}appendHealthResult(e){let t=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO health_results (id,check_id,status,agent,region,status_code,message,timings,checked_at) VALUES (?,?,?,?,?,?,?,?,?)",[t,e.checkId,e.status,e.agent.slice(0,100),e.region??null,e.statusCode??null,e.message?.slice(0,1000)??null,JSON.stringify(e.timings),e.checkedAt]),vt(this.controlPlane.database.query("SELECT * FROM health_results WHERE id=?").get(t))}listHealthResults(e,t=100){return this.controlPlane.database.query("SELECT * FROM health_results WHERE check_id=? ORDER BY checked_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(vt)}createRule(e){if(!e.name.trim())throw Error("Alert rules require a name.");if(e.operator!=="unhealthy"&&e.threshold==null)throw Error("Metric alert rules require a threshold.");let t=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO alert_rules (id,project_id,environment_id,resource_id,health_check_id,name,signal,operator,threshold,recovery_threshold,window_ms,consecutive,recovery_consecutive,no_data_policy,severity,group_by,labels,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.environmentId??null,e.resourceId??null,e.healthCheckId??null,e.name.trim().slice(0,120),e.signal,e.operator,e.threshold??null,e.recoveryThreshold??null,M(e.windowMs,300000,1e4,2678400000),M(e.consecutive,3,1,100),M(e.recoveryConsecutive,2,1,100),e.noDataPolicy,e.severity,JSON.stringify(e.groupBy.slice(0,20)),JSON.stringify(e.labels),e.enabled?1:0,1,r,r]),this.getRule(t)}getRule(e){let t=this.controlPlane.database.query("SELECT * FROM alert_rules WHERE id=?").get(e);return t?bt(t):void 0}listRules(e,t){return this.controlPlane.database.query(`SELECT * FROM alert_rules WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY updated_at DESC`).all(e,...t?[t]:[]).map(bt)}setRuleEnabled(e,t){this.controlPlane.database.run("UPDATE alert_rules SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now(),e]);let r=this.getRule(e);if(!r)throw Error("Alert rule was not found.");return r}getAlertByDedup(e){let t=this.controlPlane.database.query("SELECT * FROM alerts WHERE dedup_key=?").get(e);return t?Pe(t):void 0}getAlert(e){let t=this.controlPlane.database.query("SELECT * FROM alerts WHERE id=?").get(e);return t?Pe(t):void 0}listAlerts(e,t={}){let r=["project_id=?"],n=[e];if(t.environmentId)r.push("environment_id=?"),n.push(t.environmentId);if(t.states?.length)r.push(`state IN (${t.states.map(()=>"?").join(",")})`),n.push(...t.states);return this.controlPlane.database.query(`SELECT * FROM alerts WHERE ${r.join(" AND ")} ORDER BY updated_at DESC LIMIT ?`).all(...n,Math.min(1000,t.limit??200)).map(Pe)}saveAlert(e,t,r){return this.controlPlane.database.run("INSERT INTO alerts (id,rule_id,project_id,environment_id,resource_id,dedup_key,group_key,state,severity,title,evidence,failure_count,recovery_count,occurrence_count,owner_actor_id,acknowledged_by_actor_id,acknowledged_at,first_seen_at,last_seen_at,firing_at,resolved_at,silenced_until,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET state=excluded.state,severity=excluded.severity,title=excluded.title,evidence=excluded.evidence,failure_count=excluded.failure_count,recovery_count=excluded.recovery_count,occurrence_count=excluded.occurrence_count,owner_actor_id=excluded.owner_actor_id,acknowledged_by_actor_id=excluded.acknowledged_by_actor_id,acknowledged_at=excluded.acknowledged_at,last_seen_at=excluded.last_seen_at,firing_at=excluded.firing_at,resolved_at=excluded.resolved_at,silenced_until=excluded.silenced_until,updated_at=excluded.updated_at",[e.id,e.ruleId,e.projectId,e.environmentId??null,e.resourceId??null,e.dedupKey,e.groupKey,e.state,e.severity,e.title,JSON.stringify(e.evidence),e.failureCount,e.recoveryCount,e.occurrenceCount,e.ownerActorId??null,e.acknowledgedByActorId??null,e.acknowledgedAt??null,e.firstSeenAt,e.lastSeenAt,e.firingAt??null,e.resolvedAt??null,e.silencedUntil??null,e.updatedAt]),this.controlPlane.database.run("INSERT INTO alert_events (id,alert_id,type,actor_id,payload,created_at) VALUES (?,?,?,?,?,?)",[crypto.randomUUID(),e.id,t,r??null,JSON.stringify({state:e.state,severity:e.severity,evidence:e.evidence}),e.updatedAt]),this.getAlert(e.id)}acknowledge(e,t){let r=this.getAlert(e);if(!r)throw Error("Alert was not found.");let n=this.now();return this.saveAlert({...r,acknowledgedByActorId:t,acknowledgedAt:n,updatedAt:n},"acknowledged",t)}assign(e,t,r){let n=this.getAlert(e);if(!n)throw Error("Alert was not found.");let o=this.now();return this.saveAlert({...n,ownerActorId:t,updatedAt:o},"assigned",r)}silenceAlert(e,t,r){let n=this.getAlert(e);if(!n)throw Error("Alert was not found.");let o=new Date(t);if(!Number.isFinite(o.getTime())||o<=new Date)throw Error("Silence end must be in the future.");let i=this.now();return this.saveAlert({...n,state:"silenced",silencedUntil:o.toISOString(),updatedAt:i},"silenced",r)}createSilence(e){let t=new Date(e.startsAt),r=new Date(e.endsAt);if(!Number.isFinite(t.getTime())||!Number.isFinite(r.getTime())||t>=r)throw Error("Silence window is invalid.");try{new Intl.DateTimeFormat("en",{timeZone:e.timezone}).format(t)}catch{throw Error("Silence timezone is invalid.")}let n=crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO alert_silences (id,project_id,environment_id,resource_id,matcher,reason,starts_at,ends_at,timezone,created_by_actor_id,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[n,e.projectId,e.environmentId??null,e.resourceId??null,JSON.stringify(e.matcher??{}),e.reason.slice(0,500),t.toISOString(),r.toISOString(),e.timezone,e.actorId??null,this.now()]),n}isSilenced(e,t,r){return this.controlPlane.database.query("SELECT * FROM alert_silences WHERE project_id=? AND starts_at<=? AND ends_at>?").all(e.projectId,r,r).some((o)=>{if(o.environment_id&&o.environment_id!==e.environmentId)return!1;if(o.resource_id&&o.resource_id!==e.resourceId)return!1;let i=O(o.matcher);return Object.entries(i).every(([s,a])=>t[s]===a)})}createChannel(e){if(!e.name.trim())throw Error("Notification channels require a name.");let t=crypto.randomUUID(),r=this.now(),n=e.credential?.trim();return this.controlPlane.database.run("INSERT INTO notification_channels (id,organization_id,name,kind,config,credential_ciphertext,credential_fingerprint,status,version,created_by_actor_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.name.trim().slice(0,100),e.kind,JSON.stringify(e.config??{}),n?this.encrypt(n):null,n?ht(n):null,"active",1,e.actorId??null,r,r]),this.getChannel(t)}getChannel(e){let t=this.controlPlane.database.query("SELECT * FROM notification_channels WHERE id=?").get(e);return t?St(t):void 0}channelCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM notification_channels WHERE id=?").get(e);return t?.credential_ciphertext?this.decrypt(String(t.credential_ciphertext)):void 0}listChannels(e){return this.controlPlane.database.query("SELECT * FROM notification_channels WHERE organization_id=? ORDER BY updated_at DESC").all(e).map(St)}rotateChannel(e,t){let r=this.now();this.controlPlane.database.run("UPDATE notification_channels SET credential_ciphertext=?,credential_fingerprint=?,status='active',last_error=NULL,version=version+1,updated_at=? WHERE id=?",[this.encrypt(t),ht(t),r,e]);let n=this.getChannel(e);if(!n)throw Error("Notification channel was not found.");return n}setChannelStatus(e,t,r){this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_error=?,updated_at=? WHERE id=?",[t,r?.slice(0,1000)??null,this.now(),e]);let n=this.getChannel(e);if(!n)throw Error("Notification channel was not found.");return n}markChannelTest(e,t,r){let n=this.now();return this.controlPlane.database.run("UPDATE notification_channels SET status=?,last_tested_at=?,last_error=?,updated_at=? WHERE id=?",[t?"active":"failing",n,r?.slice(0,1000)??null,n,e]),this.getChannel(e)}createRoute(e){let t=crypto.randomUUID(),r=this.now();return this.controlPlane.database.run("INSERT INTO notification_routes (id,organization_id,name,priority,matcher,channel_ids,quiet_hours,group_wait_seconds,reminder_seconds,escalation,template,rate_limit_per_minute,enabled,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.name.trim().slice(0,100),e.priority,JSON.stringify(e.matcher),JSON.stringify(e.channelIds),e.quietHours?JSON.stringify(e.quietHours):null,M(e.groupWaitSeconds,30,0,86400),e.reminderSeconds??null,JSON.stringify(e.escalation),e.template?.trim().slice(0,2000)??null,M(e.rateLimitPerMinute,60,1,1e4),e.enabled?1:0,1,r,r]),this.getRoute(t)}getRoute(e){let t=this.controlPlane.database.query("SELECT * FROM notification_routes WHERE id=?").get(e);return t?It(t):void 0}listRoutes(e){return this.controlPlane.database.query("SELECT * FROM notification_routes WHERE organization_id=? ORDER BY priority DESC,created_at ASC").all(e).map(It)}countRouteDeliveries(e,t){return Number(this.controlPlane.database.query("SELECT COUNT(*) count FROM notification_deliveries WHERE route_id=? AND created_at>=?").get(e,t)?.count??0)}setRouteEnabled(e,t){this.controlPlane.database.run("UPDATE notification_routes SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now(),e]);let r=this.getRoute(e);if(!r)throw Error("Notification route was not found.");return r}createDelivery(e){let t=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return ke(t);let r=crypto.randomUUID(),n=this.now();return this.controlPlane.database.run("INSERT INTO notification_deliveries (id,alert_id,channel_id,route_id,event_type,idempotency_key,state,attempt,max_attempts,next_attempt_at,payload,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.alertId??null,e.channelId,e.routeId??null,e.eventType,e.idempotencyKey,"pending",0,M(e.maxAttempts,3,1,10),e.nextAttemptAt??null,JSON.stringify(e.payload),n,n]),this.getDelivery(r)}getDelivery(e){let t=this.controlPlane.database.query("SELECT * FROM notification_deliveries WHERE id=?").get(e);return t?ke(t):void 0}listDeliveries(e={}){let t=[],r=[];if(e.alertId)t.push("alert_id=?"),r.push(e.alertId);if(e.states?.length)t.push(`state IN (${e.states.map(()=>"?").join(",")})`),r.push(...e.states);return this.controlPlane.database.query(`SELECT * FROM notification_deliveries${t.length?" WHERE "+t.join(" AND "):""} ORDER BY updated_at DESC LIMIT ?`).all(...r,Math.min(1000,e.limit??200)).map(ke)}updateDelivery(e,t){return this.controlPlane.database.run("UPDATE notification_deliveries SET state=?,attempt=?,next_attempt_at=?,response_status=?,error=?,delivered_at=?,updated_at=? WHERE id=?",[t.state,t.attempt,t.nextAttemptAt??null,t.responseStatus??null,t.error?.slice(0,1000)??null,t.deliveredAt??null,this.now(),e]),this.getDelivery(e)}}import{createHash as xr}from"node:crypto";function Nr(e,t,r){if(e==="gt")return t>r;if(e==="gte")return t>=r;if(e==="lt")return t<r;if(e==="lte")return t<=r;return t===r}function jr(e,t,r){if(t.status==="no_data"||t.status==null&&t.value==null)return;if(e.operator==="unhealthy")return t.status==="unhealthy";if(t.value==null||e.threshold==null)return;return Nr(e.operator,t.value,r&&e.recoveryThreshold!=null?e.recoveryThreshold:e.threshold)}function Mr(e,t){let r=Object.fromEntries(e.groupBy.flatMap((o)=>t.group?.[o]==null?[]:[[o,String(t.group[o])]]));return{key:Object.entries(r).sort(([o],[i])=>o.localeCompare(i)).map(([o,i])=>`${o}=${i}`).join(",")||"default",values:r}}function Lr(e,t){return xr("sha256").update(`${e}\x00${t}`).digest("hex")}class Y{store;constructor(e){this.store=e}evaluate(e,t){if(!e.enabled)return{transition:"ignored",notify:!1};let r=Mr(e,t),n=Lr(e.id,r.key),o=this.store.getAlertByDedup(n),i=o?.state==="firing"||o?.state==="silenced",s=jr(e,t,i);if(s==null&&e.noDataPolicy==="ignore")return{alert:o,transition:"ignored",notify:!1};let a=s??e.noDataPolicy==="firing",d=s==null&&e.noDataPolicy==="pending",c=new Date(t.timestamp).toISOString(),u=h({...t.evidence??{},...t.value==null?{}:{value:t.value},...t.status?{healthStatus:t.status}:{},group:r.values}),p;if(!o){let y=a||d?1:0,v=a&&y>=e.consecutive?"firing":"pending";p={id:crypto.randomUUID(),ruleId:e.id,projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,dedupKey:n,groupKey:r.key,state:v,severity:e.severity,title:e.name,evidence:u,failureCount:y,recoveryCount:0,occurrenceCount:1,firstSeenAt:c,lastSeenAt:c,firingAt:v==="firing"?c:void 0,updatedAt:c}}else if(a||d){let y=o.state==="resolved",v=(y?0:o.failureCount)+1,S=o.silencedUntil&&new Date(o.silencedUntil)>new Date(c),I=d?"pending":v>=e.consecutive?"firing":"pending";if((S||this.store.isSilenced(e,r.values,c))&&I==="firing")I="silenced";p={...o,state:I,severity:e.severity,title:e.name,evidence:u,failureCount:v,recoveryCount:0,occurrenceCount:o.occurrenceCount+1,firstSeenAt:y?c:o.firstSeenAt,lastSeenAt:c,firingAt:I==="firing"||I==="silenced"?o.firingAt??c:void 0,resolvedAt:void 0,updatedAt:c}}else{let y=o.recoveryCount+1,v=y>=e.recoveryConsecutive;p={...o,state:v?"resolved":o.state,evidence:u,failureCount:v?0:o.failureCount,recoveryCount:y,lastSeenAt:c,resolvedAt:v?c:o.resolvedAt,silencedUntil:v?void 0:o.silencedUntil,updatedAt:c}}let l=o?.state!==p.state,f=p.state==="pending"?"pending":p.state==="firing"?l?"firing":"updated":p.state==="silenced"?"silenced":l?"resolved":"updated";return{alert:this.store.saveAlert(p,l||!o?f:"observed"),transition:f,notify:f==="firing"||f==="resolved"}}}import{createHmac as qr}from"node:crypto";function $r(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,weekday:"short",hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(e).map((o)=>[o.type,o.value])),n=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{minute:Number(r.hour)*60+Number(r.minute),weekday:n.indexOf(r.weekday)}}function wt(e){let t=/^(\d{2}):(\d{2})$/.exec(e);if(!t)throw Error("Quiet hours require HH:MM times.");let r=Number(t[1])*60+Number(t[2]);if(Number(t[1])>23||Number(t[2])>59)throw Error("Quiet hours require valid HH:MM times.");return r}function xe(e,t){if(!e.quietHours)return!1;let r=$r(t,e.quietHours.timezone),n=wt(e.quietHours.start),o=wt(e.quietHours.end);if(e.quietHours.weekdays?.length&&!e.quietHours.weekdays.includes(r.weekday))return!1;return n<=o?r.minute>=n&&r.minute<o:r.minute>=n||r.minute<o}function Vr(e,t,r){let n=e.matcher;return(!n.projectIds?.length||n.projectIds.includes(t.projectId))&&(!n.environmentIds?.length||!!t.environmentId&&n.environmentIds.includes(t.environmentId))&&(!n.resourceIds?.length||!!t.resourceId&&n.resourceIds.includes(t.resourceId))&&(!n.severities?.length||n.severities.includes(t.severity))&&(!n.eventTypes?.length||n.eventTypes.includes(r))}function Br(e){if(!e)return{};try{let t=JSON.parse(e);return t&&typeof t==="object"?t:{value:e}}catch{return{value:e}}}function zr(e,t,r){let n={severity:e.severity.toUpperCase(),title:e.title,state:e.state,event:t,projectId:e.projectId,environmentId:e.environmentId??"",resourceId:e.resourceId??"",groupKey:e.groupKey};return(r?.trim()||"[{{severity}}] {{title}} · {{state}}").replace(/\{\{(severity|title|state|event|projectId|environmentId|resourceId|groupKey)\}\}/g,(o,i)=>n[i]).slice(0,2000)}function De(e,t,r){return{schemaVersion:1,event:t,notificationText:zr(e,t,r),alert:{id:e.id,state:e.state,severity:e.severity,title:e.title,projectId:e.projectId,environmentId:e.environmentId??null,resourceId:e.resourceId??null,groupKey:e.groupKey,firstSeenAt:e.firstSeenAt,lastSeenAt:e.lastSeenAt,firingAt:e.firingAt??null,resolvedAt:e.resolvedAt??null,evidence:e.evidence}}}class mr{store;options;fetchImpl;constructor(e,t={}){this.store=e;this.options=t;this.fetchImpl=t.fetchImpl??globalThis.fetch}now(){return this.options.now?.()??new Date}preview(e,t,r){let n=[];for(let o of this.store.listRoutes(e)){if(!o.enabled||!Vr(o,t,r))continue;let i=[];for(let s of o.channelIds){let a=this.store.getChannel(s);if(a?.status==="active")i.push(a)}n.push({route:o,channels:i,quiet:xe(o,this.now())})}return n}enqueue(e,t,r){let n=r==="resolved"?t.resolvedAt:r==="firing"?t.firingAt:t.updatedAt,o=[];for(let i of this.preview(e,t,r)){if(i.quiet&&r!=="resolved")continue;let s=r==="resolved"||i.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+i.route.groupWaitSeconds*1000).toISOString(),a=r==="resolved"?Number.POSITIVE_INFINITY:Math.max(0,i.route.rateLimitPerMinute-this.store.countRouteDeliveries(i.route.id,new Date(this.now().getTime()-60000).toISOString()));for(let d of i.channels){if(a<=0)break;o.push(this.store.createDelivery({alertId:t.id,channelId:d.id,routeId:i.route.id,eventType:r,idempotencyKey:`${t.id}:${r}:${n}:${d.id}`,payload:De(t,r,i.route.template),nextAttemptAt:s})),a--}}return o}enqueueRemindersAndEscalations(e,t){let r=this.now(),n=[];for(let o of t.filter((i)=>i.state==="firing"&&!i.acknowledgedAt&&i.firingAt)){let i=Math.max(0,(r.getTime()-new Date(o.firingAt).getTime())/1000);for(let s of this.preview(e,o,"reminder")){if(s.quiet)continue;if(s.route.reminderSeconds&&i>=s.route.reminderSeconds){let a=Math.floor(i/s.route.reminderSeconds);for(let d of s.channels)n.push(this.store.createDelivery({alertId:o.id,channelId:d.id,routeId:s.route.id,eventType:"reminder",idempotencyKey:`${o.id}:reminder:${s.route.id}:${a}:${d.id}`,payload:De(o,"reminder")}))}for(let[a,d]of s.route.escalation.entries())if(i>=d.afterSeconds){for(let c of d.channelIds)if(this.store.getChannel(c)?.status==="active")n.push(this.store.createDelivery({alertId:o.id,channelId:c,routeId:s.route.id,eventType:"escalation",idempotencyKey:`${o.id}:escalation:${s.route.id}:${a}:${c}`,payload:De(o,"escalation")}))}}}return n}async send(e,t){let r=Br(this.store.channelCredential(e.id)),n=typeof t.notificationText==="string"?t.notificationText:`[${String(t.alert?.severity??"info").toUpperCase()}] ${String(t.alert?.title??"ts-cloud alert")} · ${String(t.alert?.state??t.event)}`;try{if(e.kind==="email"){if(!this.options.emailImpl)return{ok:!1,error:"Email adapter is not configured."};return await this.options.emailImpl({to:e.config.to,from:e.config.from,subject:`[ts-cloud] ${String(t.alert?.title??t.event)}`,text:`${n}
 
