@stacksjs/ts-cloud 0.16.29 → 0.16.30

package/dist/bin/{chunk-rs50jra0.js → chunk-nb5vjsdg.js}

@@ -1,4 +1,4 @@
-import{Zr,G,ao,Lt,M}from"./chunk-1wtkv65w.js";import{v}from"./chunk-j2yy3tth.js";import{Sr,w}from"./chunk-2q64f0df.js";import{g}from"./chunk-a9yp82q5.js";import{B}from"./chunk-y9cdqk8c.js";function L(t){let{bucketName:i,domain:a,aliases:e,certificateArn:d,defaultRootObject:o="index.html",errorDocument:n="404.html",passthroughUrls:r=!1,singlePageApp:l=!1,dynamicApp:m=!1,computeOriginDomain:D,computeOriginPort:R=3008,computeOriginId:P="app-compute",retainOnStackDelete:O=!1}=t,C=O?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},h=m&&!!D,x=h?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],I=h?["GET","HEAD"]:["GET","HEAD"],N={},F={};N.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},F.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},F.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},N.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let A;if(r&&h)A="InstallRootRedirectFunction",N[A]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+import{Zr,G,ao,Lt,M}from"./chunk-1wtkv65w.js";import{v}from"./chunk-j2yy3tth.js";import{Sr,w}from"./chunk-bvtpvstn.js";import{g}from"./chunk-a9yp82q5.js";import{B}from"./chunk-y9cdqk8c.js";function L(t){let{bucketName:i,domain:a,aliases:e,certificateArn:d,defaultRootObject:o="index.html",errorDocument:n="404.html",passthroughUrls:r=!1,singlePageApp:l=!1,dynamicApp:m=!1,computeOriginDomain:D,computeOriginPort:R=3008,computeOriginId:P="app-compute",retainOnStackDelete:O=!1}=t,C=O?{DeletionPolicy:"Retain",UpdateReplacePolicy:"Retain"}:{},h=m&&!!D,x=h?["GET","HEAD","OPTIONS","PUT","POST","PATCH","DELETE"]:["GET","HEAD"],I=h?["GET","HEAD"]:["GET","HEAD"],N={},F={};N.S3Bucket={Type:"AWS::S3::Bucket",...C,Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},F.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},F.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},N.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",...C,Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}};let A;if(r&&h)A="InstallRootRedirectFunction",N[A]={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-install-root-redirect"},AutoPublish:!0,FunctionConfig:{Comment:"Redirect curl pantry.dev | bash (GET /) to /install.sh on S3",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   var request = event.request;
   if (request.uri === '/' || request.uri === '') {
     return {
@@ -42,7 +42,7 @@ import{Zr,G,ao,Lt,M}from"./chunk-1wtkv65w.js";import{v}from"./chunk-j2yy3tth.js"
 │                                                                             │
 │  Verification typically takes 1-2 business days.                            │
 │  After verification, re-run: bunx bunpress deploy                           │
-└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:F,stackName:o,bucket:h,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:F,stackName:o,bucket:h,message:`Stack deployment failed: ${s.message}`}}let c=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],S=(s)=>c.find((u)=>u.OutputKey===s)?.OutputValue,p=S("DistributionDomain");if(p&&l)console.log(`Creating DNS records via ${l.name}...`),await V(l,e,p);else if(p&&!l)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:F,stackName:o,bucket:S("BucketName")||h,distributionId:S("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function V(t,i,a){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(i.split(".").length===2)if(t instanceof Zr){console.log(`Creating Route53 alias record for apex domain ${i} -> ${a}`);let o=await t.createCloudFrontAlias({domain:i,name:i,cloudFrontDomainName:a});if(!o.success)console.warn(`Warning: Could not create Route53 alias record: ${o.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created Route53 alias record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating Route53 alias record for ${n} -> ${a}`);let r=await t.createCloudFrontAlias({domain:i,name:n,cloudFrontDomainName:a});if(!r.success)console.warn(`Warning: Could not create www Route53 alias: ${r.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created Route53 alias record: ${n} -> ${a}`)}else{try{let l=await t.listRecords(i,"A");if(l.success)for(let m of l.records){let D=m.name.replace(/\.$/,"");if(D===i||D==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(i,{name:i,type:"A",content:m.content})}}catch(l){console.log(`Note: Could not check for conflicting A records: ${l instanceof Error?l.message:l}`)}console.log(`Creating ALIAS record for apex domain ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"ALIAS",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create ALIAS record: ${o.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created ALIAS record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating CNAME record for ${n} -> ${a}`);let r=await t.upsertRecord(i,{name:n,type:"CNAME",content:a,ttl:600});if(!r.success)console.warn(`Warning: Could not create www DNS record: ${r.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created CNAME record: ${n} -> ${a}`)}else{console.log(`Creating CNAME record for ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"CNAME",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create DNS record: ${o.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created CNAME record: ${i} -> ${a}`)}}async function Pi(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await W(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:n}=await import("./chunk-a8b2a3ab.js"),r=await n({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(m,D,R)=>{e?.("upload",`${m}/${D}: ${R}`)}});if(r.errors.length>0)return{...o,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(o.distributionId&&r.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-a8b2a3ab.js");await m(o.distributionId)}e?.("complete","Deployment complete!");let l=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged) with external DNS`:`Deployed ${r.uploaded} files successfully with external DNS`;return{...o,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:l}}function ed(t){let{bucketName:i,domain:a,certificateArn:e,hostedZoneId:d,defaultRootObject:o="index.html",errorDocument:n="404.html"}=t,r={},l={};r.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},l.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},l.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},r.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},r.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
+└─────────────────────────────────────────────────────────────────────────────┘`),{success:!1,stackId:F,stackName:o,bucket:h,message:"CloudFront account verification required. Please contact AWS Support."}}return{success:!1,stackId:F,stackName:o,bucket:h,message:`Stack deployment failed: ${s.message}`}}let c=(await n.describeStacks({stackName:o})).Stacks[0]?.Outputs||[],S=(s)=>c.find((u)=>u.OutputKey===s)?.OutputValue,p=S("DistributionDomain");if(p&&l)console.log(`Creating DNS records via ${l.name}...`),await V(l,e,p);else if(p&&!l)console.log("Skipping DNS record creation (DNS verification was skipped)");return{success:!0,stackId:F,stackName:o,bucket:S("BucketName")||h,distributionId:S("DistributionId"),distributionDomain:p,domain:e,certificateArn:m,message:"Static site infrastructure deployed successfully with external DNS"}}async function V(t,i,a){if(!t){console.log("Skipping DNS record creation (DNS verification was skipped)");return}if(i.split(".").length===2)if(t instanceof Zr){console.log(`Creating Route53 alias record for apex domain ${i} -> ${a}`);let o=await t.createCloudFrontAlias({domain:i,name:i,cloudFrontDomainName:a});if(!o.success)console.warn(`Warning: Could not create Route53 alias record: ${o.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created Route53 alias record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating Route53 alias record for ${n} -> ${a}`);let r=await t.createCloudFrontAlias({domain:i,name:n,cloudFrontDomainName:a});if(!r.success)console.warn(`Warning: Could not create www Route53 alias: ${r.message}`),console.warn("Please manually create an A-record alias in Route53:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created Route53 alias record: ${n} -> ${a}`)}else{try{let l=await t.listRecords(i,"A");if(l.success)for(let m of l.records){let D=m.name.replace(/\.$/,"");if(D===i||D==="")console.log(`Removing existing root A record (${m.content}) to make room for ALIAS...`),await t.deleteRecord(i,{name:i,type:"A",content:m.content})}}catch(l){console.log(`Note: Could not check for conflicting A records: ${l instanceof Error?l.message:l}`)}console.log(`Creating ALIAS record for apex domain ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"ALIAS",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create ALIAS record: ${o.message}`),console.warn("Please manually create an ALIAS record in your DNS provider:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created ALIAS record: ${i} -> ${a}`);let n=`www.${i}`;console.log(`Creating CNAME record for ${n} -> ${a}`);let r=await t.upsertRecord(i,{name:n,type:"CNAME",content:a,ttl:600});if(!r.success)console.warn(`Warning: Could not create www DNS record: ${r.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${n} -> ${a}`);else console.log(`Created CNAME record: ${n} -> ${a}`)}else{console.log(`Creating CNAME record for ${i} -> ${a}`);let o=await t.upsertRecord(i,{name:i,type:"CNAME",content:a,ttl:600});if(!o.success)console.warn(`Warning: Could not create DNS record: ${o.message}`),console.warn("Please manually create a CNAME record:"),console.warn(`  ${i} -> ${a}`);else console.log(`Created CNAME record: ${i} -> ${a}`)}}async function Pi(t){let{sourceDir:i,cleanBucket:a=!1,onProgress:e,...d}=t;e?.("infrastructure","Deploying CloudFormation stack...");let o=await W(d);if(!o.success)return o;if(a){e?.("clean","Cleaning old files from S3...");try{await new g(d.region||"us-east-1").emptyBucket(o.bucket)}catch(m){console.log(`Note: Could not clean bucket: ${m.message}`)}}e?.("upload","Uploading files to S3...");let{uploadStaticFiles:n}=await import("./chunk-98e48n5j.js"),r=await n({sourceDir:i,bucket:o.bucket,region:d.region||"us-east-1",cacheControl:d.cacheControl,onProgress:(m,D,R)=>{e?.("upload",`${m}/${D}: ${R}`)}});if(r.errors.length>0)return{...o,success:!1,message:`Upload errors: ${r.errors.join(", ")}`,filesUploaded:r.uploaded};if(o.distributionId&&r.uploaded>0){e?.("invalidate","Invalidating CloudFront cache...");let{invalidateCache:m}=await import("./chunk-98e48n5j.js");await m(o.distributionId)}e?.("complete","Deployment complete!");let l=r.skipped>0?`Deployed ${r.uploaded} files (${r.skipped} unchanged) with external DNS`:`Deployed ${r.uploaded} files successfully with external DNS`;return{...o,filesUploaded:r.uploaded,filesSkipped:r.skipped,message:l}}function ed(t){let{bucketName:i,domain:a,certificateArn:e,hostedZoneId:d,defaultRootObject:o="index.html",errorDocument:n="404.html"}=t,r={},l={};r.S3Bucket={Type:"AWS::S3::Bucket",Properties:{BucketName:i,PublicAccessBlockConfiguration:{BlockPublicAcls:!0,BlockPublicPolicy:!1,IgnorePublicAcls:!0,RestrictPublicBuckets:!1},WebsiteConfiguration:{IndexDocument:o,ErrorDocument:n}}},l.BucketName={Description:"S3 Bucket Name",Value:{Ref:"S3Bucket"}},l.BucketArn={Description:"S3 Bucket ARN",Value:{"Fn::GetAtt":["S3Bucket","Arn"]}},r.CloudFrontOAC={Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:`OAC-${i}`,Description:`OAC for ${i}`,OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}},r.UrlRewriteFunction={Type:"AWS::CloudFront::Function",Properties:{Name:{"Fn::Sub":"${AWS::StackName}-url-rewrite"},AutoPublish:!0,FunctionConfig:{Comment:"Append .html extension to URLs without extensions",Runtime:"cloudfront-js-2.0"},FunctionCode:`function handler(event) {
   const request = event.request;
   var uri = request.uri;
 

package/dist/bin/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import{T,Ut,n,r,a,br,e,p,i,o,I,d,go,c,en,Se,Rs,Ps,Ns,Ds,f}from"./chunk-e4p6hwct.js";import{Js,H,Pr,C,F,Io,l,s,E,Ys,Zs,ea,De,Ue,jt,Po,Si,No,bi,Do,ia,oa,sa,aa,la,j,S,L,tt,D,ge,_o,Fe,zt,vi,Ee,xo,Ti,Ht,Ct,da,ua}from"./chunk-kne9dmwr.js";import{xe,_,gn,y,fn,Ni,hn,Ho,kr,nt,Pe,yn,Sn,bn,vn,Tn,En,wn,Cn,ne,Jt,Xt,An,_r,In,Rn,Pn,Nn,Dn,kn,_n,xn,it,Qt,Yt,It,xr,Zt,er,Di,Rt,$n,ce,On,Ln,Mn,$r,Or,Un,Lr,tr,rr,ot,Pt,Nt,Mr,le,Bn,Ra,Pa,nr,Na,q,ki,je,st,at,jn,Ur,Br,Vn,zn,Hn,Fr,qo,de,fe,$e,he,qn,ir}from"./chunk-k9d81ar0.js";import{u,Hs}from"./chunk-q9tvzcr7.js";import{se,h,Rr}from"./chunk-jeg6vw5v.js";import{Er,Tt,wr,Cr,Ar,Ir,on}from"./chunk-remzfbhd.js";import{b,kt,Qn,ns,pr,La,Ma,Ua,Yn,Zn,pt,Kr,_t,Jr,mt,We,Le,Ge,gt,mr,Me,Ke,ei,ti,Je,Xr,Qr,qi,Gi,hr,xt,ft,$t,Z,Qi,ii,oi,fs}from"./chunk-k8r5zfnf.js";import{Qe,Ot,vs,Ts,Ye,to,ro,no,io,oo,so,G,Lt,M,ai}from"./chunk-1wtkv65w.js";import{J,P,fo,$s,Os,cc,lc,di,bt,ui}from"./chunk-a1kpwbjg.js";import{v}from"./chunk-j2yy3tth.js";import{Q}from"./chunk-bkzt5ntz.js";import{vt,g}from"./chunk-a9yp82q5.js";import{ze,Wo,ue,_i,Gn,xi,$i,jr,Oi,Li,ye,Y,He,Ne,Vr,or,qe,sr,zr,lt,pe,dt,cr,lr,dr,Hr,ur,O,Ui,Bi,Kn,Go,qr,Ko,Jo,_a,Fi,Xo,Qo,Yo,Zo,ut,es,ji,Vi}from"./chunk-9p7g25kx.js";import"./chunk-j8dkatkk.js";import{R}from"./chunk-1chq0c2k.js";import{me}from"./chunk-7577ykbj.js";import{K,yt,po}from"./chunk-9nnfyqme.js";import{ie,W,Da,ka,Ve}from"./chunk-jf8jp6f5.js";import{Gt,pn,Kt,Ri,mn,zo}from"./chunk-yccdr4be.js";import"./chunk-6hrycgbh.js";import{w}from"./chunk-2q64f0df.js";import{ct}from"./chunk-xtqx4v3f.js";import{ee,be}from"./chunk-3ykx59eg.js";import{V}from"./chunk-yrq5bkxe.js";import"./chunk-a3vraghd.js";import{Pi}from"./chunk-rs50jra0.js";import"./chunk-dmyr6etw.js";import"./chunk-s3mv4z3f.js";import{si}from"./chunk-8d8tdhtx.js";import{yr}from"./chunk-573red0g.js";import{ht}from"./chunk-e6xn8g28.js";import{B}from"./chunk-y9cdqk8c.js";import{k}from"./chunk-yqkdyf0w.js";import{existsSync as Jd}from"node:fs";import pa from"node:fs/promises";import ml from"node:os";import ma from"node:path";import lo from"node:process";import{EventEmitter as Yd}from"node:events";import Ji from"node:process";import fl from"node:process";import ha from"node:process";import Ss from"node:process";import Bo from"node:process";import vl from"node:tty";import Bu,{stdin as Bg,stdout as Mg}from"node:process";class bl{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let x=ml.homedir(),t=ma.join(x,".config","clapp");this.configPath=ma.join(t,"telemetry.json")}async isEnabled(){if(lo.env.DO_NOT_TRACK==="1"||lo.env.DO_NOT_TRACK==="true")return!1;if(lo.env.NO_TELEMETRY==="1"||lo.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let x=await this.loadConfig();if(x.enabled=!0,!x.userId)x.userId=this.generateUserId();await this.saveConfig(x)}async disable(){let x=await this.loadConfig();x.enabled=!1,await this.saveConfig(x)}async track(x,t){if(!await this.isEnabled())return;let A={event:x,...t,timestamp:Date.now(),platform:ml.platform(),nodeVersion:lo.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(x,t){await this.track("command",{command:x,duration:t})}async trackError(x,t){await this.track("error",{error:x,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(x){return new Promise((t)=>setTimeout(t,x))}async status(){let x=await this.loadConfig();return{enabled:x.enabled,doNotTrack:lo.env.DO_NOT_TRACK==="1"||lo.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:x.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Jd(this.configPath)){let x=await pa.readFile(this.configPath,"utf-8");return this.config=JSON.parse(x),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(x){this.config=x;try{let t=ma.dirname(this.configPath);await pa.mkdir(t,{recursive:!0}),await pa.writeFile(this.configPath,JSON.stringify(x,null,2),"utf-8")}catch{}}generateUserId(){let x=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${x}-${t}`}}var kg=new bl;function ga(x){return x.replace(/[<[].+/,"").trim()}function Zd(x){let t=/<([^>]+)>/g,m=/\[([^\]]+)\]/g,A=[],N=(X)=>{let te=!1,re=X[1];if(re.startsWith("..."))re=re.slice(3),te=!0;return{required:X[0].startsWith("<"),value:re,variadic:te}},z;while(z=t.exec(x))A.push(N(z));let U;while(U=m.exec(x))A.push(N(U));return A}function Qd(x){let t={alias:{},boolean:[]};for(let[m,A]of x.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!x.some((z,U)=>U!==m&&z.names.some((X)=>A.names.includes(X))&&typeof z.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function gl(x){return x.reduce((t,m)=>t.length>=m.length?t:m,"")}function fa(x,t){return x.length>=t?x:`${x}${" ".repeat(t-x.length)}`}function ws(x){return x.replace(/([a-z])-([a-z])/g,(t,m,A)=>m+A.toUpperCase())}function Xd(x,t,m){let A=0,N=t.length,z=x,U;for(;A<N;++A)U=z[t[A]],z=z[t[A]]=A===N-1?m:U!=null?U:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function eu(x,t){for(let m of Object.keys(t)){let A=t[m];if(A.shouldTransform){if(x[m]=Array.prototype.concat.call([],x[m]),typeof A.transformFunction==="function")x[m]=x[m].map(A.transformFunction)}}}function tu(x){let t=/([^\\/]+)$/.exec(x);return t?t[1]:""}function Mo(x){return x.split(".").map((t,m)=>m===0?ws(t):t).join(".")}class Uo extends Error{exitCode=2;isUsageError=!0;usage;constructor(x,t){super(x);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(x).stack}format(x=!1){if(x&&this.stack)return`${this.message}