-${JSON.stringify(t,null,2)}`}),{ok:!0,status:202}}if(e.kind==="sms"){if(!this.options.smsImpl)return{ok:!1,error:"SMS adapter is not configured."};let u=e.config.to;if(typeof u!=="string"||!u.trim())return{ok:!1,error:"SMS channels need a `to` number."};return await this.options.smsImpl({to:u,from:e.config.from,text:n.slice(0,300)}),{ok:!0,status:202}}let o=r.url??r.value,i=t,s={"content-type":"application/json"};if(e.kind==="slack")i={text:n};if(e.kind==="discord")i={content:n};if(e.kind==="teams")i={text:n};if(e.kind==="telegram")o=`https://api.telegram.org/bot${r.botToken??r.value}/sendMessage`,i={chat_id:e.config.chatId,text:n};if(!o||!/^https:\/\//.test(o))return{ok:!1,error:"Channel endpoint is unavailable or not HTTPS."};let a=JSON.stringify(i);if(e.kind==="webhook"&&r.signingSecret){let u=Math.floor(this.now().getTime()/1000).toString();s["x-ts-cloud-timestamp"]=u,s["x-ts-cloud-signature"]=`v1=${qr("sha256",r.signingSecret).update(`${u}.${a}`).digest("hex")}`}let d=new AbortController,c=setTimeout(()=>d.abort(),1e4);try{let u=await this.fetchImpl(o,{method:"POST",headers:s,body:a,signal:d.signal});return u.ok?{ok:!0,status:u.status}:{ok:!1,status:u.status,error:`Channel returned HTTP ${u.status}.`}}finally{clearTimeout(c)}}catch(o){return{ok:!1,error:o instanceof Error?o.message:String(o)}}}async deliver(e){let t=this.store.getDelivery(e);if(!t)throw Error("Notification delivery was not found.");if(t.state==="delivered"||t.state==="dead"||t.nextAttemptAt&&t.nextAttemptAt>this.now().toISOString())return t;let r=this.store.getChannel(t.channelId);if(!r||r.status==="disabled"||r.status==="paused")return this.store.updateDelivery(e,{state:"failed",attempt:t.attempt+1,error:"Notification channel is unavailable."});let n=t.attempt+1,o=await this.send(r,t.payload);if(o.ok)return this.store.setChannelStatus(r.id,"active"),this.store.updateDelivery(e,{state:"delivered",attempt:n,responseStatus:o.status,deliveredAt:this.now().toISOString()});let s=!(!o.status||o.status===429||o.status>=500)||n>=t.maxAttempts,a=s?void 0:new Date(this.now().getTime()+Math.min(3600000,30000*2**(n-1))).toISOString();return this.store.setChannelStatus(r.id,"failing",o.error),this.store.updateDelivery(e,{state:s?"dead":"retrying",attempt:n,nextAttemptAt:a,responseStatus:o.status,error:o.error})}async deliverAll(e){return Promise.all(e.map((t)=>this.deliver(t.id)))}async retryDue(){let e=this.now().toISOString(),t=this.store.listDeliveries({states:["pending","retrying"]}).filter((r)=>!r.nextAttemptAt||r.nextAttemptAt<=e);return this.deliverAll(t)}async testChannel(e){let t=this.store.getChannel(e);if(!t)throw Error("Notification channel was not found.");let r=await this.send(t,{schemaVersion:1,event:"test",message:"ts-cloud notification channel test. No incident was created."});return this.store.markChannelTest(e,r.ok,r.error),r}}import{lookup as Ur}from"node:dns/promises";import{connect as Fr}from"node:net";async function Hr(e,t){let r=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),n=setTimeout(()=>r.kill(),t);try{return{exitCode:await r.exited,stdout:await new Response(r.stdout).text(),stderr:await new Response(r.stderr).text()}}finally{clearTimeout(n)}}class Me{store;options;constructor(e,t={}){this.store=e;this.options=t}now(){return this.options.now?.()??new Date}async probe(e){let t=performance.now(),r=this.now().toISOString(),n=this.options.agent??"local";try{if(e.kind==="http"){let s=new URL(e.target),a=performance.now();await(this.options.lookupImpl??Ur)(s.hostname);let d=performance.now()-a,c=new AbortController,u=setTimeout(()=>c.abort(),e.timeoutSeconds*1000);try{let p=performance.now(),l=await(this.options.fetchImpl??fetch)(s.toString(),{method:e.config.method??"GET",headers:e.config.headers,signal:c.signal,redirect:"manual"}),f=performance.now()-p,g=e.config.expectedBody?await l.text():"",y=e.config.expectedStatuses??[200,201,202,204],v=y.includes(l.status)&&(!e.config.expectedBody||g.includes(e.config.expectedBody));return{checkId:e.id,status:v?"healthy":"unhealthy",agent:n,region:this.options.region,statusCode:l.status,message:v?void 0:`Expected ${y.join("/")} and configured body match.`,timings:{dnsMs:d,ttfbMs:f,totalMs:performance.now()-t},checkedAt:r}}finally{clearTimeout(u)}}if(e.kind==="tcp"){let s=Number(e.config.port);if(!Number.isInteger(s)||s<1||s>65535)throw Error("TCP health check requires a valid port.");let a=performance.now();return await new Promise((d,c)=>{let u=Fr({host:e.target,port:s}),p=setTimeout(()=>{u.destroy(),c(Error("TCP health check timed out."))},e.timeoutSeconds*1000);u.once("connect",()=>{clearTimeout(p),u.destroy(),d()}),u.once("error",(l)=>{clearTimeout(p),c(l)})}),{checkId:e.id,status:"healthy",agent:n,region:this.options.region,timings:{connectMs:performance.now()-a,totalMs:performance.now()-t},checkedAt:r}}let o=e.config.command??[];if(!o.length)throw Error("Command health check is not configured.");let i=await(this.options.commandImpl??Hr)(o,e.timeoutSeconds*1000);return{checkId:e.id,status:i.exitCode===0?"healthy":"unhealthy",agent:n,region:this.options.region,message:i.exitCode===0?void 0:(i.stderr||i.stdout||`Command exited ${i.exitCode}`).slice(0,1000),timings:{totalMs:performance.now()-t},checkedAt:r}}catch(o){return{checkId:e.id,status:"unhealthy",agent:n,region:this.options.region,message:(o instanceof Error?o.message:String(o)).slice(0,1000),timings:{totalMs:performance.now()-t},checkedAt:r}}}async run(e){return this.store.appendHealthResult(await this.probe(e))}async runAndEvaluate(e){let t=await this.run(e),r=new Z(this.store),n=this.store.listRules(e.projectId,e.environmentId).filter((o)=>o.healthCheckId===e.id);return{result:t,evaluations:n.map((o)=>r.evaluate(o,{status:t.status,timestamp:t.checkedAt,group:{agent:t.agent,region:t.region??""},evidence:{healthResultId:t.id,statusCode:t.statusCode??null,message:t.message??null,timings:t.timings}}))}}}var Wr=Object.freeze({rawDays:30,downsampleAfterDays:7,downsampleBucketMs:3600000,maxRecords:1e6,samplingRate:1,collectLogs:!0,collectTraces:!0,collectRequestAnalytics:!0,estimatedStorageUsdPerGbMonth:0});function ge(e,t,r,n){let o=Number(e);return Number.isFinite(o)?Math.min(n,Math.max(r,Math.floor(o))):t}function At(e,t,r,n){let o=Number(e);return Number.isFinite(o)?Math.min(n,Math.max(r,o)):t}function Ne(e,t){return typeof e==="boolean"?e:t}function Rt(e,t={...Wr}){let r=e&&typeof e==="object"&&!Array.isArray(e)?e:{},n=ge(r.rawDays,t.rawDays,1,3650),o=ge(r.downsampleAfterDays,t.downsampleAfterDays,1,n);return{rawDays:n,downsampleAfterDays:o,downsampleBucketMs:ge(r.downsampleBucketMs,t.downsampleBucketMs,60000,86400000),maxRecords:ge(r.maxRecords,t.maxRecords,1000,1e8),samplingRate:At(r.samplingRate,t.samplingRate,0.01,1),collectLogs:Ne(r.collectLogs,t.collectLogs),collectTraces:Ne(r.collectTraces,t.collectTraces),collectRequestAnalytics:Ne(r.collectRequestAnalytics,t.collectRequestAnalytics),estimatedStorageUsdPerGbMonth:At(r.estimatedStorageUsdPerGbMonth,t.estimatedStorageUsdPerGbMonth,0,1e4)}}function Ct(e){return`telemetry.policy:${e}`}function Ke(e,t){return Rt(e.getSetting(Ct(t)))}function Zn(e,t,r){let n=Rt(r,Ke(e,t));return e.setSetting(Ct(t),n),n}function ei(e,t){return Number((Math.max(0,e)/1073741824*t.estimatedStorageUsdPerGbMonth).toFixed(4))}var Yr=/(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key|session)/i,Zr=/\b(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;&\[]+/gi,en=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,tn=/\b(?:\d{1,3}\.){3}\d{1,3}\b/g;function je(e,t={}){let r=e.replace(/([?&][^=&#\s]+)=([^&#\s]*)/g,"$1=[REDACTED]").replace(Zr,"[REDACTED]");if(t.redactEmail!==!1)r=r.replace(en,"[EMAIL]");if(t.redactIp)r=r.replace(tn,"[IP]");for(let n of t.patterns??[])r=r.replace(n,"[REDACTED]");return r}function X(e,t={},r){if(r&&Yr.test(r))return"[REDACTED]";if(e===null||typeof e==="boolean"||typeof e==="number")return e;if(typeof e==="string")return je(e,t);if(Array.isArray(e))return e.map((n)=>X(n,t));if(e&&typeof e==="object"){let n={};for(let[o,i]of Object.entries(e))n[o]=X(i,t,o);return n}return String(e??"")}function Vi(e){if(!e)return;return e.split("?",1)[0].replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi,":id").replace(/\/(?:(?:\d{4,})|(?:[0-9a-f]{16,}))(?:\/|$)/gi,(r)=>r.endsWith("/")?"/:id/":"/:id").slice(0,512)}var Pt=65536,rn=2678400000,nn=new Set(["metric","log","trace","request","event"]);function k(e){return typeof e==="string"?e:void 0}function ee(e){return e==null?void 0:Number(e)}function on(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function he(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:k(e.environment_id),resourceId:k(e.resource_id),kind:String(e.kind),source:String(e.source),name:String(e.name),timestamp:String(e.timestamp),observedAt:String(e.observed_at),value:ee(e.value),unit:k(e.unit),level:k(e.level),message:k(e.message),durationMs:ee(e.duration_ms),statusCode:ee(e.status_code),method:k(e.method),host:k(e.host),pathTemplate:k(e.path_template),bytesIn:ee(e.bytes_in),bytesOut:ee(e.bytes_out),region:k(e.region),cacheResult:k(e.cache_result),upstream:k(e.upstream),traceId:k(e.trace_id),requestId:k(e.request_id),deploymentId:k(e.deployment_id),releaseId:k(e.release_id),workloadId:k(e.workload_id),sampled:Number(e.sampled)===1,attributes:on(e.attributes),ingestedBytes:Number(e.ingested_bytes)}}function U(e,t){let r=new Date(e);if(!e||!Number.isFinite(r.getTime()))throw Error(`${t} must be a valid ISO-8601 instant.`);return r}function fe(e){let t=U(e.from,"from"),r=U(e.to,"to");if(t>=r)throw Error("Telemetry from must be earlier than to.");if(r.getTime()-t.getTime()>rn)throw Error("Telemetry queries are limited to 31 days.");return{from:t,to:r}}function Tt(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));if(typeof t?.timestamp!=="string"||typeof t?.id!=="string")throw Error();return t}catch{throw Error("Telemetry cursor is invalid.")}}function zi(e){return e?Buffer.from(JSON.stringify({timestamp:e.timestamp,id:e.id})).toString("base64url"):void 0}function sn(e,t){if(!e.length)return;let r=[...e].sort((o,i)=>o-i),n=Math.max(0,Math.min(r.length-1,Math.ceil(t/100*r.length)-1));return r[n]}function re(e,t){if(t==="count")return e.length;if(!e.length)return;if(t==="sum")return e.reduce((r,n)=>r+n,0);if(t==="avg")return e.reduce((r,n)=>r+n,0)/e.length;if(t==="min")return Math.min(...e);if(t==="max")return Math.max(...e);return sn(e,Number(t.slice(1)))}function an(e,t="UTC"){try{return new Intl.DateTimeFormat("en-US",{timeZone:t,month:"short",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZoneName:"short"}).format(e)}catch{throw Error(`Unknown telemetry timezone: ${t}`)}}class Je{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}append(e){if(!nn.has(e.kind))throw Error(`Unsupported telemetry kind: ${e.kind}`);let t=U(e.timestamp,"timestamp").toISOString(),r=e.observedAt?U(e.observedAt,"observedAt").toISOString():this.now().toISOString(),n=X(e.attributes??{},this.options.redaction),o=e.message?je(e.message,this.options.redaction).slice(0,32768):void 0,i=Vi(e.pathTemplate),s=e.id??crypto.randomUUID(),a=JSON.stringify({...e,id:s,timestamp:t,observedAt:r,attributes:n,message:o,pathTemplate:i}),d=Buffer.byteLength(a);if(d>Pt)throw Error(`Telemetry records are limited to ${Pt} bytes.`);return this.controlPlane.database.run("INSERT OR IGNORE INTO telemetry_records (id, project_id, environment_id, resource_id, kind, source, name, timestamp, observed_at, value, unit, level, message, duration_ms, status_code, method, host, path_template, bytes_in, bytes_out, region, cache_result, upstream, trace_id, request_id, deployment_id, release_id, workload_id, sampled, attributes, ingested_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.projectId,e.environmentId??null,e.resourceId??null,e.kind,e.source.slice(0,128),e.name.slice(0,256),t,r,e.value??null,e.unit??null,e.level??null,o??null,e.durationMs??null,e.statusCode??null,e.method?.slice(0,16)??null,e.host?.slice(0,256)??null,i??null,e.bytesIn??null,e.bytesOut??null,e.region?.slice(0,64)??null,e.cacheResult?.slice(0,64)??null,e.upstream?.slice(0,256)??null,e.traceId?.slice(0,256)??null,e.requestId?.slice(0,256)??null,e.deploymentId?.slice(0,256)??null,e.releaseId?.slice(0,256)??null,e.workloadId?.slice(0,512)??null,e.sampled===!1?0:1,JSON.stringify(n),d]),this.get(s)}appendMany(e){if(e.length>1e4)throw Error("Telemetry batches are limited to 10,000 records.");return this.controlPlane.database.transaction((r)=>r.map((n)=>this.append(n)))(e)}get(e){let t=this.controlPlane.database.query("SELECT * FROM telemetry_records WHERE id=?").get(e);return t?he(t):void 0}query(e){let{from:t,to:r}=fe(e),n=Math.min(5000,Math.max(1,Math.floor(e.limit??500))),o=["project_id=?","timestamp>=?","timestamp<?"],i=[e.projectId,t.toISOString(),r.toISOString()],s=(S,I)=>{if(I)o.push(`${S}=?`),i.push(I)},a=(S,I)=>{let _=[...new Set(I??[])].slice(0,100);if(_.length)o.push(`${S} IN (${_.map(()=>"?").join(",")})`),i.push(..._)};if(s("environment_id",e.environmentId),a("resource_id",e.resourceIds),a("kind",e.kinds),a("name",e.names),a("source",e.sources),a("level",e.levels),s("trace_id",e.traceId),s("request_id",e.requestId),s("deployment_id",e.deploymentId),s("release_id",e.releaseId),s("workload_id",e.workloadId),e.text)o.push("(message LIKE ? OR name LIKE ?)"),i.push(`%${e.text.slice(0,256)}%`,`%${e.text.slice(0,256)}%`);let d=Tt(e.cursor);if(d)o.push("(timestamp<? OR (timestamp=? AND id<?))"),i.push(d.timestamp,d.timestamp,d.id);let c=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${o.join(" AND ")} ORDER BY timestamp DESC, id DESC LIMIT ?`).all(...i,n+1),u=c.slice(0,n).map(he),p=c.length>n,l=new Map;for(let S of u)l.set(S.source,[...l.get(S.source)??[],S]);let f=this.now().getTime(),g=[...l].map(([S,I])=>{let _=I.reduce((P,A)=>A.observedAt>P?A.observedAt:P,I[0].observedAt),w=f-new Date(_).getTime();return{source:S,latestAt:_,freshness:w<=120000?"live":w<=600000?"stale":"unavailable",count:I.length}}),y=Math.max(60000,(r.getTime()-t.getTime())/100),v=[...l].flatMap(([S,I])=>{let _=[...new Set(I.map((w)=>new Date(w.timestamp).getTime()))].sort((w,P)=>w-P);return _.slice(1).flatMap((w,P)=>w-_[P]>y?[{from:new Date(_[P]).toISOString(),to:new Date(w).toISOString(),source:S}]:[])});return{records:u,nextCursor:p?zi(u.at(-1)):void 0,truncated:p,scannedRange:{from:t.toISOString(),to:r.toISOString()},sources:g,gaps:v}}tail(e,t){let{from:r,to:n}=fe(e),o=Math.min(1000,Math.max(1,Math.floor(e.limit??200))),i=["project_id=?","timestamp>=?","timestamp<?"],s=[e.projectId,r.toISOString(),n.toISOString()],a=(l,f)=>{if(f)i.push(`${l}=?`),s.push(f)},d=(l,f)=>{let g=[...new Set(f??[])].slice(0,100);if(g.length)i.push(`${l} IN (${g.map(()=>"?").join(",")})`),s.push(...g)};if(a("environment_id",e.environmentId),d("resource_id",e.resourceIds),d("kind",e.kinds),d("name",e.names),d("source",e.sources),d("level",e.levels),a("trace_id",e.traceId),a("request_id",e.requestId),a("deployment_id",e.deploymentId),a("release_id",e.releaseId),a("workload_id",e.workloadId),e.text)i.push("(message LIKE ? OR name LIKE ?)"),s.push(`%${e.text.slice(0,256)}%`,`%${e.text.slice(0,256)}%`);let c=Tt(t);if(c)i.push("(timestamp>? OR (timestamp=? AND id>?))"),s.push(c.timestamp,c.timestamp,c.id);let u=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${i.join(" AND ")} ORDER BY timestamp ASC, id ASC LIMIT ?`).all(...s,o+1),p=u.slice(0,o).map(he);return{records:p,cursor:zi(p.at(-1))??t,truncated:u.length>o}}series(e){let{from:t,to:r}=fe(e),n=Math.min(86400000,Math.max(1000,Math.floor(e.bucketMs)));if((r.getTime()-t.getTime())/n>2000)throw Error("Telemetry series are limited to 2,000 buckets.");let o=this.query({...e,kinds:["metric"],limit:5000,cursor:void 0}),i=new Map;for(let a of o.records)i.set(`${a.source}\x00${a.name}`,[...i.get(`${a.source}\x00${a.name}`)??[],a]);let s=(a,d,c)=>{let u=new Map;for(let l of a){let f=d.getTime()+Math.floor((new Date(l.timestamp).getTime()-d.getTime())/n)*n;if(f>=d.getTime()&&f<c.getTime()&&l.value!=null)u.set(f,[...u.get(f)??[],l.value])}let p=[];for(let l=d.getTime();l<c.getTime();l+=n){let f=u.get(l)??[],g=re(f,e.aggregation);p.push({timestamp:new Date(l).toISOString(),label:an(new Date(l),e.timezone),value:g,count:f.length,gap:g==null})}return p};return[...i].map(([a,d])=>{let[c,u]=a.split("\x00"),p={name:u,source:c,unit:d.find((l)=>l.unit)?.unit,aggregation:e.aggregation,bucketMs:n,points:s(d,t,r)};if(e.compareFrom&&e.compareTo){let l=this.query({...e,from:e.compareFrom,to:e.compareTo,kinds:["metric"],limit:5000,cursor:void 0}).records.filter((f)=>f.source===c&&f.name===u);p.comparison=s(l,U(e.compareFrom,"compareFrom"),U(e.compareTo,"compareTo"))}return p})}status(e,t,r=30,n=1,o){let i=[e],s=t?" AND environment_id=?":"";if(t)i.push(t);let a=[...new Set(o??[])].slice(0,100);if(o&&a.length===0)return[];let d=o?` AND resource_id IN (${a.map(()=>"?").join(",")||"''"})`:"";i.push(...a);let c=this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${s}${d} GROUP BY source`).all(...i),u=this.now().getTime();return c.map((p)=>{let l=String(p.latest),f=Math.max(0,Math.floor((u-new Date(l).getTime())/1000)),g=Math.max(1,(new Date(l).getTime()-new Date(String(p.first)).getTime())/86400000);return{source:String(p.source),freshness:f<=120?"live":f<=600?"stale":"unavailable",lastObservedAt:l,lagSeconds:f,samplingRate:n,retentionDays:r,estimatedDailyBytes:Math.round(Number(p.bytes)/g)}})}saveQuery(e,t,r,n){let o=r.trim().slice(0,80);if(!o)throw Error("Saved telemetry queries require a name.");if(fe(n),n.projectId!==e)throw Error("Saved telemetry queries cannot cross project scope.");let i=this.now().toISOString(),s=JSON.stringify(X(n,this.options.redaction));if(Buffer.byteLength(s)>16384)throw Error("Saved telemetry queries are limited to 16 KB.");let a=this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? AND name=?").get(e,t??null,o),d=a?String(a.id):crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO telemetry_saved_queries (id, project_id, actor_id, name, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(project_id, actor_id, name) DO UPDATE SET query=excluded.query, updated_at=excluded.updated_at",[d,e,t??null,o,s,a?String(a.created_at):i,i]),{id:d,projectId:e,actorId:t,name:o,query:JSON.parse(s),createdAt:a?String(a.created_at):i,updatedAt:i}}listSavedQueries(e,t){return this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? ORDER BY updated_at DESC").all(e,t??null).map((r)=>({id:String(r.id),projectId:String(r.project_id),actorId:k(r.actor_id),name:String(r.name),query:JSON.parse(String(r.query)),createdAt:String(r.created_at),updatedAt:String(r.updated_at)}))}deleteSavedQuery(e,t,r){return this.controlPlane.database.run("DELETE FROM telemetry_saved_queries WHERE id=? AND project_id=? AND actor_id IS ?",[r,e,t??null]).changes>0}downsample(e,t){let r=Math.min(86400000,Math.max(60000,Math.floor(e.downsampleBucketMs))),n=new Date(this.now().getTime()-Math.max(1,e.downsampleAfterDays)*86400000).toISOString(),o=new Date(this.now().getTime()-Math.max(1,e.rawDays)*86400000).toISOString(),i=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE kind='metric' AND source NOT LIKE '%:rollup' AND timestamp>=? AND timestamp<?${t?" AND project_id=?":""} ORDER BY timestamp ASC LIMIT 50001`).all(o,n,...t?[t]:[]);if(i.length>50000)throw Error("Telemetry downsampling is limited to 50,000 raw points per pass; run compaction more frequently.");let s=i.map(he),a=new Map;for(let c of s){let u=Math.floor(new Date(c.timestamp).getTime()/r)*r,p=JSON.stringify([c.projectId,c.environmentId??"",c.resourceId??"",c.source,c.name,c.unit??"",u]);a.set(p,[...a.get(p)??[],c])}return this.controlPlane.database.transaction(()=>{for(let c=0;c<s.length;c+=500){let u=s.slice(c,c+500).map((p)=>p.id);if(u.length)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (${u.map(()=>"?").join(",")})`,u)}for(let[c,u]of a){let[p,l,f,g,y,v,S]=JSON.parse(c),I=u.flatMap((_)=>_.value==null?[]:[_.value]);this.append({projectId:p,environmentId:l||void 0,resourceId:f||void 0,kind:"metric",source:`${g}:rollup`,name:y,unit:v||void 0,timestamp:new Date(S).toISOString(),value:re(I,"avg"),attributes:{downsampled:!0,count:I.length,min:re(I,"min"),max:re(I,"max"),p95:re(I,"p95"),bucketMs:r}})}})(),{compacted:s.length,rollups:a.size}}enforceRetention(e,t){let r=this.downsample(e,t),n=Math.min(3650,Math.max(1,Math.floor(e.rawDays))),o=new Date(this.now().getTime()-n*86400000).toISOString(),i=t?" AND project_id=?":"",s=this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE timestamp<?${i}`,t?[o,t]:[o]).changes,a=Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${t?" WHERE project_id=?":""}`).get(e.maxRecords,...t?[t]:[])?.excess??0);if(a>0)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${t?" WHERE project_id=?":""} ORDER BY timestamp ASC LIMIT ?)`,t?[t,a]:[a]);return this.rebuildStatusRollups(t),{deleted:s+a,...r}}rebuildStatusRollups(e){let t=e?" WHERE project_id=?":"",r=e?[e]:[];this.controlPlane.database.transaction(()=>{this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${t}`,r),this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
+${JSON.stringify(t,null,2)}`}),{ok:!0,status:202}}if(e.kind==="sms"){if(!this.options.smsImpl)return{ok:!1,error:"SMS adapter is not configured."};let u=e.config.to;if(typeof u!=="string"||!u.trim())return{ok:!1,error:"SMS channels need a `to` number."};return await this.options.smsImpl({to:u,from:e.config.from,text:n.slice(0,300)}),{ok:!0,status:202}}let o=r.url??r.value,i=t,s={"content-type":"application/json"};if(e.kind==="slack")i={text:n};if(e.kind==="discord")i={content:n};if(e.kind==="teams")i={text:n};if(e.kind==="telegram")o=`https://api.telegram.org/bot${r.botToken??r.value}/sendMessage`,i={chat_id:e.config.chatId,text:n};if(!o||!/^https:\/\//.test(o))return{ok:!1,error:"Channel endpoint is unavailable or not HTTPS."};let a=JSON.stringify(i);if(e.kind==="webhook"&&r.signingSecret){let u=Math.floor(this.now().getTime()/1000).toString();s["x-ts-cloud-timestamp"]=u,s["x-ts-cloud-signature"]=`v1=${qr("sha256",r.signingSecret).update(`${u}.${a}`).digest("hex")}`}let d=new AbortController,c=setTimeout(()=>d.abort(),1e4);try{let u=await this.fetchImpl(o,{method:"POST",headers:s,body:a,signal:d.signal});return u.ok?{ok:!0,status:u.status}:{ok:!1,status:u.status,error:`Channel returned HTTP ${u.status}.`}}finally{clearTimeout(c)}}catch(o){return{ok:!1,error:o instanceof Error?o.message:String(o)}}}async deliver(e){let t=this.store.getDelivery(e);if(!t)throw Error("Notification delivery was not found.");if(t.state==="delivered"||t.state==="dead"||t.nextAttemptAt&&t.nextAttemptAt>this.now().toISOString())return t;let r=this.store.getChannel(t.channelId);if(!r||r.status==="disabled"||r.status==="paused")return this.store.updateDelivery(e,{state:"failed",attempt:t.attempt+1,error:"Notification channel is unavailable."});let n=t.attempt+1,o=await this.send(r,t.payload);if(o.ok)return this.store.setChannelStatus(r.id,"active"),this.store.updateDelivery(e,{state:"delivered",attempt:n,responseStatus:o.status,deliveredAt:this.now().toISOString()});let s=!(!o.status||o.status===429||o.status>=500)||n>=t.maxAttempts,a=s?void 0:new Date(this.now().getTime()+Math.min(3600000,30000*2**(n-1))).toISOString();return this.store.setChannelStatus(r.id,"failing",o.error),this.store.updateDelivery(e,{state:s?"dead":"retrying",attempt:n,nextAttemptAt:a,responseStatus:o.status,error:o.error})}async deliverAll(e){return Promise.all(e.map((t)=>this.deliver(t.id)))}async retryDue(){let e=this.now().toISOString(),t=this.store.listDeliveries({states:["pending","retrying"]}).filter((r)=>!r.nextAttemptAt||r.nextAttemptAt<=e);return this.deliverAll(t)}async testChannel(e){let t=this.store.getChannel(e);if(!t)throw Error("Notification channel was not found.");let r=await this.send(t,{schemaVersion:1,event:"test",message:"ts-cloud notification channel test. No incident was created."});return this.store.markChannelTest(e,r.ok,r.error),r}}import{lookup as Ur}from"node:dns/promises";import{connect as Fr}from"node:net";async function Hr(e,t){let r=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),n=setTimeout(()=>r.kill(),t);try{return{exitCode:await r.exited,stdout:await new Response(r.stdout).text(),stderr:await new Response(r.stderr).text()}}finally{clearTimeout(n)}}class Me{store;options;constructor(e,t={}){this.store=e;this.options=t}now(){return this.options.now?.()??new Date}async probe(e){let t=performance.now(),r=this.now().toISOString(),n=this.options.agent??"local";try{if(e.kind==="http"){let s=new URL(e.target),a=performance.now();await(this.options.lookupImpl??Ur)(s.hostname);let d=performance.now()-a,c=new AbortController,u=setTimeout(()=>c.abort(),e.timeoutSeconds*1000);try{let p=performance.now(),l=await(this.options.fetchImpl??fetch)(s.toString(),{method:e.config.method??"GET",headers:e.config.headers,signal:c.signal,redirect:"manual"}),f=performance.now()-p,g=e.config.expectedBody?await l.text():"",y=e.config.expectedStatuses??[200,201,202,204],v=y.includes(l.status)&&(!e.config.expectedBody||g.includes(e.config.expectedBody));return{checkId:e.id,status:v?"healthy":"unhealthy",agent:n,region:this.options.region,statusCode:l.status,message:v?void 0:`Expected ${y.join("/")} and configured body match.`,timings:{dnsMs:d,ttfbMs:f,totalMs:performance.now()-t},checkedAt:r}}finally{clearTimeout(u)}}if(e.kind==="tcp"){let s=Number(e.config.port);if(!Number.isInteger(s)||s<1||s>65535)throw Error("TCP health check requires a valid port.");let a=performance.now();return await new Promise((d,c)=>{let u=Fr({host:e.target,port:s}),p=setTimeout(()=>{u.destroy(),c(Error("TCP health check timed out."))},e.timeoutSeconds*1000);u.once("connect",()=>{clearTimeout(p),u.destroy(),d()}),u.once("error",(l)=>{clearTimeout(p),c(l)})}),{checkId:e.id,status:"healthy",agent:n,region:this.options.region,timings:{connectMs:performance.now()-a,totalMs:performance.now()-t},checkedAt:r}}let o=e.config.command??[];if(!o.length)throw Error("Command health check is not configured.");let i=await(this.options.commandImpl??Hr)(o,e.timeoutSeconds*1000);return{checkId:e.id,status:i.exitCode===0?"healthy":"unhealthy",agent:n,region:this.options.region,message:i.exitCode===0?void 0:(i.stderr||i.stdout||`Command exited ${i.exitCode}`).slice(0,1000),timings:{totalMs:performance.now()-t},checkedAt:r}}catch(o){return{checkId:e.id,status:"unhealthy",agent:n,region:this.options.region,message:(o instanceof Error?o.message:String(o)).slice(0,1000),timings:{totalMs:performance.now()-t},checkedAt:r}}}async run(e){return this.store.appendHealthResult(await this.probe(e))}async runAndEvaluate(e){let t=await this.run(e),r=new Y(this.store),n=this.store.listRules(e.projectId,e.environmentId).filter((o)=>o.healthCheckId===e.id);return{result:t,evaluations:n.map((o)=>r.evaluate(o,{status:t.status,timestamp:t.checkedAt,group:{agent:t.agent,region:t.region??""},evidence:{healthResultId:t.id,statusCode:t.statusCode??null,message:t.message??null,timings:t.timings}}))}}}var Wr=Object.freeze({rawDays:30,downsampleAfterDays:7,downsampleBucketMs:3600000,maxRecords:1e6,samplingRate:1,collectLogs:!0,collectTraces:!0,collectRequestAnalytics:!0,estimatedStorageUsdPerGbMonth:0});function ge(e,t,r,n){let o=Number(e);return Number.isFinite(o)?Math.min(n,Math.max(r,Math.floor(o))):t}function At(e,t,r,n){let o=Number(e);return Number.isFinite(o)?Math.min(n,Math.max(r,o)):t}function Ne(e,t){return typeof e==="boolean"?e:t}function Rt(e,t={...Wr}){let r=e&&typeof e==="object"&&!Array.isArray(e)?e:{},n=ge(r.rawDays,t.rawDays,1,3650),o=ge(r.downsampleAfterDays,t.downsampleAfterDays,1,n);return{rawDays:n,downsampleAfterDays:o,downsampleBucketMs:ge(r.downsampleBucketMs,t.downsampleBucketMs,60000,86400000),maxRecords:ge(r.maxRecords,t.maxRecords,1000,1e8),samplingRate:At(r.samplingRate,t.samplingRate,0.01,1),collectLogs:Ne(r.collectLogs,t.collectLogs),collectTraces:Ne(r.collectTraces,t.collectTraces),collectRequestAnalytics:Ne(r.collectRequestAnalytics,t.collectRequestAnalytics),estimatedStorageUsdPerGbMonth:At(r.estimatedStorageUsdPerGbMonth,t.estimatedStorageUsdPerGbMonth,0,1e4)}}function Ct(e){return`telemetry.policy:${e}`}function Ke(e,t){return Rt(e.getSetting(Ct(t)))}function Zn(e,t,r){let n=Rt(r,Ke(e,t));return e.setSetting(Ct(t),n),n}function ei(e,t){return Number((Math.max(0,e)/1073741824*t.estimatedStorageUsdPerGbMonth).toFixed(4))}var Yr=/(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key|session)/i,Zr=/\b(?:authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)\s*[=:]\s*[^\s,;&\[]+/gi,en=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,tn=/\b(?:\d{1,3}\.){3}\d{1,3}\b/g;function je(e,t={}){let r=e.replace(/([?&][^=&#\s]+)=([^&#\s]*)/g,"$1=[REDACTED]").replace(Zr,"[REDACTED]");if(t.redactEmail!==!1)r=r.replace(en,"[EMAIL]");if(t.redactIp)r=r.replace(tn,"[IP]");for(let n of t.patterns??[])r=r.replace(n,"[REDACTED]");return r}function X(e,t={},r){if(r&&Yr.test(r))return"[REDACTED]";if(e===null||typeof e==="boolean"||typeof e==="number")return e;if(typeof e==="string")return je(e,t);if(Array.isArray(e))return e.map((n)=>X(n,t));if(e&&typeof e==="object"){let n={};for(let[o,i]of Object.entries(e))n[o]=X(i,t,o);return n}return String(e??"")}function Vi(e){if(!e)return;return e.split("?",1)[0].replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi,":id").replace(/\/(?:(?:\d{4,})|(?:[0-9a-f]{16,}))(?:\/|$)/gi,(r)=>r.endsWith("/")?"/:id/":"/:id").slice(0,512)}var Pt=65536,rn=2678400000,nn=new Set(["metric","log","trace","request","event"]);function k(e){return typeof e==="string"?e:void 0}function ee(e){return e==null?void 0:Number(e)}function on(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function he(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:k(e.environment_id),resourceId:k(e.resource_id),kind:String(e.kind),source:String(e.source),name:String(e.name),timestamp:String(e.timestamp),observedAt:String(e.observed_at),value:ee(e.value),unit:k(e.unit),level:k(e.level),message:k(e.message),durationMs:ee(e.duration_ms),statusCode:ee(e.status_code),method:k(e.method),host:k(e.host),pathTemplate:k(e.path_template),bytesIn:ee(e.bytes_in),bytesOut:ee(e.bytes_out),region:k(e.region),cacheResult:k(e.cache_result),upstream:k(e.upstream),traceId:k(e.trace_id),requestId:k(e.request_id),deploymentId:k(e.deployment_id),releaseId:k(e.release_id),workloadId:k(e.workload_id),sampled:Number(e.sampled)===1,attributes:on(e.attributes),ingestedBytes:Number(e.ingested_bytes)}}function U(e,t){let r=new Date(e);if(!e||!Number.isFinite(r.getTime()))throw Error(`${t} must be a valid ISO-8601 instant.`);return r}function fe(e){let t=U(e.from,"from"),r=U(e.to,"to");if(t>=r)throw Error("Telemetry from must be earlier than to.");if(r.getTime()-t.getTime()>rn)throw Error("Telemetry queries are limited to 31 days.");return{from:t,to:r}}function Tt(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));if(typeof t?.timestamp!=="string"||typeof t?.id!=="string")throw Error();return t}catch{throw Error("Telemetry cursor is invalid.")}}function zi(e){return e?Buffer.from(JSON.stringify({timestamp:e.timestamp,id:e.id})).toString("base64url"):void 0}function sn(e,t){if(!e.length)return;let r=[...e].sort((o,i)=>o-i),n=Math.max(0,Math.min(r.length-1,Math.ceil(t/100*r.length)-1));return r[n]}function re(e,t){if(t==="count")return e.length;if(!e.length)return;if(t==="sum")return e.reduce((r,n)=>r+n,0);if(t==="avg")return e.reduce((r,n)=>r+n,0)/e.length;if(t==="min")return Math.min(...e);if(t==="max")return Math.max(...e);return sn(e,Number(t.slice(1)))}function an(e,t="UTC"){try{return new Intl.DateTimeFormat("en-US",{timeZone:t,month:"short",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZoneName:"short"}).format(e)}catch{throw Error(`Unknown telemetry timezone: ${t}`)}}class Je{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}append(e){if(!nn.has(e.kind))throw Error(`Unsupported telemetry kind: ${e.kind}`);let t=U(e.timestamp,"timestamp").toISOString(),r=e.observedAt?U(e.observedAt,"observedAt").toISOString():this.now().toISOString(),n=X(e.attributes??{},this.options.redaction),o=e.message?je(e.message,this.options.redaction).slice(0,32768):void 0,i=Vi(e.pathTemplate),s=e.id??crypto.randomUUID(),a=JSON.stringify({...e,id:s,timestamp:t,observedAt:r,attributes:n,message:o,pathTemplate:i}),d=Buffer.byteLength(a);if(d>Pt)throw Error(`Telemetry records are limited to ${Pt} bytes.`);return this.controlPlane.database.run("INSERT OR IGNORE INTO telemetry_records (id, project_id, environment_id, resource_id, kind, source, name, timestamp, observed_at, value, unit, level, message, duration_ms, status_code, method, host, path_template, bytes_in, bytes_out, region, cache_result, upstream, trace_id, request_id, deployment_id, release_id, workload_id, sampled, attributes, ingested_bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.projectId,e.environmentId??null,e.resourceId??null,e.kind,e.source.slice(0,128),e.name.slice(0,256),t,r,e.value??null,e.unit??null,e.level??null,o??null,e.durationMs??null,e.statusCode??null,e.method?.slice(0,16)??null,e.host?.slice(0,256)??null,i??null,e.bytesIn??null,e.bytesOut??null,e.region?.slice(0,64)??null,e.cacheResult?.slice(0,64)??null,e.upstream?.slice(0,256)??null,e.traceId?.slice(0,256)??null,e.requestId?.slice(0,256)??null,e.deploymentId?.slice(0,256)??null,e.releaseId?.slice(0,256)??null,e.workloadId?.slice(0,512)??null,e.sampled===!1?0:1,JSON.stringify(n),d]),this.get(s)}appendMany(e){if(e.length>1e4)throw Error("Telemetry batches are limited to 10,000 records.");return this.controlPlane.database.transaction((r)=>r.map((n)=>this.append(n)))(e)}get(e){let t=this.controlPlane.database.query("SELECT * FROM telemetry_records WHERE id=?").get(e);return t?he(t):void 0}query(e){let{from:t,to:r}=fe(e),n=Math.min(5000,Math.max(1,Math.floor(e.limit??500))),o=["project_id=?","timestamp>=?","timestamp<?"],i=[e.projectId,t.toISOString(),r.toISOString()],s=(S,I)=>{if(I)o.push(`${S}=?`),i.push(I)},a=(S,I)=>{let _=[...new Set(I??[])].slice(0,100);if(_.length)o.push(`${S} IN (${_.map(()=>"?").join(",")})`),i.push(..._)};if(s("environment_id",e.environmentId),a("resource_id",e.resourceIds),a("kind",e.kinds),a("name",e.names),a("source",e.sources),a("level",e.levels),s("trace_id",e.traceId),s("request_id",e.requestId),s("deployment_id",e.deploymentId),s("release_id",e.releaseId),s("workload_id",e.workloadId),e.text)o.push("(message LIKE ? OR name LIKE ?)"),i.push(`%${e.text.slice(0,256)}%`,`%${e.text.slice(0,256)}%`);let d=Tt(e.cursor);if(d)o.push("(timestamp<? OR (timestamp=? AND id<?))"),i.push(d.timestamp,d.timestamp,d.id);let c=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${o.join(" AND ")} ORDER BY timestamp DESC, id DESC LIMIT ?`).all(...i,n+1),u=c.slice(0,n).map(he),p=c.length>n,l=new Map;for(let S of u)l.set(S.source,[...l.get(S.source)??[],S]);let f=this.now().getTime(),g=[...l].map(([S,I])=>{let _=I.reduce((P,A)=>A.observedAt>P?A.observedAt:P,I[0].observedAt),w=f-new Date(_).getTime();return{source:S,latestAt:_,freshness:w<=120000?"live":w<=600000?"stale":"unavailable",count:I.length}}),y=Math.max(60000,(r.getTime()-t.getTime())/100),v=[...l].flatMap(([S,I])=>{let _=[...new Set(I.map((w)=>new Date(w.timestamp).getTime()))].sort((w,P)=>w-P);return _.slice(1).flatMap((w,P)=>w-_[P]>y?[{from:new Date(_[P]).toISOString(),to:new Date(w).toISOString(),source:S}]:[])});return{records:u,nextCursor:p?zi(u.at(-1)):void 0,truncated:p,scannedRange:{from:t.toISOString(),to:r.toISOString()},sources:g,gaps:v}}tail(e,t){let{from:r,to:n}=fe(e),o=Math.min(1000,Math.max(1,Math.floor(e.limit??200))),i=["project_id=?","timestamp>=?","timestamp<?"],s=[e.projectId,r.toISOString(),n.toISOString()],a=(l,f)=>{if(f)i.push(`${l}=?`),s.push(f)},d=(l,f)=>{let g=[...new Set(f??[])].slice(0,100);if(g.length)i.push(`${l} IN (${g.map(()=>"?").join(",")})`),s.push(...g)};if(a("environment_id",e.environmentId),d("resource_id",e.resourceIds),d("kind",e.kinds),d("name",e.names),d("source",e.sources),d("level",e.levels),a("trace_id",e.traceId),a("request_id",e.requestId),a("deployment_id",e.deploymentId),a("release_id",e.releaseId),a("workload_id",e.workloadId),e.text)i.push("(message LIKE ? OR name LIKE ?)"),s.push(`%${e.text.slice(0,256)}%`,`%${e.text.slice(0,256)}%`);let c=Tt(t);if(c)i.push("(timestamp>? OR (timestamp=? AND id>?))"),s.push(c.timestamp,c.timestamp,c.id);let u=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE ${i.join(" AND ")} ORDER BY timestamp ASC, id ASC LIMIT ?`).all(...s,o+1),p=u.slice(0,o).map(he);return{records:p,cursor:zi(p.at(-1))??t,truncated:u.length>o}}series(e){let{from:t,to:r}=fe(e),n=Math.min(86400000,Math.max(1000,Math.floor(e.bucketMs)));if((r.getTime()-t.getTime())/n>2000)throw Error("Telemetry series are limited to 2,000 buckets.");let o=this.query({...e,kinds:["metric"],limit:5000,cursor:void 0}),i=new Map;for(let a of o.records)i.set(`${a.source}\x00${a.name}`,[...i.get(`${a.source}\x00${a.name}`)??[],a]);let s=(a,d,c)=>{let u=new Map;for(let l of a){let f=d.getTime()+Math.floor((new Date(l.timestamp).getTime()-d.getTime())/n)*n;if(f>=d.getTime()&&f<c.getTime()&&l.value!=null)u.set(f,[...u.get(f)??[],l.value])}let p=[];for(let l=d.getTime();l<c.getTime();l+=n){let f=u.get(l)??[],g=re(f,e.aggregation);p.push({timestamp:new Date(l).toISOString(),label:an(new Date(l),e.timezone),value:g,count:f.length,gap:g==null})}return p};return[...i].map(([a,d])=>{let[c,u]=a.split("\x00"),p={name:u,source:c,unit:d.find((l)=>l.unit)?.unit,aggregation:e.aggregation,bucketMs:n,points:s(d,t,r)};if(e.compareFrom&&e.compareTo){let l=this.query({...e,from:e.compareFrom,to:e.compareTo,kinds:["metric"],limit:5000,cursor:void 0}).records.filter((f)=>f.source===c&&f.name===u);p.comparison=s(l,U(e.compareFrom,"compareFrom"),U(e.compareTo,"compareTo"))}return p})}status(e,t,r=30,n=1,o){let i=[e],s=t?" AND environment_id=?":"";if(t)i.push(t);let a=[...new Set(o??[])].slice(0,100);if(o&&a.length===0)return[];let d=o?` AND resource_id IN (${a.map(()=>"?").join(",")||"''"})`:"";i.push(...a);let c=this.controlPlane.database.query(`SELECT source, MAX(latest_observed_at) latest, SUM(ingested_bytes) bytes, SUM(record_count) count, MIN(first_observed_at) first FROM telemetry_source_rollups WHERE project_id=?${s}${d} GROUP BY source`).all(...i),u=this.now().getTime();return c.map((p)=>{let l=String(p.latest),f=Math.max(0,Math.floor((u-new Date(l).getTime())/1000)),g=Math.max(1,(new Date(l).getTime()-new Date(String(p.first)).getTime())/86400000);return{source:String(p.source),freshness:f<=120?"live":f<=600?"stale":"unavailable",lastObservedAt:l,lagSeconds:f,samplingRate:n,retentionDays:r,estimatedDailyBytes:Math.round(Number(p.bytes)/g)}})}saveQuery(e,t,r,n){let o=r.trim().slice(0,80);if(!o)throw Error("Saved telemetry queries require a name.");if(fe(n),n.projectId!==e)throw Error("Saved telemetry queries cannot cross project scope.");let i=this.now().toISOString(),s=JSON.stringify(X(n,this.options.redaction));if(Buffer.byteLength(s)>16384)throw Error("Saved telemetry queries are limited to 16 KB.");let a=this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? AND name=?").get(e,t??null,o),d=a?String(a.id):crypto.randomUUID();return this.controlPlane.database.run("INSERT INTO telemetry_saved_queries (id, project_id, actor_id, name, query, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT(project_id, actor_id, name) DO UPDATE SET query=excluded.query, updated_at=excluded.updated_at",[d,e,t??null,o,s,a?String(a.created_at):i,i]),{id:d,projectId:e,actorId:t,name:o,query:JSON.parse(s),createdAt:a?String(a.created_at):i,updatedAt:i}}listSavedQueries(e,t){return this.controlPlane.database.query("SELECT * FROM telemetry_saved_queries WHERE project_id=? AND actor_id IS ? ORDER BY updated_at DESC").all(e,t??null).map((r)=>({id:String(r.id),projectId:String(r.project_id),actorId:k(r.actor_id),name:String(r.name),query:JSON.parse(String(r.query)),createdAt:String(r.created_at),updatedAt:String(r.updated_at)}))}deleteSavedQuery(e,t,r){return this.controlPlane.database.run("DELETE FROM telemetry_saved_queries WHERE id=? AND project_id=? AND actor_id IS ?",[r,e,t??null]).changes>0}downsample(e,t){let r=Math.min(86400000,Math.max(60000,Math.floor(e.downsampleBucketMs))),n=new Date(this.now().getTime()-Math.max(1,e.downsampleAfterDays)*86400000).toISOString(),o=new Date(this.now().getTime()-Math.max(1,e.rawDays)*86400000).toISOString(),i=this.controlPlane.database.query(`SELECT * FROM telemetry_records WHERE kind='metric' AND source NOT LIKE '%:rollup' AND timestamp>=? AND timestamp<?${t?" AND project_id=?":""} ORDER BY timestamp ASC LIMIT 50001`).all(o,n,...t?[t]:[]);if(i.length>50000)throw Error("Telemetry downsampling is limited to 50,000 raw points per pass; run compaction more frequently.");let s=i.map(he),a=new Map;for(let c of s){let u=Math.floor(new Date(c.timestamp).getTime()/r)*r,p=JSON.stringify([c.projectId,c.environmentId??"",c.resourceId??"",c.source,c.name,c.unit??"",u]);a.set(p,[...a.get(p)??[],c])}return this.controlPlane.database.transaction(()=>{for(let c=0;c<s.length;c+=500){let u=s.slice(c,c+500).map((p)=>p.id);if(u.length)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (${u.map(()=>"?").join(",")})`,u)}for(let[c,u]of a){let[p,l,f,g,y,v,S]=JSON.parse(c),I=u.flatMap((_)=>_.value==null?[]:[_.value]);this.append({projectId:p,environmentId:l||void 0,resourceId:f||void 0,kind:"metric",source:`${g}:rollup`,name:y,unit:v||void 0,timestamp:new Date(S).toISOString(),value:re(I,"avg"),attributes:{downsampled:!0,count:I.length,min:re(I,"min"),max:re(I,"max"),p95:re(I,"p95"),bucketMs:r}})}})(),{compacted:s.length,rollups:a.size}}enforceRetention(e,t){let r=this.downsample(e,t),n=Math.min(3650,Math.max(1,Math.floor(e.rawDays))),o=new Date(this.now().getTime()-n*86400000).toISOString(),i=t?" AND project_id=?":"",s=this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE timestamp<?${i}`,t?[o,t]:[o]).changes,a=Number(this.controlPlane.database.query(`SELECT MAX(0, COUNT(*)-?) excess FROM telemetry_records${t?" WHERE project_id=?":""}`).get(e.maxRecords,...t?[t]:[])?.excess??0);if(a>0)this.controlPlane.database.run(`DELETE FROM telemetry_records WHERE id IN (SELECT id FROM telemetry_records${t?" WHERE project_id=?":""} ORDER BY timestamp ASC LIMIT ?)`,t?[t,a]:[a]);return this.rebuildStatusRollups(t),{deleted:s+a,...r}}rebuildStatusRollups(e){let t=e?" WHERE project_id=?":"",r=e?[e]:[];this.controlPlane.database.transaction(()=>{this.controlPlane.database.run(`DELETE FROM telemetry_source_rollups${t}`,r),this.controlPlane.database.run(`INSERT INTO telemetry_source_rollups (
           project_id, environment_id, resource_id, source,
           first_observed_at, latest_observed_at, ingested_bytes, record_count
         )
@@ -41,7 +41,7 @@ ${JSON.stringify(t,null,2)}`}),{ok:!0,status:202}}if(e.kind==="sms"){if(!this.op
           project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source,
           MIN(observed_at), MAX(observed_at), SUM(ingested_bytes), COUNT(*)
         FROM telemetry_records${t}