+import{T,Ut,n,r,a,br,e,p,i,o,I,d,go,c,en,Se,Rs,Ps,Ns,Ds,f}from"./chunk-e4p6hwct.js";import{Js,H,Pr,C,F,Io,l,s,E,Ys,Zs,ea,De,Ue,jt,Po,Si,No,bi,Do,ia,oa,sa,aa,la,j,S,L,tt,D,ge,_o,Fe,zt,vi,Ee,xo,Ti,Ht,Ct,da,ua}from"./chunk-kne9dmwr.js";import{xe,_,gn,y,fn,Ni,hn,Ho,kr,nt,Pe,yn,Sn,bn,vn,Tn,En,wn,Cn,ne,Jt,Xt,An,_r,In,Rn,Pn,Nn,Dn,kn,_n,xn,it,Qt,Yt,It,xr,Zt,er,Di,Rt,$n,ce,On,Ln,Mn,$r,Or,Un,Lr,tr,rr,ot,Pt,Nt,Mr,le,Bn,Ra,Pa,nr,Na,q,ki,je,st,at,jn,Ur,Br,Vn,zn,Hn,Fr,qo,de,fe,$e,he,qn,ir}from"./chunk-g00a221j.js";import{u,Hs}from"./chunk-q9tvzcr7.js";import{se,h,Rr}from"./chunk-jeg6vw5v.js";import{Er,Tt,wr,Cr,Ar,Ir,on}from"./chunk-remzfbhd.js";import{b,kt,Qn,ns,pr,La,Ma,Ua,Yn,Zn,pt,Kr,_t,Jr,mt,We,Le,Ge,gt,mr,Me,Ke,ei,ti,Je,Xr,Qr,qi,Gi,hr,xt,ft,$t,Z,Qi,ii,oi,fs}from"./chunk-k8r5zfnf.js";import{Qe,Ot,vs,Ts,Ye,to,ro,no,io,oo,so,G,Lt,M,ai}from"./chunk-1wtkv65w.js";import{J,P,fo,$s,Os,cc,lc,di,bt,ui}from"./chunk-a1kpwbjg.js";import{v}from"./chunk-j2yy3tth.js";import{Q}from"./chunk-bkzt5ntz.js";import{vt,g}from"./chunk-a9yp82q5.js";import{ze,Wo,ue,_i,Gn,xi,$i,jr,Oi,Li,ye,Y,He,Ne,Vr,or,qe,sr,zr,lt,pe,dt,cr,lr,dr,Hr,ur,O,Ui,Bi,Kn,Go,qr,Ko,Jo,_a,Fi,Xo,Qo,Yo,Zo,ut,es,ji,Vi}from"./chunk-9p7g25kx.js";import"./chunk-j8dkatkk.js";import{R}from"./chunk-1chq0c2k.js";import{me}from"./chunk-7577ykbj.js";import{K,yt,po}from"./chunk-9nnfyqme.js";import{ie,W,Da,ka,Ve}from"./chunk-jf8jp6f5.js";import{Gt,pn,Kt,Ri,mn,zo}from"./chunk-yccdr4be.js";import"./chunk-6hrycgbh.js";import{w}from"./chunk-bvtpvstn.js";import{ct}from"./chunk-xtqx4v3f.js";import{ee,be}from"./chunk-3ykx59eg.js";import{V}from"./chunk-yrq5bkxe.js";import"./chunk-a3vraghd.js";import{Pi}from"./chunk-nb5vjsdg.js";import"./chunk-dmyr6etw.js";import"./chunk-s3mv4z3f.js";import{si}from"./chunk-8d8tdhtx.js";import{yr}from"./chunk-573red0g.js";import{ht}from"./chunk-e6xn8g28.js";import{B}from"./chunk-y9cdqk8c.js";import{k}from"./chunk-yqkdyf0w.js";import{existsSync as Jd}from"node:fs";import pa from"node:fs/promises";import ml from"node:os";import ma from"node:path";import lo from"node:process";import{EventEmitter as Yd}from"node:events";import Ji from"node:process";import fl from"node:process";import ha from"node:process";import Ss from"node:process";import Bo from"node:process";import vl from"node:tty";import Bu,{stdin as Bg,stdout as Mg}from"node:process";class bl{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let x=ml.homedir(),t=ma.join(x,".config","clapp");this.configPath=ma.join(t,"telemetry.json")}async isEnabled(){if(lo.env.DO_NOT_TRACK==="1"||lo.env.DO_NOT_TRACK==="true")return!1;if(lo.env.NO_TELEMETRY==="1"||lo.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let x=await this.loadConfig();if(x.enabled=!0,!x.userId)x.userId=this.generateUserId();await this.saveConfig(x)}async disable(){let x=await this.loadConfig();x.enabled=!1,await this.saveConfig(x)}async track(x,t){if(!await this.isEnabled())return;let A={event:x,...t,timestamp:Date.now(),platform:ml.platform(),nodeVersion:lo.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(x,t){await this.track("command",{command:x,duration:t})}async trackError(x,t){await this.track("error",{error:x,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(x){return new Promise((t)=>setTimeout(t,x))}async status(){let x=await this.loadConfig();return{enabled:x.enabled,doNotTrack:lo.env.DO_NOT_TRACK==="1"||lo.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:x.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Jd(this.configPath)){let x=await pa.readFile(this.configPath,"utf-8");return this.config=JSON.parse(x),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(x){this.config=x;try{let t=ma.dirname(this.configPath);await pa.mkdir(t,{recursive:!0}),await pa.writeFile(this.configPath,JSON.stringify(x,null,2),"utf-8")}catch{}}generateUserId(){let x=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${x}-${t}`}}var kg=new bl;function ga(x){return x.replace(/[<[].+/,"").trim()}function Zd(x){let t=/<([^>]+)>/g,m=/\[([^\]]+)\]/g,A=[],N=(X)=>{let te=!1,re=X[1];if(re.startsWith("..."))re=re.slice(3),te=!0;return{required:X[0].startsWith("<"),value:re,variadic:te}},z;while(z=t.exec(x))A.push(N(z));let U;while(U=m.exec(x))A.push(N(U));return A}function Qd(x){let t={alias:{},boolean:[]};for(let[m,A]of x.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!x.some((z,U)=>U!==m&&z.names.some((X)=>A.names.includes(X))&&typeof z.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function gl(x){return x.reduce((t,m)=>t.length>=m.length?t:m,"")}function fa(x,t){return x.length>=t?x:`${x}${" ".repeat(t-x.length)}`}function ws(x){return x.replace(/([a-z])-([a-z])/g,(t,m,A)=>m+A.toUpperCase())}function Xd(x,t,m){let A=0,N=t.length,z=x,U;for(;A<N;++A)U=z[t[A]],z=z[t[A]]=A===N-1?m:U!=null?U:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function eu(x,t){for(let m of Object.keys(t)){let A=t[m];if(A.shouldTransform){if(x[m]=Array.prototype.concat.call([],x[m]),typeof A.transformFunction==="function")x[m]=x[m].map(A.transformFunction)}}}function tu(x){let t=/([^\\/]+)$/.exec(x);return t?t[1]:""}function Mo(x){return x.split(".").map((t,m)=>m===0?ws(t):t).join(".")}class Uo extends Error{exitCode=2;isUsageError=!0;usage;constructor(x,t){super(x);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(x).stack}format(x=!1){if(x&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function nu(x){if(x instanceof Uo)return!0;return!!x&&typeof x==="object"&&x.name==="ClappError"&&typeof x.message==="string"}function ru(){let{env:x}=fl,{TERM:t,TERM_PROGRAM:m}=x;if(fl.platform!=="win32")return t!=="linux";return Boolean(x.WT_SESSION)||Boolean(x.TERMINUS_SUBLIME)||x.ConEmuTask==="{cmd::Cmder}"||m==="Terminus-Sublime"||m==="vscode"||t==="xterm-256color"||t==="alacritty"||t==="rxvt-unicode"||t==="rxvt-unicode-256color"||x.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var Cs="\x1B",ln=`${Cs}[`;var hl={to(x,t){if(!t)return`${ln}${x+1}G`;return`${ln}${t+1};${x+1}H`},move(x,t){let m="";if(x<0)m+=`${ln}${-x}D`;else if(x>0)m+=`${ln}${x}C`;if(t<0)m+=`${ln}${-t}A`;else if(t>0)m+=`${ln}${t}B`;return m},up:(x=1)=>`${ln}${x}A`,down:(x=1)=>`${ln}${x}B`,forward:(x=1)=>`${ln}${x}C`,backward:(x=1)=>`${ln}${x}D`,nextLine:(x=1)=>`${ln}E`.repeat(x),prevLine:(x=1)=>`${ln}F`.repeat(x),left:`${ln}G`,hide:`${ln}?25l`,show:`${ln}?25h`,save:`${Cs}7`,restore:`${Cs}8`};var xg={screen:`${ln}2J`,up:(x=1)=>`${ln}1J`.repeat(x),down:(x=1)=>`${ln}J`.repeat(x),line:`${ln}2K`,lineEnd:`${ln}K`,lineStart:`${ln}1K`,lines(x){let t="";for(let m=0;m<x;m++)t+=this.line+(m<x-1?hl.up():"");if(x)t+=hl.left;return t}},Dg={screen:`${Cs}c`};function iu(x,t){let m=[];for(let A=0;A<=t.length;A++)m[A]=[A];for(let A=0;A<=x.length;A++)m[0][A]=A;for(let A=1;A<=t.length;A++)for(let N=1;N<=x.length;N++)if(t.charAt(A-1)===x.charAt(N-1))m[A][N]=m[A-1][N-1];else m[A][N]=Math.min(m[A-1][N-1]+1,m[A][N-1]+1,m[A-1][N]+1);return m[t.length][x.length]}function wl(x,t,m=2,A=3){return t.map((N)=>({cmd:N,distance:iu(x,N)})).filter(({distance:N})=>N<=m).sort((N,z)=>N.distance-z.distance).slice(0,A).map(({cmd:N})=>N)}function ou(x,t={}){let m={_:[]},A=t.alias||{},N=new Set(t.boolean||[]),z={};for(let te of Object.keys(A))for(let re of A[te])z[re]=te;for(let te of N)if(A[te])for(let re of A[te])N.add(re);function U(te,re){if(te===void 0)return re;if(typeof re==="boolean")return re;return Array.isArray(te)?[...te,re]:[te,re]}function X(te,re){let oe=z[te]||te,ae=U(m[oe],re);if(m[oe]=ae,A[oe])for(let ve of A[oe])m[ve]=ae;if(z[te]&&A[z[te]])for(let ve of A[z[te]])m[ve]=ae;m[te]=ae}for(let te=0;te<x.length;te++){let re=x[te];if(re==="--"){m._.push(...x.slice(te+1));break}if(re.startsWith("--")){let oe=re.indexOf("=");if(oe!==-1){let ae=ws(re.slice(2,oe)),ve=re.slice(oe+1);X(ae,ve)}else{let ae=re.slice(2);if(ae.startsWith("no-")){let Re=ws(ae.slice(3));X(Re,!1);continue}let ve=ws(ae),Ce=z[ve]||ve;if(N.has(Ce)||N.has(ve))X(ve,!0);else{let Re=x[te+1];if(Re!==void 0&&!Re.startsWith("-"))X(ve,Re),te++;else X(ve,!0)}}}else if(re.startsWith("-")&&re.length>1){let oe=re.slice(1);for(let ae=0;ae<oe.length;ae++){let ve=oe[ae],Ce=z[ve]||ve;if(ae===oe.length-1&&!N.has(Ce)&&!N.has(ve)){let Re=x[te+1];if(Re!==void 0&&!Re.startsWith("-"))X(ve,Re),te++;else X(ve,!0)}else X(ve,!0)}}else m._.push(re)}return m}class Sl{rawName;description;name;names;isBoolean;required;config;negated;constructor(x,t,m){if(this.rawName=x,this.description=t,this.config=Object.assign({},m),x=x.replace(/\.\*/g,""),this.negated=!1,this.names=ga(x).split(",").map((A)=>{let N=A.trim().replace(/^-{1,2}/,"");if(N.startsWith("no-"))this.negated=!0,N=N.replace(/^no-/,"");return Mo(N)}).sort((A,N)=>A.length>N.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(x.includes("<"))this.required=!0;else if(x.includes("["))this.required=!1;else this.isBoolean=!0}}var Tg=ha.argv,su=`${ha.platform}-${ha.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,yl=Ss.argv,au=`${Ss.platform}-${Ss.arch} node-${Ss.version}`;class ya{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(x,t,m,A){this.rawName=x,this.description=t,this.config=m,this.cli=A,this.options=[],this.aliasNames=[],this.name=ga(x);let N=ga(x),z=N.indexOf(":");if(z>0)this.namespace=N.substring(0,z),this.name=N.substring(z+1);if(this.args=Zd(x),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!m)this.config={}}usage(x){return this.usageText=x,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(x,t="-v, --version"){return this.versionNumber=x,this.option(t,"Display version number"),this}example(x){return this.examples.push(x),this}option(x,t,m){let A=new Sl(x,t,m);return this.options.push(A),this}alias(x){return this.aliasNames.push(x),this}action(x){return this.commandAction=x,this}before(x){return this.beforeHooks.push(x),this}after(x){return this.afterHooks.push(x),this}use(x){return this.middleware.push(x),this}isMatched(x){if(this.aliasNames.includes(x))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===x;return this.name===x}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof va}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(x){let t=Mo(x.split(".")[0]);return!!this.options.find((m)=>m.names.some((A)=>Mo(A)===t))}outputHelp(){let{name:x,commands:t}=this.cli,{versionNumber:m,options:A,helpCallback:N}=this.cli.globalCommand,z=[{body:`${x}${m?`/${m}`:""}`}];if(z.push({title:"Usage",body:`  $ ${x} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&t.length>0){let re=gl(t.map((Re)=>Re.rawName)),oe=new Map,ae=[];for(let Re of t)if(Re.namespace){if(!oe.has(Re.namespace))oe.set(Re.namespace,[]);oe.get(Re.namespace).push(Re)}else ae.push(Re);let ve="";if(ae.sort((Re,we)=>Re.rawName<we.rawName?-1:Re.rawName>we.rawName?1:0),ae.length>0)ve+=ae.map((Re)=>`  ${fa(Re.rawName,re.length)}  ${Re.description}`).join(`
@@ -28,7 +28,7 @@ Received ${m}, cleaning up...`),x)try{await x()}catch(A){console.error("Error du
 `)),this.enableDidYouMean){let t=[];for(let A of this.commands){if(A.displayName)t.push(A.displayName);if(A.aliasNames)t.push(...A.aliasNames)}let m=wl(x,t);if(m.length>0)console.log(Fo.yellow("Did you mean one of these?")),m.forEach((A)=>console.log(`  ${Fo.dim("•")} ${this.name} ${A}`)),console.log("")}console.log(Fo.dim("Run"),`${this.name} --help`,Fo.dim("to see all available commands")),Ji.exit(1)}async parse(x=yl,t={}){let{run:m=!0,exitOnError:A=!1}=t;if(A)try{return await this.parse(x,{run:m})}catch(te){throw this.handleUsageError(te),te}if(this.rawArgs=x,!this.name)this.name=x[1]?tu(x[1]):"cli";let N=!0,z=x.slice(2),U=z[0];if(U&&!U.startsWith("-")){for(let te of this.commands)if(te.isMatched(U)){let re=this.mri(z,te);N=!1;let oe={...re,args:re.args.slice(1)};this.setParsedInfo(oe,te,U),this.emit(`command:${U}`,te);break}if(N){let te=z[1];if(te&&!te.startsWith("-")){let re=`${U}:${te}`;for(let oe of this.commands)if(oe.isMatched(re)){let ae=this.mri(z,oe);N=!1;let ve={...ae,args:ae.args.slice(2)};this.setParsedInfo(ve,oe,re),this.emit(`command:${re}`,oe);break}}}}if(N){for(let te of this.commands)if(te.name===""){N=!1;let re=this.mri(z,te);this.setParsedInfo(re,te),this.emit("command:!",te);break}}if(N){let te=this.mri(x.slice(2));this.setParsedInfo(te)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),m=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),m=!1,this.unsetMatchedCommand();let X={args:this.args,options:this.options};if(m)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return X}mri(x,t){let m=[...this.globalCommand.options,...t?t.options:[]],A=Qd(m),N=[],z=x.indexOf("--");if(z>-1)N=x.slice(z+1),x=x.slice(0,z);let U=ou(x,A),X={_:U._};for(let ve of Object.keys(U))if(ve!=="_")X[Mo(ve)]=U[ve];let te=X._,re={"--":N},oe=t&&t.config.ignoreOptionDefaultValue?t.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,ae=Object.create(null);for(let ve of m){if(!oe&&ve.config.default!==void 0)for(let Ce of ve.names)re[Ce]=ve.config.default;if(Array.isArray(ve.config.type)){if(ae[ve.name]===void 0)ae[ve.name]={shouldTransform:!0,transformFunction:ve.config.type[0]}}}for(let ve of Object.keys(X))if(ve!=="_"){let Ce=ve.split(".");Xd(re,Ce,X[ve]),eu(re,ae)}return{args:te,options:re}}async run(x=yl){return this.parse(x,{run:!0,exitOnError:!0})}handleUsageError(x){if(!nu(x)||x.isUsageError===!1)return;let t=x.message||"command-line error",m=this.name?`${this.name}: `:"",A=/--help/.test(t)?"":x.usage?`
 Usage: ${x.usage}`:`
 Run \`${this.name??"cli"} --help\` for usage.`;Ji.stderr.write(`${m}${t}${A}
-`),Ji.exit(x.exitCode??2)}async runMatchedCommand(){let{args:x,options:t,matchedCommand:m}=this;if(!m||!m.commandAction)return;m.checkUnknownOptions(),m.checkOptionValue(),m.checkRequiredArgs();let A=[];m.args.forEach((X,te)=>{if(X.variadic)A.push(x.slice(te));else A.push(x[te])}),A.push(t);let N={command:m,args:A,options:t};for(let X of m.beforeHooks)await X(N);let z,U=async()=>{let X=m.commandAction.apply(this,A);if(X instanceof Promise)z=await X;else z=X;return z};if(m.middleware.length>0){let X=0,te=async()=>{if(X<m.middleware.length){let re=m.middleware[X++];await re({...N,next:te})}else await U()};await te()}else await U();for(let X of m.afterHooks)await X(N);return z}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Ji.removeAllListeners("SIGINT"),Ji.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class $l{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(x){if(!this.enabled){this.misses++;return}let t=this.cache.get(x);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(x),this.misses++;return}return this.hits++,t.value}set(x,t,m=5000){if(!this.enabled)return;this.cache.set(x,{value:t,timestamp:Date.now(),ttl:m})}has(x){if(!this.enabled)return!1;let t=this.cache.get(x);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(x),!1;return!0}delete(x){this.cache.delete(x)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let x=Date.now();for(let[t,m]of this.cache.entries())if(x-m.timestamp>m.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Og=new $l;function uu(){if("FORCE_COLOR"in Bo.env)return Bo.env.FORCE_COLOR!=="0";if("NO_COLOR"in Bo.env||Bo.env.TERM==="dumb")return!1;if(Bo.platform==="win32")return!0;return vl.isatty(1)&&vl.isatty(2)}var Cl=uu();function cn(x,t){if(!Cl)return(m)=>m;return(m)=>x+m+t}var pu=cn("\x1B[0m","\x1B[0m"),mu=cn("\x1B[31m","\x1B[39m"),fu=cn("\x1B[32m","\x1B[39m"),gu=cn("\x1B[33m","\x1B[39m"),hu=cn("\x1B[34m","\x1B[39m"),yu=cn("\x1B[35m","\x1B[39m"),vu=cn("\x1B[36m","\x1B[39m"),bu=cn("\x1B[37m","\x1B[39m"),wu=cn("\x1B[90m","\x1B[39m"),Su=cn("\x1B[1m","\x1B[22m"),$u=cn("\x1B[3m","\x1B[23m"),Cu=cn("\x1B[4m","\x1B[24m"),Au=cn("\x1B[2m","\x1B[22m"),ku=cn("\x1B[7m","\x1B[27m"),Ru=cn("\x1B[8m","\x1B[28m"),Iu=cn("\x1B[9m","\x1B[29m"),Pu=cn("\x1B[41m","\x1B[49m"),xu=cn("\x1B[42m","\x1B[49m"),Du=cn("\x1B[43m","\x1B[49m"),Eu=cn("\x1B[44m","\x1B[49m"),Tu=cn("\x1B[45m","\x1B[49m"),Nu=cn("\x1B[46m","\x1B[49m"),Ou=cn("\x1B[47m","\x1B[49m"),Lu=Cl,ju={reset:pu,red:mu,green:fu,yellow:gu,blue:hu,magenta:yu,cyan:vu,white:bu,gray:wu,bold:Su,italic:$u,underline:Cu,dim:Au,inverse:ku,hidden:Ru,strikethrough:Iu,bgRed:Pu,bgGreen:xu,bgYellow:Du,bgBlue:Eu,bgMagenta:Tu,bgCyan:Nu,bgWhite:Ou,isColorSupported:Lu},Fu=ju,Mu=["up","down","left","right","space","enter","cancel"],_g={actions:new Set(Mu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var zg=Bu.platform.startsWith("win"),Ug=Symbol("clapp:cancel");var _u=ru();var an=(x,t)=>_u?x:t,Vg=an("◆","*"),Wg=an("■","x"),qg=an("▲","x"),Gg=an("◇","o"),Hg=an("┌","T"),zu=an("│","|"),Kg=an("└","—"),Jg=an("●",">"),Yg=an("○"," "),Zg=an("◻","[•]"),Qg=an("◼","[+]"),Xg=an("◻","[ ]"),eh=an("▪","•"),th=an("─","-"),nh=an("╮","+"),rh=an("├","+"),ih=an("╯","+"),oh=an("●","•"),sh=an("◆","*"),ah=an("▲","!"),ch=an("■","x");var lh={light:an("─","-"),heavy:an("━","="),block:an("█","#")};function Uu(){return`${Fu.gray(zu)}  `}var dh=Uu();var wa="0.16.29";function Al(x,t,m=process.env){let A=t?.options.find((U)=>U.name==="profile");if((!A||/\baws\b/i.test(A.description))&&typeof x.profile==="string"&&x.profile)m.AWS_PROFILE=x.profile,delete m.AWS_ACCESS_KEY_ID,delete m.AWS_SECRET_ACCESS_KEY,delete m.AWS_SESSION_TOKEN;if(!t?.options.some((U)=>U.name==="region")&&typeof x.region==="string"&&x.region)m.AWS_REGION=x.region,m.AWS_DEFAULT_REGION=x.region}import{existsSync as Sa}from"node:fs";import{mkdir as Wu,writeFile as kl}from"node:fs/promises";function $a(x){x.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),Sa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let m=t?.name||await I("Project name","my-app"),A=t?.mode||await go("Select deployment mode",["serverless","server"]),N=t?.region||await go("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),z=new o("Creating configuration file...");z.start();let U=`import { defineConfig } from '@ts-cloud/core'