-        GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source`,r)})()}}function Jr(e,t,r,n=new Date){let o=new Je(e.controlPlane,{now:()=>n}),i=new Z(e);return e.listRules(t,r).filter((s)=>s.enabled&&!s.healthCheckId).map((s)=>{let a=new Date(n.getTime()-s.windowMs).toISOString(),d=o.query({projectId:t,environmentId:r,resourceIds:s.resourceId?[s.resourceId]:void 0,kinds:["metric"],names:[s.signal],from:a,to:new Date(n.getTime()+1).toISOString(),limit:5000}),c=d.records.flatMap((p)=>p.value==null?[]:[p.value]),u=c.length?s.operator==="gt"||s.operator==="gte"?Math.max(...c):s.operator==="lt"||s.operator==="lte"?Math.min(...c):c.at(0):void 0;return i.evaluate(s,{value:u,status:u==null?"no_data":void 0,timestamp:n.toISOString(),group:{resourceId:s.resourceId??"",source:d.records[0]?.source??""},evidence:{signal:s.signal,windowMs:s.windowMs,sampleCount:c.length,source:d.records[0]?.source??null}})})}var ip=["spend.enforced"];function dn(e){if(e.level==="hard_capped")return"critical";if(e.level==="soft_capped")return"warning";return"info"}function Y(e,t="USD"){let r=e/100;try{return new Intl.NumberFormat("en-US",{style:"currency",currency:t}).format(r)}catch{return`${r.toFixed(2)} ${t}`}}function fd(e,t,r){let n=Y(t.projection.actualCents,e.currency),o=e.hardLimitCents??e.softLimitCents,i=o==null?"":` of ${Y(o,e.currency)}`,s=t.simulated?" [dry run]":"";if(r==="spend.released")return`[RESOLVED] ${e.name}: spend fell back to ${n}${i}.${s}`;if(r==="spend.enforced"){let c=t.actions.filter((u)=>u!=="notify").join(", ");return`[CAP] ${e.name}: ${n}${i} (${t.usedPercent.toFixed(0)}%). Enforcing ${c||"notifications only"}.${s}`}let a=ri(t.projection.timeToExhaustionMs),d=a?` Projected to reach the limit in ${a}.`:` Projected ${Y(t.projection.projectedCents,e.currency)} by period end.`;return`[SPEND] ${e.name}: ${n}${i} (${t.usedPercent.toFixed(0)}%).${d}${s}`}function Dt(e,t,r){return{schemaVersion:1,event:r,notificationText:fd(e,t,r),spend:{budgetId:e.id,budgetName:e.name,organizationId:e.organizationId,projectId:e.projectId??null,environmentId:e.environmentId??null,period:e.period,currency:e.currency,level:t.level,simulated:t.simulated,usedPercent:Math.round(t.usedPercent*10)/10,projectedPercent:Math.round(t.projectedPercent*10)/10,actualCents:Math.round(t.projection.actualCents),projectedCents:Math.round(t.projection.projectedCents),projectionConfidence:t.projection.confidence,softLimitCents:e.softLimitCents??null,hardLimitCents:e.hardLimitCents??null,timeToCap:ri(t.projection.timeToExhaustionMs),actions:t.actions,window:{start:t.window.start,end:t.window.end,label:t.window.label},reason:t.reason}}}function cn(e,t){return{schemaVersion:1,event:"spend.anomaly",notificationText:`[ANOMALY] Hourly spend ${Number.isFinite(e.deltaPercent)?`${e.deltaPercent>0?"+":""}${e.deltaPercent.toFixed(0)}%`:"new"} vs the usual ${Y(e.expected,t)} for this hour (observed ${Y(e.observed,t)}).`,spend:{anomalyId:e.id,organizationId:e.organizationId,projectId:e.projectId??null,environmentId:e.environmentId??null,signal:e.signal,direction:e.direction,severity:e.severity,observedCents:Math.round(e.observed),expectedCents:Math.round(e.expected),score:Math.round(e.score*10)/10,bucketStart:e.bucketStart}}}function ln(e,t,r,n){let o=e.matcher;if(o.projectIds?.length&&(!t.projectId||!o.projectIds.includes(t.projectId)))return!1;if(o.environmentIds?.length&&(!t.environmentId||!o.environmentIds.includes(t.environmentId)))return!1;if(o.severities?.length&&!o.severities.includes(r))return!1;if(o.eventTypes?.length&&!o.eventTypes.includes(n))return!1;return!0}class ms{store;options;constructor(e,t={}){this.store=e;this.options=t}now(){return this.options.now?.()??new Date}channelsFor(e,t,r,n){let o=[];for(let i of this.store.listRoutes(e)){if(!i.enabled||!ln(i,t,r,n))continue;let s=i.channelIds.map((a)=>this.store.getChannel(a)).filter((a)=>a?.status==="active");o.push({route:i,channels:s,quiet:xe(i,this.now())})}return o}dispatch(e,t,r,n,o,i){let s=[],a=[];for(let d of this.channelsFor(e,t,r,n)){if(d.quiet&&n!=="spend.released"){a.push(d.route.id);continue}let c=this.store.countRouteDeliveries(d.route.id,new Date(this.now().getTime()-60000).toISOString()),u=Math.max(0,d.route.rateLimitPerMinute-c);for(let p of d.channels){if(u<=0)break;s.push(this.store.createDelivery({channelId:p.id,routeId:d.route.id,eventType:n,idempotencyKey:`spend:${n}:${i}:${p.id}`,payload:o,nextAttemptAt:d.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+d.route.groupWaitSeconds*1000).toISOString()})),u--}}return{deliveries:s,suppressed:a}}notifyDecision(e,t){if(t.breaches.length===0)return{deliveries:[],suppressed:[]};let n=t.actions.some((i)=>i!=="notify")?"spend.enforced":"spend.threshold",o=t.breaches[t.breaches.length-1].atPercent;return this.dispatch(e.organizationId,{projectId:e.projectId,environmentId:e.environmentId},dn(t),n,Dt(e,t,n),`${e.id}:${t.window.start}:${o}`)}notifyRelease(e,t,r){if(r.length===0)return{deliveries:[],suppressed:[]};return this.dispatch(e.organizationId,{projectId:e.projectId,environmentId:e.environmentId},"info","spend.released",{...Dt(e,t,"spend.released"),released:[...r]},`${e.id}:${t.window.start}:${[...r].sort().join("+")}`)}notifyAnomaly(e,t="USD"){return this.dispatch(e.organizationId,{projectId:e.projectId,environmentId:e.environmentId},e.severity,"spend.anomaly",cn(e,t),e.id)}}var op="spend.loop.lease";function un(){return`${typeof process>"u"?"unknown":String(process.pid)}:${crypto.randomUUID().slice(0,8)}`}class Xi{controlPlane;owner;ttlMs;constructor(e,t={}){this.controlPlane=e;this.owner=t.owner??un(),this.ttlMs=Math.max(5000,(t.ttlSeconds??120)*1000),this.nowFn=t.now??(()=>new Date)}nowFn;read(){let e=this.controlPlane.getSetting("spend.loop.lease");if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e;if(typeof t.owner!=="string"||typeof t.expiresAt!=="string")return;return t}current(){let e=this.read();if(!e)return;return new Date(e.expiresAt).getTime()>this.nowFn().getTime()?e:void 0}acquire(){let e=this.nowFn();return this.controlPlane.database.transaction(()=>{let r=this.read(),n=r&&new Date(r.expiresAt).getTime()>e.getTime();if(n&&r.owner!==this.owner)return!1;let o={owner:this.owner,acquiredAt:n?r.acquiredAt:e.toISOString(),expiresAt:new Date(e.getTime()+this.ttlMs).toISOString()};return this.controlPlane.setSetting("spend.loop.lease",o),!0})()}release(){return this.controlPlane.database.transaction(()=>{let t=this.read();if(!t||t.owner!==this.owner)return!1;return this.controlPlane.setSetting("spend.loop.lease",null),!0})()}held(){return this.current()?.owner===this.owner}}var Ot={applied:0,duplicates:0,costCents:0,unpricedMeters:[]};class ni{options;gate;service;notifications;constructor(e){this.options=e;this.gate=new $t(e.controlPlane,{now:e.now}),this.service=new ft(e.store),this.notifications=e.alerts?new ms(e.alerts,{now:e.now}):void 0}now(){return this.options.now?.()??new Date}ingest(e,t,r){if(t.length===0)return{...Ot};return this.service.ingestTelemetry(e,t,r)}async run(e,t=[]){let r=this.now(),n=[],o={scope:e,ingested:{...Ot},decisions:[],applied:[],released:[],failed:[],withheld:[],anomalies:[],notificationsSent:0,ranAt:r.toISOString(),durationMs:0,warnings:n};try{if(o.ingested=this.ingest(e.organizationId,t),o.ingested.unpricedMeters.length>0)n.push(`No price entry for ${o.ingested.unpricedMeters.join(", ")}; that usage is metered but counts as zero against every budget.`)}catch(a){n.push(`Usage ingest failed: ${ne(a)}`)}let i=ic({gate:this.gate,transport:this.options.transport}),s;try{s=await this.service.runCycle({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,environmentKind:e.environmentKind,policy:this.options.policy,now:r,handlers:i})}catch(a){return n.push(`Spend evaluation failed: ${ne(a)}`),o.durationMs=this.now().getTime()-r.getTime(),o}o.decisions=s.statuses.map((a)=>a.decision),o.anomalies=s.anomalies;for(let a of s.enforcement)o.applied.push(...a.applied.map((d)=>d.action)),o.released.push(...a.released.map((d)=>d.action)),o.failed.push(...a.failed),o.withheld.push(...a.withheld.map((d)=>d.action));for(let a of o.failed)n.push(`Enforcement for ${a.action} did not complete: ${a.error}`);if(o.withheld.length>0)n.push(`${o.withheld.join(", ")} require approval on this environment and were not applied automatically.`);try{o.released.push(...this.reconcileGate(e))}catch(a){n.push(`Gate reconciliation failed: ${ne(a)}`)}if(this.notifications)try{for(let a of s.statuses)if(o.notificationsSent+=this.notifications.notifyDecision(a.budget,a.decision).deliveries.length,a.decision.releases.length>0)o.notificationsSent+=this.notifications.notifyRelease(a.budget,a.decision,a.decision.releases).deliveries.length;for(let a of s.anomalies)o.notificationsSent+=this.notifications.notifyAnomaly(a,this.options.store.priceBook.currency).deliveries.length}catch(a){n.push(`Spend notifications failed: ${ne(a)}`)}try{this.options.store.pruneUsage(this.options.retentionDays??400,r)}catch(a){n.push(`Usage pruning failed: ${ne(a)}`)}return o.durationMs=this.now().getTime()-r.getTime(),o}reconcileGate(e){let t=new Map(this.options.store.listBudgets({organizationId:e.organizationId}).filter((n)=>n.enabled).map((n)=>[n.id,n])),r=[];for(let n of this.gate.listUnder({organizationId:e.organizationId})){if(t.has(n.budgetId))continue;this.gate.close(n.budgetId,n.action),r.push(n.action)}return r}async runAll(e=[]){let t=[];for(let r of this.options.controlPlane.listOrganizations()){t.push(await this.run({organizationId:r.id},e));for(let n of this.options.controlPlane.listProjects().filter((o)=>o.organizationId===r.id))for(let o of this.options.controlPlane.listEnvironments(n.id))t.push(await this.run({organizationId:r.id,projectId:n.id,environmentId:o.id,environmentKind:o.kind}))}return t}}function ne(e){return e instanceof Error?e.message:String(e)}var ii=60;function gs(e,t={}){let r=Math.max(10,t.intervalSeconds??ii)*1000,n=!1,o=!1,i=async()=>{if(n||o)return;if(t.lease&&!t.lease.acquire()){t.onSkip?.(t.lease.current()?.owner??"another process");return}n=!0;try{let a=await e.runAll();t.onResult?.(a)}catch(a){t.onError?.(a)}finally{n=!1}},s=setInterval(()=>void i(),r);if(s.unref?.(),t.immediate)i();return()=>{o=!0,clearInterval(s),t.lease?.release()}}function ie(e,t){if(t.code!==0)throw Error(`${e} failed (exit ${t.code}): ${t.stderr.trim().slice(0,400)}`)}class hd{options;constructor(e){this.options=e}async targets(e){let t=await this.options.functions(e);if(t.length===0)throw Error("No Lambda functions were resolved for this scope.");return t}async suspendFunctions(e){let t=await this.targets(e),r={};for(let n of t)r[n]=await this.options.lambda.getFunctionConcurrency(n),await this.options.lambda.putFunctionConcurrency(n,0);return{kind:"lambda_reserved_concurrency",previous:r}}async resumeFunctions(e){let t=e.previous??{};for(let[r,n]of Object.entries(t))if(typeof n==="number")await this.options.lambda.putFunctionConcurrency(r,n);else await this.options.lambda.deleteFunctionConcurrency(r)}async serveStatic(e){return{...await this.suspendFunctions(e),via:"serve_static"}}async restoreDynamic(e){await this.resumeFunctions(e)}async suspendProject(e){let t=await this.targets(e),r={};for(let n of t){let i={...(await this.options.lambda.getFunction(n)).Configuration?.Environment?.Variables??{}};r[n]=i.MAINTENANCE_MODE??null,await this.options.lambda.updateFunctionConfiguration({FunctionName:n,Environment:{Variables:{...i,MAINTENANCE_MODE:"1"}}}),await this.options.republish?.(n)}return{kind:"lambda_maintenance_mode",previous:r}}async resumeProject(e){let t=e.previous??{};for(let r of Object.keys(t)){let o={...(await this.options.lambda.getFunction(r)).Configuration?.Environment?.Variables??{}};o.MAINTENANCE_MODE=typeof t[r]==="string"?t[r]:"0",await this.options.lambda.updateFunctionConfiguration({FunctionName:r,Environment:{Variables:o}}),await this.options.republish?.(r)}}}class yd{options;constructor(e){this.options=e}async unitsFor(e){let t=await this.options.units(e);if(t.length===0)throw Error("No systemd units were resolved for this scope.");for(let r of t)if(!/^[A-Za-z0-9@._-]+$/.test(r))throw Error(`Refusing to act on an unsafe unit name: ${r}`);return t}async stopUnits(e,t){let r=await this.unitsFor(e),n=[];for(let o of r){let i=await this.options.exec(this.options.host,`systemctl list-units --plain --no-legend --state=active --type=service '${o}@*.service' '${o}.service' 2>/dev/null | awk '{print $1}'`);ie(`listing units for ${o}`,i);let s=i.stdout.split(`
+        GROUP BY project_id, COALESCE(environment_id, ''), COALESCE(resource_id, ''), source`,r)})()}}function Jr(e,t,r,n=new Date){let o=new Je(e.controlPlane,{now:()=>n}),i=new Y(e);return e.listRules(t,r).filter((s)=>s.enabled&&!s.healthCheckId).map((s)=>{let a=new Date(n.getTime()-s.windowMs).toISOString(),d=o.query({projectId:t,environmentId:r,resourceIds:s.resourceId?[s.resourceId]:void 0,kinds:["metric"],names:[s.signal],from:a,to:new Date(n.getTime()+1).toISOString(),limit:5000}),c=d.records.flatMap((p)=>p.value==null?[]:[p.value]),u=c.length?s.operator==="gt"||s.operator==="gte"?Math.max(...c):s.operator==="lt"||s.operator==="lte"?Math.min(...c):c.at(0):void 0;return i.evaluate(s,{value:u,status:u==null?"no_data":void 0,timestamp:n.toISOString(),group:{resourceId:s.resourceId??"",source:d.records[0]?.source??""},evidence:{signal:s.signal,windowMs:s.windowMs,sampleCount:c.length,source:d.records[0]?.source??null}})})}var ip=["spend.enforced"];function dn(e){if(e.level==="hard_capped")return"critical";if(e.level==="soft_capped")return"warning";return"info"}function Z(e,t="USD"){let r=e/100;try{return new Intl.NumberFormat("en-US",{style:"currency",currency:t}).format(r)}catch{return`${r.toFixed(2)} ${t}`}}function fd(e,t,r){let n=Z(t.projection.actualCents,e.currency),o=e.hardLimitCents??e.softLimitCents,i=o==null?"":` of ${Z(o,e.currency)}`,s=t.simulated?" [dry run]":"";if(r==="spend.released")return`[RESOLVED] ${e.name}: spend fell back to ${n}${i}.${s}`;if(r==="spend.enforced"){let c=t.actions.filter((u)=>u!=="notify").join(", ");return`[CAP] ${e.name}: ${n}${i} (${t.usedPercent.toFixed(0)}%). Enforcing ${c||"notifications only"}.${s}`}let a=ri(t.projection.timeToExhaustionMs),d=a?` Projected to reach the limit in ${a}.`:` Projected ${Z(t.projection.projectedCents,e.currency)} by period end.`;return`[SPEND] ${e.name}: ${n}${i} (${t.usedPercent.toFixed(0)}%).${d}${s}`}function Dt(e,t,r){return{schemaVersion:1,event:r,notificationText:fd(e,t,r),spend:{budgetId:e.id,budgetName:e.name,organizationId:e.organizationId,projectId:e.projectId??null,environmentId:e.environmentId??null,period:e.period,currency:e.currency,level:t.level,simulated:t.simulated,usedPercent:Math.round(t.usedPercent*10)/10,projectedPercent:Math.round(t.projectedPercent*10)/10,actualCents:Math.round(t.projection.actualCents),projectedCents:Math.round(t.projection.projectedCents),projectionConfidence:t.projection.confidence,softLimitCents:e.softLimitCents??null,hardLimitCents:e.hardLimitCents??null,timeToCap:ri(t.projection.timeToExhaustionMs),actions:t.actions,window:{start:t.window.start,end:t.window.end,label:t.window.label},reason:t.reason}}}function cn(e,t){return{schemaVersion:1,event:"spend.anomaly",notificationText:`[ANOMALY] Hourly spend ${Number.isFinite(e.deltaPercent)?`${e.deltaPercent>0?"+":""}${e.deltaPercent.toFixed(0)}%`:"new"} vs the usual ${Z(e.expected,t)} for this hour (observed ${Z(e.observed,t)}).`,spend:{anomalyId:e.id,organizationId:e.organizationId,projectId:e.projectId??null,environmentId:e.environmentId??null,signal:e.signal,direction:e.direction,severity:e.severity,observedCents:Math.round(e.observed),expectedCents:Math.round(e.expected),score:Math.round(e.score*10)/10,bucketStart:e.bucketStart}}}function ln(e,t,r,n){let o=e.matcher;if(o.projectIds?.length&&(!t.projectId||!o.projectIds.includes(t.projectId)))return!1;if(o.environmentIds?.length&&(!t.environmentId||!o.environmentIds.includes(t.environmentId)))return!1;if(o.severities?.length&&!o.severities.includes(r))return!1;if(o.eventTypes?.length&&!o.eventTypes.includes(n))return!1;return!0}class ms{store;options;constructor(e,t={}){this.store=e;this.options=t}now(){return this.options.now?.()??new Date}channelsFor(e,t,r,n){let o=[];for(let i of this.store.listRoutes(e)){if(!i.enabled||!ln(i,t,r,n))continue;let s=i.channelIds.map((a)=>this.store.getChannel(a)).filter((a)=>a?.status==="active");o.push({route:i,channels:s,quiet:xe(i,this.now())})}return o}dispatch(e,t,r,n,o,i){let s=[],a=[];for(let d of this.channelsFor(e,t,r,n)){if(d.quiet&&n!=="spend.released"){a.push(d.route.id);continue}let c=this.store.countRouteDeliveries(d.route.id,new Date(this.now().getTime()-60000).toISOString()),u=Math.max(0,d.route.rateLimitPerMinute-c);for(let p of d.channels){if(u<=0)break;s.push(this.store.createDelivery({channelId:p.id,routeId:d.route.id,eventType:n,idempotencyKey:`spend:${n}:${i}:${p.id}`,payload:o,nextAttemptAt:d.route.groupWaitSeconds===0?void 0:new Date(this.now().getTime()+d.route.groupWaitSeconds*1000).toISOString()})),u--}}return{deliveries:s,suppressed:a}}notifyDecision(e,t){if(t.breaches.length===0)return{deliveries:[],suppressed:[]};let n=t.actions.some((i)=>i!=="notify")?"spend.enforced":"spend.threshold",o=t.breaches[t.breaches.length-1].atPercent;return this.dispatch(e.organizationId,{projectId:e.projectId,environmentId:e.environmentId},dn(t),n,Dt(e,t,n),`${e.id}:${t.window.start}:${o}`)}notifyRelease(e,t,r){if(r.length===0)return{deliveries:[],suppressed:[]};return this.dispatch(e.organizationId,{projectId:e.projectId,environmentId:e.environmentId},"info","spend.released",{...Dt(e,t,"spend.released"),released:[...r]},`${e.id}:${t.window.start}:${[...r].sort().join("+")}`)}notifyAnomaly(e,t="USD"){return this.dispatch(e.organizationId,{projectId:e.projectId,environmentId:e.environmentId},e.severity,"spend.anomaly",cn(e,t),e.id)}}var op="spend.loop.lease";function un(){return`${typeof process>"u"?"unknown":String(process.pid)}:${crypto.randomUUID().slice(0,8)}`}class Xi{controlPlane;owner;ttlMs;constructor(e,t={}){this.controlPlane=e;this.owner=t.owner??un(),this.ttlMs=Math.max(5000,(t.ttlSeconds??120)*1000),this.nowFn=t.now??(()=>new Date)}nowFn;read(){let e=this.controlPlane.getSetting("spend.loop.lease");if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e;if(typeof t.owner!=="string"||typeof t.expiresAt!=="string")return;return t}current(){let e=this.read();if(!e)return;return new Date(e.expiresAt).getTime()>this.nowFn().getTime()?e:void 0}acquire(){let e=this.nowFn();return this.controlPlane.database.transaction(()=>{let r=this.read(),n=r&&new Date(r.expiresAt).getTime()>e.getTime();if(n&&r.owner!==this.owner)return!1;let o={owner:this.owner,acquiredAt:n?r.acquiredAt:e.toISOString(),expiresAt:new Date(e.getTime()+this.ttlMs).toISOString()};return this.controlPlane.setSetting("spend.loop.lease",o),!0})()}release(){return this.controlPlane.database.transaction(()=>{let t=this.read();if(!t||t.owner!==this.owner)return!1;return this.controlPlane.setSetting("spend.loop.lease",null),!0})()}held(){return this.current()?.owner===this.owner}}var Ot={applied:0,duplicates:0,costCents:0,unpricedMeters:[]};class ni{options;gate;service;notifications;constructor(e){this.options=e;this.gate=new $t(e.controlPlane,{now:e.now}),this.service=new ft(e.store),this.notifications=e.alerts?new ms(e.alerts,{now:e.now}):void 0}now(){return this.options.now?.()??new Date}ingest(e,t,r){if(t.length===0)return{...Ot};return this.service.ingestTelemetry(e,t,r)}async run(e,t=[]){let r=this.now(),n=[],o={scope:e,ingested:{...Ot},decisions:[],applied:[],released:[],failed:[],withheld:[],anomalies:[],notificationsSent:0,ranAt:r.toISOString(),durationMs:0,warnings:n};try{if(o.ingested=this.ingest(e.organizationId,t),o.ingested.unpricedMeters.length>0)n.push(`No price entry for ${o.ingested.unpricedMeters.join(", ")}; that usage is metered but counts as zero against every budget.`)}catch(a){n.push(`Usage ingest failed: ${ne(a)}`)}let i=ic({gate:this.gate,transport:this.options.transport}),s;try{s=await this.service.runCycle({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,environmentKind:e.environmentKind,policy:this.options.policy,now:r,handlers:i})}catch(a){return n.push(`Spend evaluation failed: ${ne(a)}`),o.durationMs=this.now().getTime()-r.getTime(),o}o.decisions=s.statuses.map((a)=>a.decision),o.anomalies=s.anomalies;for(let a of s.enforcement)o.applied.push(...a.applied.map((d)=>d.action)),o.released.push(...a.released.map((d)=>d.action)),o.failed.push(...a.failed),o.withheld.push(...a.withheld.map((d)=>d.action));for(let a of o.failed)n.push(`Enforcement for ${a.action} did not complete: ${a.error}`);if(o.withheld.length>0)n.push(`${o.withheld.join(", ")} require approval on this environment and were not applied automatically.`);try{o.released.push(...this.reconcileGate(e))}catch(a){n.push(`Gate reconciliation failed: ${ne(a)}`)}if(this.notifications)try{for(let a of s.statuses)if(o.notificationsSent+=this.notifications.notifyDecision(a.budget,a.decision).deliveries.length,a.decision.releases.length>0)o.notificationsSent+=this.notifications.notifyRelease(a.budget,a.decision,a.decision.releases).deliveries.length;for(let a of s.anomalies)o.notificationsSent+=this.notifications.notifyAnomaly(a,this.options.store.priceBook.currency).deliveries.length}catch(a){n.push(`Spend notifications failed: ${ne(a)}`)}try{this.options.store.pruneUsage(this.options.retentionDays??400,r)}catch(a){n.push(`Usage pruning failed: ${ne(a)}`)}return o.durationMs=this.now().getTime()-r.getTime(),o}reconcileGate(e){let t=new Map(this.options.store.listBudgets({organizationId:e.organizationId}).filter((n)=>n.enabled).map((n)=>[n.id,n])),r=[];for(let n of this.gate.listUnder({organizationId:e.organizationId})){if(t.has(n.budgetId))continue;this.gate.close(n.budgetId,n.action),r.push(n.action)}return r}async runAll(e=[]){let t=[];for(let r of this.options.controlPlane.listOrganizations()){t.push(await this.run({organizationId:r.id},e));for(let n of this.options.controlPlane.listProjects().filter((o)=>o.organizationId===r.id))for(let o of this.options.controlPlane.listEnvironments(n.id))t.push(await this.run({organizationId:r.id,projectId:n.id,environmentId:o.id,environmentKind:o.kind}))}return t}}function ne(e){return e instanceof Error?e.message:String(e)}var ii=60;function gs(e,t={}){let r=Math.max(10,t.intervalSeconds??ii)*1000,n=!1,o=!1,i=async()=>{if(n||o)return;if(t.lease&&!t.lease.acquire()){t.onSkip?.(t.lease.current()?.owner??"another process");return}n=!0;try{let a=await e.runAll();t.onResult?.(a)}catch(a){t.onError?.(a)}finally{n=!1}},s=setInterval(()=>void i(),r);if(s.unref?.(),t.immediate)i();return()=>{o=!0,clearInterval(s),t.lease?.release()}}function ie(e,t){if(t.code!==0)throw Error(`${e} failed (exit ${t.code}): ${t.stderr.trim().slice(0,400)}`)}class hd{options;constructor(e){this.options=e}async targets(e){let t=await this.options.functions(e);if(t.length===0)throw Error("No Lambda functions were resolved for this scope.");return t}async suspendFunctions(e){let t=await this.targets(e),r={};for(let n of t)r[n]=await this.options.lambda.getFunctionConcurrency(n),await this.options.lambda.putFunctionConcurrency(n,0);return{kind:"lambda_reserved_concurrency",previous:r}}async resumeFunctions(e){let t=e.previous??{};for(let[r,n]of Object.entries(t))if(typeof n==="number")await this.options.lambda.putFunctionConcurrency(r,n);else await this.options.lambda.deleteFunctionConcurrency(r)}async serveStatic(e){return{...await this.suspendFunctions(e),via:"serve_static"}}async restoreDynamic(e){await this.resumeFunctions(e)}async suspendProject(e){let t=await this.targets(e),r={};for(let n of t){let i={...(await this.options.lambda.getFunction(n)).Configuration?.Environment?.Variables??{}};r[n]=i.MAINTENANCE_MODE??null,await this.options.lambda.updateFunctionConfiguration({FunctionName:n,Environment:{Variables:{...i,MAINTENANCE_MODE:"1"}}}),await this.options.republish?.(n)}return{kind:"lambda_maintenance_mode",previous:r}}async resumeProject(e){let t=e.previous??{};for(let r of Object.keys(t)){let o={...(await this.options.lambda.getFunction(r)).Configuration?.Environment?.Variables??{}};o.MAINTENANCE_MODE=typeof t[r]==="string"?t[r]:"0",await this.options.lambda.updateFunctionConfiguration({FunctionName:r,Environment:{Variables:o}}),await this.options.republish?.(r)}}}class yd{options;constructor(e){this.options=e}async unitsFor(e){let t=await this.options.units(e);if(t.length===0)throw Error("No systemd units were resolved for this scope.");for(let r of t)if(!/^[A-Za-z0-9@._-]+$/.test(r))throw Error(`Refusing to act on an unsafe unit name: ${r}`);return t}async stopUnits(e,t){let r=await this.unitsFor(e),n=[];for(let o of r){let i=await this.options.exec(this.options.host,`systemctl list-units --plain --no-legend --state=active --type=service '${o}@*.service' '${o}.service' 2>/dev/null | awk '{print $1}'`);ie(`listing units for ${o}`,i);let s=i.stdout.split(`
 `).map((a)=>a.trim()).filter((a)=>/^[A-Za-z0-9@._-]+\.service$/.test(a));for(let a of s){let d=await this.options.exec(this.options.host,`systemctl stop '${a}'`);ie(`stopping ${a}`,d),n.push(a)}}return{kind:"systemd_units",via:t,stopped:n}}async startUnits(e){let t=Array.isArray(e.stopped)?e.stopped:[];for(let r of t){if(!/^[A-Za-z0-9@._-]+$/.test(r))continue;let n=await this.options.exec(this.options.host,`systemctl start '${r}'`);ie(`starting ${r}`,n)}}async suspendFunctions(e){return this.stopUnits(e,"suspend_functions")}async resumeFunctions(e){await this.startUnits(e)}async serveStatic(e){return this.stopUnits(e,"serve_static")}async restoreDynamic(e){await this.startUnits(e)}async suspendProject(e){return this.stopUnits(e,"suspend_project")}async resumeProject(e){await this.startUnits(e)}async throttleRequests(e){let t=this.options.renderDdos,r=this.options.ddos;if(!t||!r)throw Error("Request throttling needs a DDoS config and renderer on this transport.");let n={rateLimitFactor:e.factor},o={...r.thresholds,newConnectionsPerSecond:Zi(r.thresholds?.newConnectionsPerSecond??50,n),concurrentPerSource:Zi(r.thresholds?.concurrentPerSource??100,n)},i=t({...r,thresholds:o}),s=await this.options.exec(this.options.host,`bash -s <<'TS_CLOUD_THROTTLE_EOF'
 ${i}
 TS_CLOUD_THROTTLE_EOF`);return ie("applying the throttled firewall ruleset",s),{kind:"nftables_throttle",factor:e.factor,previousThresholds:r.thresholds??{}}}async restoreRequests(e){let t=this.options.renderDdos,r=this.options.ddos;if(!t||!r)return;let n=e.previousThresholds??{},o=t({...r,thresholds:n}),i=await this.options.exec(this.options.host,`bash -s <<'TS_CLOUD_THROTTLE_EOF'
@@ -108,4 +108,4 @@ volumes:
 `).map((i)=>i.trim()).filter(F.test.bind(F))){let i=await this.inspect(o);if(i)n.push(i)}return n}async create(e){let t=typeof e.desiredState.nativeName==="string"?e.desiredState.nativeName:e.name;if(!F.test(t))throw Error("Docker volume name is invalid.");return await this.run(["volume","create","--label",`ts-cloud.volume=${e.id}`,"--label",`ts-cloud.project=${e.projectId}`,t]),await this.inspect(t)??{providerId:t}}async attach(e,t){}async detach(e,t){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(e,t,r){throw Error(this.capabilities().restore.reason)}async delete(e){if(!e.providerId||!F.test(e.providerId))throw Error("Docker volume provider identity is missing or invalid.");await this.run(["volume","rm",e.providerId])}async usage(e){let t=await this.run(["system","df","-v","--format","{{json .}}"],!0),r=t.split(`
 `).find((n)=>n.includes(`"Name":"${e.providerId}"`));if(!r)return{};try{let n=JSON.parse(r);return{usedBytes:typeof n.Size==="number"?n.Size:void 0}}catch{return{}}}}class Kr{provider="server";type="server_path";root;constructor(e){this.root=Wt(e)}capabilities(){return ze(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Server paths use the capacity of their containing filesystem."},snapshot:{supported:!1,reason:"Attach a filesystem backup policy for verified recovery points."},restore:{supported:!1,reason:"Restore a filesystem recovery point into a new managed path."}})}path(e){if(!F.test(e))throw Error("Server path volume name is invalid.");let t=Wt(this.root,e);if(!t.startsWith(`${this.root}${Bn}`)||Vn(t)!==e)throw Error("Server path escaped the managed volume root.");return t}async discover(e,t){return await Ue(this.root,{recursive:!0,mode:488}),(await Ln(this.root,{withFileTypes:!0})).filter((n)=>n.isDirectory()&&F.test(n.name)).map((n)=>({providerId:n.name,raw:{path:this.path(n.name)}}))}async create(e){let t=typeof e.desiredState.nativeName==="string"?e.desiredState.nativeName:e.name,r=this.path(t);return await Ue(this.root,{recursive:!0,mode:488}),await Ue(r,{recursive:!1,mode:488}),{providerId:t,filesystem:"host",raw:{path:r}}}async attach(e,t){}async detach(e,t){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(e,t,r){throw Error(this.capabilities().restore.reason)}async delete(e){if(!e.providerId)throw Error("Server path provider identity is unavailable.");await qn(this.path(e.providerId),{recursive:!0,force:!1})}async usage(e){if(!e.providerId)return{};return{usedBytes:(await $n(this.path(e.providerId))).size}}}var D=(e)=>e==null?void 0:String(e),de=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},He=(e)=>Number(e)===1,H=(e)=>e().toISOString();function Kt(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:D(e.environment_id),resourceId:D(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:D(e.provider_id),type:String(e.type),status:String(e.status),capacityBytes:e.capacity_bytes==null?void 0:Number(e.capacity_bytes),usedBytes:e.used_bytes==null?void 0:Number(e.used_bytes),filesystem:D(e.filesystem),encrypted:He(e.encrypted),capabilities:de(e.capabilities,{}),desiredState:de(e.desired_state,{}),observedState:de(e.observed_state,{}),backupPolicyId:D(e.backup_policy_id),lastBackupAt:D(e.last_backup_at),orphanedAt:D(e.orphaned_at),adoptedAt:D(e.adopted_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:D(e.deleted_at)}}function Fe(e){return{id:String(e.id),volumeId:String(e.volume_id),resourceId:String(e.resource_id),targetPath:String(e.target_path),readOnly:He(e.read_only),uid:e.uid==null?void 0:Number(e.uid),gid:e.gid==null?void 0:Number(e.gid),mode:D(e.mode),propagation:String(e.propagation),driverOptions:de(e.driver_options,{}),desiredState:String(e.desired_state),observedState:String(e.observed_state),operationId:D(e.operation_id),lastError:D(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Gt(e){return{id:String(e.id),volumeId:String(e.volume_id),recoveryPointId:D(e.recovery_point_id),providerId:D(e.provider_id),name:String(e.name),status:String(e.status),sizeBytes:e.size_bytes==null?void 0:Number(e.size_bytes),encrypted:He(e.encrypted),checksum:D(e.checksum),metadata:de(e.metadata,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:D(e.deleted_at)}}class pt{controlPlane;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.controlPlane=e;this.now=t;this.id=r}get(e){let t=this.controlPlane.database.query("SELECT * FROM persistent_volumes WHERE id=?").get(e);return t?Kt(t):void 0}list(e){let t=["project_id=?"],r=[e.projectId];if(e.environmentId)t.push("environment_id=?"),r.push(e.environmentId);if(!e.includeDeleted)t.push("deleted_at IS NULL");return this.controlPlane.database.query(`SELECT * FROM persistent_volumes WHERE ${t.join(" AND ")} ORDER BY name`).all(...r).map(Kt)}create(e){let t=H(this.now),r=e.id??this.id();return this.controlPlane.database.run("INSERT INTO persistent_volumes (id,organization_id,project_id,environment_id,resource_id,name,provider,provider_id,type,status,capacity_bytes,used_bytes,filesystem,encrypted,capabilities,desired_state,observed_state,backup_policy_id,last_backup_at,orphaned_at,adopted_at,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.provider,e.providerId??null,e.type,e.status,e.capacityBytes??null,e.usedBytes??null,e.filesystem??null,e.encrypted?1:0,JSON.stringify(e.capabilities),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),e.backupPolicyId??null,e.lastBackupAt??null,e.orphanedAt??null,e.adoptedAt??null,t,t,e.deletedAt??null]),this.get(r)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error("Volume changed before this operation could be applied.");let o={...n,...r,updatedAt:H(this.now)};if(this.controlPlane.database.run("UPDATE persistent_volumes SET environment_id=?,resource_id=?,name=?,provider=?,provider_id=?,type=?,status=?,capacity_bytes=?,used_bytes=?,filesystem=?,encrypted=?,capabilities=?,desired_state=?,observed_state=?,backup_policy_id=?,last_backup_at=?,orphaned_at=?,adopted_at=?,deleted_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[o.environmentId??null,o.resourceId??null,o.name,o.provider,o.providerId??null,o.type,o.status,o.capacityBytes??null,o.usedBytes??null,o.filesystem??null,o.encrypted?1:0,JSON.stringify(o.capabilities),JSON.stringify(o.desiredState),JSON.stringify(o.observedState),o.backupPolicyId??null,o.lastBackupAt??null,o.orphanedAt??null,o.adoptedAt??null,o.deletedAt??null,o.updatedAt,e,t]).changes!==1)throw Error("Volume changed before this operation could be applied.");return this.get(e)}attachments(e){return this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? ORDER BY target_path").all(e).map(Fe)}attachment(e){let t=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE id=?").get(e);return t?Fe(t):void 0}upsertAttachment(e){let t=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? AND resource_id=? AND target_path=?").get(e.volumeId,e.resourceId,e.targetPath),r=H(this.now);if(t){let o=Fe(t);return this.controlPlane.database.run("UPDATE volume_attachments SET read_only=?,uid=?,gid=?,mode=?,propagation=?,driver_options=?,desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[e.readOnly?1:0,e.uid??null,e.gid??null,e.mode??null,e.propagation,JSON.stringify(e.driverOptions),e.desiredState,e.observedState,e.operationId??null,e.lastError??null,r,o.id]),this.attachment(o.id)}let n=e.id??this.id();return this.controlPlane.database.run("INSERT INTO volume_attachments (id,volume_id,resource_id,target_path,read_only,uid,gid,mode,propagation,driver_options,desired_state,observed_state,operation_id,last_error,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[n,e.volumeId,e.resourceId,e.targetPath,e.readOnly?1:0,e.uid??null,e.gid??null,e.mode??null,e.propagation,JSON.stringify(e.driverOptions),e.desiredState,e.observedState,e.operationId??null,e.lastError??null,r,r]),this.attachment(n)}updateAttachment(e,t){let r=this.attachment(e);if(!r)throw Error("Volume attachment was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE volume_attachments SET desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[n.desiredState,n.observedState,n.operationId??null,n.lastError??null,H(this.now),e]),this.attachment(e)}snapshots(e){return this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE volume_id=? AND deleted_at IS NULL ORDER BY created_at DESC").all(e).map(Gt)}snapshot(e){let t=this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE id=?").get(e);return t?Gt(t):void 0}createSnapshot(e){let t=e.id??this.id(),r=H(this.now);return this.controlPlane.database.run("INSERT INTO volume_snapshots (id,volume_id,recovery_point_id,provider_id,name,status,size_bytes,encrypted,checksum,metadata,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.volumeId,e.recoveryPointId??null,e.providerId??null,e.name,e.status,e.sizeBytes??null,e.encrypted?1:0,e.checksum??null,JSON.stringify(e.metadata),r,r,e.deletedAt??null]),this.snapshot(t)}updateSnapshot(e,t){let r=this.snapshot(e);if(!r)throw Error("Volume snapshot was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE volume_snapshots SET recovery_point_id=?,provider_id=?,name=?,status=?,size_bytes=?,encrypted=?,checksum=?,metadata=?,deleted_at=?,updated_at=? WHERE id=?",[n.recoveryPointId??null,n.providerId??null,n.name,n.status,n.sizeBytes??null,n.encrypted?1:0,n.checksum??null,JSON.stringify(n.metadata),n.deletedAt??null,H(this.now),e]),this.snapshot(e)}inventory(e,t){return this.list({projectId:e,environmentId:t}).map((r)=>{let n=this.attachments(r.id),o=this.snapshots(r.id),i=r.lastBackupAt?Date.now()-new Date(r.lastBackupAt).getTime():1/0;return{...r,attachments:n,snapshots:o,orphaned:r.status==="orphaned",usagePercent:r.capacityBytes&&r.usedBytes!=null?Math.round(r.usedBytes/r.capacityBytes*1000)/10:void 0,backupState:r.backupPolicyId?i<=86400000?"protected":"stale":"unprotected"}})}audit(e){this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,resourceId:this.get(e.volumeId)?.resourceId,actorId:e.actorId,type:e.type,level:"warning",payload:{volumeId:e.volumeId,environmentId:e.environmentId??null,...e.payload}})}}function Qe(e,t){let r=e.getProject(t.projectId);if(!r?.organizationId)return;let n=new pt(e),o=new _t,i=new Set(t.manifest.spec.volumes),s=new Set;for(let a of i){let d=`${t.slug}-${a}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),c=n.list({projectId:t.projectId,environmentId:t.environmentId,includeDeleted:!0}).find((f)=>f.name===d);if(c?.deletedAt)throw Error(`Compose volume ${d} was permanently deleted; rename it before redeploying.`);let u=c?.resourceId?e.getResource(c.resourceId):e.createResource({projectId:t.projectId,environmentId:t.environmentId,kind:"volume",slug:d,name:d,provider:"docker",providerId:d,desiredState:{composeApplicationId:t.id,composeVolume:a}}),p=c??n.create({organizationId:r.organizationId,projectId:t.projectId,environmentId:t.environmentId,resourceId:u?.id,name:d,provider:"docker",providerId:d,type:"docker",status:"available",encrypted:!1,capabilities:o.capabilities(),desiredState:{composeApplicationId:t.id,composeVolume:a,nativeName:d},observedState:{}});s.add(p.id);let l=new Map;for(let f of Object.values(t.manifest.spec.services))for(let g of f.volumes.filter((y)=>y.source===a)){let y=l.get(g.target)??[];y.push(f.name),l.set(g.target,y),n.upsertAttachment({volumeId:p.id,resourceId:t.resourceId,targetPath:g.target,readOnly:g.readOnly,propagation:"private",driverOptions:{composeServices:y},desiredState:"attached",observedState:"pending"})}}for(let a of n.list({projectId:t.projectId,environmentId:t.environmentId}).filter((d)=>d.desiredState.composeApplicationId===t.id&&!s.has(d.id)))for(let d of n.attachments(a.id))n.updateAttachment(d.id,{desiredState:"detached"})}function Yt(e,t,r){let n=new pt(e);for(let o of n.list({projectId:t.projectId,environmentId:t.environmentId}).filter((i)=>i.desiredState.composeApplicationId===t.id)){for(let i of n.attachments(o.id))n.updateAttachment(i.id,{desiredState:"detached",observedState:"detached"});n.update(o.id,o.version,{status:r?"deleted":"available",deletedAt:r?new Date().toISOString():void 0})}}function Q(e){return typeof e==="string"&&e?e:void 0}function Ye(e,t){try{return JSON.parse(String(e))}catch{return t}}function Ie(e){return{id:String(e.id),resourceId:String(e.resource_id),projectId:String(e.project_id),environmentId:String(e.environment_id),name:String(e.name),slug:String(e.slug),status:String(e.status),sourceKind:String(e.source_kind),sourceHash:String(e.source_hash),redactedSource:String(e.redacted_source),manifest:Ye(e.manifest,{}),diagnostics:Ye(e.diagnostics,[]),templateId:Q(e.template_id),templateVersion:Q(e.template_version),latestOperationId:Q(e.latest_operation_id),createdByActorId:Q(e.created_by_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:Q(e.deleted_at)}}function Un(e){return{applicationId:String(e.application_id),serviceName:String(e.service_name),status:String(e.status),replicas:Number(e.replicas),healthyReplicas:Number(e.healthy_replicas),latestOperationId:Q(e.latest_operation_id),observedState:Ye(e.observed_state,{}),updatedAt:String(e.updated_at)}}class mt{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}persist(e,t){if(!e.valid)throw Error(`Compose definition contains ${e.diagnostics.filter((g)=>g.severity==="error").length} blocking diagnostic(s)`);let{projectId:r,environmentId:n,name:o,slug:i}=e.manifest.metadata;if(!this.controlPlane.listEnvironments(r).find((g)=>g.id===n))throw Error("Compose project and environment scope was not found");let a=this.getBySlug(r,n,i),d=this.now().toISOString(),c=JSON.stringify(e.manifest),u=JSON.stringify(h(e.diagnostics));if(a){if(a.status==="deleted")throw Error("A deleted Compose application cannot be overwritten; choose another slug");let g=this.controlPlane.getResource(a.resourceId);if(!g)throw Error("Compose application resource was not found");this.controlPlane.updateResource(g.id,g.version,{name:o,provider:g.provider,providerId:g.providerId,desiredState:e.manifest,discoveredState:g.discoveredState,metadata:{sourceKind:t.sourceKind,templateId:t.templateId??null,templateVersion:t.templateVersion??null,sourceHash:e.sourceHash}}),this.controlPlane.database.run("UPDATE compose_applications SET name=?, status='ready', source_kind=?, source_hash=?, redacted_source=?, manifest=?, diagnostics=?, template_id=?, template_version=?, version=version+1, updated_at=? WHERE id=?",[o,t.sourceKind,e.sourceHash,e.redactedSource,c,u,t.templateId??null,t.templateVersion??null,d,a.id]);let y=Object.keys(e.manifest.spec.services);if(y.length)this.controlPlane.database.run(`DELETE FROM compose_service_states WHERE application_id=? AND service_name NOT IN (${y.map(()=>"?").join(",")})`,[a.id,...y]);for(let S of Object.values(e.