+`),Ji.exit(x.exitCode??2)}async runMatchedCommand(){let{args:x,options:t,matchedCommand:m}=this;if(!m||!m.commandAction)return;m.checkUnknownOptions(),m.checkOptionValue(),m.checkRequiredArgs();let A=[];m.args.forEach((X,te)=>{if(X.variadic)A.push(x.slice(te));else A.push(x[te])}),A.push(t);let N={command:m,args:A,options:t};for(let X of m.beforeHooks)await X(N);let z,U=async()=>{let X=m.commandAction.apply(this,A);if(X instanceof Promise)z=await X;else z=X;return z};if(m.middleware.length>0){let X=0,te=async()=>{if(X<m.middleware.length){let re=m.middleware[X++];await re({...N,next:te})}else await U()};await te()}else await U();for(let X of m.afterHooks)await X(N);return z}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Ji.removeAllListeners("SIGINT"),Ji.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class $l{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(x){if(!this.enabled){this.misses++;return}let t=this.cache.get(x);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(x),this.misses++;return}return this.hits++,t.value}set(x,t,m=5000){if(!this.enabled)return;this.cache.set(x,{value:t,timestamp:Date.now(),ttl:m})}has(x){if(!this.enabled)return!1;let t=this.cache.get(x);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(x),!1;return!0}delete(x){this.cache.delete(x)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let x=Date.now();for(let[t,m]of this.cache.entries())if(x-m.timestamp>m.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Og=new $l;function uu(){if("FORCE_COLOR"in Bo.env)return Bo.env.FORCE_COLOR!=="0";if("NO_COLOR"in Bo.env||Bo.env.TERM==="dumb")return!1;if(Bo.platform==="win32")return!0;return vl.isatty(1)&&vl.isatty(2)}var Cl=uu();function cn(x,t){if(!Cl)return(m)=>m;return(m)=>x+m+t}var pu=cn("\x1B[0m","\x1B[0m"),mu=cn("\x1B[31m","\x1B[39m"),fu=cn("\x1B[32m","\x1B[39m"),gu=cn("\x1B[33m","\x1B[39m"),hu=cn("\x1B[34m","\x1B[39m"),yu=cn("\x1B[35m","\x1B[39m"),vu=cn("\x1B[36m","\x1B[39m"),bu=cn("\x1B[37m","\x1B[39m"),wu=cn("\x1B[90m","\x1B[39m"),Su=cn("\x1B[1m","\x1B[22m"),$u=cn("\x1B[3m","\x1B[23m"),Cu=cn("\x1B[4m","\x1B[24m"),Au=cn("\x1B[2m","\x1B[22m"),ku=cn("\x1B[7m","\x1B[27m"),Ru=cn("\x1B[8m","\x1B[28m"),Iu=cn("\x1B[9m","\x1B[29m"),Pu=cn("\x1B[41m","\x1B[49m"),xu=cn("\x1B[42m","\x1B[49m"),Du=cn("\x1B[43m","\x1B[49m"),Eu=cn("\x1B[44m","\x1B[49m"),Tu=cn("\x1B[45m","\x1B[49m"),Nu=cn("\x1B[46m","\x1B[49m"),Ou=cn("\x1B[47m","\x1B[49m"),Lu=Cl,ju={reset:pu,red:mu,green:fu,yellow:gu,blue:hu,magenta:yu,cyan:vu,white:bu,gray:wu,bold:Su,italic:$u,underline:Cu,dim:Au,inverse:ku,hidden:Ru,strikethrough:Iu,bgRed:Pu,bgGreen:xu,bgYellow:Du,bgBlue:Eu,bgMagenta:Tu,bgCyan:Nu,bgWhite:Ou,isColorSupported:Lu},Fu=ju,Mu=["up","down","left","right","space","enter","cancel"],_g={actions:new Set(Mu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var zg=Bu.platform.startsWith("win"),Ug=Symbol("clapp:cancel");var _u=ru();var an=(x,t)=>_u?x:t,Vg=an("◆","*"),Wg=an("■","x"),qg=an("▲","x"),Gg=an("◇","o"),Hg=an("┌","T"),zu=an("│","|"),Kg=an("└","—"),Jg=an("●",">"),Yg=an("○"," "),Zg=an("◻","[•]"),Qg=an("◼","[+]"),Xg=an("◻","[ ]"),eh=an("▪","•"),th=an("─","-"),nh=an("╮","+"),rh=an("├","+"),ih=an("╯","+"),oh=an("●","•"),sh=an("◆","*"),ah=an("▲","!"),ch=an("■","x");var lh={light:an("─","-"),heavy:an("━","="),block:an("█","#")};function Uu(){return`${Fu.gray(zu)}  `}var dh=Uu();var wa="0.16.30";function Al(x,t,m=process.env){let A=t?.options.find((U)=>U.name==="profile");if((!A||/\baws\b/i.test(A.description))&&typeof x.profile==="string"&&x.profile)m.AWS_PROFILE=x.profile,delete m.AWS_ACCESS_KEY_ID,delete m.AWS_SECRET_ACCESS_KEY,delete m.AWS_SESSION_TOKEN;if(!t?.options.some((U)=>U.name==="region")&&typeof x.region==="string"&&x.region)m.AWS_REGION=x.region,m.AWS_DEFAULT_REGION=x.region}import{existsSync as Sa}from"node:fs";import{mkdir as Wu,writeFile as kl}from"node:fs/promises";function $a(x){x.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),Sa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let m=t?.name||await I("Project name","my-app"),A=t?.mode||await go("Select deployment mode",["serverless","server"]),N=t?.region||await go("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),z=new o("Creating configuration file...");z.start();let U=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -315,7 +315,7 @@ Resources to create: ${Te}`);let Xe={};for(let _e of Object.values(re.Resources|
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
 `),ke.length>0){n(`Resources to add (${ke.length}):`);for(let Ie of ke){let Te=Ce[Ie].Type;e(`  + ${Ie} (${Te})`)}console.log()}if(Be.length>0){r(`Resources to remove (${Be.length}):`);for(let Ie of Be){let Te=ve[Ie].Type;e(`  - ${Ie} (${Te})`)}console.log()}if(Ae.length>0){a(`Resources to modify (${Ae.length}):`);for(let Ie of Ae){let Te=Ce[Ie].Type;e(`  ~ ${Ie} (${Te})`)}console.log()}e("Summary:"),e(`  - Add: ${ke.length}`),e(`  - Remove: ${Be.length}`),e(`  - Modify: ${Ae.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(m){r(`Diff failed: ${m.message}`)}})}function Zi(x,t=0){let m=Number(x);return Number.isFinite(m)?m:t}function Oa(x){return Zi(x)*1024}function $p(x){let t=x?.date?.trim(),m=x?.time?.trim();if(!t||!m)return null;let A=new Date(`${t}T${m}Z`);return Number.isFinite(A.getTime())?A.toISOString():null}function Cp(x,t,m){let A;try{A=JSON.parse(x)}catch{return[]}let N=(A?.sysstat?.hosts??[]).flatMap((U)=>U.statistics??[]),z=[];for(let U of N){let X=$p(U.timestamp);if(!X)continue;let te=new Date(X).getTime();if(te<t.getTime()||te>m.getTime())continue;let re=U["cpu-load"]?.find((ae)=>ae.cpu==="all")??U["cpu-load"]?.[0],oe=Zi(re?.idle,100);z.push({timestamp:X,cpuUsedPercent:Math.max(0,Math.min(100,100-oe)),cpuUserPercent:Zi(re?.user),cpuSystemPercent:Zi(re?.system),cpuIowaitPercent:Zi(re?.iowait),memoryUsedPercent:Zi(U.memory?.["memused-percent"]),memoryUsedBytes:Oa(U.memory?.memused),memoryAvailableBytes:Oa(U.memory?.avail),swapUsedPercent:Zi(U.memory?.["swpused-percent"]),swapUsedBytes:Oa(U.memory?.swpused)})}return z.sort((U,X)=>U.timestamp.localeCompare(X.timestamp))}function Ap(x){return Object.fromEntries(Object.entries(x.time_series??{}).map(([t,m])=>[t,(m.values??[]).map(([A,N])=>({timestamp:new Date(Number(A)*1000).toISOString(),value:Zi(N,Number.NaN)})).filter((A)=>Number.isFinite(A.value))]))}function Ml(x){return x.length?x.reduce((t,m)=>t+m,0)/x.length:null}function ja(x){return x.length?Math.max(...x):null}function kp(x){return x.length?Math.min(...x):null}async function _l(x){let[t,m]=await Promise.all([x.client.getServerMetrics(x.serverId,{types:["cpu","disk","network"],start:x.from,end:x.to,step:x.step}),Ne(x.remote.host,"LC_ALL=C sadf -j -- -u -r -S",x.remote).catch(()=>"")]),A=Cp(m,x.from,x.to),N=Ap(t),U=(N.cpu??[]).map((ae)=>Math.max(0,Math.min(100,ae.value/Math.max(1,x.cores)))),X=A.map((ae)=>ae.cpuUsedPercent),te=U.length?U:X,re=A.map((ae)=>ae.memoryUsedPercent),oe=A.map((ae)=>ae.swapUsedPercent);return{from:x.from.toISOString(),to:x.to.toISOString(),cores:x.cores,host:A,provider:N,summary:{cpuAveragePercent:Ml(te),cpuPeakPercent:ja(te),memoryAveragePercent:Ml(re),memoryPeakPercent:ja(re),memoryMinimumAvailableBytes:kp(A.map((ae)=>ae.memoryAvailableBytes)),swapPeakPercent:ja(oe)}}}function Rp(x){if(x.length===0)throw Error("A server name cannot be empty.");if(x.length>253)throw Error(`'${x}' is longer than the 253 characters a hostname allows.`);for(let t of x.split(".")){if(t.length===0)throw Error(`'${x}' has an empty label — a hostname cannot contain '..'.`);if(t.length>63)throw Error(`'${t}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(t))throw Error(`'${t}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function zl(x,t,m){if(Rp(t),x===t)throw Error(`'${x}' is already named that.`);if((await m.takenNames()).some((z)=>z===t&&z!==x))throw Error(`'${t}' is already taken. Server names have to be unique within a provider project.`);let N=[];if(m.providerName&&m.renameProvider){let{providerName:z,renameProvider:U}=m;N.push({id:"provider",title:"Rename the server at the provider",change:{from:x,to:t},satisfied:async()=>await z()===t,apply:()=>U(t)})}if(m.stateName&&m.writeStateName){let{stateName:z,writeStateName:U}=m;N.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:x,to:t},satisfied:async()=>{let X=await z();return X===void 0||X===t},apply:()=>U(t)})}if(m.remoteHostname&&m.setRemoteHostname){let{remoteHostname:z,setRemoteHostname:U}=m;N.push({id:"hostname",title:"Set the hostname on the box",change:{from:x,to:t},satisfied:async()=>await z()===t,apply:()=>U(t)})}return N.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:x,to:t},satisfied:async()=>m.inventoryName()===t,apply:async()=>{await m.renameInventory(t)}}),{operation:"server:rename",target:x,steps:N}}function Ul(x){let t=`'${x.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${t} 2>/dev/null || { echo ${t} > /etc/hostname && hostname ${t}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${x}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${t} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}async function Ip(){let x=await Oe(),t=y(process.cwd(),x),m=new Pe(t.store),A=new yn(m,[new nt("aws"),new nt("hetzner"),new nt("ssh")]);return{controlPlane:t,store:m,service:A}}async function wi(x){let t=await Ip();try{return await x(t)}finally{t.controlPlane.store.close()}}var Xi=(x,t)=>{let m=x.store.list(x.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error(`Server ${t} was not found.`);return m},ar=(x)=>{r(x instanceof Error?x.message:String(x)),process.exitCode=1};function Fa(x,t){let m=Number.parseInt(x??"",10);return Number.isFinite(m)&&m>=0?m:t}function Pp(x="3h"){let t=x.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let m=Number(t[1])*(t[2]==="h"?3600000:60000);if(m<300000||m>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return m}function is(x,t="%"){return x==null?"unavailable":`${x.toFixed(1)}${t}`}async function xp(x,t){let m=await Oe();if(m.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",N=E(m,A),z=await pe(N);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(x))throw Error(`Refusing to read ${x}: project state is pinned to ${z.serverName}.`);let U=or(m),X=new qe({apiToken:sr(U.apiToken,m)}),te=await X.getServer(z.serverId),re=z.publicIp??te.public_net.ipv4?.ip;if(!re)throw Error(`Server ${te.name} has no public IPv4 address.`);let oe=new Date,ae=new Date(oe.getTime()-Pp(t.range)),ve=Math.min(3600,Math.max(60,Fa(t.step,60))),Ce=await _l({client:X,serverId:te.id,cores:Math.max(1,Number(te.server_type.cores)||1),from:ae,to:oe,step:ve,remote:{host:re,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:te.name,result:Ce},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[te.name,`${Ce.from} to ${Ce.to}`,`${is(Ce.summary.cpuAveragePercent)} / ${is(Ce.summary.cpuPeakPercent)}`,`${is(Ce.summary.memoryAveragePercent)} / ${is(Ce.summary.memoryPeakPercent)}`,Ce.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(Ce.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,is(Ce.summary.swapPeakPercent)]])}function Vl(x){let t=x.targetType.prices?.find((m)=>m.location===x.location);return{serverId:x.serverId,serverName:x.serverName,location:x.location,from:x.currentType.name,to:x.targetType.name,capacityAvailable:x.capacityAvailable,alreadyComplete:x.alreadyComplete,upgradeDisk:x.upgradeDisk,target:{cores:x.targetType.cores,memoryGb:x.targetType.memory,diskGb:x.targetType.disk,architecture:x.targetType.architecture,cpuType:x.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function Dp(x){let t=Vl(x);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function Ep(x,t,m){let A=await Oe();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=m.env??process.env.CLOUD_ENV??"production",z=E(A,N),U=await pe(z),X=or(A),te=new qe({apiToken:sr(X.apiToken,A)}),oe=U&&(x===U.serverName||x===String(U.serverId)||x===U.stackName)?await te.getServer(U.serverId):(await te.listServers()).find((_e)=>_e.name===x||String(_e.id)===x);if(!oe)throw Error(`Hetzner server ${x} was not found.`);if(U?.serverId&&U.serverId!==oe.id)throw Error(`Refusing to resize ${x}: project state is pinned to server ${U.serverId}.`);let ae=lt(t),ve=m.upgradeDisk!==!1,Ce=await Kn(te,oe.id,ae,ve);if(m.json)console.log(JSON.stringify({schemaVersion:1,plan:Vl(Ce)},null,2));else Dp(Ce);if(!m.apply){if(!m.json)e(`Preview only. Re-run with --apply --confirm ${oe.name} to execute.`);return}if(m.confirm!==oe.name)throw Error(`Resize requires --confirm ${oe.name}.`);let Re=U?.publicIp??oe.public_net.ipv4?.ip;if(!Re)throw Error(`Server ${oe.name} has no public IPv4 address for verification.`);let we={host:Re,user:U?.sshUser??X.sshUser,identityFile:X.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},ke=await Zo(z),Be=new Date().toISOString(),Ae={schemaVersion:1,operationId:ke?.targetType===ae&&ke.serverId===oe.id?ke.operationId:crypto.randomUUID(),stackName:z,serverId:oe.id,serverName:oe.name,sourceType:Ce.currentType.name,targetType:ae,upgradeDisk:ve,phase:"planning",status:"running",attempts:ke?.targetType===ae?ke.attempts:0,startedAt:ke?.targetType===ae?ke.startedAt:Be,updatedAt:Be,manifest:ke?.targetType===ae?ke.manifest:void 0};await ut(Ae);let Ie=Fa(m.pollSeconds,900)*1000,Te=Fa(m.maxWaitMinutes,0)*60000,Xe=Date.now();for(;;){let _e=await Kn(te,oe.id,ae,ve);if(!_e.capacityAvailable&&!_e.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await ut(Ae),!m.wait){if(!m.json)e(`${ae} has no capacity in ${_e.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Te>0&&Date.now()-Xe>=Te)throw Error(`Timed out waiting for ${ae} capacity in ${_e.location}.`);if(!m.json)e(`Waiting ${Math.round(Ie/1000)} seconds for ${ae} capacity...`);await Bun.sleep(Ie);continue}let Ze=await es(z);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await ut(Ae),await Go({client:te,serverId:oe.id,targetType:ae,upgradeDisk:ve,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let At=await Ko(we);return Ae={...Ae,manifest:At,updatedAt:new Date().toISOString()},await ut(Ae),At},afterBoot:async(At,Ft,wt,Et)=>Jo(we,Ft,wt,Et),onPhase:async(At,Ft)=>{if(Ae={...Ae,phase:At,status:At==="waiting-capacity"?"waiting-capacity":At==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await ut(Ae),!m.json)e(`${At}${Ft?` ${JSON.stringify(Ft)}`:""}`)}}})}finally{await Ze()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await ut(Ae),m.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${oe.name} is on ${ae} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&m.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Ie/1000)} seconds before retry.`),await Bun.sleep(Ie);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await ut(Ae),et}}}async function Tp(x,t){let m=await Oe();if(m.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",N=E(m,A),z=await pe(N);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(x))throw Error(`Refusing to optimize ${x}: project state is pinned to ${z.serverName}.`);let U=or(m),X=new qe({apiToken:sr(U.apiToken,m)}),te=await X.getServer(z.serverId),re=z.publicIp??te.public_net.ipv4?.ip;if(!re)throw Error(`Server ${te.name} has no public IPv4 address.`);let oe=Fi(m);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:te.name,plan:oe},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[te.name,oe.firewallPorts.join(","),oe.monitoring?"on":"off",oe.autoUpdates?"on":"off",`${oe.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${te.name} to execute.`);return}if(t.confirm!==te.name)throw Error(`Optimization requires --confirm ${te.name}.`);let ae={host:re,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15},ve=await qr(ae),Ce=ve.routeProbes.filter((wt)=>!wt.ok),Re=m.infrastructure?.compute,we=Y(Re)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,ke=ve.failedUnits.filter((wt)=>!we.has(wt));if(ke.length>0)throw Error(`Preflight found failed services: ${ke.join(", ")}`);if(Ce.length>0)throw Error(`Preflight found unhealthy routes: ${Ce.map((wt)=>wt.domain).join(", ")}`);let Be=Y(Re)?[]:Object.values(m.sites??{}).flatMap((wt)=>typeof wt?.port==="number"&&![80,443].includes(wt.port)?[wt.port]:[]),Ae=zr({allowSsh:Re?.allowSsh!==!1,sitePorts:Be,allowedPorts:Re?.firewall?.allowedPorts}),Ie=(z.firewallId?(await X.listFirewalls()).find((wt)=>wt.id===z.firewallId):void 0)??(await X.listFirewalls()).find((wt)=>wt.name===`${m.project.slug}-${A}-app-fw`);if(!Ie)throw Error(`Managed firewall for ${te.name} was not found.`);let Te=await X.setFirewallRules(Ie.id,Ae);await Promise.all(Te.map((wt)=>X.waitForAction(wt.id))),await Xo(m,ae);let[Xe,_e]=await Promise.all([qr(ae),Qo(ae)]),Ze=Yo(oe,_e),et=_a(ve,Xe),At=Xe.routeProbes.filter((wt)=>!wt.ok);if(et.stoppedServices.length>0)Ze.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Ze.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Ze.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Ze.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Ze.