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?) ON CONFLICT(application_id, service_name) DO UPDATE SET replicas=excluded.replicas, updated_at=excluded.updated_at",[a.id,S.name,S.replicas,d]);this.controlPlane.appendEvent({projectId:r,resourceId:a.resourceId,actorId:t.createdByActorId,type:"compose.application.updated",payload:{applicationId:a.id,sourceHash:e.sourceHash,diagnosticCount:e.diagnostics.length,templateId:t.templateId??null,templateVersion:t.templateVersion??null}});let v=this.get(a.id);return Qe(this.controlPlane,v),v}let p=this.controlPlane.createResource({projectId:r,environmentId:n,kind:"compose_application",slug:i,name:o,desiredState:e.manifest,metadata:{sourceKind:t.sourceKind,templateId:t.templateId??null,templateVersion:t.templateVersion??null,sourceHash:e.sourceHash}}),l=this.id();this.controlPlane.database.run("INSERT INTO compose_applications (id, resource_id, project_id, environment_id, name, slug, status, source_kind, source_hash, redacted_source, manifest, diagnostics, template_id, template_version, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[l,p.id,r,n,o,i,t.sourceKind,e.sourceHash,e.redactedSource,c,u,t.templateId??null,t.templateVersion??null,t.createdByActorId??null,d,d]);for(let g of Object.values(e.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?)",[l,g.name,g.replicas,d]);this.controlPlane.appendEvent({projectId:r,resourceId:p.id,actorId:t.createdByActorId,type:"compose.application.created",payload:{applicationId:l,sourceHash:e.sourceHash,serviceNames:Object.keys(e.manifest.spec.services),templateId:t.templateId??null}});let f=this.get(l);return Qe(this.controlPlane,f),f}import(e,t){let r=kt(e,t);return{application:this.persist(r,{sourceKind:"compose",createdByActorId:t.createdByActorId}),parsed:r}}fromTemplate(e,t,r){let n=Jt(e,t,r,r.version);return{application:this.persist(n,{sourceKind:"template",templateId:e,templateVersion:r.version??"1.0.0",createdByActorId:r.createdByActorId}),parsed:n}}preview(e,t){return kt(e,t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE id=?").get(e);return t?Ie(t):void 0}getByResource(e){let t=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE resource_id=?").get(e);return t?Ie(t):void 0}getBySlug(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE project_id=? AND environment_id=? AND slug=?").get(e,t,r);return n?Ie(n):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM compose_applications ORDER BY updated_at DESC").all().map(Ie).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(e.includeDeleted||t.status!=="deleted"))}services(e){return this.controlPlane.database.query("SELECT * FROM compose_service_states WHERE application_id=? ORDER BY service_name").all(e).map(Un)}transition(e,t,r={}){let n=this.get(e);if(!n)throw Error(`Compose application ${e} was not found`);let o=this.now().toISOString(),i=t==="deleted"?o:null;this.controlPlane.database.run("UPDATE compose_applications SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), version=version+1, updated_at=?, deleted_at=? WHERE id=?",[t,r.operationId??null,o,i,e]);for(let s of r.services??[])if(n.manifest.spec.services[s.name])this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, latest_operation_id, observed_state, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(application_id, service_name) DO UPDATE SET status=excluded.status, replicas=excluded.replicas, healthy_replicas=excluded.healthy_replicas, latest_operation_id=excluded.latest_operation_id, observed_state=excluded.observed_state, updated_at=excluded.updated_at",[e,s.name,s.status,s.replicas??n.manifest.spec.services[s.name].replicas,s.healthyReplicas??0,r.operationId??null,JSON.stringify(h(s.observedState??{})),o]);return this.controlPlane.appendEvent({projectId:n.projectId,resourceId:n.resourceId,operationId:r.operationId,type:`compose.application.${t}`,level:t==="failed"||t==="degraded"?"error":"info",payload:{applicationId:e,error:r.error??null}}),this.get(e)}}class We{controlPlane;applications;queue;constructor(e){this.controlPlane=e;this.applications=new mt(e),this.queue=new b(e)}enqueue(e,t,r={}){if(e.status==="deleted")throw Error("Deleted Compose applications cannot be operated");if(r.service&&!e.manifest.spec.services[r.service])throw Error(`Compose service ${r.service} was not found`);if(t==="delete"){let o=r.removeVolumes?`${e.slug} delete volumes`:e.slug;if(r.confirmation!==o)throw Error(`Type ${o} to confirm ${r.removeVolumes?"persistent data removal":"stack deletion"}`)}if(t==="scale"&&(!r.service||!Number.isInteger(r.replicas)||r.replicas<0||r.replicas>100))throw Error("Scale requires a service and 0-100 replicas");let n=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r.actorId,kind:`compose.${t}`,idempotencyKey:`compose:${e.id}:${t}:${r.service??"stack"}:${r.replicas??""}:${e.version}`,correlationId:`compose:${e.id}`,input:{applicationId:e.id,service:r.service??null,replicas:r.replicas??null,removeVolumes:!!r.removeVolumes},lockKey:`compose:${e.id}`,providerKey:this.controlPlane.getResource(e.resourceId)?.provider??"default",buildSlot:t==="deploy"||t==="redeploy",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.applications.transition(e.id,t==="delete"?"deleting":t==="stop"?"stopped":t==="start"?"deploying":t==="scale"?e.status:"deploying",{operationId:n.id}),n}}import{createHash as Fn}from"node:crypto";var Hn=/^[a-f0-9]{40,64}$/i,Jn=/^[A-Z][A-Z0-9_]{1,127}$/;function L(e){return typeof e==="string"&&e?e:void 0}function J(e){try{return JSON.parse(String(e))}catch{return{}}}function Wn(e){let t=J(e);return Array.isArray(t)?t.map(String):[]}function Ze(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:String(e.resource_id),baseEnvironmentId:String(e.base_environment_id),enabled:Number(e.enabled)===1,branchRule:L(e.branch_rule),domainPattern:String(e.domain_pattern),ttlHours:Number(e.ttl_hours),keepCount:Number(e.keep_count),publicAccess:Number(e.public_access)===1,authenticationRequired:Number(e.authentication_required)===1,allowForks:Number(e.allow_forks)===1,inheritedSecrets:Wn(e.inherited_secrets),resourceOverrides:J(e.resource_overrides),databaseStrategy:String(e.database_strategy),maxMonthlyCost:Number(e.max_monthly_cost),maxCpu:Number(e.max_cpu),maxMemoryMb:Number(e.max_memory_mb),cleanupOnClose:Number(e.cleanup_on_close)===1,version:Number(e.version),createdByActorId:L(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function ce(e){return{id:String(e.id),definitionId:String(e.definition_id),projectId:String(e.project_id),resourceId:String(e.resource_id),baseEnvironmentId:String(e.base_environment_id),identityKey:String(e.identity_key),sourceProvider:L(e.source_provider),repository:L(e.repository),branch:String(e.branch),pullRequestNumber:e.pull_request_number==null?void 0:Number(e.pull_request_number),fork:Number(e.fork)===1,commitSha:String(e.commit_sha),name:String(e.name),stackName:String(e.stack_name),url:L(e.url),status:String(e.status),expiresAt:String(e.expires_at),latestOperationId:L(e.latest_operation_id),createdByActorId:L(e.created_by_actor_id),costEstimate:e.cost_estimate==null?void 0:Number(e.cost_estimate),desiredState:J(e.desired_state),observedState:J(e.observed_state),teardownError:L(e.teardown_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),destroyedAt:L(e.destroyed_at)}}function Zt(e){return{id:String(e.id),previewId:String(e.preview_id),provider:String(e.provider),providerResourceId:String(e.provider_resource_id),kind:String(e.kind),tags:J(e.tags),observedState:J(e.observed_state),discoveredAt:String(e.discovered_at),deletedAt:L(e.deleted_at)}}function q(e,t,r,n){return Number.isFinite(e)?Math.min(n,Math.max(r,Math.floor(e))):t}function _e(e,t,r,n){return Number.isFinite(e)?Math.min(n,Math.max(r,e)):t}function Xe(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,28)||"preview"}class Le{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}createDefinition(e){let t=this.controlPlane.getResource(e.resourceId),r=this.controlPlane.listEnvironments(e.projectId).find((c)=>c.id===e.baseEnvironmentId);if(!t||t.projectId!==e.projectId||t.environmentId!==r?.id)throw Error("Preview resource and base environment must belong to the same project scope");if(t.kind!=="application")throw Error("Preview environments currently support application resources only");if(!/^https:\/\//.test(e.domainPattern)||!e.domainPattern.includes("{name}"))throw Error("Preview domainPattern must be HTTPS and include {name}");let n=this.getDefinitionForResource(e.resourceId),o=e.publicAccess??n?.publicAccess??!1,i=e.authenticationRequired??n?.authenticationRequired??!0;if(o&&!i)throw Error("Public preview environments require an authentication policy");let s=[...new Set(e.inheritedSecrets??[])];if(s.some((c)=>!Jn.test(c)))throw Error("Inherited preview secret names must use uppercase environment-variable identifiers");let a=this.now().toISOString();if(n)return this.controlPlane.database.run("UPDATE preview_definitions SET base_environment_id=?, enabled=1, branch_rule=?, domain_pattern=?, ttl_hours=?, keep_count=?, public_access=?, authentication_required=?, allow_forks=?, inherited_secrets=?, resource_overrides=?, database_strategy=?, max_monthly_cost=?, max_cpu=?, max_memory_mb=?, cleanup_on_close=?, version=version+1, updated_at=? WHERE id=?",[e.baseEnvironmentId,e.branchRule??null,e.domainPattern,q(e.ttlHours,n.ttlHours,1,720),q(e.keepCount,n.keepCount,1,100),o?1:0,i?1:0,e.allowForks??n.allowForks?1:0,JSON.stringify(e.inheritedSecrets===void 0?n.inheritedSecrets:s),JSON.stringify(h(e.resourceOverrides??n.resourceOverrides)),e.databaseStrategy??n.databaseStrategy,_e(e.maxMonthlyCost,n.maxMonthlyCost,0,1e4),_e(e.maxCpu,n.maxCpu,0.1,64),q(e.maxMemoryMb,n.maxMemoryMb,128,131072),e.cleanupOnClose??n.cleanupOnClose?1:0,a,n.id]),this.controlPlane.appendEvent({projectId:e.projectId,resourceId:e.resourceId,actorId:e.createdByActorId,type:"preview.definition.updated",payload:{definitionId:n.id,baseEnvironmentId:e.baseEnvironmentId,version:n.version+1}}),this.getDefinition(n.id);let d=this.id();return this.controlPlane.database.run("INSERT INTO preview_definitions (id, project_id, resource_id, base_environment_id, enabled, branch_rule, domain_pattern, ttl_hours, keep_count, public_access, authentication_required, allow_forks, inherited_secrets, resource_overrides, database_strategy, max_monthly_cost, max_cpu, max_memory_mb, cleanup_on_close, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[d,e.projectId,e.resourceId,e.baseEnvironmentId,e.branchRule??null,e.domainPattern,q(e.ttlHours,24,1,720),q(e.keepCount,10,1,100),e.publicAccess?1:0,e.authenticationRequired===!1?0:1,e.allowForks?1:0,JSON.stringify(s),JSON.stringify(h(e.resourceOverrides??{})),e.databaseStrategy??"disabled",_e(e.maxMonthlyCost,25,0,1e4),_e(e.maxCpu,1,0.1,64),q(e.maxMemoryMb,1024,128,131072),e.cleanupOnClose===!1?0:1,e.createdByActorId??null,a,a]),this.controlPlane.appendEvent({projectId:e.projectId,resourceId:e.resourceId,actorId:e.createdByActorId,type:"preview.definition.created",payload:{definitionId:d,baseEnvironmentId:e.baseEnvironmentId,ttlHours:q(e.ttlHours,24,1,720),inheritedSecretNames:s}}),this.getDefinition(d)}getDefinition(e){let t=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE id=?").get(e);return t?Ze(t):void 0}getDefinitionForResource(e){let t=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE resource_id=?").get(e);return t?Ze(t):void 0}listDefinitions(e){return this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Ze)}listInstances(e={}){return this.controlPlane.database.query("SELECT * FROM preview_instances ORDER BY created_at DESC").all().map(ce).filter((r)=>(!e.projectId||r.projectId===e.projectId)&&(!e.definitionId||r.definitionId===e.definitionId)&&(!e.status||r.status===e.status))}getInstance(e){let t=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE id=?").get(e);return t?ce(t):void 0}findForPullRequest(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(e,`pr:${t}:${r}`);return n?ce(n):void 0}findForBranch(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(e,`branch:${t}:${r}`);return n?ce(n):void 0}upsert(e){let t=this.getDefinition(e.definitionId);if(!t?.enabled)throw Error("Preview environments are not enabled for this application");if(!Hn.test(e.commitSha))throw Error("Preview deployment requires an immutable 40-64 character commit SHA");if(e.fork&&!t.allowForks)throw Error("Untrusted fork previews are disabled");let r=e.pullRequestNumber?`pr:${e.repository??"unknown"}:${e.pullRequestNumber}`:`branch:${e.repository??"local"}:${e.branch}`,n=Fn("sha256").update(`${t.id}:${r}`).digest("hex").slice(0,8),i=`${(e.pullRequestNumber?`pr-${e.pullRequestNumber}`:Xe(e.branch)).slice(0,28)}-${n}`,s=`preview-${i}`.slice(0,63),a=t.domainPattern.replaceAll("{name}",i).replaceAll("{project}",Xe(t.projectId)).replaceAll("{branch}",Xe(e.branch)).replaceAll("{pr}",String(e.pullRequestNumber??"branch")),d=e.now??this.now(),c=d.toISOString(),u=new Date(d.getTime()+t.ttlHours*60*60*1000).toISOString(),p=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(t.id,r);if(p){let g=ce(p),y=g.commitSha!==e.commitSha||g.status==="destroyed";if(y)this.controlPlane.database.run("UPDATE preview_instances SET commit_sha=?, branch=?, fork=?, status='queued', expires_at=?, url=?, teardown_error=NULL, destroyed_at=NULL, version=version+1, updated_at=? WHERE id=?",[e.commitSha,e.branch,e.fork?1:0,u,a,c,g.id]);return{preview:this.getInstance(g.id),created:!1,changed:y,inheritedSecrets:e.fork?[]:t.inheritedSecrets}}let l=this.id(),f=h({source:{provider:e.sourceProvider??null,repository:e.repository??null,branch:e.branch,commitSha:e.commitSha,pullRequestNumber:e.pullRequestNumber??null,fork:!!e.fork},policy:{databaseStrategy:t.databaseStrategy,resourceOverrides:t.resourceOverrides,maxMonthlyCost:t.maxMonthlyCost,maxCpu:t.maxCpu,maxMemoryMb:t.maxMemoryMb,publicAccess:t.publicAccess,authenticationRequired:t.authenticationRequired},inheritedSecretNames:e.fork?[]:t.inheritedSecrets});return this.controlPlane.database.run("INSERT INTO preview_instances (id, definition_id, project_id, resource_id, base_environment_id, identity_key, source_provider, repository, branch, pull_request_number, fork, commit_sha, name, stack_name, url, status, expires_at, created_by_actor_id, desired_state, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?)",[l,t.id,t.projectId,t.resourceId,t.baseEnvironmentId,r,e.sourceProvider??null,e.repository??null,e.branch,e.pullRequestNumber??null,e.fork?1:0,e.commitSha,i,s,a,u,e.createdByActorId??null,JSON.stringify(f),c,c]),this.controlPlane.appendEvent({projectId:t.projectId,resourceId:t.resourceId,actorId:e.createdByActorId,type:"preview.created",payload:{previewId:l,identityKey:r,commitSha:e.commitSha,expiresAt:u,fork:!!e.fork}}),{preview:this.getInstance(l),created:!0,changed:!0,inheritedSecrets:e.fork?[]:t.inheritedSecrets}}transition(e,t,r={}){let n=this.getInstance(e);if(!n)throw Error(`Preview ${e} was not found`);let o=this.now().toISOString(),i=t==="destroyed"?o:null;return this.controlPlane.database.run("UPDATE preview_instances SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), observed_state=?, teardown_error=?, cost_estimate=COALESCE(?, cost_estimate), destroyed_at=?, version=version+1, updated_at=? WHERE id=?",[t,r.operationId??null,JSON.stringify(h(r.observedState??n.observedState)),r.teardownError??null,r.costEstimate??null,i,o,e]),this.controlPlane.appendEvent({projectId:n.projectId,resourceId:n.resourceId,operationId:r.operationId,type:`preview.${t}`,level:t==="failed"||t==="cleanup_failed"?"error":"info",payload:{previewId:e,commitSha:n.commitSha,teardownError:r.teardownError??null}}),this.getInstance(e)}extend(e,t){let r=this.getInstance(e),n=r?this.getDefinition(r.definitionId):void 0;if(!r||!n)throw Error(`Preview ${e} was not found`);let o=this.now(),i=q(t,n.ttlHours,1,720),s=new Date(Math.max(o.getTime(),new Date(r.expiresAt).getTime())+i*3600000).toISOString();return this.controlPlane.database.run("UPDATE preview_instances SET expires_at=?, version=version+1, updated_at=? WHERE id=?",[s,o.toISOString(),e]),this.getInstance(e)}expired(e=this.now()){return this.listInstances().filter((t)=>["queued","deploying","active","updating","failed","cleanup_failed"].includes(t.status)&&new Date(t.expiresAt)<=e)}recordResource(e){let t=this.getInstance(e.previewId);if(!t)throw Error(`Preview ${e.previewId} was not found`);let r={"ts-cloud:preview":t.id,"ts-cloud:project":t.projectId,"ts-cloud:expires-at":t.expiresAt};for(let[s,a]of Object.entries(r))if(e.tags[s]!==a)throw Error(`Preview resource is missing immutable tag ${s}`);let n=this.id(),o=this.now().toISOString();this.controlPlane.database.run("INSERT INTO preview_resources (id, preview_id, provider, provider_resource_id, kind, tags, observed_state, discovered_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(preview_id, provider, provider_resource_id) DO UPDATE SET kind=excluded.kind, tags=excluded.tags, observed_state=excluded.observed_state, deleted_at=NULL",[n,t.id,e.provider,e.providerResourceId,e.kind,JSON.stringify(e.tags),JSON.stringify(h(e.observedState??{})),o]);let i=this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? AND provider=? AND provider_resource_id=?").get(t.id,e.provider,e.providerResourceId);return Zt(i)}listResources(e){return this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? ORDER BY kind, provider_resource_id").all(e).map(Zt)}markResourcesDeleted(e){if(!this.getInstance(e))throw Error(`Preview ${e} was not found`);return this.controlPlane.database.run("UPDATE preview_resources SET deleted_at=? WHERE preview_id=? AND deleted_at IS NULL",[this.now().toISOString(),e]).changes}}class Ge{controlPlane;previews;queue;constructor(e){this.controlPlane=e;this.previews=new Le(e),this.queue=new b(e)}enqueueDeploy(e,t={}){let r=t.created?"preview.create":"preview.update",n=t.reason==="manual_rebuild"?`:${crypto.randomUUID()}`:"",o=this.queue.enqueue({projectId:e.projectId,environmentId:e.baseEnvironmentId,resourceId:e.resourceId,actorId:t.actorId,kind:r,correlationId:`preview:${e.id}`,idempotencyKey:`preview:${e.id}:${e.commitSha}${n}`,input:{previewId:e.id,reason:t.reason??(t.created?"create":"commit_update"),source:{repository:e.repository??null,branch:e.branch,commitSha:e.commitSha,pullRequestNumber:e.pullRequestNumber??null,fork:e.fork}},lockKey:`preview:${e.id}`,providerKey:"preview",buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(e.id,"queued",{operationId:o.id}),o}enqueueDestroy(e,t,r){if(e.status==="destroyed")throw Error("Preview is already destroyed");let n=this.queue.enqueue({projectId:e.projectId,environmentId:e.baseEnvironmentId,resourceId:e.resourceId,actorId:r,kind:"preview.destroy",correlationId:`preview:${e.id}`,idempotencyKey:`preview:${e.id}:destroy:${t}`,input:{previewId:e.id,reason:t},lockKey:`preview:${e.id}`,providerKey:"preview",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(e.id,"queued",{operationId:n.id}),n}cleanup(e={}){let t=e.now??new Date,r=new Map,n=this.previews.listInstances().filter((d)=>!["destroyed","destroying"].includes(d.status)),o=(d,c)=>{let u=r.get(d.id)??{preview:d,reasons:[]};if(!u.reasons.includes(c))u.reasons.push(c);r.set(d.id,u)};for(let d of n){if(new Date(d.expiresAt)<=t)o(d,"ttl_expired");if(e.maxAgeHours&&t.getTime()-new Date(d.createdAt).getTime()>=e.maxAgeHours*3600000)o(d,"max_age")}let i=new Map;for(let d of n)i.set(d.definitionId,[...i.get(d.definitionId)??[],d]);for(let[d,c]of i){let u=this.previews.getDefinition(d),p=e.keepCount??u?.keepCount;if(!p)continue;c.sort((l,f)=>f.createdAt.localeCompare(l.createdAt)).slice(p).forEach((l)=>o(l,"keep_count"))}let s=[...r.values()].sort((d,c)=>d.preview.createdAt.localeCompare(c.preview.createdAt)),a=e.dryRun?[]:s.map((d)=>this.enqueueDestroy(d.preview,d.reasons.sort().join("+"),e.actorId));if(s.length)this.controlPlane.appendEvent({actorId:e.actorId,type:e.dryRun?"preview.cleanup.planned":"preview.cleanup.queued",payload:{previewIds:s.map((d)=>d.preview.id),reasons:Object.fromEntries(s.map((d)=>[d.preview.id,d.reasons])),dryRun:!!e.dryRun}});return{candidates:s,operations:a,dryRun:!!e.dryRun}}reconcile(e){let t=[],r=[],n=[];for(let o of e){let i=o.tags["ts-cloud:preview"],s=o.tags["ts-cloud:project"],a=o.tags["ts-cloud:expires-at"];if(!i||!s||!a){n.push(o.providerResourceId);continue}let d=this.previews.getInstance(i);if(!d||d.projectId!==s||d.expiresAt!==a){r.push(o.providerResourceId);continue}if(this.previews.recordResource({...o,previewId:d.id}),o.estimatedMonthlyCost!==void 0)this.previews.transition(d.id,d.status,{costEstimate:o.estimatedMonthlyCost,observedState:{...d.observedState,lastReconciledAt:new Date().toISOString()}});t.push(o.providerResourceId)}if(r.length)this.controlPlane.appendEvent({type:"preview.reconciliation.leaks",level:"error",payload:{providerResourceIds:r}});return{matched:t,unknownPreviewResources:r,ignoredUntagged:n}}}var Kn=["deployment.create","deployment.rollback","application.create","deploy.source","deploy.preview","preview.create","preview.update","preview.destroy","compose.deploy","compose.redeploy","compose.start","compose.stop","compose.delete","compose.scale"];function Ee(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Gn(e,t){if(!t.projectId||!t.environmentId)throw Error(`Queued ${t.kind} operation is missing its project or environment scope`);let r=e.listEnvironments(t.projectId).find((s)=>s.id===t.environmentId);if(!r)throw Error(`Environment ${t.environmentId} was not found for queued ${t.kind} operation`);let n=t.resourceId?e.getResource(t.resourceId):void 0;if(t.resourceId&&(!n||n.projectId!==t.projectId||n.environmentId!==t.environmentId))throw Error(`Resource ${t.resourceId} was not found in the queued deployment scope`);let o=Ee(t.input);if(t.kind.startsWith("compose.")){let s=typeof o.applicationId==="string"?o.applicationId:void 0,a=s?new mt(e).get(s):t.resourceId?new mt(e).getByResource(t.resourceId):void 0;if(!a||a.projectId!==t.projectId||a.environmentId!==t.environmentId||a.resourceId!==t.resourceId)throw Error("Queued Compose application does not match the operation scope");let d=t.kind.slice(8),c=["compose:apply",a.id,"--action",d,"--env",r.slug];if(typeof o.service==="string"&&o.service)c.push("--service",o.service);if(typeof o.replicas==="number")c.push("--replicas",String(o.replicas));if(o.removeVolumes===!0)c.push("--remove-volumes");return{id:`queue:${t.id}`,label:`${d[0].toUpperCase()}${d.slice(1)} Compose application`,description:`${d} ${a.name}.`,command:c,mutates:!0,target:{environment:r.slug,resource:n?.slug,composeId:a.id}}}if(t.kind.startsWith("preview.")){let s=typeof o.previewId==="string"?o.previewId:void 0,a=s?new Le(e).getInstance(s):void 0;if(!a)throw Error(`Preview ${s??"(missing)"} was not found for queued ${t.kind}`);if(a.projectId!==t.projectId||a.resourceId!==t.resourceId)throw Error("Queued preview does not match the operation scope");if(t.kind==="preview.destroy")return{id:`queue:${t.id}`,label:"Destroy preview",description:`Destroy ${a.name}.`,command:["stack:delete",a.stackName,"--yes"],mutates:!0,target:{environment:r.slug,resource:n?.slug,previewId:a.id}};return{id:`queue:${t.id}`,label:t.kind==="preview.create"?"Create preview":"Update preview",description:`Deploy ${a.name} at ${a.commitSha}.`,command:["deploy","--stack",a.stackName,"--env",r.slug,"--yes","--skip-dns-verification",...n?["--site",n.slug]:[]],mutates:!0,target:{environment:r.slug,resource:n?.slug,previewId:a.id}}}if(t.kind==="deployment.rollback"){let s=["deploy:rollback"];if(n)s.push(n.slug);if(s.push("--env",r.slug),typeof o.revision==="string"&&o.revision)s.push("--to",o.revision);return{id:`queue:${t.id}`,label:"Rollback deployment",description:`Roll back ${n?.slug??r.slug}.`,command:s,mutates:!0,target:{environment:r.slug,resource:n?.slug}}}let i=["deploy","--env",r.slug,"--yes"];if(n)i.push("--site",n.slug);return{id:`queue:${t.id}`,label:t.kind==="deploy.preview"?"Deploy preview":"Deploy release",description:`Deploy ${n?.slug??r.slug}.`,command:i,mutates:!0,target:{environment:r.slug,resource:n?.slug}}}function eo(e){let t=e.stderr?.trim()||`Deployment process exited with code ${e.exitCode}`;if(/\b(?:429|rate.?limit|throttl)/i.test(t))return new Oe(t,"provider_throttled");if(/\b(?:502|503|504|temporar(?:y|ily)|unavailable|provider.?error)/i.test(t))return new Oe(t,"provider_unavailable");if(/\b(?:network|econn|enotfound|socket|timed?\s*out|fetch failed|dns)\b/i.test(t))return new Oe(t,"network");return Error(t)}function Ba(e){let t=async(r)=>{r.checkpoint("prepare","Resolving the persisted deployment target.");let n=Gn(e.store,r.operation),o=n.target.previewId?new Le(e.store):void 0,i=n.target.composeId?new mt(e.store):void 0;if(o&&n.target.previewId)o.transition(n.target.previewId,r.operation.kind==="preview.destroy"?"destroying":r.operation.kind==="preview.update"?"updating":"deploying",{operationId:r.operation.id});if(i&&n.target.composeId)i.transition(n.target.composeId,r.operation.kind==="compose.delete"?"deleting":r.operation.kind==="compose.stop"?"stopped":"deploying",{operationId:r.operation.id});r.log(`Target: ${n.target.resource??"all resources"} in ${n.target.environment}.`,{stream:"system"}),r.throwIfCancellationRequested(),r.checkpoint("execute",`Running cloud ${n.command.join(" ")}.`);let s=await e.execute(n,r);if(!s.ok){if(o&&n.target.previewId)o.transition(n.target.previewId,r.operation.kind==="preview.destroy"?"cleanup_failed":"failed",{operationId:r.operation.id,teardownError:r.operation.kind==="preview.destroy"?s.stderr?.trim()||`Process exited with ${s.exitCode}`:void 0});if(i&&n.target.composeId)i.transition(n.target.composeId,r.operation.kind==="compose.delete"?"degraded":"failed",{operationId:r.operation.id,error:s.stderr?.trim()||`Process exited with ${s.exitCode}`});throw eo(s)}if(r.throwIfCancellationRequested(),o&&n.target.previewId){let a=o.getInstance(n.target.previewId);if(r.operation.kind==="preview.destroy")o.markResourcesDeleted(a.id),o.transition(a.id,"destroyed",{operationId:r.operation.id,observedState:{reconciledResourceIds:o.listResources(a.id).map((d)=>d.providerResourceId),exactCommitSha:a.commitSha}});else{let d=e.store.getResource(a.resourceId)?.provider??"default";o.recordResource({previewId:a.id,provider:d,providerResourceId:a.stackName,kind:"stack",tags:{"ts-cloud:preview":a.id,"ts-cloud:project":a.projectId,"ts-cloud:expires-at":a.expiresAt},observedState:{command:s.command??null,exactCommitSha:a.commitSha}}),o.transition(a.id,"active",{operationId:r.operation.id,observedState:{url:a.url??null,stackName:a.stackName,exactCommitSha:a.commitSha,providerStatus:"deployed"}})}}if(i&&n.target.composeId){let a=i.get(n.target.composeId),d=typeof Ee(r.operation.input).service==="string"?String(Ee(r.operation.input).service):void 0,c=r.operation.kind==="compose.delete"?"deleted":r.operation.kind==="compose.stop"?"stopped":"running",u=i.transition(a.id,c,{operationId:r.operation.id,services:Object.values(a.manifest.spec.services).filter((p)=>!d||p.name===d).map((p)=>({name:p.name,status:c==="stopped"||c==="deleted"?"stopped":"running",replicas:c==="deleted"?0:p.replicas,healthyReplicas:c==="running"?p.replicas:0,observedState:{command:s.command??null,healthGatePassed:c==="running"}}))});if(c==="deleted")Yt(e.store,u,Ee(r.operation.input).removeVolumes===!0)}return r.checkpoint("finalize","Deployment command completed; persisting the terminal result."),{command:s.command??`cloud ${n.command.join(" ")}`,exitCode:s.exitCode,environment:n.target.environment,resource:n.target.resource??null}};return Object.fromEntries(Kn.map((r)=>[r,t]))}class m extends Error{code;status;details;constructor(e,t,r,n){super(t);this.code=e;this.status=r;this.details=n}}function et(e,t){if(e.organizationId!==t.organizationId)return!1;if(e.projectId&&e.projectId!==t.projectId)return!1;if(e.environmentId&&e.environmentId!==t.environmentId)return!1;if(e.resourceId&&e.resourceId!==t.resourceId)return!1;return!0}function ro(e,t,r){return to("sha256").update(`${e.toUpperCase()}
 ${t}
-${JSON.stringify(r)}`).digest("hex")}class Qi{controlPlane;identities;queue;spendGate;constructor(e,t){this.controlPlane=e;this.identities=t;this.queue=new b(e),this.spendGate=new $t(e)}target(e,t){let r=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,t),n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope);if(!r||!n||!et(n,r))throw new m("forbidden","The token does not grant access to this resource.",403);return r}authorize(e,t,r){if(!e.token.capabilities.includes(t))throw new m("forbidden",`The token is missing the ${t} capability.`,403);let n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,r),o=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope),i=t==="project:read"&&!!n&&!!o&&et(n,o);if(!n||!o||!et(o,n)&&!i)throw new m("forbidden","The token does not grant access to this resource.",403);let s=i?o:n;if(!te({membership:e.membership,grants:this.controlPlane.listGrants(e.membership.id),capability:t,target:s}).allowed)throw new m("forbidden","The service account does not have access to this resource.",403);return n}listProjects(e){return this.controlPlane.listProjects().filter((t)=>t.organizationId===e.serviceAccount.organizationId).filter((t)=>{try{return this.authorize(e,"project:read",{type:"project",id:t.id}),!0}catch{return!1}}).map((t)=>({id:t.id,slug:t.slug,name:t.name,description:t.description,version:t.version,createdAt:t.createdAt,updatedAt:t.updatedAt}))}listEnvironments(e,t){let r=this.controlPlane.getProject(t);if(!r||r.organizationId!==e.serviceAccount.organizationId)throw new m("not_found","Project was not found.",404);return this.controlPlane.listEnvironments(t).filter((n)=>{try{return this.authorize(e,"project:read",{type:"environment",id:n.id}),!0}catch{return!1}}).map((n)=>({id:n.id,projectId:n.projectId,slug:n.slug,name:n.name,kind:n.kind,region:n.region,version:n.version,createdAt:n.createdAt,updatedAt:n.updatedAt}))}listServices(e,t,r){let n=new Set(this.listEnvironments(e,t).map((o)=>String(o.id)));if(r&&!n.has(r))throw new m("not_found","Environment was not found.",404);return this.controlPlane.listResources(t,r).filter((o)=>!o.environmentId||n.has(o.environmentId)).filter((o)=>{try{return this.authorize(e,"project:read",{type:"resource",id:o.id}),!0}catch{return!1}}).map((o)=>({id:o.id,projectId:o.projectId,environmentId:o.environmentId,kind:o.kind,slug:o.slug,name:o.name,provider:o.provider,providerId:o.providerId,metadata:h(o.metadata),version:o.version,createdAt:o.createdAt,updatedAt:o.updatedAt}))}listOperations(e,t){return this.controlPlane.listOperations({projectId:t,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.environmentId?{type:"environment",id:n.environmentId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.authorize(e,"deployments:read",o),!0}catch{return!1}}).map((n)=>this.operation(n))}listEvents(e,t,r){if(t)this.authorize(e,"audit:read",{type:"project",id:t});else this.authorize(e,"audit:read",e.token.scope);return this.controlPlane.listEvents({organizationId:e.serviceAccount.organizationId,projectId:t,afterSequence:r,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.target(e,o),!0}catch{return!1}}).map((n)=>({id:n.id,sequence:n.sequence,projectId:n.projectId,operationId:n.operationId,resourceId:n.resourceId,correlationId:n.correlationId,type:n.type,level:n.level,payload:h(n.payload),createdAt:n.createdAt}))}createDeployment(e,t,r){if(!this.controlPlane.listEnvironments(t.projectId).find((u)=>u.id===t.environmentId))throw new m("not_found","Environment was not found in this project.",404);let o=t.serviceId?{type:"resource",id:t.serviceId}:{type:"environment",id:t.environmentId};this.authorize(e,"deployments:create",o);let i=this.spendGate.check("deploy",{organizationId:e.serviceAccount.organizationId,projectId:t.projectId,environmentId:t.environmentId});if(!i.allowed)throw new m("spend_cap_exceeded",i.reason??"A spend cap is blocking deployments.",402,{action:i.action,budgetId:i.budgetId});let s=ro("POST","/api/v1/deployments",t),a=this.identities.getIdempotency(e.token.id,r);if(a){if(a.requestHash!==s)throw new m("idempotency_conflict","Idempotency-Key was already used for another request.",409);let u=a.operationId?this.controlPlane.getOperation(a.operationId):void 0;if(!u)throw new m("idempotency_unavailable","The original operation is no longer available.",409);return{operation:this.operation(u),replay:!0}}if(t.serviceId){let u=this.controlPlane.getResource(t.serviceId);if(!u||u.projectId!==t.projectId||u.environmentId!==t.environmentId)throw new m("not_found","Service was not found in this environment.",404)}let d=t.serviceId?this.controlPlane.getResource(t.serviceId):void 0,c=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.serviceId,actorId:e.actor.id,kind:t.action==="rollback"?"deployment.rollback":"deployment.create",idempotencyKey:`api:${e.token.id}:${r}`,input:h({action:t.action??"deploy",revision:t.revision??null}),lockKey:t.serviceId?`resource:${t.serviceId}`:`environment:${t.environmentId}`,providerKey:d?.provider??"default",buildSlot:t.action!=="rollback",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.identities.saveIdempotency({tokenId:e.token.id,key:r,requestHash:s,operationId:c.id,responseStatus:202,responseBody:{operationId:c.id}}),{operation:this.operation(c),replay:!1}}operation(e){return{id:e.id,state:e.state,kind:e.kind,projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:e.actorId,correlationId:e.correlationId,input:h(e.input),output:h(e.output),error:e.error,attempt:e.attempt,createdAt:e.createdAt,updatedAt:e.updatedAt,startedAt:e.startedAt,finishedAt:e.finishedAt}}}function we(e){return e.serviceAccount.organizationId}function Xt(e){if(e==null)return;if(e==="daily"||e==="weekly"||e==="monthly")return e;throw new m("validation_error","period must be daily, weekly, or monthly.",422)}function W(e,t){if(e==null)return;let r=Number(e);if(!Number.isFinite(r)||r<0||!Number.isInteger(r))throw new m("validation_error",`${t} must be a non-negative integer.`,422);return r}function T(e,t,r,n,o){if(o)e.authorization.authorize(t,r,{type:"environment",id:o});else if(n)e.authorization.authorize(t,r,{type:"project",id:n});else e.authorization.authorize(t,r,{type:"organization"});return{organizationId:we(t),projectId:n,environmentId:o}}async function fs(e,t,r){let{method:n,url:o}=r,i=e.now?.()??new Date,s=o.searchParams.get("projectId")??void 0,a=o.searchParams.get("environmentId")??void 0;if(n==="GET"&&o.pathname==="/api/v1/usage"){let l=T(e,t,"billing:read",s,a);return e.service.usageReport({...l,period:Xt(o.searchParams.get("period")),timezone:o.searchParams.get("timezone")??void 0,now:i})}if(n==="GET"&&o.pathname==="/api/v1/usage/rollups"){let l=T(e,t,"billing:read",s,a),f=o.searchParams.get("from"),g=o.searchParams.get("to");if(!f||!g)throw new m("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(f))||Number.isNaN(Date.parse(g)))throw new m("validation_error","from and to must be ISO-8601 timestamps.",422);let y=o.searchParams.getAll("meter");return{data:e.store.listRollups({...l,from:f,to:g,meters:y.length>0?y:void 0},W(o.searchParams.get("limit"),"limit")??1000)}}if(n==="GET"&&o.pathname==="/api/v1/usage/focus"){let l=T(e,t,"billing:read",s,a),f=o.searchParams.get("from"),g=o.searchParams.get("to");if(!f||!g)throw new m("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(f))||Number.isNaN(Date.parse(g)))throw new m("validation_error","from and to must be ISO-8601 timestamps.",422);if(new Date(g).getTime()-new Date(f).getTime()>31622400000)throw new m("validation_error","The range must not exceed one year.",422);let y=o.searchParams.get("granularity")==="hourly"?"hourly":"daily",v=e.store.listRollups({...l,from:f,to:g},1e4),S=tc(v,{billingPeriodStart:f,billingPeriodEnd:g,currency:e.store.priceBook.currency,granularity:y});return{contentType:"application/x-ndjson",body:ps(S),recordCount:S.length}}if(n==="GET"&&o.pathname==="/api/v1/spend/budgets"){let l=T(e,t,"billing:read",s,a);return{data:e.store.listBudgets({organizationId:l.organizationId,projectId:l.projectId})}}if(n==="POST"&&o.pathname==="/api/v1/spend/budgets"){let l=await r.body?.()??{},g={organizationId:T(e,t,"billing:manage",l.projectId,l.environmentId).organizationId,projectId:l.projectId,environmentId:l.environmentId,name:String(l.name??"").trim(),period:Xt(l.period??"monthly")??"monthly",timezone:l.timezone,currency:l.currency,softLimitCents:W(l.softLimitCents,"softLimitCents"),hardLimitCents:W(l.hardLimitCents,"hardLimitCents"),thresholds:l.thresholds,meters:l.meters,graceSeconds:W(l.graceSeconds,"graceSeconds"),hysteresisPercent:l.hysteresisPercent,dryRun:l.dryRun!==!1,enabled:l.enabled};try{return{data:e.store.createBudget(g)}}catch(y){throw new m("validation_error",y instanceof Error?y.message:String(y),422)}}let d=/^\/api\/v1\/spend\/budgets\/([^/]+)$/.exec(o.pathname);if(d&&(n==="PATCH"||n==="DELETE")){let l=e.store.getBudget(decodeURIComponent(d[1]));if(!l||l.organizationId!==we(t))throw new m("not_found","Budget was not found.",404);if(T(e,t,"billing:manage",l.projectId,l.environmentId),n==="DELETE")return{data:{deleted:e.store.deleteBudget(l.id)}};let f=await r.body?.()??{};try{return{data:e.store.updateBudget(l.id,f,W(f.expectedVersion,"expectedVersion"))}}catch(g){let y=g instanceof Error?g.message:String(g);throw new m(y.includes("concurrently")?"conflict":"validation_error",y,y.includes("concurrently")?409:422)}}if(n==="GET"&&o.pathname==="/api/v1/spend/anomalies"){let l=T(e,t,"billing:read",s,a);return{data:e.store.listAnomalies({organizationId:l.organizationId,projectId:l.projectId,since:o.searchParams.get("since")??void 0,unacknowledgedOnly:o.searchParams.get("unacknowledged")==="true",limit:W(o.searchParams.get("limit"),"limit")})}}let c=/^\/api\/v1\/spend\/anomalies\/([^/]+)\/acknowledge$/.exec(o.pathname);if(c&&n==="POST"){let l=e.store.getAnomaly(decodeURIComponent(c[1]));if(!l||l.organizationId!==we(t))throw new m("not_found","Anomaly was not found.",404);return T(e,t,"billing:manage",l.projectId,l.environmentId),{data:{acknowledged:e.store.acknowledgeAnomaly(l.id)}}}if(n==="GET"&&o.pathname==="/api/v1/spend/signals")return T(e,t,"billing:read",s,a),{data:xt};if(o.pathname==="/api/v1/spend/anomaly-configs"){if(n==="GET"){let l=T(e,t,"billing:read",s,a);return{data:e.service.anomalyConfigs.list({organizationId:l.organizationId,projectId:l.projectId})}}if(n==="POST"){let l=await r.body?.()??{},f=T(e,t,"billing:manage",l.projectId,l.environmentId);try{return{data:e.service.anomalyConfigs.upsert({organizationId:f.organizationId,projectId:l.projectId,environmentId:l.environmentId,signal:String(l.signal??""),enabled:l.enabled,sensitivity:l.sensitivity,seasonLength:l.seasonLength==null?void 0:Number(l.seasonLength),minAbsoluteDelta:l.minAbsoluteDelta==null?void 0:Number(l.minAbsoluteDelta),detectDrops:l.detectDrops,severity:l.severity})}}catch(g){throw new m("validation_error",g instanceof Error?g.message:String(g),422)}}}let u=/^\/api\/v1\/spend\/anomaly-configs\/([^/]+)$/.exec(o.pathname);if(u&&n==="DELETE"){let l=e.service.anomalyConfigs.get(decodeURIComponent(u[1]));if(!l||l.organizationId!==we(t))throw new m("not_found","Anomaly config was not found.",404);return T(e,t,"billing:manage",l.projectId,l.environmentId),{data:{deleted:e.service.anomalyConfigs.delete(l.id)}}}if(o.pathname==="/api/v1/spend/anomaly-silences"){if(n==="GET"){let l=T(e,t,"billing:read",s,a);return{data:e.service.anomalyConfigs.listSilences({organizationId:l.organizationId,projectId:l.projectId,includeExpired:o.searchParams.get("includeExpired")==="true"})}}if(n==="POST"){let l=await r.body?.()??{},f=T(e,t,"billing:manage",l.projectId);try{return{data:e.service.anomalyConfigs.silence({organizationId:f.organizationId,projectId:l.projectId,signal:l.signal,routePattern:l.routePattern,statusCode:l.statusCode==null?void 0:Number(l.statusCode),reason:String(l.reason??""),expiresAt:l.expiresAt})}}catch(g){throw new m("validation_error",g instanceof Error?g.message:String(g),422)}}}let p=/^\/api\/v1\/spend\/anomaly-silences\/([^/]+)$/.exec(o.pathname);if(p&&n==="DELETE")return T(e,t,"billing:manage",s),{data:{deleted:e.service.anomalyConfigs.removeSilence(decodeURIComponent(p[1]))}};if(n==="GET"&&o.pathname==="/api/v1/spend/enforcement"){let l=T(e,t,"billing:read",s,a);return{data:e.store.listEnforcements({organizationId:l.organizationId,activeOnly:o.searchParams.get("active")!=="false"})}}if(n==="GET"&&o.pathname==="/api/v1/spend/allowance"){let l=T(e,t,"billing:read",s,a),f=o.searchParams.get("operation")??"deploy";if(!["build","deploy","function_invoke","request"].includes(f))throw new m("validation_error","operation must be build, deploy, function_invoke, or request.",422);let y=e.store.listEnforcements({organizationId:l.organizationId,activeOnly:!0}).filter((_)=>(!_.projectId||_.projectId===l.projectId)&&(!_.environmentId||_.environmentId===l.environmentId)),v=Ya(f,y),I=e.store.budgetsForScope(l.organizationId,l.projectId,l.environmentId).map((_)=>e.service.status(_,i));return{operation:f,allowed:v.allowed,blockedBy:v.blockedBy??null,reason:v.reason??null,budgets:I.map((_)=>({id:_.budget.id,name:_.budget.name,usedPercent:_.decision.usedPercent,projectedPercent:_.decision.projectedPercent,level:_.decision.level,timeToCap:_.timeToCap}))}}return}function hs(){let e=[{name:"projectId",in:"query",schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}}];return{"/api/v1/usage":{get:{summary:"Current usage, cost, and every budget governing the scope.",parameters:[...e,{name:"period",in:"query",schema:{type:"string",enum:["daily","weekly","monthly"]}},{name:"timezone",in:"query",schema:{type:"string"}}],responses:{"200":{description:"Usage totals, per-meter breakdown, hourly series, and budget status."