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if(At.length>0)Ze.push(`unhealthy routes: ${At.map((wt)=>wt.domain).join(", ")}`);if(Ze.length>0)throw Error(`Host optimization verification failed: ${Ze.join("; ")}`);let Ft={serverId:te.id,serverName:te.name,services:Xe.runningServices.length,routes:Xe.routeIds.length,healthyDomains:Xe.routeProbes.length,releaseLinks:Xe.releaseLinks.length,databasesAndVolumes:Xe.dataCatalog.length,report:_e};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:Ft},null,2));else n(`${te.name} passed full host, rpx route, service, release, and data verification.`)}async function Np(x,t,m){let A=await Oe(),N=m.env??"production",z=E(A,N);await wi(async(U)=>{let X=Xi(U,x),te=U.store.list(U.controlPlane.project.id,!0),re=X.provider==="hetzner"&&X.providerId?(()=>{try{let Ie=or(A);return new qe({apiToken:sr(Ie.apiToken,A)})}catch{return null}})():null,oe=X.providerId?Number(X.providerId):Number.NaN,ae=await pe(z),ve=ae!=null&&ae.serverId===oe,Ce=new kr,Re=X.trustState==="pinned",we={takenNames:async()=>{let Ie=te.map((Te)=>Te.name);if(re)Ie.push(...(await re.listServers()).map((Te)=>Te.name));return Ie},inventoryName:()=>U.store.get(X.id)?.name??X.name,renameInventory:(Ie)=>{U.store.update(X.id,{name:Ie})},...re&&Number.isFinite(oe)?{providerName:async()=>(await re.getServer(oe)).name,renameProvider:async(Ie)=>{await re.renameServer(oe,Ie)}}:{},...ve?{stateName:async()=>(await pe(z))?.serverName,writeStateName:async(Ie)=>{let Te=await pe(z);if(Te)await dt(z,{...Te,serverName:Ie})}}:{},...Re?{remoteHostname:async()=>{let Ie=await Ce.exec(X,"hostname");return Ie.code===0?Ie.stdout.trim():void 0},setRemoteHostname:async(Ie)=>{let Te=await Ce.exec(X,Ul(Ie));if(Te.code!==0)throw Error(Te.stderr.trim()||`hostname exited ${Te.code}`)}}:{}},ke=await zl(X.name,t,we),Be=await ks(ke);if(!m.apply){let Ie=[re?"":"provider record (no provider id or no API token)",ve?"":"local state pin (none points at this server)",Re?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(m.json){console.log(JSON.stringify({schemaVersion:1,operation:ke.operation,target:ke.target,rename:{from:X.name,to:t},notCovered:Ie,steps:Be.map((Te)=>({id:Te.step.id,title:Te.step.title,state:Te.state,change:Te.step.change,reason:Te.reason}))},null,2));return}for(let Te of Is(ke,Be))console.log(Te);for(let Te of Ie)console.log(`  not covered: ${Te}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await xs(ke,Be,{log:(Ie)=>e(Ie),audit:(Ie)=>U.controlPlane.store.appendEvent({projectId:U.controlPlane.project.id,resourceId:X.resourceId,type:`${Ie.operation}.${Ie.step}.${Ie.state}`,level:Ie.state==="failed"?"error":"info",payload:{target:Ie.target,renameTo:t,...Ie.error?{error:Ie.error}:{}}})});if(m.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Ie=Ae.steps.find((Te)=>Te.state==="failed");throw Error(`${ke.operation} stopped at '${Ie?.title}': ${Ie?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!m.json)n(`Renamed ${X.name} to ${t}.`)})}function Ba(x){x.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,m)=>{try{await wi(async(A)=>{let N=t?[Xi(A,t)]:A.store.list(A.controlPlane.project.id),z=N.flatMap((U)=>Object.entries(U.capabilities).map(([X,te])=>({server:U.name,provider:U.provider,action:X,...te})));if(m.json)console.log(JSON.stringify({schemaVersion:1,targets:z},null,2));else c(["Server","Provider","Action","Support","Explanation"],z.map((U)=>[U.server,U.provider,U.action,U.supported?"supported":"unsupported",U.reason??"—"]))})}catch(A){ar(A)}}),x.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Ep(t,m,A)}catch(N){ar(N)}}),x.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,m)=>{try{await Tp(t,m)}catch(A){ar(A)}}),x.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,m)=>{try{await xp(t,m)}catch(A){ar(A)}}),x.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await wi(async(m)=>{let A=m.store.list(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(m){ar(m)}}),x.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,m)=>{try{await wi(async(A)=>{let N=m.provider;if(!["aws","hetzner","ssh"].includes(N)||!m.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let z=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:N,providerId:m.providerId,endpoint:m.endpoint,sshUser:m.user??"deploy",credentialRef:m.credentialRef??"secret://fleet/agent",region:m.region,roles:String(m.roles??"application").split(","),labels:Object.fromEntries(String(m.labels??"").split(",").map((U)=>U.split("=")).filter((U)=>U[0]&&U[1]))});n(`Enrolled ${z.name} as ${z.id}; no remote mutation was performed.`)})}catch(A){ar(A)}}),x.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,m)=>{try{await wi(async(A)=>{let N=Xi(A,t);if(N=await A.service.test(N.id),N.trustState==="rotation_pending"){if(!m.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=A.service.reviewHostKey(N.id,m.acceptHostKey)}let z=await A.service.validate(N.id);if(m.json)console.log(JSON.stringify(z.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(z.validation?.findings??[]).map((U)=>[U.severity,U.code,U.message,U.remediation??"—"]));if(!z.validation?.valid)process.exitCode=1})}catch(A){ar(A)}}),x.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,m)=>{try{await wi(async(A)=>{let N=A.service.bootstrap(Xi(A,t).id,!!m.apply);if(N.preview)c(["Step"],N.steps.map((z)=>[z]));else n(`Bootstrap queued: ${N.operation?.id}`)})}catch(A){ar(A)}}),x.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Np(t,m,A)}catch(N){ar(N)}}),x.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,m)=>{try{await wi(async(A)=>n(A.service.drain(Xi(A,t).id,!!m.complete).status))}catch(A){ar(A)}}),x.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await wi(async(m)=>{m.service.uncordon(Xi(m,t).id),n(`Uncordoned ${t}.`)})}catch(m){ar(m)}}),x.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,m)=>{try{await wi(async(A)=>{A.service.archive(Xi(A,t).id,m.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){ar(A)}}),x.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await wi(async(m)=>{let A=Xi(m,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),z=await N.exited;if(z)process.exitCode=z})}catch(m){ar(m)}});for(let[t,m]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])x.command(t,m).action(async(...A)=>Dr(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Wl,mkdirSync as Op,readFileSync as Lp,writeFileSync as jp}from"node:fs";import{join as ql,resolve as Fp}from"node:path";var za=(x)=>{r(x instanceof Error?x.message:String(x)),process.exitCode=1};async function Bp(){try{return await Oe()}catch{return}}function Mp(x){if(x===void 0)return;let t=Number(x);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${x}'.`);return t}function Gl(x,t,m){let A=x?.ssh?.hosts?.find((N)=>N.host===t);return new ur({hosts:t?[A??{host:t}]:x?.ssh?.hosts,user:m.user,port:Mp(m.port),privateKeyPath:m.key,hostKey:x?.ssh?.hostKey,sudo:x?.ssh?.sudo,profile:m.profile??x?.ssh?.profile,publicIp:x?.ssh?.publicIp,lan:x?.ssh?.lan})}var Hl=1073741824;function Va(x){x.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,m)=>{try{let A=await Bp(),N=Gl(A,t,m),z=t??N.targetHost(),U=await N.ensureHostKey(z),{facts:X,findings:te}=await N.preflight(z);if(m.json)console.log(JSON.stringify({schemaVersion:1,host:z,hostKeyFingerprint:U.fingerprint,facts:X,findings:te},null,2));else{if(i(`Preflight ${z}`),U.pinnedNow)e(`Pinned host key ${U.fingerprint}`);if(e(`${X.os} on ${X.arch}, ${X.cpuCores} cores, ${(X.memoryBytes/Hl).toFixed(1)} GiB memory, ${(X.diskFreeBytes/Hl).toFixed(1)} GiB free`),X.piModel)e(X.piModel);if(X.lanIp)e(`LAN address ${X.lanIp}`);if(console.log(Hr(te)),dr(te))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(dr(te))process.exitCode=1}catch(A){za(A)}}),x.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let m=await Oe(),A=t.env??"production";if(t.dryRun){let U=lr(m),[X]=U.hosts;console.log(cr({config:m,environment:A,profile:U.profile,sudoUser:X.user!=="root"?X.user:void 0,lan:U.lan}));return}let N=Gl(m,void 0,{});i(`Adopt ${N.targetHost()}`);let z=await N.provisionComputeInfrastructure({config:m,environment:A});n(`${z.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(m){za(m)}}),x.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let m=t.os??"raspberry-pi-os";if(!(m in Ui))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${m}'.`);let A=await Oe(),N=t.env??"production",z=lr(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:m==="raspberry-pi-os"?"raspberry-pi":void 0}),U=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),X=Vr(t.key??"~/.ssh/id_ed25519.pub");if(!Wl(X))throw Error(`Public key not found at ${X}; pass --key <path to a .pub file>.`);let te=Lp(X,"utf8").trim(),re;if(t.wifiSsid){let Re=t.wifiPassphraseEnv??"WIFI_PASSWORD",we=process.env[Re];if(!we)throw Error(`--wifi-ssid needs the passphrase in $${Re} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");re={ssid:t.wifiSsid,passphrase:we,country:t.wifiCountry}}let oe=cr({config:A,environment:N,profile:z.profile,sudoUser:U!=="root"?U:void 0,lan:z.lan}),ae=Bi({hostname:t.hostname,user:U,publicKey:te,timezone:t.timezone,locale:t.locale,wifi:re},oe,{os:m}),ve=Fp(t.out);Op(ve,{recursive:!0});let Ce=Object.keys(ae.files).filter((Re)=>Wl(ql(ve,Re)));if(Ce.length>0&&!t.force)throw Error(`${Ce.join(", ")} already exist in ${ve}; pass --force to overwrite.`);for(let[Re,we]of Object.entries(ae.files))jp(ql(ve,Re),we,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(ae.files).join(", ")} to ${ve}`),console.log(ae.instructions)}catch(m){za(m)}})}async function _p(){let x=await Oe(),t=y(process.cwd(),x),m=new Sn(t.store),A=new bn(m,new Pe(t.store));return{controlPlane:t,store:m,service:A}}async function os(x){let t=await _p();try{await x(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Es=(x)=>Object.fromEntries(String(x??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Kl=(x)=>Object.fromEntries(Object.entries(Es(x)).map(([t,m])=>[t,Number(m)]));function Wa(x){x.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>os((m)=>{let A=m.store.listPools(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),x.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,m)=>os((A)=>{let{purpose:N,backend:z}=m;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(z))throw Error("Unsupported pool purpose or backend.");let U=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:N,backend:z,region:m.region,architecture:m.arch,labels:Es(m.labels),requiredServerLabels:Es(m.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Kl(m.capacity)},maxWorkloads:Number(m.max),costWeight:1,concurrency:Number(m.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${U.name} (${U.id}).`)})),x.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,m)=>os((A)=>{let N=A.store.listPools(A.controlPlane.project.id).find((U)=>U.id===t||U.name===t),z=new Pe(A.controlPlane.store).list(A.controlPlane.project.id).find((U)=>U.id===m||U.name===m);if(!N||!z)throw Error("Pool or server was not found.");A.store.addMember(N.id,z.id),n(`Attached ${z.name} to ${N.name}.`)})),x.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>os((m)=>{let A=m.service.explain(m.controlPlane.project.id,{purpose:t.purpose,resources:Kl(t.resources),region:t.region,architecture:t.arch,labels:Es(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),x.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>os((m)=>{let A=m.store.listPools(m.controlPlane.project.id).find((z)=>z.id===t||z.name===t);if(!A)throw Error("Pool was not found.");let N=m.service.drainPool(A.id);n(`Draining ${A.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}async function zp(){let x=await Oe(),t=y(process.cwd(),x),m=new vn(t.store),A=new Tn(m);return{controlPlane:t,store:m,service:A}}async function mo(x){let t=await zp();try{await x(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var ss=(x,t)=>{let m=x.store.list(x.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error("Regional topology was not found.");return m},Up=(x)=>x.split(",").map((t,m)=>{let[A,N="aws"]=t.split(":");return{region:String(A),provider:N,role:m===0?"primary":"secondary"}}),Vp=(x)=>{let t=new Set(["s3","dynamodb","secrets"]),m=x.split(",").map((N)=>N.trim()),A=m.find((N)=>!t.has(N));if(A)throw Error(`Unsupported replication kind: ${A}`);return m};function qa(x){x.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>mo((m)=>{let A=m.store.list(m.controlPlane.project.id).map((N)=>({topology:N,targets:m.store.targets(N.id),channels:m.store.channels(N.id),route:m.store.route(N.id),executions:m.store.executions(N.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((z)=>z.status==="in_sync").length}/${N.channels.length} in sync`]))})),x.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,m)=>mo((A)=>{if(!m.hostname||!m.regions)throw Error("--hostname and --regions are required.");let N=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:m.hostname,regions:Up(m.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Vp(String(m.replicate)),maxLagSeconds:Number(m.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!m.cdn,wafEnabled:!!m.waf});n(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),x.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,m,A)=>mo((N)=>c(["Step"],N.service.plan(ss(N,t).id,m,A.target).map((z)=>[z])))),x.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,m,A)=>mo(async(N)=>{let z=A.manifest?await Bun.file(A.manifest).json():{},U=N.service.enqueue({topologyId:ss(N,t).id,kind:"rollout",revision:m,manifest:z});n(`Regional rollout queued: ${U.operation.id}`)})),x.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,m)=>mo((A)=>{let N=A.service.enqueue({topologyId:ss(A,t).id,kind:"failover",targetRegion:m});n(`Failover queued: ${N.operation.id}`)})),x.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,m)=>mo((A)=>{let N=A.service.enqueue({topologyId:ss(A,t).id,kind:"failback",targetRegion:m});n(`Failback queued: ${N.operation.id}`)})),x.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,m)=>mo((A)=>{let N=A.service.enqueue({topologyId:ss(A,t).id,kind:"destroy",confirmation:m.confirm});n(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}var as="0.16.29";async function qp(){let x=await Oe(),t=y(process.cwd(),x),m=new En(t.store),A=new wn(m),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((z)=>new Cn(z,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:m,service:A,cleanup:N}}async function Ei(x){let t=await qp();try{await x(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}function Ga(x){x.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Ei((m)=>{let A={manifests:m.store.manifests(m.controlPlane.organization.id),windows:m.store.windows(m.controlPlane.project.id),campaigns:m.store.campaigns(m.controlPlane.project.id),cleanups:m.store.cleanups(m.controlPlane.project.id),drills:m.store.drills(m.controlPlane.project.id)},N=[...A.manifests.map((z)=>["update",z.version,z.compatibility.compatible?"compatible":"blocked",z.compatibility.reasons.join("; ")||z.channel]),...A.campaigns.map((z)=>["upgrade",z.id,z.status,z.currentStage??z.fromVersion]),...A.cleanups.map((z)=>["cleanup",z.kind,z.status,`${z.candidates.length} items / ${z.estimatedBytes} bytes`]),...A.drills.map((z)=>["DR drill",z.scenario,z.status,z.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],N)})),x.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,m)=>Ei(async(A)=>{let N=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(m).text()});n(`Trusted ${N.name}: ${N.fingerprint}`)})),x.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,m,A)=>Ei(async(N)=>{let z=await Bun.file(t).json(),U=(await Bun.file(m).text()).trim(),X=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:A,document:z,signature:U,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:as,platform:process.platform,architecture:process.arch}});n(`Verified ${X.version}; ${X.compatibility.compatible?"compatible":"blocked: "+X.compatibility.reasons.join("; ")}`)})),x.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,m,A)=>Ei((N)=>{let z=N.store.createWindow({projectId:N.controlPlane.project.id,name:t,schedule:m,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${z.name} (${z.id}).`)})),x.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,m,A)=>Ei((N)=>{let z=new Pe(N.controlPlane.store).list(N.controlPlane.project.id).filter((te)=>te.status==="ready").map((te)=>({serverId:te.id,target:te.name,previousVersion:te.bootstrapVersion??as}));if(!z.length)z.push({target:"control-plane",previousVersion:as});let U=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:t,fromVersion:as,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:m,targets:z}),X=N.service.enqueueCampaign(U.id);n(`Staged upgrade queued: ${X.operation.id}`)})),x.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,m)=>Ei(async(A)=>{let N=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(m.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],N.candidates.map((z)=>[z.id,z.label,String(z.bytes)])),e(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),x.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,m)=>Ei((A)=>{let N=A.service.enqueueCleanup(t,String(m.confirm??""));n(`Cleanup queued: ${N.operation.id}`)})),x.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,m,A)=>Ei((N)=>{let z=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:t,isolatedTarget:m,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${z.id}.`)})),x.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Ei((m)=>{let A=m.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Ha(){try{return(await Oe()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Ka(x){x.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let m=t?.region||await Ha(),A=new R(m);try{let{Functions:N=[]}=await A.listFunctions({MaxItems:50});if(!N.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((z)=>[z.FunctionName??"-",z.Runtime??"-",z.MemorySize?`${z.MemorySize} MB`:"-",z.Timeout?`${z.Timeout}s`:"-",z.LastModified??"-"]))}catch(N){r(`Failed to list functions: ${N.message}`),process.exitCode=1}}),x.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,m)=>{i(`Invoking ${t}`);let A=m?.region||await Ha(),N=new R(A),z=new o("Invoking function...");z.start();try{let U=await N.invoke({FunctionName:t,InvocationType:m?.async?"Event":"RequestResponse",Payload:m?.payload||"{}",LogType:m?.async?"None":"Tail"});if(U.FunctionError){if(z.fail(`Function returned an error (${U.FunctionError})`),U.Payload)e(U.Payload);process.exitCode=1;return}if(z.succeed(`Invoked (status ${U.StatusCode})`),U.Payload)e(`