}}}},"/api/v1/usage/rollups":{get:{summary:"Itemized hourly usage rollups.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"meter",in:"query",schema:{type:"array",items:{type:"string"}}},{name:"limit",in:"query",schema:{type:"integer"}}],responses:{"200":{description:"Hourly rollups, newest first."}}}},"/api/v1/usage/focus":{get:{summary:"Usage and cost in FOCUS v1.3 format, newline-delimited JSON.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"granularity",in:"query",schema:{type:"string",enum:["daily","hourly"]}}],responses:{"200":{description:"FOCUS records, one JSON object per line."}}}},"/api/v1/spend/budgets":{get:{summary:"Budgets governing a scope.",parameters:e,responses:{"200":{description:"Budgets."}}},post:{summary:"Create a budget. Starts in dry run unless dryRun is explicitly false.",responses:{"201":{description:"The created budget."},"422":{description:"Validation error."}}}},"/api/v1/spend/budgets/{budgetId}":{patch:{summary:"Update a budget. Pass expectedVersion for optimistic concurrency.",responses:{"200":{description:"The updated budget."},"409":{description:"Version conflict."}}},delete:{summary:"Delete a budget.",responses:{"200":{description:"Deletion result."}}}},"/api/v1/spend/anomalies":{get:{summary:"Detected spend anomalies.",parameters:[...e,{name:"since",in:"query",schema:{type:"string",format:"date-time"}},{name:"unacknowledged",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Anomalies, newest first."}}}},"/api/v1/spend/anomalies/{anomalyId}/acknowledge":{post:{summary:"Acknowledge an anomaly.",responses:{"200":{description:"Acknowledgement result."}}}},"/api/v1/spend/signals":{get:{summary:"Signals anomaly detection can run on, with their gap and sample rules.",responses:{"200":{description:"Signal catalog."}}}},"/api/v1/spend/anomaly-configs":{get:{summary:"Anomaly detection configuration.",parameters:e,responses:{"200":{description:"Configs."}}},post:{summary:"Create or update the config for a signal.",responses:{"200":{description:"The config."}}}},"/api/v1/spend/anomaly-configs/{configId}":{delete:{summary:"Delete an anomaly config, returning the signal to its default.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/anomaly-silences":{get:{summary:"Active anomaly silences.",parameters:e,responses:{"200":{description:"Silences."}}},post:{summary:"Silence a signal, route, or status code. A reason is required.",responses:{"200":{description:"The silence."}}}},"/api/v1/spend/anomaly-silences/{silenceId}":{delete:{summary:"Remove a silence.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/enforcement":{get:{summary:"Enforcement actions in force.",parameters:[...e,{name:"active",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Enforcement records."}}}},"/api/v1/spend/allowance":{get:{summary:"Whether an operation is allowed under current spend enforcement.",parameters:[...e,{name:"operation",in:"query",schema:{type:"string",enum:["build","deploy","function_invoke","request"]}}],responses:{"200":{description:"Allowance verdict and the budgets behind it."}}}}}}export{Oe,b,ts,kt,Xn,rs,pr,Oa,La,Ma,Qn,Yn,pt,Gr,Ua,_t,Kr,mt,We,Le,Ge,Ba,gt,mr,Me,Ke,Zn,ei,Vi,zi,Je,Jr,Gu,Xr,Hi,oe,Ku,Fa,nd,ns,Ju,Xu,Qu,ja,qi,is,Va,Qr,gr,Yu,ti,Zu,za,id,od,os,Ha,qa,fr,Wi,hr,Wa,ss,ri,sd,Gi,Ga,Ka,Ki,ad,Ja,Xa,Qa,Ya,as,cd,ld,ep,dd,Za,Ji,ud,pd,cs,xt,ls,ds,us,ec,md,tc,ps,tp,ft,rp,rc,$t,nc,np,ic,gd,ip,Y,fd,ms,op,Xi,ni,ii,gs,hd,yd,sp,m,Qi,fs,hs};
+${JSON.stringify(r)}`).digest("hex")}class Qi{controlPlane;identities;queue;spendGate;constructor(e,t){this.controlPlane=e;this.identities=t;this.queue=new b(e),this.spendGate=new $t(e)}target(e,t){let r=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,t),n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope);if(!r||!n||!et(n,r))throw new m("forbidden","The token does not grant access to this resource.",403);return r}authorize(e,t,r){if(!e.token.capabilities.includes(t))throw new m("forbidden",`The token is missing the ${t} capability.`,403);let n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,r),o=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope),i=t==="project:read"&&!!n&&!!o&&et(n,o);if(!n||!o||!et(o,n)&&!i)throw new m("forbidden","The token does not grant access to this resource.",403);let s=i?o:n;if(!te({membership:e.membership,grants:this.controlPlane.listGrants(e.membership.id),capability:t,target:s}).allowed)throw new m("forbidden","The service account does not have access to this resource.",403);return n}listProjects(e){return this.controlPlane.listProjects().filter((t)=>t.organizationId===e.serviceAccount.organizationId).filter((t)=>{try{return this.authorize(e,"project:read",{type:"project",id:t.id}),!0}catch{return!1}}).map((t)=>({id:t.id,slug:t.slug,name:t.name,description:t.description,version:t.version,createdAt:t.createdAt,updatedAt:t.updatedAt}))}listEnvironments(e,t){let r=this.controlPlane.getProject(t);if(!r||r.organizationId!==e.serviceAccount.organizationId)throw new m("not_found","Project was not found.",404);return this.controlPlane.listEnvironments(t).filter((n)=>{try{return this.authorize(e,"project:read",{type:"environment",id:n.id}),!0}catch{return!1}}).map((n)=>({id:n.id,projectId:n.projectId,slug:n.slug,name:n.name,kind:n.kind,region:n.region,version:n.version,createdAt:n.createdAt,updatedAt:n.updatedAt}))}listServices(e,t,r){let n=new Set(this.listEnvironments(e,t).map((o)=>String(o.id)));if(r&&!n.has(r))throw new m("not_found","Environment was not found.",404);return this.controlPlane.listResources(t,r).filter((o)=>!o.environmentId||n.has(o.environmentId)).filter((o)=>{try{return this.authorize(e,"project:read",{type:"resource",id:o.id}),!0}catch{return!1}}).map((o)=>({id:o.id,projectId:o.projectId,environmentId:o.environmentId,kind:o.kind,slug:o.slug,name:o.name,provider:o.provider,providerId:o.providerId,metadata:h(o.metadata),version:o.version,createdAt:o.createdAt,updatedAt:o.updatedAt}))}listOperations(e,t){return this.controlPlane.listOperations({projectId:t,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.environmentId?{type:"environment",id:n.environmentId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.authorize(e,"deployments:read",o),!0}catch{return!1}}).map((n)=>this.operation(n))}listEvents(e,t,r){if(t)this.authorize(e,"audit:read",{type:"project",id:t});else this.authorize(e,"audit:read",e.token.scope);return this.controlPlane.listEvents({organizationId:e.serviceAccount.organizationId,projectId:t,afterSequence:r,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.target(e,o),!0}catch{return!1}}).map((n)=>({id:n.id,sequence:n.sequence,projectId:n.projectId,operationId:n.operationId,resourceId:n.resourceId,correlationId:n.correlationId,type:n.type,level:n.level,payload:h(n.payload),createdAt:n.createdAt}))}createDeployment(e,t,r){if(!this.controlPlane.listEnvironments(t.projectId).find((u)=>u.id===t.environmentId))throw new m("not_found","Environment was not found in this project.",404);let o=t.serviceId?{type:"resource",id:t.serviceId}:{type:"environment",id:t.environmentId};this.authorize(e,"deployments:create",o);let i=this.spendGate.check("deploy",{organizationId:e.serviceAccount.organizationId,projectId:t.projectId,environmentId:t.environmentId});if(!i.allowed)throw new m("spend_cap_exceeded",i.reason??"A spend cap is blocking deployments.",402,{action:i.action,budgetId:i.budgetId});let s=ro("POST","/api/v1/deployments",t),a=this.identities.getIdempotency(e.token.id,r);if(a){if(a.requestHash!==s)throw new m("idempotency_conflict","Idempotency-Key was already used for another request.",409);let u=a.operationId?this.controlPlane.getOperation(a.operationId):void 0;if(!u)throw new m("idempotency_unavailable","The original operation is no longer available.",409);return{operation:this.operation(u),replay:!0}}if(t.serviceId){let u=this.controlPlane.getResource(t.serviceId);if(!u||u.projectId!==t.projectId||u.environmentId!==t.environmentId)throw new m("not_found","Service was not found in this environment.",404)}let d=t.serviceId?this.controlPlane.getResource(t.serviceId):void 0,c=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.serviceId,actorId:e.actor.id,kind:t.action==="rollback"?"deployment.rollback":"deployment.create",idempotencyKey:`api:${e.token.id}:${r}`,input:h({action:t.action??"deploy",revision:t.revision??null}),lockKey:t.serviceId?`resource:${t.serviceId}`:`environment:${t.environmentId}`,providerKey:d?.provider??"default",buildSlot:t.action!=="rollback",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.identities.saveIdempotency({tokenId:e.token.id,key:r,requestHash:s,operationId:c.id,responseStatus:202,responseBody:{operationId:c.id}}),{operation:this.operation(c),replay:!1}}operation(e){return{id:e.id,state:e.state,kind:e.kind,projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:e.actorId,correlationId:e.correlationId,input:h(e.input),output:h(e.output),error:e.error,attempt:e.attempt,createdAt:e.createdAt,updatedAt:e.updatedAt,startedAt:e.startedAt,finishedAt:e.finishedAt}}}function we(e){return e.serviceAccount.organizationId}function Xt(e){if(e==null)return;if(e==="daily"||e==="weekly"||e==="monthly")return e;throw new m("validation_error","period must be daily, weekly, or monthly.",422)}function W(e,t){if(e==null)return;let r=Number(e);if(!Number.isFinite(r)||r<0||!Number.isInteger(r))throw new m("validation_error",`${t} must be a non-negative integer.`,422);return r}function T(e,t,r,n,o){if(o)e.authorization.authorize(t,r,{type:"environment",id:o});else if(n)e.authorization.authorize(t,r,{type:"project",id:n});else e.authorization.authorize(t,r,{type:"organization"});return{organizationId:we(t),projectId:n,environmentId:o}}async function fs(e,t,r){let{method:n,url:o}=r,i=e.now?.()??new Date,s=o.searchParams.get("projectId")??void 0,a=o.searchParams.get("environmentId")??void 0;if(n==="GET"&&o.pathname==="/api/v1/usage"){let l=T(e,t,"billing:read",s,a);return e.service.usageReport({...l,period:Xt(o.searchParams.get("period")),timezone:o.searchParams.get("timezone")??void 0,now:i})}if(n==="GET"&&o.pathname==="/api/v1/usage/rollups"){let l=T(e,t,"billing:read",s,a),f=o.searchParams.get("from"),g=o.searchParams.get("to");if(!f||!g)throw new m("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(f))||Number.isNaN(Date.parse(g)))throw new m("validation_error","from and to must be ISO-8601 timestamps.",422);let y=o.searchParams.getAll("meter");return{data:e.store.listRollups({...l,from:f,to:g,meters:y.length>0?y:void 0},W(o.searchParams.get("limit"),"limit")??1000)}}if(n==="GET"&&o.pathname==="/api/v1/usage/focus"){let l=T(e,t,"billing:read",s,a),f=o.searchParams.get("from"),g=o.searchParams.get("to");if(!f||!g)throw new m("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(f))||Number.isNaN(Date.parse(g)))throw new m("validation_error","from and to must be ISO-8601 timestamps.",422);if(new Date(g).getTime()-new Date(f).getTime()>31622400000)throw new m("validation_error","The range must not exceed one year.",422);let y=o.searchParams.get("granularity")==="hourly"?"hourly":"daily",v=e.store.listRollups({...l,from:f,to:g},1e4),S=tc(v,{billingPeriodStart:f,billingPeriodEnd:g,currency:e.store.priceBook.currency,granularity:y});return{contentType:"application/x-ndjson",body:ps(S),recordCount:S.length}}if(n==="GET"&&o.pathname==="/api/v1/spend/budgets"){let l=T(e,t,"billing:read",s,a);return{data:e.store.listBudgets({organizationId:l.organizationId,projectId:l.projectId})}}if(n==="POST"&&o.pathname==="/api/v1/spend/budgets"){let l=await r.body?.()??{},g={organizationId:T(e,t,"billing:manage",l.projectId,l.environmentId).organizationId,projectId:l.projectId,environmentId:l.environmentId,name:String(l.name??"").trim(),period:Xt(l.period??"monthly")??"monthly",timezone:l.timezone,currency:l.currency,softLimitCents:W(l.softLimitCents,"softLimitCents"),hardLimitCents:W(l.hardLimitCents,"hardLimitCents"),thresholds:l.thresholds,meters:l.meters,graceSeconds:W(l.graceSeconds,"graceSeconds"),hysteresisPercent:l.hysteresisPercent,dryRun:l.dryRun!==!1,enabled:l.enabled};try{return{data:e.store.createBudget(g)}}catch(y){throw new m("validation_error",y instanceof Error?y.message:String(y),422)}}let d=/^\/api\/v1\/spend\/budgets\/([^/]+)$/.exec(o.pathname);if(d&&(n==="PATCH"||n==="DELETE")){let l=e.store.getBudget(decodeURIComponent(d[1]));if(!l||l.organizationId!==we(t))throw new m("not_found","Budget was not found.",404);if(T(e,t,"billing:manage",l.projectId,l.environmentId),n==="DELETE")return{data:{deleted:e.store.deleteBudget(l.id)}};let f=await r.body?.()??{};try{return{data:e.store.updateBudget(l.id,f,W(f.expectedVersion,"expectedVersion"))}}catch(g){let y=g instanceof Error?g.message:String(g);throw new m(y.includes("concurrently")?"conflict":"validation_error",y,y.includes("concurrently")?409:422)}}if(n==="GET"&&o.pathname==="/api/v1/spend/anomalies"){let l=T(e,t,"billing:read",s,a);return{data:e.store.listAnomalies({organizationId:l.organizationId,projectId:l.projectId,since:o.searchParams.get("since")??void 0,unacknowledgedOnly:o.searchParams.get("unacknowledged")==="true",limit:W(o.searchParams.get("limit"),"limit")})}}let c=/^\/api\/v1\/spend\/anomalies\/([^/]+)\/acknowledge$/.exec(o.pathname);if(c&&n==="POST"){let l=e.store.getAnomaly(decodeURIComponent(c[1]));if(!l||l.organizationId!==we(t))throw new m("not_found","Anomaly was not found.",404);return T(e,t,"billing:manage",l.projectId,l.environmentId),{data:{acknowledged:e.store.acknowledgeAnomaly(l.id)}}}if(n==="GET"&&o.pathname==="/api/v1/spend/signals")return T(e,t,"billing:read",s,a),{data:xt};if(o.pathname==="/api/v1/spend/anomaly-configs"){if(n==="GET"){let l=T(e,t,"billing:read",s,a);return{data:e.service.anomalyConfigs.list({organizationId:l.organizationId,projectId:l.projectId})}}if(n==="POST"){let l=await r.body?.()??{},f=T(e,t,"billing:manage",l.projectId,l.environmentId);try{return{data:e.service.anomalyConfigs.upsert({organizationId:f.organizationId,projectId:l.projectId,environmentId:l.environmentId,signal:String(l.signal??""),enabled:l.enabled,sensitivity:l.sensitivity,seasonLength:l.seasonLength==null?void 0:Number(l.seasonLength),minAbsoluteDelta:l.minAbsoluteDelta==null?void 0:Number(l.minAbsoluteDelta),detectDrops:l.detectDrops,severity:l.severity})}}catch(g){throw new m("validation_error",g instanceof Error?g.message:String(g),422)}}}let u=/^\/api\/v1\/spend\/anomaly-configs\/([^/]+)$/.exec(o.pathname);if(u&&n==="DELETE"){let l=e.service.anomalyConfigs.get(decodeURIComponent(u[1]));if(!l||l.organizationId!==we(t))throw new m("not_found","Anomaly config was not found.",404);return T(e,t,"billing:manage",l.projectId,l.environmentId),{data:{deleted:e.service.anomalyConfigs.delete(l.id)}}}if(o.pathname==="/api/v1/spend/anomaly-silences"){if(n==="GET"){let l=T(e,t,"billing:read",s,a);return{data:e.service.anomalyConfigs.listSilences({organizationId:l.organizationId,projectId:l.projectId,includeExpired:o.searchParams.get("includeExpired")==="true"})}}if(n==="POST"){let l=await r.body?.()??{},f=T(e,t,"billing:manage",l.projectId);try{return{data:e.service.anomalyConfigs.silence({organizationId:f.organizationId,projectId:l.projectId,signal:l.signal,routePattern:l.routePattern,statusCode:l.statusCode==null?void 0:Number(l.statusCode),reason:String(l.reason??""),expiresAt:l.expiresAt})}}catch(g){throw new m("validation_error",g instanceof Error?g.message:String(g),422)}}}let p=/^\/api\/v1\/spend\/anomaly-silences\/([^/]+)$/.exec(o.pathname);if(p&&n==="DELETE")return T(e,t,"billing:manage",s),{data:{deleted:e.service.anomalyConfigs.removeSilence(decodeURIComponent(p[1]))}};if(n==="GET"&&o.pathname==="/api/v1/spend/enforcement"){let l=T(e,t,"billing:read",s,a);return{data:e.store.listEnforcements({organizationId:l.organizationId,activeOnly:o.searchParams.get("active")!=="false"})}}if(n==="GET"&&o.pathname==="/api/v1/spend/allowance"){let l=T(e,t,"billing:read",s,a),f=o.searchParams.get("operation")??"deploy";if(!["build","deploy","function_invoke","request"].includes(f))throw new m("validation_error","operation must be build, deploy, function_invoke, or request.",422);let y=e.store.listEnforcements({organizationId:l.organizationId,activeOnly:!0}).filter((_)=>(!_.projectId||_.projectId===l.projectId)&&(!_.environmentId||_.environmentId===l.environmentId)),v=Ya(f,y),I=e.store.budgetsForScope(l.organizationId,l.projectId,l.environmentId).map((_)=>e.service.status(_,i));return{operation:f,allowed:v.allowed,blockedBy:v.blockedBy??null,reason:v.reason??null,budgets:I.map((_)=>({id:_.budget.id,name:_.budget.name,usedPercent:_.decision.usedPercent,projectedPercent:_.decision.projectedPercent,level:_.decision.level,timeToCap:_.timeToCap}))}}return}function hs(){let e=[{name:"projectId",in:"query",schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}}];return{"/api/v1/usage":{get:{summary:"Current usage, cost, and every budget governing the scope.",parameters:[...e,{name:"period",in:"query",schema:{type:"string",enum:["daily","weekly","monthly"]}},{name:"timezone",in:"query",schema:{type:"string"}}],responses:{"200":{description:"Usage totals, per-meter breakdown, hourly series, and budget status."}}}},"/api/v1/usage/rollups":{get:{summary:"Itemized hourly usage rollups.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"meter",in:"query",schema:{type:"array",items:{type:"string"}}},{name:"limit",in:"query",schema:{type:"integer"}}],responses:{"200":{description:"Hourly rollups, newest first."}}}},"/api/v1/usage/focus":{get:{summary:"Usage and cost in FOCUS v1.3 format, newline-delimited JSON.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"granularity",in:"query",schema:{type:"string",enum:["daily","hourly"]}}],responses:{"200":{description:"FOCUS records, one JSON object per line."}}}},"/api/v1/spend/budgets":{get:{summary:"Budgets governing a scope.",parameters:e,responses:{"200":{description:"Budgets."}}},post:{summary:"Create a budget. Starts in dry run unless dryRun is explicitly false.",responses:{"201":{description:"The created budget."},"422":{description:"Validation error."}}}},"/api/v1/spend/budgets/{budgetId}":{patch:{summary:"Update a budget. Pass expectedVersion for optimistic concurrency.",responses:{"200":{description:"The updated budget."},"409":{description:"Version conflict."}}},delete:{summary:"Delete a budget.",responses:{"200":{description:"Deletion result."}}}},"/api/v1/spend/anomalies":{get:{summary:"Detected spend anomalies.",parameters:[...e,{name:"since",in:"query",schema:{type:"string",format:"date-time"}},{name:"unacknowledged",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Anomalies, newest first."}}}},"/api/v1/spend/anomalies/{anomalyId}/acknowledge":{post:{summary:"Acknowledge an anomaly.",responses:{"200":{description:"Acknowledgement result."}}}},"/api/v1/spend/signals":{get:{summary:"Signals anomaly detection can run on, with their gap and sample rules.",responses:{"200":{description:"Signal catalog."}}}},"/api/v1/spend/anomaly-configs":{get:{summary:"Anomaly detection configuration.",parameters:e,responses:{"200":{description:"Configs."}}},post:{summary:"Create or update the config for a signal.",responses:{"200":{description:"The config."}}}},"/api/v1/spend/anomaly-configs/{configId}":{delete:{summary:"Delete an anomaly config, returning the signal to its default.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/anomaly-silences":{get:{summary:"Active anomaly silences.",parameters:e,responses:{"200":{description:"Silences."}}},post:{summary:"Silence a signal, route, or status code. A reason is required.",responses:{"200":{description:"The silence."}}}},"/api/v1/spend/anomaly-silences/{silenceId}":{delete:{summary:"Remove a silence.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/enforcement":{get:{summary:"Enforcement actions in force.",parameters:[...e,{name:"active",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Enforcement records."}}}},"/api/v1/spend/allowance":{get:{summary:"Whether an operation is allowed under current spend enforcement.",parameters:[...e,{name:"operation",in:"query",schema:{type:"string",enum:["build","deploy","function_invoke","request"]}}],responses:{"200":{description:"Allowance verdict and the budgets behind it."}}}}}}export{Oe,b,ts,kt,Xn,rs,pr,Oa,La,Ma,Qn,Yn,pt,Gr,Ua,_t,Kr,mt,We,Le,Ge,Ba,gt,mr,Me,Ke,Zn,ei,Vi,zi,Je,Jr,Gu,Xr,Hi,oe,Ku,Fa,nd,ns,Ju,Xu,Qu,ja,qi,is,Va,Qr,gr,Yu,ti,Zu,za,id,od,os,Ha,qa,fr,Wi,hr,Wa,ss,ri,sd,Gi,Ga,Ka,Ki,ad,Ja,Xa,Qa,Ya,as,cd,ld,ep,dd,Za,Ji,ud,pd,cs,xt,ls,ds,us,ec,md,tc,ps,tp,ft,rp,rc,$t,nc,np,ic,gd,ip,Z,fd,ms,op,Xi,ni,ii,gs,hd,yd,sp,m,Qi,fs,hs};