+`)}async function Ip(){let x=await Oe(),t=y(process.cwd(),x),m=new Pe(t.store),A=new yn(m,[new nt("aws"),new nt("hetzner"),new nt("ssh")]);return{controlPlane:t,store:m,service:A}}async function wi(x){let t=await Ip();try{return await x(t)}finally{t.controlPlane.store.close()}}var Xi=(x,t)=>{let m=x.store.list(x.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error(`Server ${t} was not found.`);return m},ar=(x)=>{r(x instanceof Error?x.message:String(x)),process.exitCode=1};function Fa(x,t){let m=Number.parseInt(x??"",10);return Number.isFinite(m)&&m>=0?m:t}function Pp(x="3h"){let t=x.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let m=Number(t[1])*(t[2]==="h"?3600000:60000);if(m<300000||m>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return m}function is(x,t="%"){return x==null?"unavailable":`${x.toFixed(1)}${t}`}async function xp(x,t){let m=await Oe();if(m.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",N=E(m,A),z=await pe(N);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(x))throw Error(`Refusing to read ${x}: project state is pinned to ${z.serverName}.`);let U=or(m),X=new qe({apiToken:sr(U.apiToken,m)}),te=await X.getServer(z.serverId),re=z.publicIp??te.public_net.ipv4?.ip;if(!re)throw Error(`Server ${te.name} has no public IPv4 address.`);let oe=new Date,ae=new Date(oe.getTime()-Pp(t.range)),ve=Math.min(3600,Math.max(60,Fa(t.step,60))),Ce=await _l({client:X,serverId:te.id,cores:Math.max(1,Number(te.server_type.cores)||1),from:ae,to:oe,step:ve,remote:{host:re,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:te.name,result:Ce},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[te.name,`${Ce.from} to ${Ce.to}`,`${is(Ce.summary.cpuAveragePercent)} / ${is(Ce.summary.cpuPeakPercent)}`,`${is(Ce.summary.memoryAveragePercent)} / ${is(Ce.summary.memoryPeakPercent)}`,Ce.summary.memoryMinimumAvailableBytes==null?"unavailable":`${(Ce.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,is(Ce.summary.swapPeakPercent)]])}function Vl(x){let t=x.targetType.prices?.find((m)=>m.location===x.location);return{serverId:x.serverId,serverName:x.serverName,location:x.location,from:x.currentType.name,to:x.targetType.name,capacityAvailable:x.capacityAvailable,alreadyComplete:x.alreadyComplete,upgradeDisk:x.upgradeDisk,target:{cores:x.targetType.cores,memoryGb:x.targetType.memory,diskGb:x.targetType.disk,architecture:x.targetType.architecture,cpuType:x.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function Dp(x){let t=Vl(x);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function Ep(x,t,m){let A=await Oe();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let N=m.env??process.env.CLOUD_ENV??"production",z=E(A,N),U=await pe(z),X=or(A),te=new qe({apiToken:sr(X.apiToken,A)}),oe=U&&(x===U.serverName||x===String(U.serverId)||x===U.stackName)?await te.getServer(U.serverId):(await te.listServers()).find((_e)=>_e.name===x||String(_e.id)===x);if(!oe)throw Error(`Hetzner server ${x} was not found.`);if(U?.serverId&&U.serverId!==oe.id)throw Error(`Refusing to resize ${x}: project state is pinned to server ${U.serverId}.`);let ae=lt(t),ve=m.upgradeDisk!==!1,Ce=await Kn(te,oe.id,ae,ve);if(m.json)console.log(JSON.stringify({schemaVersion:1,plan:Vl(Ce)},null,2));else Dp(Ce);if(!m.apply){if(!m.json)e(`Preview only. Re-run with --apply --confirm ${oe.name} to execute.`);return}if(m.confirm!==oe.name)throw Error(`Resize requires --confirm ${oe.name}.`);let Re=U?.publicIp??oe.public_net.ipv4?.ip;if(!Re)throw Error(`Server ${oe.name} has no public IPv4 address for verification.`);let we={host:Re,user:U?.sshUser??X.sshUser,identityFile:X.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},ke=await Zo(z),Be=new Date().toISOString(),Ae={schemaVersion:1,operationId:ke?.targetType===ae&&ke.serverId===oe.id?ke.operationId:crypto.randomUUID(),stackName:z,serverId:oe.id,serverName:oe.name,sourceType:Ce.currentType.name,targetType:ae,upgradeDisk:ve,phase:"planning",status:"running",attempts:ke?.targetType===ae?ke.attempts:0,startedAt:ke?.targetType===ae?ke.startedAt:Be,updatedAt:Be,manifest:ke?.targetType===ae?ke.manifest:void 0};await ut(Ae);let Ie=Fa(m.pollSeconds,900)*1000,Te=Fa(m.maxWaitMinutes,0)*60000,Xe=Date.now();for(;;){let _e=await Kn(te,oe.id,ae,ve);if(!_e.capacityAvailable&&!_e.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await ut(Ae),!m.wait){if(!m.json)e(`${ae} has no capacity in ${_e.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(Te>0&&Date.now()-Xe>=Te)throw Error(`Timed out waiting for ${ae} capacity in ${_e.location}.`);if(!m.json)e(`Waiting ${Math.round(Ie/1000)} seconds for ${ae} capacity...`);await Bun.sleep(Ie);continue}let Ze=await es(z);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await ut(Ae),await Go({client:te,serverId:oe.id,targetType:ae,upgradeDisk:ve,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let At=await Ko(we);return Ae={...Ae,manifest:At,updatedAt:new Date().toISOString()},await ut(Ae),At},afterBoot:async(At,Ft,wt,Et)=>Jo(we,Ft,wt,Et),onPhase:async(At,Ft)=>{if(Ae={...Ae,phase:At,status:At==="waiting-capacity"?"waiting-capacity":At==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await ut(Ae),!m.json)e(`${At}${Ft?` ${JSON.stringify(Ft)}`:""}`)}}})}finally{await Ze()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await ut(Ae),m.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${oe.name} is on ${ae} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&m.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Ie/1000)} seconds before retry.`),await Bun.sleep(Ie);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await ut(Ae),et}}}async function Tp(x,t){let m=await Oe();if(m.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",N=E(m,A),z=await pe(N);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${N}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(x))throw Error(`Refusing to optimize ${x}: project state is pinned to ${z.serverName}.`);let U=or(m),X=new qe({apiToken:sr(U.apiToken,m)}),te=await X.getServer(z.serverId),re=z.publicIp??te.public_net.ipv4?.ip;if(!re)throw Error(`Server ${te.name} has no public IPv4 address.`);let oe=Fi(m);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:te.name,plan:oe},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[te.name,oe.firewallPorts.join(","),oe.monitoring?"on":"off",oe.autoUpdates?"on":"off",`${oe.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${te.name} to execute.`);return}if(t.confirm!==te.name)throw Error(`Optimization requires --confirm ${te.name}.`);let ae={host:re,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15},ve=await qr(ae),Ce=ve.routeProbes.filter((wt)=>!wt.ok),Re=m.infrastructure?.compute,we=Y(Re)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,ke=ve.failedUnits.filter((wt)=>!we.has(wt));if(ke.length>0)throw Error(`Preflight found failed services: ${ke.join(", ")}`);if(Ce.length>0)throw Error(`Preflight found unhealthy routes: ${Ce.map((wt)=>wt.domain).join(", ")}`);let Be=Y(Re)?[]:Object.values(m.sites??{}).flatMap((wt)=>typeof wt?.port==="number"&&![80,443].includes(wt.port)?[wt.port]:[]),Ae=zr({allowSsh:Re?.allowSsh!==!1,sitePorts:Be,allowedPorts:Re?.firewall?.allowedPorts}),Ie=(z.firewallId?(await X.listFirewalls()).find((wt)=>wt.id===z.firewallId):void 0)??(await X.listFirewalls()).find((wt)=>wt.name===`${m.project.slug}-${A}-app-fw`);if(!Ie)throw Error(`Managed firewall for ${te.name} was not found.`);let Te=await X.setFirewallRules(Ie.id,Ae);await Promise.all(Te.map((wt)=>X.waitForAction(wt.id))),await Xo(m,ae);let[Xe,_e]=await Promise.all([qr(ae),Qo(ae)]),Ze=Yo(oe,_e),et=_a(ve,Xe),At=Xe.routeProbes.filter((wt)=>!wt.ok);if(et.stoppedServices.length>0)Ze.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Ze.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Ze.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Ze.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Ze.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if(At.length>0)Ze.push(`unhealthy routes: ${At.map((wt)=>wt.domain).join(", ")}`);if(Ze.length>0)throw Error(`Host optimization verification failed: ${Ze.join("; ")}`);let Ft={serverId:te.id,serverName:te.name,services:Xe.runningServices.length,routes:Xe.routeIds.length,healthyDomains:Xe.routeProbes.length,releaseLinks:Xe.releaseLinks.length,databasesAndVolumes:Xe.dataCatalog.length,report:_e};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:Ft},null,2));else n(`${te.name} passed full host, rpx route, service, release, and data verification.`)}async function Np(x,t,m){let A=await Oe(),N=m.env??"production",z=E(A,N);await wi(async(U)=>{let X=Xi(U,x),te=U.store.list(U.controlPlane.project.id,!0),re=X.provider==="hetzner"&&X.providerId?(()=>{try{let Ie=or(A);return new qe({apiToken:sr(Ie.apiToken,A)})}catch{return null}})():null,oe=X.providerId?Number(X.providerId):Number.NaN,ae=await pe(z),ve=ae!=null&&ae.serverId===oe,Ce=new kr,Re=X.trustState==="pinned",we={takenNames:async()=>{let Ie=te.map((Te)=>Te.name);if(re)Ie.push(...(await re.listServers()).map((Te)=>Te.name));return Ie},inventoryName:()=>U.store.get(X.id)?.name??X.name,renameInventory:(Ie)=>{U.store.update(X.id,{name:Ie})},...re&&Number.isFinite(oe)?{providerName:async()=>(await re.getServer(oe)).name,renameProvider:async(Ie)=>{await re.renameServer(oe,Ie)}}:{},...ve?{stateName:async()=>(await pe(z))?.serverName,writeStateName:async(Ie)=>{let Te=await pe(z);if(Te)await dt(z,{...Te,serverName:Ie})}}:{},...Re?{remoteHostname:async()=>{let Ie=await Ce.exec(X,"hostname");return Ie.code===0?Ie.stdout.trim():void 0},setRemoteHostname:async(Ie)=>{let Te=await Ce.exec(X,Ul(Ie));if(Te.code!==0)throw Error(Te.stderr.trim()||`hostname exited ${Te.code}`)}}:{}},ke=await zl(X.name,t,we),Be=await ks(ke);if(!m.apply){let Ie=[re?"":"provider record (no provider id or no API token)",ve?"":"local state pin (none points at this server)",Re?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(m.json){console.log(JSON.stringify({schemaVersion:1,operation:ke.operation,target:ke.target,rename:{from:X.name,to:t},notCovered:Ie,steps:Be.map((Te)=>({id:Te.step.id,title:Te.step.title,state:Te.state,change:Te.step.change,reason:Te.reason}))},null,2));return}for(let Te of Is(ke,Be))console.log(Te);for(let Te of Ie)console.log(`  not covered: ${Te}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await xs(ke,Be,{log:(Ie)=>e(Ie),audit:(Ie)=>U.controlPlane.store.appendEvent({projectId:U.controlPlane.project.id,resourceId:X.resourceId,type:`${Ie.operation}.${Ie.step}.${Ie.state}`,level:Ie.state==="failed"?"error":"info",payload:{target:Ie.target,renameTo:t,...Ie.error?{error:Ie.error}:{}}})});if(m.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Ie=Ae.steps.find((Te)=>Te.state==="failed");throw Error(`${ke.operation} stopped at '${Ie?.title}': ${Ie?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!m.json)n(`Renamed ${X.name} to ${t}.`)})}function Ba(x){x.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,m)=>{try{await wi(async(A)=>{let N=t?[Xi(A,t)]:A.store.list(A.controlPlane.project.id),z=N.flatMap((U)=>Object.entries(U.capabilities).map(([X,te])=>({server:U.name,provider:U.provider,action:X,...te})));if(m.json)console.log(JSON.stringify({schemaVersion:1,targets:z},null,2));else c(["Server","Provider","Action","Support","Explanation"],z.map((U)=>[U.server,U.provider,U.action,U.supported?"supported":"unsupported",U.reason??"—"]))})}catch(A){ar(A)}}),x.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Ep(t,m,A)}catch(N){ar(N)}}),x.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,m)=>{try{await Tp(t,m)}catch(A){ar(A)}}),x.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,m)=>{try{await xp(t,m)}catch(A){ar(A)}}),x.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await wi(async(m)=>{let A=m.store.list(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((N)=>[N.name,N.providerId??"—",`${N.provider} / ${N.region??"external"}`,`${N.status} / ${N.trustState}`,N.roles.join(","),`${N.capacity.cpu??0} / ${N.capacity.memoryBytes??0}`,N.heartbeatAt??"never"]))})}catch(m){ar(m)}}),x.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,m)=>{try{await wi(async(A)=>{let N=m.provider;if(!["aws","hetzner","ssh"].includes(N)||!m.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let z=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:N,providerId:m.providerId,endpoint:m.endpoint,sshUser:m.user??"deploy",credentialRef:m.credentialRef??"secret://fleet/agent",region:m.region,roles:String(m.roles??"application").split(","),labels:Object.fromEntries(String(m.labels??"").split(",").map((U)=>U.split("=")).filter((U)=>U[0]&&U[1]))});n(`Enrolled ${z.name} as ${z.id}; no remote mutation was performed.`)})}catch(A){ar(A)}}),x.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,m)=>{try{await wi(async(A)=>{let N=Xi(A,t);if(N=await A.service.test(N.id),N.trustState==="rotation_pending"){if(!m.acceptHostKey)throw Error(`Host key changed to ${N.pendingHostKey}; review it first.`);N=A.service.reviewHostKey(N.id,m.acceptHostKey)}let z=await A.service.validate(N.id);if(m.json)console.log(JSON.stringify(z.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(z.validation?.findings??[]).map((U)=>[U.severity,U.code,U.message,U.remediation??"—"]));if(!z.validation?.valid)process.exitCode=1})}catch(A){ar(A)}}),x.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,m)=>{try{await wi(async(A)=>{let N=A.service.bootstrap(Xi(A,t).id,!!m.apply);if(N.preview)c(["Step"],N.steps.map((z)=>[z]));else n(`Bootstrap queued: ${N.operation?.id}`)})}catch(A){ar(A)}}),x.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Np(t,m,A)}catch(N){ar(N)}}),x.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,m)=>{try{await wi(async(A)=>n(A.service.drain(Xi(A,t).id,!!m.complete).status))}catch(A){ar(A)}}),x.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await wi(async(m)=>{m.service.uncordon(Xi(m,t).id),n(`Uncordoned ${t}.`)})}catch(m){ar(m)}}),x.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,m)=>{try{await wi(async(A)=>{A.service.archive(Xi(A,t).id,m.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){ar(A)}}),x.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await wi(async(m)=>{let A=Xi(m,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let N=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),z=await N.exited;if(z)process.exitCode=z})}catch(m){ar(m)}});for(let[t,m]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])x.command(t,m).action(async(...A)=>Dr(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Wl,mkdirSync as Op,readFileSync as Lp,writeFileSync as jp}from"node:fs";import{join as ql,resolve as Fp}from"node:path";var za=(x)=>{r(x instanceof Error?x.message:String(x)),process.exitCode=1};async function Bp(){try{return await Oe()}catch{return}}function Mp(x){if(x===void 0)return;let t=Number(x);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${x}'.`);return t}function Gl(x,t,m){let A=x?.ssh?.hosts?.find((N)=>N.host===t);return new ur({hosts:t?[A??{host:t}]:x?.ssh?.hosts,user:m.user,port:Mp(m.port),privateKeyPath:m.key,hostKey:x?.ssh?.hostKey,sudo:x?.ssh?.sudo,profile:m.profile??x?.ssh?.profile,publicIp:x?.ssh?.publicIp,lan:x?.ssh?.lan})}var Hl=1073741824;function Va(x){x.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,m)=>{try{let A=await Bp(),N=Gl(A,t,m),z=t??N.targetHost(),U=await N.ensureHostKey(z),{facts:X,findings:te}=await N.preflight(z);if(m.json)console.log(JSON.stringify({schemaVersion:1,host:z,hostKeyFingerprint:U.fingerprint,facts:X,findings:te},null,2));else{if(i(`Preflight ${z}`),U.pinnedNow)e(`Pinned host key ${U.fingerprint}`);if(e(`${X.os} on ${X.arch}, ${X.cpuCores} cores, ${(X.memoryBytes/Hl).toFixed(1)} GiB memory, ${(X.diskFreeBytes/Hl).toFixed(1)} GiB free`),X.piModel)e(X.piModel);if(X.lanIp)e(`LAN address ${X.lanIp}`);if(console.log(Hr(te)),dr(te))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(dr(te))process.exitCode=1}catch(A){za(A)}}),x.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let m=await Oe(),A=t.env??"production";if(t.dryRun){let U=lr(m),[X]=U.hosts;console.log(cr({config:m,environment:A,profile:U.profile,sudoUser:X.user!=="root"?X.user:void 0,lan:U.lan}));return}let N=Gl(m,void 0,{});i(`Adopt ${N.targetHost()}`);let z=await N.provisionComputeInfrastructure({config:m,environment:A});n(`${z.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(m){za(m)}}),x.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let m=t.os??"raspberry-pi-os";if(!(m in Ui))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${m}'.`);let A=await Oe(),N=t.env??"production",z=lr(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:m==="raspberry-pi-os"?"raspberry-pi":void 0}),U=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),X=Vr(t.key??"~/.ssh/id_ed25519.pub");if(!Wl(X))throw Error(`Public key not found at ${X}; pass --key <path to a .pub file>.`);let te=Lp(X,"utf8").trim(),re;if(t.wifiSsid){let Re=t.wifiPassphraseEnv??"WIFI_PASSWORD",we=process.env[Re];if(!we)throw Error(`--wifi-ssid needs the passphrase in $${Re} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");re={ssid:t.wifiSsid,passphrase:we,country:t.wifiCountry}}let oe=cr({config:A,environment:N,profile:z.profile,sudoUser:U!=="root"?U:void 0,lan:z.lan}),ae=Bi({hostname:t.hostname,user:U,publicKey:te,timezone:t.timezone,locale:t.locale,wifi:re},oe,{os:m}),ve=Fp(t.out);Op(ve,{recursive:!0});let Ce=Object.keys(ae.files).filter((Re)=>Wl(ql(ve,Re)));if(Ce.length>0&&!t.force)throw Error(`${Ce.join(", ")} already exist in ${ve}; pass --force to overwrite.`);for(let[Re,we]of Object.entries(ae.files))jp(ql(ve,Re),we,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(ae.files).join(", ")} to ${ve}`),console.log(ae.instructions)}catch(m){za(m)}})}async function _p(){let x=await Oe(),t=y(process.cwd(),x),m=new Sn(t.store),A=new bn(m,new Pe(t.store));return{controlPlane:t,store:m,service:A}}async function os(x){let t=await _p();try{await x(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Es=(x)=>Object.fromEntries(String(x??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Kl=(x)=>Object.fromEntries(Object.entries(Es(x)).map(([t,m])=>[t,Number(m)]));function Wa(x){x.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>os((m)=>{let A=m.store.listPools(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((N)=>[N.name,N.purpose,N.backend,`${N.region??"any"} / ${N.architecture??"any"}`,N.status,JSON.stringify(N.capacity),String(N.concurrency)]))})),x.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,m)=>os((A)=>{let{purpose:N,backend:z}=m;if(!["application","build","worker","monitoring","backup"].includes(N)||!["server","ecs","asg"].includes(z))throw Error("Unsupported pool purpose or backend.");let U=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:N,backend:z,region:m.region,architecture:m.arch,labels:Es(m.labels),requiredServerLabels:Es(m.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Kl(m.capacity)},maxWorkloads:Number(m.max),costWeight:1,concurrency:Number(m.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${U.name} (${U.id}).`)})),x.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,m)=>os((A)=>{let N=A.store.listPools(A.controlPlane.project.id).find((U)=>U.id===t||U.name===t),z=new Pe(A.controlPlane.store).list(A.controlPlane.project.id).find((U)=>U.id===m||U.name===m);if(!N||!z)throw Error("Pool or server was not found.");A.store.addMember(N.id,z.id),n(`Attached ${z.name} to ${N.name}.`)})),x.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>os((m)=>{let A=m.service.explain(m.controlPlane.project.id,{purpose:t.purpose,resources:Kl(t.resources),region:t.region,architecture:t.arch,labels:Es(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((N)=>[N.poolName,N.serverId??"provider-managed",N.eligible?"yes":"no",JSON.stringify(N.available),`${N.score.fit.toFixed(2)} / ${N.score.spread} / ${N.score.cost}`,N.reasons.join("; ")||"eligible"]))})),x.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>os((m)=>{let A=m.store.listPools(m.controlPlane.project.id).find((z)=>z.id===t||z.name===t);if(!A)throw Error("Pool was not found.");let N=m.service.drainPool(A.id);n(`Draining ${A.name}: moved ${N.moved.length}, blocked ${N.blocked.length} stateful placement(s).`)}))}async function zp(){let x=await Oe(),t=y(process.cwd(),x),m=new vn(t.store),A=new Tn(m);return{controlPlane:t,store:m,service:A}}async function mo(x){let t=await zp();try{await x(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var ss=(x,t)=>{let m=x.store.list(x.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error("Regional topology was not found.");return m},Up=(x)=>x.split(",").map((t,m)=>{let[A,N="aws"]=t.split(":");return{region:String(A),provider:N,role:m===0?"primary":"secondary"}}),Vp=(x)=>{let t=new Set(["s3","dynamodb","secrets"]),m=x.split(",").map((N)=>N.trim()),A=m.find((N)=>!t.has(N));if(A)throw Error(`Unsupported replication kind: ${A}`);return m};function qa(x){x.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>mo((m)=>{let A=m.store.list(m.controlPlane.project.id).map((N)=>({topology:N,targets:m.store.targets(N.id),channels:m.store.channels(N.id),route:m.store.route(N.id),executions:m.store.executions(N.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((N)=>[N.topology.name,N.topology.hostname,N.topology.activeRegion,N.topology.status,N.topology.revision??"—",`${N.channels.filter((z)=>z.status==="in_sync").length}/${N.channels.length} in sync`]))})),x.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,m)=>mo((A)=>{if(!m.hostname||!m.regions)throw Error("--hostname and --regions are required.");let N=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:m.hostname,regions:Up(m.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Vp(String(m.replicate)),maxLagSeconds:Number(m.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!m.cdn,wafEnabled:!!m.waf});n(`Created ${N.name} (${N.id}); run region:rollout with an immutable manifest.`)})),x.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,m,A)=>mo((N)=>c(["Step"],N.service.plan(ss(N,t).id,m,A.target).map((z)=>[z])))),x.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,m,A)=>mo(async(N)=>{let z=A.manifest?await Bun.file(A.manifest).json():{},U=N.service.enqueue({topologyId:ss(N,t).id,kind:"rollout",revision:m,manifest:z});n(`Regional rollout queued: ${U.operation.id}`)})),x.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,m)=>mo((A)=>{let N=A.service.enqueue({topologyId:ss(A,t).id,kind:"failover",targetRegion:m});n(`Failover queued: ${N.operation.id}`)})),x.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,m)=>mo((A)=>{let N=A.service.enqueue({topologyId:ss(A,t).id,kind:"failback",targetRegion:m});n(`Failback queued: ${N.operation.id}`)})),x.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,m)=>mo((A)=>{let N=A.service.enqueue({topologyId:ss(A,t).id,kind:"destroy",confirmation:m.confirm});n(`Regional teardown queued: ${N.operation.id}; replicated data remains retained.`)}))}var as="0.16.30";async function qp(){let x=await Oe(),t=y(process.cwd(),x),m=new En(t.store),A=new wn(m),N=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((z)=>new Cn(z,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:m,service:A,cleanup:N}}async function Ei(x){let t=await qp();try{await x(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}function Ga(x){x.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>Ei((m)=>{let A={manifests:m.store.manifests(m.controlPlane.organization.id),windows:m.store.windows(m.controlPlane.project.id),campaigns:m.store.campaigns(m.controlPlane.project.id),cleanups:m.store.cleanups(m.controlPlane.project.id),drills:m.store.drills(m.controlPlane.project.id)},N=[...A.manifests.map((z)=>["update",z.version,z.compatibility.compatible?"compatible":"blocked",z.compatibility.reasons.join("; ")||z.channel]),...A.campaigns.map((z)=>["upgrade",z.id,z.status,z.currentStage??z.fromVersion]),...A.cleanups.map((z)=>["cleanup",z.kind,z.status,`${z.candidates.length} items / ${z.estimatedBytes} bytes`]),...A.drills.map((z)=>["DR drill",z.scenario,z.status,z.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],N)})),x.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,m)=>Ei(async(A)=>{let N=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(m).text()});n(`Trusted ${N.name}: ${N.fingerprint}`)})),x.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,m,A)=>Ei(async(N)=>{let z=await Bun.file(t).json(),U=(await Bun.file(m).text()).trim(),X=N.store.importManifest({organizationId:N.controlPlane.organization.id,keyId:A,document:z,signature:U,current:{schemaVersion:N.controlPlane.store.health().schemaVersion,currentVersion:as,platform:process.platform,architecture:process.arch}});n(`Verified ${X.version}; ${X.compatibility.compatible?"compatible":"blocked: "+X.compatibility.reasons.join("; ")}`)})),x.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,m,A)=>Ei((N)=>{let z=N.store.createWindow({projectId:N.controlPlane.project.id,name:t,schedule:m,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${z.name} (${z.id}).`)})),x.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,m,A)=>Ei((N)=>{let z=new Pe(N.controlPlane.store).list(N.controlPlane.project.id).filter((te)=>te.status==="ready").map((te)=>({serverId:te.id,target:te.name,previousVersion:te.bootstrapVersion??as}));if(!z.length)z.push({target:"control-plane",previousVersion:as});let U=N.store.createCampaign({projectId:N.controlPlane.project.id,manifestId:t,fromVersion:as,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:m,targets:z}),X=N.service.enqueueCampaign(U.id);n(`Staged upgrade queued: ${X.operation.id}`)})),x.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,m)=>Ei(async(A)=>{let N=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(m.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],N.candidates.map((z)=>[z.id,z.label,String(z.bytes)])),e(`Apply with: cloud cleanup:apply ${N.id} --confirm "DELETE ${N.candidates.length} ${N.kind}"`)})),x.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,m)=>Ei((A)=>{let N=A.service.enqueueCleanup(t,String(m.confirm??""));n(`Cleanup queued: ${N.operation.id}`)})),x.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,m,A)=>Ei((N)=>{let z=N.store.createDrill({projectId:N.controlPlane.project.id,scenario:t,isolatedTarget:m,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${z.id}.`)})),x.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>Ei((m)=>{let A=m.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Ha(){try{return(await Oe()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Ka(x){x.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let m=t?.region||await Ha(),A=new R(m);try{let{Functions:N=[]}=await A.listFunctions({MaxItems:50});if(!N.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],N.map((z)=>[z.FunctionName??"-",z.Runtime??"-",z.MemorySize?`${z.MemorySize} MB`:"-",z.Timeout?`${z.Timeout}s`:"-",z.LastModified??"-"]))}catch(N){r(`Failed to list functions: ${N.message}`),process.exitCode=1}}),x.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,m)=>{i(`Invoking ${t}`);let A=m?.region||await Ha(),N=new R(A),z=new o("Invoking function...");z.start();try{let U=await N.invoke({FunctionName:t,InvocationType:m?.async?"Event":"RequestResponse",Payload:m?.payload||"{}",LogType:m?.async?"None":"Tail"});if(U.FunctionError){if(z.fail(`Function returned an error (${U.FunctionError})`),U.Payload)e(U.Payload);process.exitCode=1;return}if(z.succeed(`Invoked (status ${U.StatusCode})`),U.Payload)e(`
 Response:`),e(U.Payload);if(U.LogResult)e(`
 Logs:`),e(Buffer.from(U.LogResult,"base64").toString("utf-8"))}catch(U){z.fail(`Invocation failed: ${U.message}`),process.exitCode=1}}),x.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(t,m)=>{i(`Logs for ${t}`);let A=m?.region||await Ha(),N=new ie(A),z=t.startsWith("/aws/lambda/")?t:`/aws/lambda/${t}`,U=Number(m?.since??15),X=(te)=>{for(let re of te){let oe=re.timestamp?new Date(re.timestamp).toISOString():"";e(`${oe}  ${(re.message??"").trimEnd()}`)}};try{let te=Date.now()-U*60000,{events:re=[]}=await N.filterLogEvents({logGroupName:z,startTime:te,filterPattern:m?.filter,limit:200});if(X(re),re.length)te=(re[re.length-1].timestamp??te)+1;if(m?.tail){e(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((ae)=>setTimeout(ae,3000));let{events:oe=[]}=await N.filterLogEvents({logGroupName:z,startTime:te,filterPattern:m?.filter,limit:200});if(oe.length)X(oe),te=(oe[oe.length-1].timestamp??te)+1}}}catch(te){r(`Failed to read logs: ${te.message}`),process.exitCode=1}})}async function Jl(x){let t=Bun.spawn(["docker",...x],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[m,A]=await Promise.all([t.exited,new Response(t.stderr).text()]);return{ok:m===0,exitCode:m,command:["docker",...x].join(" "),stderr:A.trim()}}function Ja(x){x.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(t)=>{let m=["build","--file",t.file??"Dockerfile","--tag",t.tag??"latest","."];if(t.dryRun){console.log(`docker ${m.join(" ")}`);return}let A=await Jl(m);if(t.json)console.log(JSON.stringify(A));if(!A.ok)r(A.stderr||`docker exited ${A.exitCode}`),process.exitCode=A.exitCode;else n(`Built ${t.tag??"latest"}.`)}),x.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(t)=>{if(!t.image){r("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(t.dryRun){console.log(`docker push ${t.image}`);return}let m=await Jl(["push",t.image]);if(t.json)console.log(JSON.stringify(m));if(!m.ok)r(m.stderr),process.exitCode=m.exitCode;else n(`Pushed ${t.image}.`)}),x.command("container:deploy","Deploy a container image").action(async()=>Dr("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function Ya(x){x.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t)=>{i("Domains");try{let m=gi(t?.provider),A=Wn(t?.provider)?.provider||"unknown",N=new o(`Fetching domains from ${A}...`);N.start();let z=await m.listDomains();if(N.succeed(`Found ${z.length} domain(s)`),z.length===0){e("No domains found in this provider");return}let U=z.map((X)=>[X,"Active","-",A.charAt(0).toUpperCase()+A.slice(1)]);c(["Domain","Status","SSL","Provider"],U)}catch(m){r(`Failed to list domains: ${m instanceof Error?m.message:String(m)}`)}}),x.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,m)=>{i(`Adding Domain: ${t}`);try{let A=gi(m?.provider),N=Wn(m?.provider)?.provider||"unknown",z=new o(`Checking if ${N} can manage ${t}...`);if(z.start(),await A.canManageDomain(t))z.succeed(`Domain ${t} is already available in ${N}`),e(`
@@ -393,7 +393,7 @@ Resources: ${wt}
 
 View in console:
 https://console.aws.amazon.com/cloudformation/home?region=${ve}#/stacks/stackinfo?stackId=${encodeURIComponent(ae)}`,"green"),Object.keys(qt).length>0){e(`
-Stack Outputs:`);for(let[St,Bt]of Object.entries(qt))e(`  - ${St}: ${Bt}`)}if(rt.length>0){let{grantFailoverReplicaAccess:St}=await import("./chunk-5nf3fxgw.js");p("Granting the distribution read access to its failover replicas..."),await St(rt,qt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.storage)for(let[St,Bt]of Object.entries(U.infrastructure.storage)){if(!Bt.website||!Bt.root)continue;let un=qt[`${St}BucketName`]||qt.FrontendBucketName,Fn=qt[`${St}CloudFrontDistributionId`];if(!un){a(`Could not find bucket name for storage '${St}' — skipping file upload`);continue}if(!fr(Bt.root)){a(`Source directory not found: ${Bt.root} — skipping file upload for '${St}'`);continue}p(`Uploading files from ${Bt.root} to s3://${un}...`);let{uploadStaticFiles:Yr,invalidateCache:Ki}=await import("./chunk-a8b2a3ab.js"),Jn=await Yr({sourceDir:Bt.root,bucket:un,region:ve,onProgress:(tn,gr,vr)=>{if(tn%10===0||tn===gr)e(`  ${tn}/${gr}: ${vr}`)}});if(Jn.errors.length>0)a(`Upload completed with errors: ${Jn.errors.join(", ")}`);else{let tn=Jn.skipped>0?`Uploaded ${Jn.uploaded} files (${Jn.skipped} unchanged)`:`Uploaded ${Jn.uploaded} files`;n(tn)}if(Fn&&Jn.uploaded>0){p("Invalidating CloudFront cache...");let{invalidationId:tn}=await Ki(Fn);n(`Cache invalidation created: ${tn}`)}}if(rt.length>0){let{seedFailoverReplicas:St}=await import("./chunk-5nf3fxgw.js");p("Syncing failover replicas..."),await St(rt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.compute)await Ec(U,A,ve,t?.site);if(U.infrastructure?.compute&&U.sites){let St=Object.values(U.sites).map((Bt)=>Bt.domain).filter((Bt)=>!!Bt);if(St.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Vs(St)}}catch(z){if(r(`Deployment failed: ${z.message}`),process.exitCode=1,z.stack)e(`
+Stack Outputs:`);for(let[St,Bt]of Object.entries(qt))e(`  - ${St}: ${Bt}`)}if(rt.length>0){let{grantFailoverReplicaAccess:St}=await import("./chunk-5nf3fxgw.js");p("Granting the distribution read access to its failover replicas..."),await St(rt,qt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.storage)for(let[St,Bt]of Object.entries(U.infrastructure.storage)){if(!Bt.website||!Bt.root)continue;let un=qt[`${St}BucketName`]||qt.FrontendBucketName,Fn=qt[`${St}CloudFrontDistributionId`];if(!un){a(`Could not find bucket name for storage '${St}' — skipping file upload`);continue}if(!fr(Bt.root)){a(`Source directory not found: ${Bt.root} — skipping file upload for '${St}'`);continue}p(`Uploading files from ${Bt.root} to s3://${un}...`);let{uploadStaticFiles:Yr,invalidateCache:Ki}=await import("./chunk-98e48n5j.js"),Jn=await Yr({sourceDir:Bt.root,bucket:un,region:ve,onProgress:(tn,gr,vr)=>{if(tn%10===0||tn===gr)e(`  ${tn}/${gr}: ${vr}`)}});if(Jn.errors.length>0)a(`Upload completed with errors: ${Jn.errors.join(", ")}`);else{let tn=Jn.skipped>0?`Uploaded ${Jn.uploaded} files (${Jn.skipped} unchanged)`:`Uploaded ${Jn.uploaded} files`;n(tn)}if(Fn&&Jn.uploaded>0){p("Invalidating CloudFront cache...");let{invalidationId:tn}=await Ki(Fn);n(`Cache invalidation created: ${tn}`)}}if(rt.length>0){let{seedFailoverReplicas:St}=await import("./chunk-5nf3fxgw.js");p("Syncing failover replicas..."),await St(rt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.compute)await Ec(U,A,ve,t?.site);if(U.infrastructure?.compute&&U.sites){let St=Object.values(U.sites).map((Bt)=>Bt.domain).filter((Bt)=>!!Bt);if(St.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Vs(St)}}catch(z){if(r(`Deployment failed: ${z.message}`),process.exitCode=1,z.stack)e(`
 Stack trace:`),console.error(z.stack)}finally{if(N)await N()}}),x.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async(t)=>{i("Deploying Server Infrastructure");try{let m=await Oe(),A=t?.env||"production",N=m.project.region||"us-east-1",z=Pr(m);if(z){r(z),process.exitCode=1;return}if(!fo(m)){r("No `infrastructure.compute` configured — nothing to deploy as a server."),e("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(e(`Region: ${N}`),e(`Environment: ${A}`),!await Ec(m,A,N,t?.site)){process.exitCode=1;return}if(m.sites){let X=Object.values(m.sites).map((te)=>te.domain).filter((te)=>!!te);if(X.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Vs(X)}n(`
 Server deployment complete!`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),x.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let m=await Oe(),A=t?.env||"production",N=Pr(m);if(N){r(N),process.exitCode=1;return}let{deployServerlessApp:z,redeployServerlessApp:U}=await import("./chunk-gz0gahzh.js");if(t?.redeploy){await U(m,A);return}await z(m,A,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),x.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Oe(),A=t?.env||"production",{rollbackServerlessApp:N}=await import("./chunk-gz0gahzh.js");await N(m,A)}catch(m){r(`Rollback failed: ${m.message}`),process.exitCode=1}}),x.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").action(async(t,m)=>{i("Rolling Back Release");try{let A=await Oe(),N=m?.env||"production",z=t||Object.keys(A.sites||{})[0];if(!z){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:U}=await import("./chunk-hg60j47r.js"),X=await U({driver:O({config:A}),slug:A.project.slug,environment:N,logger:f},{siteName:z,to:m?.to});if(!X.success){r(`Rollback failed: ${X.error||"unknown error"}`),process.exitCode=1;return}for(let te of X.perInstance||[])e(`  ${te.instanceId}: ${te.output?.trim()||te.status}`)}catch(A){r(`Rollback failed: ${A.message}`),process.exitCode=1}}),x.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,m)=>{i("Deployment History");try{let A=await Oe(),N=m?.env||"production",z=t||Object.keys(A.sites||{})[0];if(!z){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:U}=await import("./chunk-hg60j47r.js"),X=await U({driver:O({config:A}),slug:A.project.slug,environment:N,logger:f},{siteName:z,limit:Number.parseInt(m?.limit||"20",10)||20});if(!X.success){r(`Could not read history: ${X.error||"unknown error"}`),process.exitCode=1;return}for(let te of X.perInstance||[])e(`
 ${te.instanceId}:`),e(te.output?.trimEnd()||"(no output)")}catch(A){r(`History lookup failed: ${A.message}`),process.exitCode=1}}),x.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(t,m,A)=>{i(`Running Recipe: ${t}`);try{if(!fr(m)){r(`Recipe script not found: ${m}`),process.exitCode=1;return}let N=await Oe(),z=A?.env||"production",U=Nc(m,"utf8").split(`
@@ -457,7 +457,7 @@ Resources (${te.StackResourceSummaries.length}):`);let re=["Logical ID","Type","
 ... and ${te.StackResourceSummaries.length-10} more resources`)}}catch(m){r(`Failed to describe stack: ${m.message}`)}}),x.command("stack:delete STACK_NAME","Delete a CloudFormation stack").option("--yes","Skip the confirmation prompt").action(async(t,m)=>{i(`Delete Stack: ${t}`);try{let N=(await Oe()).project.region||"us-east-1";if(a("This will permanently delete the stack and all its resources!"),!(m?.yes||await d(`
 Are you sure you want to delete this stack?`,!1))){e("Deletion cancelled");return}let U=new v(N),X=new o("Deleting stack...");X.start(),await U.deleteStack(t),X.succeed("Stack deletion initiated"),p("Waiting for stack deletion..."),await U.waitForStack(t,"stack-delete-complete"),n("Stack deleted successfully!")}catch(A){r(`Failed to delete stack: ${A.message}`)}}),x.command("stack:events STACK_NAME","Show stack events").option("--limit <number>","Limit number of events",{default:"20"}).action(async(t,m)=>{i(`Stack Events: ${t}`);try{let N=(await Oe()).project.region||"us-east-1",z=new v(N),U=new o("Loading events...");U.start();let X=await z.describeStackEvents(t);U.succeed(`Found ${X.StackEvents.length} events`);let te=m?.limit?Number.parseInt(m.limit):20,re=X.StackEvents.slice(0,te);if(re.length===0){e("No events found");return}let oe=["Time","Resource","Status","Reason"],ae=re.map((ve)=>[new Date(ve.Timestamp).toLocaleString(),ve.LogicalResourceId,ve.ResourceStatus,ve.ResourceStatusReason||""]);c(oe,ae)}catch(A){r(`Failed to load events: ${A.message}`)}}),x.command("stack:outputs STACK_NAME","Show stack outputs").action(async(t)=>{i(`Stack Outputs: ${t}`);try{let A=(await Oe()).project.region||"us-east-1",N=new v(A),z=new o("Loading stack outputs...");z.start();let U=await N.describeStacks({stackName:t});if(!U.Stacks||U.Stacks.length===0){z.fail("Stack not found");return}let X=U.Stacks[0];if(z.succeed("Stack outputs loaded"),!X.Outputs||X.Outputs.length===0){e("No outputs found for this stack");return}let te=["Key","Value","Description","Export Name"],re=X.Outputs.map((oe)=>[oe.OutputKey||"",oe.OutputValue||"",oe.Description||"",oe.ExportName||""]);c(te,re),e(`
 Copy-friendly format:`);for(let oe of X.Outputs)e(`${oe.OutputKey}=${oe.OutputValue}`)}catch(m){r(`Failed to load outputs: ${m.message}`)}}),x.command("stack:export STACK_NAME","Export stack template").option("--output <file>","Output file path").option("--format <format>","Output format (json or yaml)",{default:"json"}).action(async(t,m)=>{i(`Export Stack: ${t}`);try{let N=(await Oe()).project.region||"us-east-1",z=new v(N),U=new o("Fetching stack template...");U.start();let X=await z.getTemplate(t);if(!X.TemplateBody){U.fail("Template not found");return}U.succeed("Template fetched");let te=m?.format||"json",re=X.TemplateBody;if(te==="json"){let oe=JSON.parse(re);re=JSON.stringify(oe,null,2)}if(m?.output){let oe=m.output;hf(oe,re,"utf-8"),n(`Template exported to: ${oe}`);let ve=(gf(oe).size/1024).toFixed(2);e(`File size: ${ve} KB`)}else e(`
-Template:`),console.log(re)}catch(A){r(`Failed to export template: ${A.message}`)}})}import{existsSync as yf}from"node:fs";function zc(x,t){x.command("upgrade","Upgrade CLI to latest version").action(async()=>{Dr("upgrade",{message:`Self-update is disabled for this ${t} build because no signed update-manifest source is configured.`,nextAction:"Install a verified release with your package manager or configure platform maintenance updates."})}),x.command("doctor","Check system requirements and AWS credentials").action(async()=>{if(i("System Diagnostics"),p("Checking Bun..."),n(`Bun ${process.versions.bun}`),p("Checking AWS CLI..."),await Rs())n("AWS CLI is installed");else r("AWS CLI is not installed"),e("Install: https://aws.amazon.com/cli/");if(p("Checking AWS credentials..."),await Ps()){n("AWS credentials are configured");let z=await Ns();if(z)e(`Account ID: ${z}`)}else r("AWS credentials are not configured"),e("Run: aws configure");p("Checking CloudFront list access...");let N=!1;try{let{CloudFrontClient:z}=await import("./chunk-4ab2bceq.js");await new z().listDistributions(),n("CloudFront list access is enabled"),N=!0}catch(z){a(`CloudFront list check failed: ${z.message}`)}if(N){p("Checking CloudFront create access...");try{let z=new v("us-east-1"),U=JSON.stringify({AWSTemplateFormatVersion:"2010-09-09",Description:"Test CloudFront access",Resources:{TestOAC:{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:"test-oac-validation",OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}}}});await z.validateTemplate(U),n("CloudFront create access appears enabled")}catch(z){if(z.message?.includes("403")||z.message?.includes("AccessDenied")||z.message?.includes("must be verified"))r("CloudFront create access denied - account verification required"),e(""),e("Your AWS account needs to be verified for CloudFront."),e("This is required before you can create CloudFront distributions."),e(""),e("To verify your account:"),e("  1. Go to: https://console.aws.amazon.com/support/home#/"),e("  2. Create a support case"),e("  3. Select: Service limit increase > CloudFront"),e('  4. Request: "Please verify my account for CloudFront access"'),e(""),e("Verification usually takes 1-2 business days.");else n("CloudFront create access appears enabled (validation passed)")}}p("Checking S3 access...");try{let{S3Client:z}=await import("./chunk-1d4663e1.js");await new z("us-east-1").listBuckets(),n("S3 access is enabled")}catch(z){a(`S3 check failed: ${z.message}`)}p("Checking ACM (SSL certificates) access...");try{await new G("us-east-1").listCertificates(),n("ACM access is enabled")}catch(z){a(`ACM check failed: ${z.message}`)}if(p("Checking configuration..."),yf("cloud.config.ts"))n("cloud.config.ts found");else a("cloud.config.ts not found"),e("Run: cloud init")}),x.command("regions","List available AWS regions").action(async()=>{i("AWS Regions");let m=new o("Fetching regions...");m.start();let A=await Ds();m.stop(),A.forEach((N)=>{console.log(`  ${N}`)})}),x.command("version","Show the version of the CLI").alias("v").action(()=>{console.log(`ts-cloud v${t}`)})}function Uc(x){x.command("analytics:sites:list","List all analytics sites").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t)=>{i("Analytics Sites");try{let m=new q(t.region),A=new o("Fetching sites...");A.start();let N=await m.scan({TableName:t.table,FilterExpression:"begins_with(pk, :pk)",ExpressionAttributeValues:{":pk":{S:"SITE#"}}});if(A.succeed(`Found ${N.Items?.length||0} site(s)`),!N.Items||N.Items.length===0){e("No analytics sites found"),e("Use `cloud analytics:sites:create` to create a new site");return}let z=N.Items.map((U)=>q.unmarshal(U));c(["ID","Name","Domains","Active","Created"],z.map((U)=>[U.siteId||"N/A",U.name||"Unnamed",(U.domains||[]).join(", ")||"-",U.isActive?"Yes":"No",U.createdAt?new Date(U.createdAt).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list sites: ${m.message}`),process.exit(1)}}),x.command("analytics:sites:create","Create a new analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Site name").option("--domain <domain>","Site domain(s) (can be specified multiple times)").action(async(t)=>{i("Create Analytics Site");try{let m=new q(t.region),A=t.name||await I("Site name","My Site"),N=[];if(t.domain)N=Array.isArray(t.domain)?t.domain:[t.domain];else N=(await I("Site domains (comma-separated)","example.com")).split(",").map((oe)=>oe.trim()).filter(Boolean);if(e(`
+Template:`),console.log(re)}catch(A){r(`Failed to export template: ${A.message}`)}})}import{existsSync as yf}from"node:fs";function zc(x,t){x.command("upgrade","Upgrade CLI to latest version").action(async()=>{Dr("upgrade",{message:`Self-update is disabled for this ${t} build because no signed update-manifest source is configured.`,nextAction:"Install a verified release with your package manager or configure platform maintenance updates."})}),x.command("doctor","Check system requirements and AWS credentials").action(async()=>{if(i("System Diagnostics"),p("Checking Bun..."),n(`Bun ${process.versions.bun}`),p("Checking AWS CLI..."),await Rs())n("AWS CLI is installed");else r("AWS CLI is not installed"),e("Install: https://aws.amazon.com/cli/");if(p("Checking AWS credentials..."),await Ps()){n("AWS credentials are configured");let z=await Ns();if(z)e(`Account ID: ${z}`)}else r("AWS credentials are not configured"),e("Run: aws configure");p("Checking CloudFront list access...");let N=!1;try{let{CloudFrontClient:z}=await import("./chunk-675txngy.js");await new z().listDistributions(),n("CloudFront list access is enabled"),N=!0}catch(z){a(`CloudFront list check failed: ${z.message}`)}if(N){p("Checking CloudFront create access...");try{let z=new v("us-east-1"),U=JSON.stringify({AWSTemplateFormatVersion:"2010-09-09",Description:"Test CloudFront access",Resources:{TestOAC:{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:"test-oac-validation",OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}}}});await z.validateTemplate(U),n("CloudFront create access appears enabled")}catch(z){if(z.message?.includes("403")||z.message?.includes("AccessDenied")||z.message?.includes("must be verified"))r("CloudFront create access denied - account verification required"),e(""),e("Your AWS account needs to be verified for CloudFront."),e("This is required before you can create CloudFront distributions."),e(""),e("To verify your account:"),e("  1. Go to: https://console.aws.amazon.com/support/home#/"),e("  2. Create a support case"),e("  3. Select: Service limit increase > CloudFront"),e('  4. Request: "Please verify my account for CloudFront access"'),e(""),e("Verification usually takes 1-2 business days.");else n("CloudFront create access appears enabled (validation passed)")}}p("Checking S3 access...");try{let{S3Client:z}=await import("./chunk-1d4663e1.js");await new z("us-east-1").listBuckets(),n("S3 access is enabled")}catch(z){a(`S3 check failed: ${z.message}`)}p("Checking ACM (SSL certificates) access...");try{await new G("us-east-1").listCertificates(),n("ACM access is enabled")}catch(z){a(`ACM check failed: ${z.message}`)}if(p("Checking configuration..."),yf("cloud.config.ts"))n("cloud.config.ts found");else a("cloud.config.ts not found"),e("Run: cloud init")}),x.command("regions","List available AWS regions").action(async()=>{i("AWS Regions");let m=new o("Fetching regions...");m.start();let A=await Ds();m.stop(),A.forEach((N)=>{console.log(`  ${N}`)})}),x.command("version","Show the version of the CLI").alias("v").action(()=>{console.log(`ts-cloud v${t}`)})}function Uc(x){x.command("analytics:sites:list","List all analytics sites").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t)=>{i("Analytics Sites");try{let m=new q(t.region),A=new o("Fetching sites...");A.start();let N=await m.scan({TableName:t.table,FilterExpression:"begins_with(pk, :pk)",ExpressionAttributeValues:{":pk":{S:"SITE#"}}});if(A.succeed(`Found ${N.Items?.length||0} site(s)`),!N.Items||N.Items.length===0){e("No analytics sites found"),e("Use `cloud analytics:sites:create` to create a new site");return}let z=N.Items.map((U)=>q.unmarshal(U));c(["ID","Name","Domains","Active","Created"],z.map((U)=>[U.siteId||"N/A",U.name||"Unnamed",(U.domains||[]).join(", ")||"-",U.isActive?"Yes":"No",U.createdAt?new Date(U.createdAt).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list sites: ${m.message}`),process.exit(1)}}),x.command("analytics:sites:create","Create a new analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Site name").option("--domain <domain>","Site domain(s) (can be specified multiple times)").action(async(t)=>{i("Create Analytics Site");try{let m=new q(t.region),A=t.name||await I("Site name","My Site"),N=[];if(t.domain)N=Array.isArray(t.domain)?t.domain:[t.domain];else N=(await I("Site domains (comma-separated)","example.com")).split(",").map((oe)=>oe.trim()).filter(Boolean);if(e(`
 Creating site: ${A}`),e(`Domains: ${N.join(", ")}`),!await d(`
 Create this site?`,!0)){e("Operation cancelled");return}let U=new o("Creating site...");U.start();let X=`site_${Date.now()}_${Math.random().toString(36).substring(2,9)}`,te=new Date().toISOString();await m.putItem({TableName:t.table,Item:{pk:{S:`SITE#${X}`},sk:{S:`SITE#${X}`},siteId:{S:X},name:{S:A},domains:{L:N.map((re)=>({S:re}))},isActive:{BOOL:!0},createdAt:{S:te},updatedAt:{S:te}}}),U.succeed("Site created successfully"),n(`
 Site ID: ${X}`),e(`
@@ -629,7 +629,7 @@ Full Event Record:`);let re=JSON.parse(te.CloudTrailEvent);console.log(JSON.stri
 Create this trail?`,!0)){e("Operation cancelled");return}let z=new o("Creating trail...");z.start();let U=await A.createTrail({Name:t,S3BucketName:m.bucket,S3KeyPrefix:m.prefix,IsMultiRegionTrail:m.multiRegion,EnableLogFileValidation:m.validation,IncludeGlobalServiceEvents:m.globalEvents??!0});z.text="Starting logging...",await A.startLogging(t),z.succeed("Trail created and logging started"),n(`
 Trail ARN: ${U.TrailARN}`),e(`S3 Bucket: ${U.S3BucketName}`)}catch(A){r(`Failed to create trail: ${A.message}`),process.exit(1)}}),x.command("audit:start <trailName>","Start CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Start CloudTrail Logging");try{let A=await ao(m.region),N=new o("Starting logging...");N.start(),await A.startLogging(t),N.succeed("Logging started")}catch(A){r(`Failed to start logging: ${A.message}`),process.exit(1)}}),x.command("audit:stop <trailName>","Stop CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Stop CloudTrail Logging");try{let A=await ao(m.region);if(a(`This will stop logging for trail: ${t}`),!await d(`
 Stop logging?`,!1)){e("Operation cancelled");return}let z=new o("Stopping logging...");z.start(),await A.stopLogging(t),z.succeed("Logging stopped")}catch(A){r(`Failed to stop logging: ${A.message}`),process.exit(1)}}),x.command("audit:delete <trailName>","Delete a CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete CloudTrail Trail");try{let A=await ao(m.region);if(a(`This will permanently delete trail: ${t}`),!await d(`
-Delete this trail?`,!1)){e("Operation cancelled");return}let z=new o("Deleting trail...");z.start(),await A.deleteTrail(t),z.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function rl(x){x.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let m=await Oe(),A=t.region||m.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${m.project.name||"Unknown"}`),e("");let N=[],z=new o("Checking EC2 instances...");z.start();try{let{EC2Client:we}=await import("./chunk-ecxchy9q.js"),Be=await new we(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Ie=0,Te=0;for(let Xe of Be.Reservations||[])for(let _e of Xe.Instances||[])if(Te++,_e.State?.Name==="running")Ae++;else if(_e.State?.Name==="stopped")Ie++;z.succeed("EC2 instances checked"),N.push({name:"EC2 Instances",status:Ae>0?"OK":Te>0?"WARN":"INFO",details:`${Ae} running, ${Ie} stopped, ${Te} total`})}catch(we){z.fail("EC2 check failed"),N.push({name:"EC2 Instances",status:"ERROR",details:we.message})}let U=new o("Checking RDS instances...");U.start();try{let{RDSClient:we}=await import("./chunk-gcazbfsv.js"),Ae=(await new we(A).describeDBInstances()).DBInstances||[],Ie=Ae.filter((Te)=>Te.DBInstanceStatus==="available").length;U.succeed("RDS instances checked"),N.push({name:"RDS Databases",status:Ae.length>0&&Ie===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Ie} available, ${Ae.length} total`})}catch(we){U.fail("RDS check failed"),N.push({name:"RDS Databases",status:"ERROR",details:we.message})}let X=new o("Checking Lambda functions...");X.start();try{let{LambdaClient:we}=await import("./chunk-052sk11z.js"),Ae=(await new we(A).listFunctions()).Functions||[];X.succeed("Lambda functions checked"),N.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(we){X.fail("Lambda check failed"),N.push({name:"Lambda Functions",status:"ERROR",details:we.message})}let te=new o("Checking S3 buckets...");te.start();try{let{S3Client:we}=await import("./chunk-1d4663e1.js"),Ae=(await new we(A).listBuckets()).Buckets||[];te.succeed("S3 buckets checked"),N.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(we){te.fail("S3 check failed"),N.push({name:"S3 Buckets",status:"ERROR",details:we.message})}let re=new o("Checking CloudFront distributions...");re.start();try{let{CloudFrontClient:we}=await import("./chunk-4ab2bceq.js"),Be=await new we().listDistributions(),Ae=Be.filter((Ie)=>Ie.Status==="Deployed").length;re.succeed("CloudFront checked"),N.push({name:"CloudFront",status:Be.length>0&&Ae===Be.length?"OK":Be.length>0?"WARN":"INFO",details:`${Ae} deployed, ${Be.length} total`})}catch(we){re.fail("CloudFront check failed"),N.push({name:"CloudFront",status:"ERROR",details:we.message})}let oe=new o("Checking SQS queues...");oe.start();try{let{SQSClient:we}=await import("./chunk-w3815pxd.js"),Ae=(await new we(A).listQueues()).QueueUrls||[];oe.succeed("SQS queues checked"),N.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(we){oe.fail("SQS check failed"),N.push({name:"SQS Queues",status:"ERROR",details:we.message})}let ae=new o("Checking CloudFormation stacks...");ae.start();try{let{CloudFormationClient:we}=await import("./chunk-pa106cr4.js"),Ae=(await new we(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Ie=Ae.filter((_e)=>_e.StackStatus==="CREATE_COMPLETE"||_e.StackStatus==="UPDATE_COMPLETE").length,Te=Ae.filter((_e)=>_e.StackStatus?.includes("IN_PROGRESS")).length,Xe=Ae.filter((_e)=>_e.StackStatus?.includes("ROLLBACK")).length;ae.succeed("CloudFormation checked"),N.push({name:"CloudFormation",status:Xe>0?"WARN":Te>0?"INFO":"OK",details:`${Ie} healthy, ${Te} in progress, ${Xe} rolled back`})}catch(we){ae.fail("CloudFormation check failed"),N.push({name:"CloudFormation",status:"ERROR",details:we.message})}let ve=new o("Checking SSL certificates...");ve.start();try{let{ACMClient:we}=await import("./chunk-p8f1qgz2.js"),ke=new we("us-east-1"),Ae=(await ke.listCertificates()).CertificateSummaryList||[],Ie=await Promise.all(Ae.map((Ze)=>ke.describeCertificate({CertificateArn:Ze.CertificateArn}))),Te=Ie.filter((Ze)=>Ze.Status==="ISSUED").length,Xe=Ie.filter((Ze)=>Ze.Status==="PENDING_VALIDATION").length,_e=Ie.filter((Ze)=>{if(Ze.NotAfter)return(new Date(Ze.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;ve.succeed("SSL certificates checked"),N.push({name:"SSL Certificates",status:_e>0?"WARN":Xe>0?"INFO":"OK",details:`${Te} issued, ${Xe} pending${_e>0?`, ${_e} expiring soon`:""}`})}catch(we){ve.fail("ACM check failed"),N.push({name:"SSL Certificates",status:"ERROR",details:we.message})}e(`
+Delete this trail?`,!1)){e("Operation cancelled");return}let z=new o("Deleting trail...");z.start(),await A.deleteTrail(t),z.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function rl(x){x.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let m=await Oe(),A=t.region||m.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${m.project.name||"Unknown"}`),e("");let N=[],z=new o("Checking EC2 instances...");z.start();try{let{EC2Client:we}=await import("./chunk-ecxchy9q.js"),Be=await new we(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Ie=0,Te=0;for(let Xe of Be.Reservations||[])for(let _e of Xe.Instances||[])if(Te++,_e.State?.Name==="running")Ae++;else if(_e.State?.Name==="stopped")Ie++;z.succeed("EC2 instances checked"),N.push({name:"EC2 Instances",status:Ae>0?"OK":Te>0?"WARN":"INFO",details:`${Ae} running, ${Ie} stopped, ${Te} total`})}catch(we){z.fail("EC2 check failed"),N.push({name:"EC2 Instances",status:"ERROR",details:we.message})}let U=new o("Checking RDS instances...");U.start();try{let{RDSClient:we}=await import("./chunk-gcazbfsv.js"),Ae=(await new we(A).describeDBInstances()).DBInstances||[],Ie=Ae.filter((Te)=>Te.DBInstanceStatus==="available").length;U.succeed("RDS instances checked"),N.push({name:"RDS Databases",status:Ae.length>0&&Ie===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Ie} available, ${Ae.length} total`})}catch(we){U.fail("RDS check failed"),N.push({name:"RDS Databases",status:"ERROR",details:we.message})}let X=new o("Checking Lambda functions...");X.start();try{let{LambdaClient:we}=await import("./chunk-052sk11z.js"),Ae=(await new we(A).listFunctions()).Functions||[];X.succeed("Lambda functions checked"),N.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(we){X.fail("Lambda check failed"),N.push({name:"Lambda Functions",status:"ERROR",details:we.message})}let te=new o("Checking S3 buckets...");te.start();try{let{S3Client:we}=await import("./chunk-1d4663e1.js"),Ae=(await new we(A).listBuckets()).Buckets||[];te.succeed("S3 buckets checked"),N.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(we){te.fail("S3 check failed"),N.push({name:"S3 Buckets",status:"ERROR",details:we.message})}let re=new o("Checking CloudFront distributions...");re.start();try{let{CloudFrontClient:we}=await import("./chunk-675txngy.js"),Be=await new we().listDistributions(),Ae=Be.filter((Ie)=>Ie.Status==="Deployed").length;re.succeed("CloudFront checked"),N.push({name:"CloudFront",status:Be.length>0&&Ae===Be.length?"OK":Be.length>0?"WARN":"INFO",details:`${Ae} deployed, ${Be.length} total`})}catch(we){re.fail("CloudFront check failed"),N.push({name:"CloudFront",status:"ERROR",details:we.message})}let oe=new o("Checking SQS queues...");oe.start();try{let{SQSClient:we}=await import("./chunk-w3815pxd.js"),Ae=(await new we(A).listQueues()).QueueUrls||[];oe.succeed("SQS queues checked"),N.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(we){oe.fail("SQS check failed"),N.push({name:"SQS Queues",status:"ERROR",details:we.message})}let ae=new o("Checking CloudFormation stacks...");ae.start();try{let{CloudFormationClient:we}=await import("./chunk-pa106cr4.js"),Ae=(await new we(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Ie=Ae.filter((_e)=>_e.StackStatus==="CREATE_COMPLETE"||_e.StackStatus==="UPDATE_COMPLETE").length,Te=Ae.filter((_e)=>_e.StackStatus?.includes("IN_PROGRESS")).length,Xe=Ae.filter((_e)=>_e.StackStatus?.includes("ROLLBACK")).length;ae.succeed("CloudFormation checked"),N.push({name:"CloudFormation",status:Xe>0?"WARN":Te>0?"INFO":"OK",details:`${Ie} healthy, ${Te} in progress, ${Xe} rolled back`})}catch(we){ae.fail("CloudFormation check failed"),N.push({name:"CloudFormation",status:"ERROR",details:we.message})}let ve=new o("Checking SSL certificates...");ve.start();try{let{ACMClient:we}=await import("./chunk-p8f1qgz2.js"),ke=new we("us-east-1"),Ae=(await ke.listCertificates()).CertificateSummaryList||[],Ie=await Promise.all(Ae.map((Ze)=>ke.describeCertificate({CertificateArn:Ze.CertificateArn}))),Te=Ie.filter((Ze)=>Ze.Status==="ISSUED").length,Xe=Ie.filter((Ze)=>Ze.Status==="PENDING_VALIDATION").length,_e=Ie.filter((Ze)=>{if(Ze.NotAfter)return(new Date(Ze.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;ve.succeed("SSL certificates checked"),N.push({name:"SSL Certificates",status:_e>0?"WARN":Xe>0?"INFO":"OK",details:`${Te} issued, ${Xe} pending${_e>0?`, ${_e} expiring soon`:""}`})}catch(we){ve.fail("ACM check failed"),N.push({name:"SSL Certificates",status:"ERROR",details:we.message})}e(`
 `+"=".repeat(60)),e("HEALTH SUMMARY"),e("=".repeat(60)+`
 `);for(let we of N){let ke="";if(we.status==="OK")ke=`${T.green}[OK]${T.reset}`;else if(we.status==="WARN")ke=`${T.yellow}[WARN]${T.reset}`;else if(we.status==="ERROR")ke=`${T.red}[ERROR]${T.reset}`;else ke=`${T.blue}[INFO]${T.reset}`;console.log(`${ke} ${we.name.padEnd(20)} ${we.details}`)}let Ce=N.some((we)=>we.status==="ERROR"),Re=N.some((we)=>we.status==="WARN");if(e(""),Ce)r("Some services have errors. Check the details above.");else if(Re)a("Some services need attention. Check the warnings above.");else n("All services are healthy!")}catch(m){r(`Failed to get status: ${m.message}`),process.exit(1)}}),x.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(t)=>{i("Cost Summary");try{e("Fetching cost data from AWS Cost Explorer..."),e("");let m=new Date,A=new Date(m.getFullYear(),m.getMonth(),1),N=new Date(m.getFullYear(),m.getMonth()+1,0);e(`Period: ${A.toISOString().split("T")[0]} to ${N.toISOString().split("T")[0]}`),e(""),e("Note: Cost data requires AWS Cost Explorer API access."),e("Run `cloud cost` for detailed cost analysis.")}catch(m){r(`Failed to get cost summary: ${m.message}`),process.exit(1)}}),x.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");try{let m=await Oe(),A=t.region||m.project.region||"us-east-1",{AWSClient:N}=await import("./chunk-jxh78anm.js");class z{client;region;constructor(Ce){this.region=Ce,this.client=new N}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let U=new z(A),X=new o("Fetching alarms...");X.start();let re=(await U.describeAlarms()).MetricAlarms||[];if(X.succeed(`Found ${re.length} alarm(s)`),re.length===0){e("No CloudWatch alarms configured");return}let oe=re.filter((Ce)=>Ce.StateValue==="ALARM"),ae=re.filter((Ce)=>Ce.StateValue==="OK"),ve=re.filter((Ce)=>Ce.StateValue==="INSUFFICIENT_DATA");if(e(""),e(`Alarming: ${oe.length}`),e(`OK: ${ae.length}`),e(`Insufficient Data: ${ve.length}`),oe.length>0){e(`
 Alarms in ALARM state:`);for(let Ce of oe)r(`  - ${Ce.AlarmName}: ${Ce.AlarmDescription||"No description"}`)}}catch(m){r(`Failed to get alarms: ${m.message}`),process.exit(1)}})}async function mi(x){let{AWSClient:t}=await import("./chunk-jxh78anm.js");class m{client;region;constructor(A){this.region=A,this.client=new t}async jsonRpcRequest(A,N){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${A}`},body:JSON.stringify(N)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(A,N){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:A,...N})}async describeBackupVault(A){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:A})}async getBackupPlan(A){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:A})}async createBackupVault(A,N){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:A,...N})}async deleteBackupVault(A){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:A})}async createBackupPlan(A){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:A})}async deleteBackupPlan(A){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:A})}async startBackupJob(A){return this.jsonRpcRequest("StartBackupJob",A)}async startRestoreJob(A){return this.jsonRpcRequest("StartRestoreJob",A)}async describeBackupJob(A){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:A})}async describeRestoreJob(A){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:A})}async listBackupJobs(A){return this.jsonRpcRequest("ListBackupJobs",A||{})}async listRestoreJobs(A){return this.jsonRpcRequest("ListRestoreJobs",A||{})}async createBackupSelection(A,N){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:A,BackupSelection:N})}async listBackupSelections(A){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:A})}}return new m(x)}function il(x){x.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(t)=>{i("Backup Vaults");try{let m=await Oe(),A=t.region||m.project.region||"us-east-1",N=await mi(A),z=new o("Fetching vaults...");z.start();let X=(await N.listBackupVaults()).BackupVaultList||[];if(z.succeed(`Found ${X.length} vault(s)`),X.length===0){e("No backup vaults found"),e("Use `cloud backup:create-vault` to create a new vault");return}c(["Vault Name","Recovery Points","Created","Encrypted"],X.map((te)=>[te.BackupVaultName||"N/A",(te.NumberOfRecoveryPoints||0).toString(),te.CreationDate?new Date(te.CreationDate).toLocaleDateString():"N/A",te.EncryptionKeyArn?"Yes":"Default"]))}catch(m){r(`Failed to list vaults: ${m.message}`),process.exit(1)}}),x.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(t)=>{i("Backup Plans");try{let m=await Oe(),A=t.region||m.project.region||"us-east-1",N=await mi(A),z=new o("Fetching backup plans...");z.start();let X=(await N.listBackupPlans()).BackupPlansList||[];if(z.succeed(`Found ${X.length} backup plan(s)`),X.length===0){e("No backup plans found"),e("Use `cloud backup:create` to create a backup plan");return}c(["Plan Name","Plan ID","Version","Created"],X.map((te)=>[te.BackupPlanName||"N/A",te.BackupPlanId||"N/A",te.VersionId?.substring(0,8)||"N/A",te.CreationDate?new Date(te.CreationDate).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list backup plans: ${m.message}`),process.exit(1)}}),x.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(t,m)=>{i(`Recovery Points: ${t}`);try{let A=await Oe(),N=m.region||A.project.region||"us-east-1",z=await mi(N),U=new o("Fetching recovery points...");U.start();let te=(await z.listRecoveryPointsByBackupVault(t,{MaxResults:Number.parseInt(m.limit)})).RecoveryPoints||[];if(U.succeed(`Found ${te.length} recovery point(s)`),te.length===0){e("No recovery points found");return}c(["Resource","Status","Created","Size","Lifecycle"],te.map((re)=>[re.ResourceArn?.split(":").pop()||"N/A",re.Status||"N/A",re.CreationDate?new Date(re.CreationDate).toLocaleString():"N/A",re.BackupSizeInBytes?Vd(re.BackupSizeInBytes):"N/A",re.Lifecycle?.DeleteAfterDays?`${re.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(A){r(`Failed to list recovery points: ${A.message}`),process.exit(1)}}),x.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(t,m)=>{i("Create Backup Vault");try{let A=await mi(m.region);if(e(`Vault Name: ${t}`),e(`Region: ${m.region}`),e(`Encryption: ${m.kmsKey?"Custom KMS":"AWS Managed"}`),!await d(`

package/dist/bin/dashboard-server.js

@@ -1 +1 @@
-import"./chunk-kne9dmwr.js";import"./chunk-jeg6vw5v.js";import"./chunk-k8r5zfnf.js";import{ir}from"./chunk-k9d81ar0.js";import"./chunk-q9tvzcr7.js";import"./chunk-a9yp82q5.js";import"./chunk-7577ykbj.js";import"./chunk-remzfbhd.js";import"./chunk-9p7g25kx.js";import"./chunk-j2yy3tth.js";import"./chunk-jf8jp6f5.js";import"./chunk-bkzt5ntz.js";import"./chunk-2q64f0df.js";import"./chunk-1wtkv65w.js";import"./chunk-xtqx4v3f.js";import"./chunk-3ykx59eg.js";import"./chunk-yrq5bkxe.js";import"./chunk-1chq0c2k.js";import"./chunk-a1kpwbjg.js";import"./chunk-j8dkatkk.js";import"./chunk-e4p6hwct.js";import"./chunk-9nnfyqme.js";import"./chunk-6hrycgbh.js";import"./chunk-a3vraghd.js";import"./chunk-e6xn8g28.js";import"./chunk-y9cdqk8c.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await ir({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();
+import"./chunk-kne9dmwr.js";import"./chunk-jeg6vw5v.js";import"./chunk-k8r5zfnf.js";import{ir}from"./chunk-g00a221j.js";import"./chunk-q9tvzcr7.js";import"./chunk-a9yp82q5.js";import"./chunk-7577ykbj.js";import"./chunk-remzfbhd.js";import"./chunk-9p7g25kx.js";import"./chunk-j2yy3tth.js";import"./chunk-jf8jp6f5.js";import"./chunk-bkzt5ntz.js";import"./chunk-bvtpvstn.js";import"./chunk-1wtkv65w.js";import"./chunk-xtqx4v3f.js";import"./chunk-3ykx59eg.js";import"./chunk-yrq5bkxe.js";import"./chunk-1chq0c2k.js";import"./chunk-a1kpwbjg.js";import"./chunk-j8dkatkk.js";import"./chunk-e4p6hwct.js";import"./chunk-9nnfyqme.js";import"./chunk-6hrycgbh.js";import"./chunk-a3vraghd.js";import"./chunk-e6xn8g28.js";import"./chunk-y9cdqk8c.js";import n from"node:process";function r(o){let e=n.argv.indexOf(o);return e===-1?void 0:n.argv[e+1]}function t(o){return n.argv.includes(o)}async function i(){let o=await ir({host:r("--host")??"127.0.0.1",port:Number(r("--port")??7676),environment:r("--env"),box:t("--box"),verbose:t("--verbose")});console.log("ts-cloud Local Dashboard"),console.log(`Serving ${o.url}`),await new Promise((e)=>{let s=()=>{o.server.stop(!0),e()};n.once("SIGINT",s),n.once("SIGTERM",s)})}i();